{ "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807", "session_id": "2571013a-e926-41d7-b13c-b180a0720a96", "status": "completed", "filename": "2022-03-21-traffic-analysis-exercise.pcap", "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d", "source_size_bytes": 6852381, "schema_version": "pcap-analysis-v1", "semantic_sha256": "f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 16296 packets across 63 IP endpoints and 837 transport flows. Observed 640 DNS events, 38 HTTP requests, 313 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 0 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-03-21-traffic-analysis-exercise.pcap\nCapture SHA-256: `d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d`\nSemantic result SHA-256: `f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 16296 packets across 63 IP endpoints and 837 transport flows. Observed 640 DNS events, 38 HTTP requests, 313 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 0 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 16296\n- Duration: 22746.472749 seconds\n- Captured bytes: 6591621\n- Endpoints: 63\n- Flows: 837\n\n## Deterministic findings\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 3298, frame 3584, frame 3845, frame 3916, frame 4014.\n\nMetrics: `{\"domain\":\"wpad.burnincandle.com\",\"response_count\":42,\"source\":\"10.0.19.14\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 3300, frame 3586, frame 3851, frame 3918, frame 4016.\n\nMetrics: `{\"domain\":\"wpad.mshome.net\",\"response_count\":41,\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3450 / TCP stream 23, frame 3452 / TCP stream 23, frame 3454 / TCP stream 23, frame 3458 / TCP stream 23, frame 3460 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":82,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3473 / TCP stream 24, frame 3478 / TCP stream 24, frame 3481 / TCP stream 24, frame 3483 / TCP stream 24, frame 3485 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":182,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 816 / TCP stream 12, frame 818 / TCP stream 12, frame 820 / TCP stream 12, frame 822 / TCP stream 12, frame 824 / TCP stream 12.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":51,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3451 / TCP stream 23, frame 3453 / TCP stream 23, frame 3455 / TCP stream 23, frame 3459 / TCP stream 23, frame 3461 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":82,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.19.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3475 / TCP stream 24, frame 3480 / TCP stream 24, frame 3482 / TCP stream 24, frame 3484 / TCP stream 24, frame 3486 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":146,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.19.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 817 / TCP stream 12, frame 819 / TCP stream 12, frame 821 / TCP stream 12, frame 823 / TCP stream 12, frame 825 / TCP stream 12.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":51,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.0.19.9\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `DESKTOP-5QS3D5D$`; client IPs: 10.0.19.14; frames: 12633, 12641, 12643, 12655, 15402\n- account: `patrick.zimmerman`; client IPs: 10.0.19.14; frames: 3696, 4150, 4162, 4171, 4173\n- full-name: `Patrick Zimmerman`; client IPs: 10.0.19.14; frames: 3696, 4317\n- hostname: `BURNINCANDLE`; client IPs: 10.0.19.14, 169.254.179.89; frames: 3763, 3764, 3765, 3766, 3933\n- hostname: `BURNINCANDLE-DC`; client IPs: 10.0.19.9; frames: 3980\n- hostname: `DESKTOP-5QS3D5D`; client IPs: 10.0.19.14, 169.254.179.89; frames: 3771, 3773, 744, 3241, 3513\n- netbios-group: `BURNINCANDLE`; client IPs: unbound subject; frames: 3724, 3728, 3732, 3735, 3737\n\n## IOC and artifact candidates\n\n- domain: `antnosience.com`; roles: dns-query, tls-sni\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `bupdater.com`; roles: dns-query, tls-sni\n- domain: `burnincandle-dc.burnincandle.com`; roles: dns-query\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-lr77s6e.burnincandle.com`; roles: dns-query\n- domain: `dilimoretast.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `filebin.net`; roles: dns-query, tls-sni\n- domain: `fp-vp-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vp.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `msedge.api.cdp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `oceriesfornot.top`; roles: http-host\n- domain: `otectagain.top`; roles: dns-query, tls-sni\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `r3.i.lencr.org`; roles: dns-query, http-host\n- domain: `seaskysafe.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `situla.bitbit.net`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `suncoastpinball.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.burnincandle.com`; roles: dns-query\n- domain: `wpad.mshome.net`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `x1.c.lencr.org`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.0.19.1`; roles: network-endpoint\n- ipv4: `10.0.19.14`; roles: network-endpoint\n- ipv4: `10.0.19.255`; roles: network-endpoint\n- ipv4: `10.0.19.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.80.96.219`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.42.16`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.116.104`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.74`; roles: dns-answer, network-endpoint\n- ipv4: `13.87.188.105`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.9`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `157.245.142.66`; roles: dns-answer, network-endpoint\n- ipv4: `160.153.32.99`; roles: dns-answer, network-endpoint\n- ipv4: `169.254.179.89`; roles: network-endpoint\n- ipv4: `169.254.255.255`; roles: network-endpoint\n- ipv4: `184.85.64.91`; roles: dns-answer, network-endpoint\n- ipv4: `185.47.40.36`; roles: dns-answer, network-endpoint\n- ipv4: `188.166.154.118`; roles: network-endpoint\n- ipv4: `20.189.173.15`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.2`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.154.137`; roles: dns-answer\n- ipv4: `20.190.154.139`; roles: dns-answer\n- ipv4: `20.190.154.16`; roles: dns-answer\n- ipv4: `20.190.154.17`; roles: dns-answer\n- ipv4: `20.190.154.18`; roles: dns-answer\n- ipv4: `20.190.154.19`; roles: dns-answer\n- ipv4: `20.42.65.89`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.123`; roles: dns-answer, network-endpoint\n- ipv4: `20.69.130.185`; roles: dns-answer, network-endpoint\n- ipv4: `20.72.205.209`; roles: dns-answer, network-endpoint\n- ipv4: `20.81.51.95`; roles: dns-answer, network-endpoint\n- ipv4: `20.81.52.156`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `209.197.3.8`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.219.38.10`; roles: dns-answer, network-endpoint\n- ipv4: `23.219.38.40`; roles: dns-answer\n- ipv4: `23.227.198.203`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.124.168.44`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.134`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.135`; roles: dns-answer\n- ipv4: `40.74.98.194`; roles: dns-answer, network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `51.105.71.137`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.19`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.21`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.137.108.250`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.208`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.210`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.185.211.133`; roles: dns-answer, network-endpoint\n- ipv4: `68.142.107.1`; roles: dns-answer, network-endpoint\n- ipv4: `68.142.107.129`; roles: dns-answer, network-endpoint\n- ipv4: `69.28.162.0`; roles: dns-answer, network-endpoint\n- ipv4: `69.28.162.128`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.240`; roles: dns-answer, network-endpoint\n- ipv4: `87.238.33.7`; roles: dns-answer\n- ipv4: `87.238.33.8`; roles: dns-answer, network-endpoint\n- ipv4: `91.193.16.181`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd`; roles: exported-object\n- sha256: `ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?161b4282e13b6962`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?48e7354130cbe0e4`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c66ea67221454a2e`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6c9c220471a286c`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0356947035b28e34`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1131f2daab4034ba`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fd0590036de0ddd`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?36a063424dfa7851`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?416ee1a6826abea5`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9770388e0c613755`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d1adc478adff0d72`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?fcfd7669d19bb421`; roles: http-request\n- url: `http://oceriesfornot.top/`; roles: http-request\n- url: `http://r3.i.lencr.org/`; roles: http-request\n- url: `http://x1.c.lencr.org/`; roles: http-request\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- exported object `%2f`; SHA-256 `ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501`; size 393277 bytes\n- exported object `%2f(1)`; SHA-256 `67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd`; size 1306 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `6a2316caee77621222da55a0117f143ac0b4ad630ec057912dd940e824fe529d`; recorded 2026-09-19T12:09:11.063080+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":137,\"observable_limit\":5000,\"observables_checked\":137,\"observables_total\":137,\"prior_case_limit_reached\":false,\"prior_cases_checked\":10,\"truncated\":false}`\n\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 19 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"exported_objects\":2,\"hashed_bytes\":394583,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 7/7, observables 137/137, artifacts 2/2. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 16296, "captured_bytes": 6591621, "first_packet_epoch": "1647896291.116658", "last_packet_epoch": "1647919037.589407", "duration_seconds": 22746.472749, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d", "source_size_bytes": 6852381, "protocol_counts": { "eth": 16296, "ethertype": 16296, "ip": 15406, "tcp": 14455, "tls": 3476, "x509sat": 3028, "x509ce": 1673, "nbss": 1205, "smb2": 1117, "udp": 928, "arp": 890, "spnego-krb5": 774, "dns": 640, "dcerpc": 508, "gss-api": 397, "ldap": 349, "spnego": 290, "data": 285, "smb": 150, "pkix1implicit": 138, "cldap": 68, "browser": 67, "nbdgm": 67, "nbns": 65, "kerberos": 44, "pkix1explicit": 44, "igmp": 42, "http": 36, "ntp": 34, "ssdp": 20, "ocsp": 16, "ntlmssp": 15, "xml": 13, "llmnr": 9, "mdns": 8, "dhcp": 4, "icmp": 2, "media": 1, "pkix-cert": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-f810becc8d56ac4ece881fab", "ip": "0.0.0.0", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:60:52:b7:33:0f" ], "packets_sent": 2, "packets_received": 0, "bytes_sent": 731, "bytes_received": 0, "first_seen_epoch": "1647898110.838235", "last_seen_epoch": "1647898110.843938", "evidence_frames": [ 3771, 3773 ] }, { "endpoint_id": "endpoint-0545abc273eae0c90d87e9d3", "ip": "10.0.19.1", "ip_version": 4, "is_private": true, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 2, "packets_received": 0, "bytes_sent": 693, "bytes_received": 0, "first_seen_epoch": "1647898110.843518", "last_seen_epoch": "1647898110.847846", "evidence_frames": [ 3772, 3774 ] }, { "endpoint_id": "endpoint-aba659fe2fef95ad8a1553c9", "ip": "10.0.19.14", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:60:52:b7:33:0f" ], "packets_sent": 7619, "packets_received": 7731, "bytes_sent": 1224908, "bytes_received": 5305402, "first_seen_epoch": "1647896291.116658", "last_seen_epoch": "1647919037.589407", "evidence_frames": [ 1, 2, 3, 4, 5 ] }, { "endpoint_id": "endpoint-869ca9654818693cea9659ba", "ip": "10.0.19.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 72, "bytes_sent": 0, "bytes_received": 12925, "first_seen_epoch": "1647896380.931112", "last_seen_epoch": "1647919010.5886", "evidence_frames": [ 727, 728, 734, 750, 756 ] }, { "endpoint_id": "endpoint-4eea9ebef41f392a4653f9b1", "ip": "10.0.19.9", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:c0:4f:f8:48:19", "2c:54:2d:2f:13:5c" ], "packets_sent": 2416, "packets_received": 2527, "bytes_sent": 831188, "bytes_received": 583831, "first_seen_epoch": "1647896315.838802", "last_seen_epoch": "1647918979.794112", "evidence_frames": [ 499, 501, 517, 518, 538 ] }, { "endpoint_id": "endpoint-e486d49d3090e7315567e11c", "ip": "104.80.96.219", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 22, "packets_received": 31, "bytes_sent": 3969, "bytes_received": 2889, "first_seen_epoch": "1647899684.276322", "last_seen_epoch": "1647914707.237515", "evidence_frames": [ 5750, 5751, 5752, 5753, 5754 ] }, { "endpoint_id": "endpoint-78944af07f7bc8830ed5a7bd", "ip": "13.107.136.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 12, "packets_received": 13, "bytes_sent": 5602, "bytes_received": 1240, "first_seen_epoch": "1647899010.410387", "last_seen_epoch": "1647899134.225363", "evidence_frames": [ 4468, 4489, 4491, 4494, 4573 ] }, { "endpoint_id": "endpoint-0f53744ca4977611225f42f2", "ip": "13.107.246.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 13, "packets_received": 13, "bytes_sent": 5646, "bytes_received": 1238, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647899133.280255", "evidence_frames": [ 4459, 4476, 4478, 4483, 4500 ] }, { "endpoint_id": "endpoint-b80208cd0fe4d346912019d5", "ip": "13.107.42.16", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 18, "packets_received": 14, "bytes_sent": 7558, "bytes_received": 2382, "first_seen_epoch": "1647902555.521824", "last_seen_epoch": "1647902556.01824", "evidence_frames": [ 8882, 8883, 8884, 8885, 8886 ] }, { "endpoint_id": "endpoint-5451409923996124152fd198", "ip": "13.69.116.104", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 11, "packets_received": 12, "bytes_sent": 5895, "bytes_received": 4552, "first_seen_epoch": "1647899910.33688", "last_seen_epoch": "1647899911.627494", "evidence_frames": [ 5946, 5947, 5948, 5949, 5950 ] }, { "endpoint_id": "endpoint-9ce327aa8dd3116565a2f2a6", "ip": "13.69.239.74", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2843, "first_seen_epoch": "1647905585.461493", "last_seen_epoch": "1647905586.505806", "evidence_frames": [ 10045, 10046, 10047, 10048, 10052 ] }, { "endpoint_id": "endpoint-9efb70a2bcd0455337486c96", "ip": "13.87.188.105", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 13, "bytes_sent": 6732, "bytes_received": 2860, "first_seen_epoch": "1647897262.994386", "last_seen_epoch": "1647897263.934709", "evidence_frames": [ 3522, 3523, 3524, 3525, 3526 ] }, { "endpoint_id": "endpoint-d95775f7683d017824a0d7e4", "ip": "13.89.179.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2844, "first_seen_epoch": "1647901985.639193", "last_seen_epoch": "1647901986.206635", "evidence_frames": [ 8692, 8693, 8694, 8695, 8696 ] }, { "endpoint_id": "endpoint-3e1918723b8aae56014e75c5", "ip": "13.89.179.9", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 11, "packets_received": 12, "bytes_sent": 5895, "bytes_received": 4450, "first_seen_epoch": "1647898144.079629", "last_seen_epoch": "1647898144.821071", "evidence_frames": [ 4041, 4042, 4043, 4044, 4045 ] }, { "endpoint_id": "endpoint-72afdcda7d279b563df84057", "ip": "157.245.142.66", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 2555, "packets_received": 2143, "bytes_sent": 2274408, "bytes_received": 208129, "first_seen_epoch": "1647896315.891891", "last_seen_epoch": "1647919031.729478", "evidence_frames": [ 502, 503, 504, 505, 506 ] }, { "endpoint_id": "endpoint-b26d6ff985ffddc9921c3dd5", "ip": "160.153.32.99", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 89, "packets_received": 74, "bytes_sent": 97106, "bytes_received": 6787, "first_seen_epoch": "1647896378.16369", "last_seen_epoch": "1647896407.997693", "evidence_frames": [ 567, 571, 572, 573, 576 ] }, { "endpoint_id": "endpoint-b1987d1beb2b4706ef0e8453", "ip": "169.254.179.89", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:60:52:b7:33:0f" ], "packets_sent": 54, "packets_received": 0, "bytes_sent": 7180, "bytes_received": 0, "first_seen_epoch": "1647898089.387528", "last_seen_epoch": "1647898110.243883", "evidence_frames": [ 3717, 3718, 3719, 3720, 3721 ] }, { "endpoint_id": "endpoint-5443f11a554e7cbc0c3a2849", "ip": "169.254.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 32, "bytes_sent": 0, "bytes_received": 4645, "first_seen_epoch": "1647898089.463553", "last_seen_epoch": "1647898110.243883", "evidence_frames": [ 3723, 3724, 3725, 3727, 3728 ] }, { "endpoint_id": "endpoint-afcf6755c731ce694bd7a2dc", "ip": "184.85.64.91", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 14, "packets_received": 11, "bytes_sent": 7156, "bytes_received": 1228, "first_seen_epoch": "1647911025.746285", "last_seen_epoch": "1647911026.176746", "evidence_frames": [ 12770, 12771, 12772, 12773, 12774 ] }, { "endpoint_id": "endpoint-cc8d3d989dcb8952ebe5a0be", "ip": "185.47.40.36", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 14, "packets_received": 11, "bytes_sent": 6326, "bytes_received": 1059, "first_seen_epoch": "1647899674.022682", "last_seen_epoch": "1647899705.307172", "evidence_frames": [ 5076, 5079, 5080, 5081, 5084 ] }, { "endpoint_id": "endpoint-0e7ac543d239b1a592c3816c", "ip": "188.166.154.118", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 287, "packets_received": 215, "bytes_sent": 408950, "bytes_received": 13723, "first_seen_epoch": "1647896291.116658", "last_seen_epoch": "1647896375.999037", "evidence_frames": [ 1, 2, 3, 4, 5 ] }, { "endpoint_id": "endpoint-e8a5ce65d46159e3899ce657", "ip": "20.189.173.15", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2845, "first_seen_epoch": "1647896327.922349", "last_seen_epoch": "1647896328.520177", "evidence_frames": [ 519, 520, 521, 522, 523 ] }, { "endpoint_id": "endpoint-a4ac54d618a4e88d6083f9b4", "ip": "20.189.173.2", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2841, "first_seen_epoch": "1647907385.352782", "last_seen_epoch": "1647907385.761153", "evidence_frames": [ 10809, 10810, 10811, 10812, 10813 ] }, { "endpoint_id": "endpoint-cdd15fce5b7509dbfa186d80", "ip": "20.42.65.89", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2842, "first_seen_epoch": "1647916384.862486", "last_seen_epoch": "1647916385.506155", "evidence_frames": [ 15205, 15206, 15207, 15208, 15209 ] }, { "endpoint_id": "endpoint-f830b4570d6ec5738936acd7", "ip": "20.44.10.123", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2839, "first_seen_epoch": "1647903785.529205", "last_seen_epoch": "1647903786.097667", "evidence_frames": [ 9234, 9235, 9236, 9237, 9238 ] }, { "endpoint_id": "endpoint-5a1d93dea73f4a2f25f26cb6", "ip": "20.69.130.185", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 11, "packets_received": 17, "bytes_sent": 6049, "bytes_received": 3358, "first_seen_epoch": "1647908842.158646", "last_seen_epoch": "1647908842.657325", "evidence_frames": [ 11612, 11613, 11614, 11615, 11616 ] }, { "endpoint_id": "endpoint-574d49a59b840fe9b5b86624", "ip": "20.72.205.209", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 11, "packets_received": 13, "bytes_sent": 4634, "bytes_received": 1410, "first_seen_epoch": "1647915526.315936", "last_seen_epoch": "1647915526.824334", "evidence_frames": [ 14764, 14765, 14766, 14767, 14768 ] }, { "endpoint_id": "endpoint-648d9554d8588adc6d094fe6", "ip": "20.81.51.95", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 13, "bytes_sent": 6733, "bytes_received": 2861, "first_seen_epoch": "1647899020.485452", "last_seen_epoch": "1647899021.13768", "evidence_frames": [ 4727, 4728, 4729, 4730, 4731 ] }, { "endpoint_id": "endpoint-f0637f67c3b1a02370f316dc", "ip": "20.81.52.156", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 14, "bytes_sent": 6733, "bytes_received": 2926, "first_seen_epoch": "1647900608.860697", "last_seen_epoch": "1647900610.563893", "evidence_frames": [ 7958, 7961, 7962, 7963, 7964 ] }, { "endpoint_id": "endpoint-1e909e0c992e4140f49d5a36", "ip": "204.79.197.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 97, "packets_received": 104, "bytes_sent": 45084, "bytes_received": 21978, "first_seen_epoch": "1647899010.351888", "last_seen_epoch": "1647908900.927898", "evidence_frames": [ 4464, 4484, 4485, 4486, 4487 ] }, { "endpoint_id": "endpoint-be20e5fca451addc98699f18", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 11, "packets_received": 12, "bytes_sent": 8136, "bytes_received": 1323, "first_seen_epoch": "1647899009.502241", "last_seen_epoch": "1647899075.876146", "evidence_frames": [ 4415, 4416, 4417, 4418, 4419 ] }, { "endpoint_id": "endpoint-1803fd70da16e119f8843717", "ip": "209.197.3.8", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 16, "packets_received": 23, "bytes_sent": 1718, "bytes_received": 2238, "first_seen_epoch": "1647901774.208156", "last_seen_epoch": "1647910835.874068", "evidence_frames": [ 8623, 8624, 8625, 8626, 8627 ] }, { "endpoint_id": "endpoint-4a1b758fd71da39068f40625", "ip": "224.0.0.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:16" ], "packets_sent": 0, "packets_received": 21, "bytes_sent": 0, "bytes_received": 1280, "first_seen_epoch": "1647898089.387528", "last_seen_epoch": "1647898111.884693", "evidence_frames": [ 3717, 3718, 3722, 3726, 3756 ] }, { "endpoint_id": "endpoint-8162c3bd3fb300057ab51f12", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 8, "bytes_sent": 0, "bytes_received": 656, "first_seen_epoch": "1647898089.387901", "last_seen_epoch": "1647899731.286924", "evidence_frames": [ 3719, 3720, 3758, 3759, 3846 ] }, { "endpoint_id": "endpoint-1b4dcc45bbcc35697849df39", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 7, "bytes_sent": 0, "bytes_received": 503, "first_seen_epoch": "1647898089.388266", "last_seen_epoch": "1647899730.698141", "evidence_frames": [ 3721, 3760, 3789, 3821, 3848 ] }, { "endpoint_id": "endpoint-9bcef2d2d7ec8535b44975b3", "ip": "23.219.38.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 4, "packets_received": 6, "bytes_sent": 507, "bytes_received": 647, "first_seen_epoch": "1647915587.245045", "last_seen_epoch": "1647915647.491893", "evidence_frames": [ 14818, 14819, 14820, 14821, 14822 ] }, { "endpoint_id": "endpoint-5159dee7f1e347d45bbc1c76", "ip": "23.227.198.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 641, "packets_received": 738, "bytes_sent": 543520, "bytes_received": 118058, "first_seen_epoch": "1647899683.83167", "last_seen_epoch": "1647900404.787459", "evidence_frames": [ 5737, 5738, 5739, 5740, 5741 ] }, { "endpoint_id": "endpoint-0cb60177e6cb67a167b03fb1", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 33, "bytes_sent": 0, "bytes_received": 14296, "first_seen_epoch": "1647897817.090517", "last_seen_epoch": "1647918744.211724", "evidence_frames": [ 3715, 3716, 3730, 3739, 3742 ] }, { "endpoint_id": "endpoint-f94343232e3544ef486dfe17", "ip": "255.255.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 731, "first_seen_epoch": "1647898110.838235", "last_seen_epoch": "1647898110.843938", "evidence_frames": [ 3771, 3773 ] }, { "endpoint_id": "endpoint-5a1642f41a2477d892c6091f", "ip": "40.124.168.44", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 17, "packets_received": 19, "bytes_sent": 7063, "bytes_received": 3852, "first_seen_epoch": "1647902554.445978", "last_seen_epoch": "1647902556.058194", "evidence_frames": [ 8847, 8848, 8849, 8850, 8851 ] }, { "endpoint_id": "endpoint-81b92b32271b50c2d1eab3ee", "ip": "40.126.26.134", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 7, "packets_received": 12, "bytes_sent": 5175, "bytes_received": 1865, "first_seen_epoch": "1647908840.908296", "last_seen_epoch": "1647908841.797057", "evidence_frames": [ 11584, 11590, 11591, 11592, 11593 ] }, { "endpoint_id": "endpoint-02401b9009aa7ce975373ff6", "ip": "40.74.98.194", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 14, "packets_received": 15, "bytes_sent": 5710, "bytes_received": 2940, "first_seen_epoch": "1647909185.252926", "last_seen_epoch": "1647909186.212051", "evidence_frames": [ 11882, 11883, 11884, 11885, 11886 ] }, { "endpoint_id": "endpoint-eb23b5d669715e3e8f6318fc", "ip": "40.83.240.146", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 45, "packets_received": 61, "bytes_sent": 14367, "bytes_received": 9531, "first_seen_epoch": "1647898112.044816", "last_seen_epoch": "1647918963.001638", "evidence_frames": [ 3874, 3878, 3879, 3880, 3881 ] }, { "endpoint_id": "endpoint-36a0f3e6b2c9b7c80cb4c883", "ip": "51.105.71.137", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 3207, "first_seen_epoch": "1647911928.526635", "last_seen_epoch": "1647911929.532832", "evidence_frames": [ 13157, 13158, 13159, 13160, 13161 ] }, { "endpoint_id": "endpoint-81b2dd40756090bb577322a3", "ip": "52.109.8.19", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 12, "packets_received": 11, "bytes_sent": 6894, "bytes_received": 1563, "first_seen_epoch": "1647909021.9912", "last_seen_epoch": "1647909144.433464", "evidence_frames": [ 11804, 11805, 11806, 11807, 11808 ] }, { "endpoint_id": "endpoint-1006c37c74fffae46bae6368", "ip": "52.109.8.20", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 12, "packets_received": 11, "bytes_sent": 6894, "bytes_received": 1563, "first_seen_epoch": "1647901731.557791", "last_seen_epoch": "1647901853.903099", "evidence_frames": [ 8571, 8572, 8573, 8574, 8575 ] }, { "endpoint_id": "endpoint-b41ebb4763448498aa18e45e", "ip": "52.109.8.21", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 21, "packets_received": 22, "bytes_sent": 18348, "bytes_received": 2277, "first_seen_epoch": "1647916312.581248", "last_seen_epoch": "1647916414.502035", "evidence_frames": [ 15157, 15158, 15159, 15160, 15161 ] }, { "endpoint_id": "endpoint-552be070c5f0eb0e9f641dc2", "ip": "52.113.194.132", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 97, "packets_received": 61, "bytes_sent": 94405, "bytes_received": 8046, "first_seen_epoch": "1647914217.139741", "last_seen_epoch": "1647918376.276832", "evidence_frames": [ 14080, 14081, 14111, 14112, 14113 ] }, { "endpoint_id": "endpoint-f49fc7a5e4cb19175ddb6db4", "ip": "52.113.196.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 13, "packets_received": 13, "bytes_sent": 5647, "bytes_received": 1242, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647899135.118209", "evidence_frames": [ 4461, 4475, 4477, 4482, 4540 ] }, { "endpoint_id": "endpoint-ecb232920e5171d6a38e6827", "ip": "52.137.108.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 27, "packets_received": 23, "bytes_sent": 15019, "bytes_received": 7532, "first_seen_epoch": "1647911022.073573", "last_seen_epoch": "1647911022.723564", "evidence_frames": [ 12672, 12676, 12677, 12678, 12682 ] }, { "endpoint_id": "endpoint-284d46af462a65dcf28727f4", "ip": "52.168.117.170", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2843, "first_seen_epoch": "1647914584.965886", "last_seen_epoch": "1647914585.612981", "evidence_frames": [ 14343, 14344, 14345, 14346, 14347 ] }, { "endpoint_id": "endpoint-dd477c37bd96823930cd402e", "ip": "52.182.143.208", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2842, "first_seen_epoch": "1647918184.768351", "last_seen_epoch": "1647918185.314307", "evidence_frames": [ 15798, 15799, 15800, 15801, 15802 ] }, { "endpoint_id": "endpoint-a15e69e747c372e609045b2f", "ip": "52.182.143.210", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 9, "packets_received": 10, "bytes_sent": 5372, "bytes_received": 2841, "first_seen_epoch": "1647910985.195333", "last_seen_epoch": "1647910985.762474", "evidence_frames": [ 12569, 12570, 12571, 12572, 12573 ] }, { "endpoint_id": "endpoint-8d743202495a493206dc8913", "ip": "52.183.220.149", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 86, "packets_received": 102, "bytes_sent": 38413, "bytes_received": 19134, "first_seen_epoch": "1647898111.571162", "last_seen_epoch": "1647917918.498928", "evidence_frames": [ 3828, 3830, 3831, 3832, 3834 ] }, { "endpoint_id": "endpoint-1104ff8b6feed55de0a20107", "ip": "52.185.211.133", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 82, "packets_received": 99, "bytes_sent": 36893, "bytes_received": 17230, "first_seen_epoch": "1647897103.675574", "last_seen_epoch": "1647916118.064576", "evidence_frames": [ 3382, 3383, 3384, 3385, 3386 ] }, { "endpoint_id": "endpoint-ffb802cf6cfd03b33163018a", "ip": "68.142.107.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 7, "packets_received": 7, "bytes_sent": 919, "bytes_received": 978, "first_seen_epoch": "1647914646.688413", "last_seen_epoch": "1647914707.298546", "evidence_frames": [ 14377, 14378, 14379, 14380, 14381 ] }, { "endpoint_id": "endpoint-f187fecb7416ec253859cd8e", "ip": "68.142.107.129", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 553, "bytes_received": 642, "first_seen_epoch": "1647898171.979672", "last_seen_epoch": "1647898232.395589", "evidence_frames": [ 4071, 4072, 4073, 4074, 4075 ] }, { "endpoint_id": "endpoint-6af1df7148ff21e0604c225f", "ip": "69.28.162.0", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 553, "bytes_received": 642, "first_seen_epoch": "1647899971.440943", "last_seen_epoch": "1647900031.866614", "evidence_frames": [ 6065, 6066, 6067, 6068, 6069 ] }, { "endpoint_id": "endpoint-2522d9b4e161dd50b273f8b7", "ip": "69.28.162.128", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 553, "bytes_received": 642, "first_seen_epoch": "1647903846.225642", "last_seen_epoch": "1647903906.629425", "evidence_frames": [ 9276, 9277, 9278, 9279, 9280 ] }, { "endpoint_id": "endpoint-b07f7ecb13aa830bbdb192c3", "ip": "72.21.81.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 49, "packets_received": 68, "bytes_sent": 24630, "bytes_received": 5380, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647905602.619013", "evidence_frames": [ 4457, 4458, 4460, 4469, 4470 ] }, { "endpoint_id": "endpoint-0f40612c1f5e4ddb55b1ac5b", "ip": "72.21.81.240", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 13, "packets_received": 20, "bytes_sent": 1651, "bytes_received": 2056, "first_seen_epoch": "1647904915.978802", "last_seen_epoch": "1647911143.108974", "evidence_frames": [ 9786, 9787, 9788, 9789, 9790 ] }, { "endpoint_id": "endpoint-d89b9cbdc7e63585a7aed26b", "ip": "87.238.33.8", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 369, "packets_received": 263, "bytes_sent": 507947, "bytes_received": 17480, "first_seen_epoch": "1647899675.141417", "last_seen_epoch": "1647899683.583035", "evidence_frames": [ 5101, 5102, 5103, 5104, 5105 ] }, { "endpoint_id": "endpoint-f83a60d4b180658865bb90ef", "ip": "91.193.16.181", "ip_version": 4, "is_private": false, "mac_addresses": [ "2c:54:2d:2f:13:5c" ], "packets_sent": 473, "packets_received": 546, "bytes_sent": 169810, "bytes_received": 75234, "first_seen_epoch": "1647908448.370194", "last_seen_epoch": "1647919037.589407", "evidence_frames": [ 11198, 11199, 11200, 11201, 11202 ] } ], "identities": [ { "identity_id": "identity-2a4241613ba373b5bdb6675f", "type": "account", "value": "DESKTOP-5QS3D5D$", "ip_addresses": [ "10.0.19.14" ], "mac_addresses": [ "00:60:52:b7:33:0f" ], "evidence": [ { "frame_number": 12633, "timestamp_epoch": "1647911020.809733000", "display_filter": "frame.number == 12633", "tcp_stream": 282 }, { "frame_number": 12641, "timestamp_epoch": "1647911020.825241000", "display_filter": "frame.number == 12641", "tcp_stream": 283 }, { "frame_number": 12643, "timestamp_epoch": "1647911020.826922000", "display_filter": "frame.number == 12643", "tcp_stream": 283 }, { "frame_number": 12655, "timestamp_epoch": "1647911020.830086000", "display_filter": "frame.number == 12655", "tcp_stream": 284 }, { "frame_number": 15402, "timestamp_epoch": "1647917039.078464000", "display_filter": "frame.number == 15402", "tcp_stream": 420 }, { "frame_number": 15414, "timestamp_epoch": "1647917039.081571000", "display_filter": "frame.number == 15414", "tcp_stream": 421 }, { "frame_number": 15741, "timestamp_epoch": "1647917939.047983000", "display_filter": "frame.number == 15741", "tcp_stream": 441 }, { "frame_number": 16053, "timestamp_epoch": "1647918729.757812000", "display_filter": "frame.number == 16053", "tcp_stream": 457 }, { "frame_number": 16061, "timestamp_epoch": "1647918729.779634000", "display_filter": "frame.number == 16061", "tcp_stream": 458 }, { "frame_number": 16063, "timestamp_epoch": "1647918729.781341000", "display_filter": "frame.number == 16063", "tcp_stream": 458 }, { "frame_number": 16077, "timestamp_epoch": "1647918729.784514000", "display_filter": "frame.number == 16077", "tcp_stream": 459 } ], "bindings": [ { "frame_number": 12633, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 12641, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 12643, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 12655, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 15402, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 15414, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 15741, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 16053, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 16061, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 16063, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 16077, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "DESKTOP-5QS3D5D$", "desktop-5qs3d5d$" ] }, { "identity_id": "identity-44d78aa32c6481d13eb35655", "type": "account", "value": "patrick.zimmerman", "ip_addresses": [ "10.0.19.14" ], "mac_addresses": [ "00:60:52:b7:33:0f" ], "evidence": [ { "frame_number": 3696, "timestamp_epoch": "1647897816.616993000", "display_filter": "frame.number == 3696", "tcp_stream": 29 }, { "frame_number": 4150, "timestamp_epoch": "1647899008.771958000", "display_filter": "frame.number == 4150", "tcp_stream": 41 }, { "frame_number": 4162, "timestamp_epoch": "1647899008.773229000", "display_filter": "frame.number == 4162", "tcp_stream": 43 }, { "frame_number": 4171, "timestamp_epoch": "1647899008.778106000", "display_filter": "frame.number == 4171", "tcp_stream": 44 }, { "frame_number": 4173, "timestamp_epoch": "1647899008.779758000", "display_filter": "frame.number == 4173", "tcp_stream": 44 }, { "frame_number": 4181, "timestamp_epoch": "1647899008.782862000", "display_filter": "frame.number == 4181", "tcp_stream": 45 }, { "frame_number": 4183, "timestamp_epoch": "1647899008.784427000", "display_filter": "frame.number == 4183", "tcp_stream": 45 }, { "frame_number": 4195, "timestamp_epoch": "1647899008.787474000", "display_filter": "frame.number == 4195", "tcp_stream": 46 }, { "frame_number": 4235, "timestamp_epoch": "1647899008.798204000", "display_filter": "frame.number == 4235", "tcp_stream": 47 }, { "frame_number": 4253, "timestamp_epoch": "1647899008.799509000", "display_filter": "frame.number == 4253", "tcp_stream": 50 }, { "frame_number": 4255, "timestamp_epoch": "1647899008.800293000", "display_filter": "frame.number == 4255", "tcp_stream": 49 }, { "frame_number": 4300, "timestamp_epoch": "1647899008.806011000", "display_filter": "frame.number == 4300", "tcp_stream": 51 }, { "frame_number": 4306, "timestamp_epoch": "1647899008.806952000", "display_filter": "frame.number == 4306", "tcp_stream": 51 }, { "frame_number": 4317, "timestamp_epoch": "1647899008.807692000", "display_filter": "frame.number == 4317", "tcp_stream": 39 }, { "frame_number": 4323, "timestamp_epoch": "1647899008.808757000", "display_filter": "frame.number == 4323", "tcp_stream": 52 }, { "frame_number": 4359, "timestamp_epoch": "1647899008.902878000", "display_filter": "frame.number == 4359", "tcp_stream": 54 }, { "frame_number": 7005, "timestamp_epoch": "1647900354.453638000", "display_filter": "frame.number == 7005", "tcp_stream": 105 } ], "bindings": [ { "frame_number": 3696, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "patrick.zimmerman", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 4150, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4162, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4171, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4173, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4181, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4183, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4195, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4235, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4253, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4255, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4300, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4306, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4317, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "patrick.zimmerman", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 4323, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 4359, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 7005, "relationship": "kerberos-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "patrick.zimmerman" ] }, { "identity_id": "identity-72755737df202221413f04f1", "type": "full-name", "value": "Patrick Zimmerman", "ip_addresses": [ "10.0.19.14" ], "mac_addresses": [], "evidence": [ { "frame_number": 3696, "timestamp_epoch": "1647897816.616993000", "display_filter": "frame.number == 3696", "tcp_stream": 29 }, { "frame_number": 4317, "timestamp_epoch": "1647899008.807692000", "display_filter": "frame.number == 4317", "tcp_stream": 39 } ], "bindings": [ { "frame_number": 3696, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "patrick.zimmerman", "source_field": "samr.samr_UserInfo21.full_name" }, { "frame_number": 4317, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "patrick.zimmerman", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Patrick Zimmerman" ] }, { "identity_id": "identity-7ac8610f0db400a7547dd3cd", "type": "hostname", "value": "BURNINCANDLE", "ip_addresses": [ "10.0.19.14", "169.254.179.89" ], "mac_addresses": [ "00:60:52:b7:33:0f" ], "evidence": [ { "frame_number": 3763, "timestamp_epoch": "1647898105.665651000", "display_filter": "frame.number == 3763", "udp_stream": 26 }, { "frame_number": 3764, "timestamp_epoch": "1647898106.415606000", "display_filter": "frame.number == 3764", "udp_stream": 26 }, { "frame_number": 3765, "timestamp_epoch": "1647898107.165747000", "display_filter": "frame.number == 3765", "udp_stream": 26 }, { "frame_number": 3766, "timestamp_epoch": "1647898107.931579000", "display_filter": "frame.number == 3766", "udp_stream": 26 }, { "frame_number": 3933, "timestamp_epoch": "1647898117.056425000", "display_filter": "frame.number == 3933", "udp_stream": 6 }, { "frame_number": 3937, "timestamp_epoch": "1647898117.057486000", "display_filter": "frame.number == 3937", "udp_stream": 5 }, { "frame_number": 3938, "timestamp_epoch": "1647898117.057620000", "display_filter": "frame.number == 3938", "udp_stream": 8 }, { "frame_number": 3965, "timestamp_epoch": "1647898117.175200000", "display_filter": "frame.number == 3965", "udp_stream": 6 } ], "bindings": [ { "frame_number": 3763, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3764, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3765, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3766, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3933, "relationship": "netbios-registration", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3937, "relationship": "client-asserted", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "browser.server" }, { "frame_number": 3938, "relationship": "client-asserted", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "browser.server" }, { "frame_number": 3965, "relationship": "netbios-registration", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "BURNINCANDLE", "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)" ] }, { "identity_id": "identity-db69bb10353cead93d493c08", "type": "hostname", "value": "BURNINCANDLE-DC", "ip_addresses": [ "10.0.19.9" ], "mac_addresses": [ "00:c0:4f:f8:48:19" ], "evidence": [ { "frame_number": 3980, "timestamp_epoch": "1647898117.180785000", "display_filter": "frame.number == 3980", "tcp_stream": 34 } ], "bindings": [ { "frame_number": 3980, "relationship": "client-asserted", "owner_ip": "10.0.19.9", "conversation_src": "10.0.19.9", "conversation_dst": "10.0.19.14", "account": "", "source_field": "ntlmssp.auth.hostname" } ], "raw_values": [ "BURNINCANDLE-DC" ] }, { "identity_id": "identity-3093adbb9490c8edf125441f", "type": "hostname", "value": "DESKTOP-5QS3D5D", "ip_addresses": [ "10.0.19.14", "169.254.179.89" ], "mac_addresses": [ "00:60:52:b7:33:0f", "00:60:52:b7:33:0f,00:60:52:b7:33:0f" ], "evidence": [ { "frame_number": 3771, "timestamp_epoch": "1647898110.838235000", "display_filter": "frame.number == 3771", "udp_stream": 30 }, { "frame_number": 3773, "timestamp_epoch": "1647898110.843938000", "display_filter": "frame.number == 3773", "udp_stream": 30 }, { "frame_number": 744, "timestamp_epoch": "1647896380.935810000", "display_filter": "frame.number == 744", "tcp_stream": 11 }, { "frame_number": 3241, "timestamp_epoch": "1647896486.782059000", "display_filter": "frame.number == 3241", "udp_stream": 5 }, { "frame_number": 3513, "timestamp_epoch": "1647897206.969096000", "display_filter": "frame.number == 3513", "udp_stream": 5 }, { "frame_number": 3723, "timestamp_epoch": "1647898089.463553000", "display_filter": "frame.number == 3723", "udp_stream": 26 }, { "frame_number": 3725, "timestamp_epoch": "1647898089.463705000", "display_filter": "frame.number == 3725", "udp_stream": 26 }, { "frame_number": 3727, "timestamp_epoch": "1647898090.213290000", "display_filter": "frame.number == 3727", "udp_stream": 26 }, { "frame_number": 3729, "timestamp_epoch": "1647898090.213449000", "display_filter": "frame.number == 3729", "udp_stream": 26 }, { "frame_number": 3731, "timestamp_epoch": "1647898090.994480000", "display_filter": "frame.number == 3731", "udp_stream": 26 }, { "frame_number": 3733, "timestamp_epoch": "1647898090.994651000", "display_filter": "frame.number == 3733", "udp_stream": 26 }, { "frame_number": 3734, "timestamp_epoch": "1647898091.744584000", "display_filter": "frame.number == 3734", "udp_stream": 26 }, { "frame_number": 3736, "timestamp_epoch": "1647898091.744698000", "display_filter": "frame.number == 3736", "udp_stream": 26 }, { "frame_number": 3743, "timestamp_epoch": "1647898095.636081000", "display_filter": "frame.number == 3743", "udp_stream": 28 }, { "frame_number": 3744, "timestamp_epoch": "1647898095.639796000", "display_filter": "frame.number == 3744", "udp_stream": 28 }, { "frame_number": 3746, "timestamp_epoch": "1647898097.135990000", "display_filter": "frame.number == 3746", "udp_stream": 28 }, { "frame_number": 3748, "timestamp_epoch": "1647898098.636150000", "display_filter": "frame.number == 3748", "udp_stream": 28 }, { "frame_number": 3750, "timestamp_epoch": "1647898100.136185000", "display_filter": "frame.number == 3750", "udp_stream": 28 }, { "frame_number": 3751, "timestamp_epoch": "1647898101.636244000", "display_filter": "frame.number == 3751", "udp_stream": 28 }, { "frame_number": 3753, "timestamp_epoch": "1647898102.636332000", "display_filter": "frame.number == 3753", "udp_stream": 28 } ], "bindings": [ { "frame_number": 3771, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 3773, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 744, "relationship": "client-asserted", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.9", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 3241, "relationship": "client-asserted", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "browser.server" }, { "frame_number": 3513, "relationship": "client-asserted", "owner_ip": "10.0.19.14", "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "browser.server" }, { "frame_number": 3723, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3725, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3727, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3729, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3731, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3733, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3734, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3736, "relationship": "netbios-registration", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3743, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 3744, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.server" }, { "frame_number": 3746, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 3748, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 3750, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 3751, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.server" }, { "frame_number": 3753, "relationship": "client-asserted", "owner_ip": "169.254.179.89", "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "browser.server" } ], "raw_values": [ "DESKTOP-5QS3D5D", "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)" ] }, { "identity_id": "identity-6a4dd1565ad9630ae9bc9a9d", "type": "netbios-group", "value": "BURNINCANDLE", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 3724, "timestamp_epoch": "1647898089.463705000", "display_filter": "frame.number == 3724", "udp_stream": 26 }, { "frame_number": 3728, "timestamp_epoch": "1647898090.213449000", "display_filter": "frame.number == 3728", "udp_stream": 26 }, { "frame_number": 3732, "timestamp_epoch": "1647898090.994651000", "display_filter": "frame.number == 3732", "udp_stream": 26 }, { "frame_number": 3735, "timestamp_epoch": "1647898091.744698000", "display_filter": "frame.number == 3735", "udp_stream": 26 }, { "frame_number": 3737, "timestamp_epoch": "1647898092.557145000", "display_filter": "frame.number == 3737", "udp_stream": 26 }, { "frame_number": 3738, "timestamp_epoch": "1647898093.322841000", "display_filter": "frame.number == 3738", "udp_stream": 26 }, { "frame_number": 3740, "timestamp_epoch": "1647898094.088809000", "display_filter": "frame.number == 3740", "udp_stream": 26 }, { "frame_number": 3741, "timestamp_epoch": "1647898094.854186000", "display_filter": "frame.number == 3741", "udp_stream": 26 }, { "frame_number": 3840, "timestamp_epoch": "1647898111.838130000", "display_filter": "frame.number == 3840", "udp_stream": 6 }, { "frame_number": 3908, "timestamp_epoch": "1647898112.603273000", "display_filter": "frame.number == 3908", "udp_stream": 6 }, { "frame_number": 3914, "timestamp_epoch": "1647898113.353272000", "display_filter": "frame.number == 3914", "udp_stream": 6 }, { "frame_number": 3920, "timestamp_epoch": "1647898113.963345000", "display_filter": "frame.number == 3920", "udp_stream": 6 }, { "frame_number": 3922, "timestamp_epoch": "1647898114.119089000", "display_filter": "frame.number == 3922", "udp_stream": 6 }, { "frame_number": 3926, "timestamp_epoch": "1647898114.712700000", "display_filter": "frame.number == 3926", "udp_stream": 6 }, { "frame_number": 3928, "timestamp_epoch": "1647898115.478242000", "display_filter": "frame.number == 3928", "udp_stream": 6 }, { "frame_number": 3930, "timestamp_epoch": "1647898116.228516000", "display_filter": "frame.number == 3930", "udp_stream": 6 }, { "frame_number": 3971, "timestamp_epoch": "1647898117.176561000", "display_filter": "frame.number == 3971", "udp_stream": 6 }, { "frame_number": 3991, "timestamp_epoch": "1647898117.915697000", "display_filter": "frame.number == 3991", "udp_stream": 6 }, { "frame_number": 3994, "timestamp_epoch": "1647898118.668493000", "display_filter": "frame.number == 3994", "udp_stream": 6 }, { "frame_number": 3995, "timestamp_epoch": "1647898119.418463000", "display_filter": "frame.number == 3995", "udp_stream": 6 } ], "bindings": [ { "frame_number": 3724, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3728, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3732, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3735, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3737, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3738, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3740, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3741, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "169.254.179.89", "conversation_dst": "169.254.255.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3840, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3908, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3914, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3920, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3922, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3926, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3928, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3930, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3971, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3991, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3994, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 3995, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.0.19.14", "conversation_dst": "10.0.19.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-29984a821a46ad9f9916d6fd", "transport": "tcp", "stream": 0, "initiator_ip": "10.0.19.14", "initiator_port": 62179, "responder_ip": "188.166.154.118", "responder_port": 80, "first_frame": 1, "last_frame": 546, "first_seen_epoch": "1647896291.116658", "last_seen_epoch": "1647896375.999037", "packets": 502, "bytes": 422673, "initiator_bytes": 13723, "responder_bytes": 408950 }, { "flow_id": "flow-afdc14dd929ec31c964fd2d2", "transport": "udp", "stream": 0, "initiator_ip": "10.0.19.14", "initiator_port": 63313, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 499, "last_frame": 501, "first_seen_epoch": "1647896315.838802", "last_seen_epoch": "1647896315.891442", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-5857a0266ebe3742b4bf3f33", "transport": "tcp", "stream": 1, "initiator_ip": "10.0.19.14", "initiator_port": 62180, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 502, "last_frame": 703, "first_seen_epoch": "1647896315.891891", "last_seen_epoch": "1647896380.747315", "packets": 20, "bytes": 3542, "initiator_bytes": 1148, "responder_bytes": 2394 }, { "flow_id": "flow-0dd46faeefc5b03781e3f2e0", "transport": "udp", "stream": 1, "initiator_ip": "10.0.19.14", "initiator_port": 56525, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 517, "last_frame": 518, "first_seen_epoch": "1647896327.883955", "last_seen_epoch": "1647896327.921157", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-dd0147483f8c2caad45aaeef", "transport": "tcp", "stream": 2, "initiator_ip": "10.0.19.14", "initiator_port": 62181, "responder_ip": "20.189.173.15", "responder_port": 443, "first_frame": 519, "last_frame": 537, "first_seen_epoch": "1647896327.922349", "last_seen_epoch": "1647896328.520177", "packets": 19, "bytes": 8217, "initiator_bytes": 2845, "responder_bytes": 5372 }, { "flow_id": "flow-2a99177b97a8d9131797141e", "transport": "udp", "stream": 2, "initiator_ip": "10.0.19.14", "initiator_port": 123, "responder_ip": "10.0.19.9", "responder_port": 123, "first_frame": 538, "last_frame": 16005, "first_seen_epoch": "1647896365.368329", "last_seen_epoch": "1647918592.058927", "packets": 34, "bytes": 5508, "initiator_bytes": 2754, "responder_bytes": 2754 }, { "flow_id": "flow-1efa7272f2335424dd46cbc4", "transport": "udp", "stream": 3, "initiator_ip": "10.0.19.14", "initiator_port": 51660, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 543, "last_frame": 544, "first_seen_epoch": "1647896375.854295", "last_seen_epoch": "1647896375.854615", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-42d35fe2ba5844b8b7d7b9f4", "transport": "tcp", "stream": 3, "initiator_ip": "10.0.19.14", "initiator_port": 62182, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 547, "last_frame": 3235, "first_seen_epoch": "1647896376.85786", "last_seen_epoch": "1647896474.654118", "packets": 38, "bytes": 7868, "initiator_bytes": 3877, "responder_bytes": 3991 }, { "flow_id": "flow-7352c5b27e5102fcc4de2542", "transport": "udp", "stream": 4, "initiator_ip": "10.0.19.14", "initiator_port": 58289, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 564, "last_frame": 566, "first_seen_epoch": "1647896378.09457", "last_seen_epoch": "1647896378.163267", "packets": 2, "bytes": 174, "initiator_bytes": 79, "responder_bytes": 95 }, { "flow_id": "flow-dcbbeb9f442ac15910327c44", "transport": "tcp", "stream": 4, "initiator_ip": "10.0.19.14", "initiator_port": 62184, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 565, "last_frame": 3236, "first_seen_epoch": "1647896378.097254", "last_seen_epoch": "1647896474.654197", "packets": 28, "bytes": 8683, "initiator_bytes": 5852, "responder_bytes": 2831 }, { "flow_id": "flow-a3d550c0814984406f5dd351", "transport": "tcp", "stream": 5, "initiator_ip": "10.0.19.14", "initiator_port": 62185, "responder_ip": "160.153.32.99", "responder_port": 443, "first_frame": 567, "last_frame": 683, "first_seen_epoch": "1647896378.16369", "last_seen_epoch": "1647896379.655116", "packets": 49, "bytes": 31150, "initiator_bytes": 1978, "responder_bytes": 29172 }, { "flow_id": "flow-ad09d73d823ef9baf3ff553f", "transport": "tcp", "stream": 6, "initiator_ip": "10.0.19.14", "initiator_port": 62186, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 594, "last_frame": 3654, "first_seen_epoch": "1647896378.702452", "last_seen_epoch": "1647897816.124193", "packets": 108, "bytes": 10230, "initiator_bytes": 4624, "responder_bytes": 5606 }, { "flow_id": "flow-77f517dd256cbac06389c0bd", "transport": "tcp", "stream": 7, "initiator_ip": "10.0.19.14", "initiator_port": 62183, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 609, "last_frame": 3238, "first_seen_epoch": "1647896379.107771", "last_seen_epoch": "1647896474.656897", "packets": 2243, "bytes": 2036297, "initiator_bytes": 54106, "responder_bytes": 1982191 }, { "flow_id": "flow-21db93ec553fb2544b435f95", "transport": "tcp", "stream": 8, "initiator_ip": "10.0.19.14", "initiator_port": 62187, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 644, "last_frame": 1952, "first_seen_epoch": "1647896379.600705", "last_seen_epoch": "1647896393.222991", "packets": 17, "bytes": 2480, "initiator_bytes": 1036, "responder_bytes": 1444 }, { "flow_id": "flow-f57a5e30b427fdfbba0c5170", "transport": "tcp", "stream": 9, "initiator_ip": "10.0.19.14", "initiator_port": 62188, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 651, "last_frame": 1950, "first_seen_epoch": "1647896379.602213", "last_seen_epoch": "1647896393.22295", "packets": 23, "bytes": 3712, "initiator_bytes": 1894, "responder_bytes": 1818 }, { "flow_id": "flow-2c2906d6102f3f5d343fa8e0", "transport": "tcp", "stream": 10, "initiator_ip": "10.0.19.14", "initiator_port": 62189, "responder_ip": "10.0.19.9", "responder_port": 49676, "first_frame": 714, "last_frame": 1951, "first_seen_epoch": "1647896380.892856", "last_seen_epoch": "1647896393.222974", "packets": 13, "bytes": 4232, "initiator_bytes": 1692, "responder_bytes": 2540 }, { "flow_id": "flow-2ac53bb94ae38433dbe57320", "transport": "udp", "stream": 5, "initiator_ip": "10.0.19.14", "initiator_port": 138, "responder_ip": "10.0.19.255", "responder_port": 138, "first_frame": 727, "last_frame": 16285, "first_seen_epoch": "1647896380.931112", "last_seen_epoch": "1647919010.5886", "packets": 40, "bytes": 9567, "initiator_bytes": 9567, "responder_bytes": 0 }, { "flow_id": "flow-11c4e303fb32b2564d2882e9", "transport": "udp", "stream": 6, "initiator_ip": "10.0.19.14", "initiator_port": 137, "responder_ip": "10.0.19.255", "responder_port": 137, "first_frame": 728, "last_frame": 5791, "first_seen_epoch": "1647896380.931112", "last_seen_epoch": "1647899731.849224", "packets": 32, "bytes": 3358, "initiator_bytes": 3358, "responder_bytes": 0 }, { "flow_id": "flow-abe416936af43b94b5e61c3e", "transport": "udp", "stream": 7, "initiator_ip": "10.0.19.9", "initiator_port": 137, "responder_ip": "10.0.19.14", "responder_port": 137, "first_frame": 729, "last_frame": 3968, "first_seen_epoch": "1647896380.931476", "last_seen_epoch": "1647898117.176345", "packets": 10, "bytes": 1040, "initiator_bytes": 832, "responder_bytes": 208 }, { "flow_id": "flow-ce45af29c04f628039e66942", "transport": "udp", "stream": 8, "initiator_ip": "10.0.19.14", "initiator_port": 138, "responder_ip": "10.0.19.9", "responder_port": 138, "first_frame": 730, "last_frame": 3970, "first_seen_epoch": "1647896380.931672", "last_seen_epoch": "1647898117.176459", "packets": 18, "bytes": 4110, "initiator_bytes": 1790, "responder_bytes": 2320 }, { "flow_id": "flow-b4f22412b36b4aa64bb745e6", "transport": "tcp", "stream": 11, "initiator_ip": "10.0.19.14", "initiator_port": 62190, "responder_ip": "10.0.19.9", "responder_port": 139, "first_frame": 736, "last_frame": 1837, "first_seen_epoch": "1647896380.933385", "last_seen_epoch": "1647896391.646654", "packets": 28, "bytes": 4170, "initiator_bytes": 2093, "responder_bytes": 2077 }, { "flow_id": "flow-00d5c4ee7c4c4efc12f61082", "transport": "udp", "stream": 9, "initiator_ip": "10.0.19.14", "initiator_port": 58290, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 779, "last_frame": 780, "first_seen_epoch": "1647896380.978256", "last_seen_epoch": "1647896380.978612", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-442b1abf6af92ea8f512006b", "transport": "tcp", "stream": 12, "initiator_ip": "10.0.19.14", "initiator_port": 62191, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 791, "last_frame": 1841, "first_seen_epoch": "1647896381.08731", "last_seen_epoch": "1647896391.647605", "packets": 86, "bytes": 22043, "initiator_bytes": 12771, "responder_bytes": 9272 }, { "flow_id": "flow-a5f795dac951016f5f18023b", "transport": "tcp", "stream": 13, "initiator_ip": "10.0.19.14", "initiator_port": 62192, "responder_ip": "160.153.32.99", "responder_port": 443, "first_frame": 1098, "last_frame": 1169, "first_seen_epoch": "1647896384.660735", "last_seen_epoch": "1647896385.28512", "packets": 27, "bytes": 17999, "initiator_bytes": 1054, "responder_bytes": 16945 }, { "flow_id": "flow-dcdc97c911bbdd6a05b1390f", "transport": "tcp", "stream": 14, "initiator_ip": "10.0.19.14", "initiator_port": 62193, "responder_ip": "160.153.32.99", "responder_port": 443, "first_frame": 1688, "last_frame": 1776, "first_seen_epoch": "1647896390.288146", "last_seen_epoch": "1647896390.935165", "packets": 25, "bytes": 16618, "initiator_bytes": 1175, "responder_bytes": 15443 }, { "flow_id": "flow-6d932711cd3b9b4b8f19a965", "transport": "tcp", "stream": 15, "initiator_ip": "10.0.19.14", "initiator_port": 62194, "responder_ip": "160.153.32.99", "responder_port": 443, "first_frame": 2232, "last_frame": 2312, "first_seen_epoch": "1647896398.974582", "last_seen_epoch": "1647896401.66535", "packets": 32, "bytes": 18458, "initiator_bytes": 1406, "responder_bytes": 17052 }, { "flow_id": "flow-7d1da91dff0528295f3a7519", "transport": "tcp", "stream": 16, "initiator_ip": "10.0.19.14", "initiator_port": 62195, "responder_ip": "160.153.32.99", "responder_port": 443, "first_frame": 2433, "last_frame": 2525, "first_seen_epoch": "1647896406.682128", "last_seen_epoch": "1647896407.997693", "packets": 30, "bytes": 19668, "initiator_bytes": 1174, "responder_bytes": 18494 }, { "flow_id": "flow-06b4c444a419affa133ca1f5", "transport": "udp", "stream": 10, "initiator_ip": "10.0.19.14", "initiator_port": 55426, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3262, "last_frame": 3263, "first_seen_epoch": "1647896678.078409", "last_seen_epoch": "1647896678.12496", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-238e086b434a923f4911c83a", "transport": "tcp", "stream": 17, "initiator_ip": "10.0.19.14", "initiator_port": 62196, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 3264, "last_frame": 3284, "first_seen_epoch": "1647896678.12588", "last_seen_epoch": "1647896739.20994", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-c7e10bd6b6c45e734d4538d7", "transport": "udp", "stream": 11, "initiator_ip": "10.0.19.14", "initiator_port": 60983, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3297, "last_frame": 3298, "first_seen_epoch": "1647896803.730229", "last_seen_epoch": "1647896803.730603", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-7c17da0e1f3f5f1ea6252a26", "transport": "udp", "stream": 12, "initiator_ip": "10.0.19.14", "initiator_port": 62042, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3299, "last_frame": 3300, "first_seen_epoch": "1647896803.731257", "last_seen_epoch": "1647896803.732244", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-69b5fec4ae903c64d0b02d19", "transport": "udp", "stream": 13, "initiator_ip": "10.0.19.14", "initiator_port": 50246, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3321, "last_frame": 3322, "first_seen_epoch": "1647896979.101968", "last_seen_epoch": "1647896979.16344", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-b251528962e0e26af2536662", "transport": "tcp", "stream": 18, "initiator_ip": "10.0.19.14", "initiator_port": 62197, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 3323, "last_frame": 3345, "first_seen_epoch": "1647896979.164481", "last_seen_epoch": "1647897040.925662", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-ff5776612083375b860aafc3", "transport": "tcp", "stream": 19, "initiator_ip": "10.0.19.14", "initiator_port": 62198, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 3350, "last_frame": 3375, "first_seen_epoch": "1647897044.216474", "last_seen_epoch": "1647897054.93724", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-73a8eb5ee58a1d3ff0959dcd", "transport": "udp", "stream": 14, "initiator_ip": "10.0.19.14", "initiator_port": 64886, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3379, "last_frame": 3381, "first_seen_epoch": "1647897103.636741", "last_seen_epoch": "1647897103.673485", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-d2baf5369202cd370efe0d05", "transport": "tcp", "stream": 20, "initiator_ip": "10.0.19.14", "initiator_port": 62199, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 3382, "last_frame": 3404, "first_seen_epoch": "1647897103.675574", "last_seen_epoch": "1647897104.05144", "packets": 22, "bytes": 6220, "initiator_bytes": 1673, "responder_bytes": 4547 }, { "flow_id": "flow-d653ad9faf2e735e932a218e", "transport": "tcp", "stream": 21, "initiator_ip": "10.0.19.14", "initiator_port": 62200, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 3402, "last_frame": 3425, "first_seen_epoch": "1647897104.016175", "last_seen_epoch": "1647897104.382794", "packets": 22, "bytes": 5889, "initiator_bytes": 1350, "responder_bytes": 4539 }, { "flow_id": "flow-9df16be28bcb2781ad988ea6", "transport": "udp", "stream": 15, "initiator_ip": "10.0.19.14", "initiator_port": 50514, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3430, "last_frame": 3431, "first_seen_epoch": "1647897130.18823", "last_seen_epoch": "1647897130.188604", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-5523cb4a282fea31ed7cf2a4", "transport": "udp", "stream": 16, "initiator_ip": "10.0.19.14", "initiator_port": 50515, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3432, "last_frame": 3433, "first_seen_epoch": "1647897130.189233", "last_seen_epoch": "1647897130.189622", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-88646cf444a2172b0bb3a782", "transport": "tcp", "stream": 22, "initiator_ip": "10.0.19.14", "initiator_port": 62201, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 3434, "last_frame": 3505, "first_seen_epoch": "1647897130.320198", "last_seen_epoch": "1647897130.465004", "packets": 12, "bytes": 1816, "initiator_bytes": 910, "responder_bytes": 906 }, { "flow_id": "flow-6167c1762715ace9893cebe2", "transport": "tcp", "stream": 23, "initiator_ip": "10.0.19.14", "initiator_port": 62202, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 3441, "last_frame": 3506, "first_seen_epoch": "1647897130.324965", "last_seen_epoch": "1647897130.465061", "packets": 24, "bytes": 7093, "initiator_bytes": 4472, "responder_bytes": 2621 }, { "flow_id": "flow-85a02e48a9c392e059a72e6e", "transport": "udp", "stream": 17, "initiator_ip": "10.0.19.14", "initiator_port": 50517, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3464, "last_frame": 3465, "first_seen_epoch": "1647897130.336289", "last_seen_epoch": "1647897130.336718", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-51e9eb589f143f8d23e7fc8a", "transport": "tcp", "stream": 24, "initiator_ip": "10.0.19.14", "initiator_port": 62203, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3470, "last_frame": 3504, "first_seen_epoch": "1647897130.442398", "last_seen_epoch": "1647897130.460354", "packets": 19, "bytes": 7512, "initiator_bytes": 3493, "responder_bytes": 4019 }, { "flow_id": "flow-b19b9cf03fc1c974167c0eae", "transport": "tcp", "stream": 25, "initiator_ip": "10.0.19.14", "initiator_port": 62204, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3487, "last_frame": 3502, "first_seen_epoch": "1647897130.453719", "last_seen_epoch": "1647897130.459995", "packets": 16, "bytes": 6926, "initiator_bytes": 2893, "responder_bytes": 4033 }, { "flow_id": "flow-4c7f8eeb4f3cf946f033a8f7", "transport": "udp", "stream": 18, "initiator_ip": "10.0.19.14", "initiator_port": 59627, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3520, "last_frame": 3521, "first_seen_epoch": "1647897262.965449", "last_seen_epoch": "1647897262.992763", "packets": 2, "bytes": 291, "initiator_bytes": 86, "responder_bytes": 205 }, { "flow_id": "flow-d62753a2438c9a91f503ac21", "transport": "tcp", "stream": 26, "initiator_ip": "10.0.19.14", "initiator_port": 62205, "responder_ip": "13.87.188.105", "responder_port": 443, "first_frame": 3522, "last_frame": 3543, "first_seen_epoch": "1647897262.994386", "last_seen_epoch": "1647897263.934709", "packets": 22, "bytes": 9592, "initiator_bytes": 2860, "responder_bytes": 6732 }, { "flow_id": "flow-6e09d00d77bc801cd4bfef67", "transport": "udp", "stream": 19, "initiator_ip": "10.0.19.14", "initiator_port": 53901, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3546, "last_frame": 3547, "first_seen_epoch": "1647897280.810233", "last_seen_epoch": "1647897280.856532", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-c57a74ebfc712319209048bb", "transport": "tcp", "stream": 27, "initiator_ip": "10.0.19.14", "initiator_port": 62206, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 3548, "last_frame": 3570, "first_seen_epoch": "1647897280.857457", "last_seen_epoch": "1647897342.500472", "packets": 17, "bytes": 3302, "initiator_bytes": 1113, "responder_bytes": 2189 }, { "flow_id": "flow-e5789871eb8f0b9cab42b676", "transport": "udp", "stream": 20, "initiator_ip": "10.0.19.14", "initiator_port": 51112, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3583, "last_frame": 3584, "first_seen_epoch": "1647897403.696275", "last_seen_epoch": "1647897403.696658", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-2e7f8f680f6b6f0775dd032d", "transport": "udp", "stream": 21, "initiator_ip": "10.0.19.14", "initiator_port": 62790, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3585, "last_frame": 3586, "first_seen_epoch": "1647897403.697276", "last_seen_epoch": "1647897403.699036", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-956303a7ee8979f9cd751916", "transport": "udp", "stream": 22, "initiator_ip": "10.0.19.14", "initiator_port": 57152, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3609, "last_frame": 3610, "first_seen_epoch": "1647897582.385735", "last_seen_epoch": "1647897582.42149", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-04102e9207f0cb0c6f18f6d4", "transport": "tcp", "stream": 28, "initiator_ip": "10.0.19.14", "initiator_port": 62207, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 3611, "last_frame": 3633, "first_seen_epoch": "1647897582.422425", "last_seen_epoch": "1647897644.067126", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-590d7fde86e52d384e238a34", "transport": "tcp", "stream": 29, "initiator_ip": "10.0.19.14", "initiator_port": 62208, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 3655, "last_frame": 3714, "first_seen_epoch": "1647897816.605147", "last_seen_epoch": "1647897816.640654", "packets": 60, "bytes": 17108, "initiator_bytes": 9938, "responder_bytes": 7170 }, { "flow_id": "flow-d10484fd0d5706becdc12613", "transport": "udp", "stream": 23, "initiator_ip": "10.0.19.14", "initiator_port": 61223, "responder_ip": "239.255.255.250", "responder_port": 3702, "first_frame": 3715, "last_frame": 3825, "first_seen_epoch": "1647897817.090517", "last_seen_epoch": "1647898111.478352", "packets": 6, "bytes": 6090, "initiator_bytes": 6090, "responder_bytes": 0 }, { "flow_id": "flow-2ac57b67c0b12295438e056e", "transport": "udp", "stream": 24, "initiator_ip": "169.254.179.89", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 3719, "last_frame": 3759, "first_seen_epoch": "1647898089.387901", "last_seen_epoch": "1647898104.840912", "packets": 4, "bytes": 344, "initiator_bytes": 344, "responder_bytes": 0 }, { "flow_id": "flow-78ce22850de3313a12bab2c1", "transport": "udp", "stream": 25, "initiator_ip": "169.254.179.89", "initiator_port": 51740, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 3721, "last_frame": 3721, "first_seen_epoch": "1647898089.388266", "last_seen_epoch": "1647898089.388266", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-b4743e6fa4f549e26d7784d5", "transport": "udp", "stream": 26, "initiator_ip": "169.254.179.89", "initiator_port": 137, "responder_ip": "169.254.255.255", "responder_port": 137, "first_frame": 3723, "last_frame": 3770, "first_seen_epoch": "1647898089.463553", "last_seen_epoch": "1647898110.243883", "packets": 23, "bytes": 2530, "initiator_bytes": 2530, "responder_bytes": 0 }, { "flow_id": "flow-2b7689eecfd33f6659dc3bd9", "transport": "udp", "stream": 27, "initiator_ip": "169.254.179.89", "initiator_port": 51742, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 3730, "last_frame": 3767, "first_seen_epoch": "1647898090.369579", "last_seen_epoch": "1647898108.384633", "packets": 9, "bytes": 1611, "initiator_bytes": 1611, "responder_bytes": 0 }, { "flow_id": "flow-000d7c8be04868a0c85ea7db", "transport": "udp", "stream": 28, "initiator_ip": "169.254.179.89", "initiator_port": 138, "responder_ip": "169.254.255.255", "responder_port": 138, "first_frame": 3743, "last_frame": 3755, "first_seen_epoch": "1647898095.636081", "last_seen_epoch": "1647898104.651817", "packets": 9, "bytes": 2115, "initiator_bytes": 2115, "responder_bytes": 0 }, { "flow_id": "flow-6fea3b6e18d0cf1957ae16aa", "transport": "udp", "stream": 29, "initiator_ip": "169.254.179.89", "initiator_port": 57051, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 3760, "last_frame": 3760, "first_seen_epoch": "1647898104.840951", "last_seen_epoch": "1647898104.840951", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-d47ed6ff4457b131c42602df", "transport": "udp", "stream": 30, "initiator_ip": "0.0.0.0", "initiator_port": 68, "responder_ip": "255.255.255.255", "responder_port": 67, "first_frame": 3771, "last_frame": 3773, "first_seen_epoch": "1647898110.838235", "last_seen_epoch": "1647898110.843938", "packets": 2, "bytes": 731, "initiator_bytes": 731, "responder_bytes": 0 }, { "flow_id": "flow-9f4a4b001d70df3476ad6b96", "transport": "udp", "stream": 31, "initiator_ip": "10.0.19.1", "initiator_port": 67, "responder_ip": "10.0.19.14", "responder_port": 68, "first_frame": 3772, "last_frame": 3774, "first_seen_epoch": "1647898110.843518", "last_seen_epoch": "1647898110.847846", "packets": 2, "bytes": 693, "initiator_bytes": 693, "responder_bytes": 0 }, { "flow_id": "flow-aed216702a3f7f249bdf20e7", "transport": "udp", "stream": 32, "initiator_ip": "10.0.19.14", "initiator_port": 50620, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3787, "last_frame": 8652, "first_seen_epoch": "1647898110.85566", "last_seen_epoch": "1647901792.204194", "packets": 4, "bytes": 565, "initiator_bytes": 209, "responder_bytes": 356 }, { "flow_id": "flow-924851b1736514359f84b9aa", "transport": "udp", "stream": 33, "initiator_ip": "10.0.19.14", "initiator_port": 49220, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 3789, "last_frame": 3821, "first_seen_epoch": "1647898110.856043", "last_seen_epoch": "1647898111.275148", "packets": 2, "bytes": 150, "initiator_bytes": 150, "responder_bytes": 0 }, { "flow_id": "flow-a7b9fbd98ddcfc38c6a9a31b", "transport": "udp", "stream": 34, "initiator_ip": "10.0.19.14", "initiator_port": 58717, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3792, "last_frame": 3793, "first_seen_epoch": "1647898110.857134", "last_seen_epoch": "1647898110.857406", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-7f55be96a013a9ad302d41a9", "transport": "udp", "stream": 35, "initiator_ip": "10.0.19.14", "initiator_port": 58718, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3794, "last_frame": 3795, "first_seen_epoch": "1647898110.857717", "last_seen_epoch": "1647898110.85807", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-c87562095498d51a7a17b6f3", "transport": "tcp", "stream": 30, "initiator_ip": "10.0.19.14", "initiator_port": 62209, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3801, "last_frame": 3815, "first_seen_epoch": "1647898110.964189", "last_seen_epoch": "1647898110.967389", "packets": 15, "bytes": 6357, "initiator_bytes": 2928, "responder_bytes": 3429 }, { "flow_id": "flow-64f636d56160eab900d1472c", "transport": "udp", "stream": 36, "initiator_ip": "10.0.19.14", "initiator_port": 57053, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 3817, "last_frame": 16177, "first_seen_epoch": "1647898111.072041", "last_seen_epoch": "1647918744.211724", "packets": 11, "bytes": 1933, "initiator_bytes": 1933, "responder_bytes": 0 }, { "flow_id": "flow-e3bf765bb0511bbc9da4ddbc", "transport": "udp", "stream": 37, "initiator_ip": "10.0.19.14", "initiator_port": 62930, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3822, "last_frame": 3824, "first_seen_epoch": "1647898111.386634", "last_seen_epoch": "1647898111.450439", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-e7838609ed124dc689057b2b", "transport": "udp", "stream": 38, "initiator_ip": "10.0.19.14", "initiator_port": 60562, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3826, "last_frame": 3827, "first_seen_epoch": "1647898111.49938", "last_seen_epoch": "1647898111.570693", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-69adbaf1580a929505b50293", "transport": "tcp", "stream": 31, "initiator_ip": "10.0.19.14", "initiator_port": 62210, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 3828, "last_frame": 3877, "first_seen_epoch": "1647898111.571162", "last_seen_epoch": "1647898112.080809", "packets": 22, "bytes": 6761, "initiator_bytes": 2223, "responder_bytes": 4538 }, { "flow_id": "flow-3d3105e52b2fcd79f46e488e", "transport": "udp", "stream": 39, "initiator_ip": "10.0.19.14", "initiator_port": 52551, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3841, "last_frame": 3850, "first_seen_epoch": "1647898111.853586", "last_seen_epoch": "1647898111.855341", "packets": 2, "bytes": 244, "initiator_bytes": 122, "responder_bytes": 122 }, { "flow_id": "flow-36aa824a0ca29d046a5c3b67", "transport": "udp", "stream": 40, "initiator_ip": "10.0.19.14", "initiator_port": 53458, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3842, "last_frame": 3845, "first_seen_epoch": "1647898111.853586", "last_seen_epoch": "1647898111.854034", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-a07cecf130c549b6a0fedc83", "transport": "udp", "stream": 41, "initiator_ip": "10.0.19.14", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 3846, "last_frame": 5790, "first_seen_epoch": "1647898111.854034", "last_seen_epoch": "1647899731.286924", "packets": 4, "bytes": 312, "initiator_bytes": 312, "responder_bytes": 0 }, { "flow_id": "flow-a97ac9e33d80cc309896e908", "transport": "udp", "stream": 42, "initiator_ip": "10.0.19.14", "initiator_port": 59575, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 3848, "last_frame": 3848, "first_seen_epoch": "1647898111.854176", "last_seen_epoch": "1647898111.854176", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-7dcf27a69e76dcd23da74ec3", "transport": "udp", "stream": 43, "initiator_ip": "10.0.19.14", "initiator_port": 51132, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3849, "last_frame": 3851, "first_seen_epoch": "1647898111.854269", "last_seen_epoch": "1647898111.855443", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-6501b190c0547d8ad3b26a1f", "transport": "udp", "stream": 44, "initiator_ip": "10.0.19.14", "initiator_port": 57537, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3852, "last_frame": 3853, "first_seen_epoch": "1647898111.855649", "last_seen_epoch": "1647898111.856462", "packets": 2, "bytes": 182, "initiator_bytes": 91, "responder_bytes": 91 }, { "flow_id": "flow-1d0278c414c3f5cab42217bd", "transport": "udp", "stream": 45, "initiator_ip": "10.0.19.14", "initiator_port": 53745, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3854, "last_frame": 3855, "first_seen_epoch": "1647898111.857108", "last_seen_epoch": "1647898111.857427", "packets": 2, "bytes": 244, "initiator_bytes": 122, "responder_bytes": 122 }, { "flow_id": "flow-3bc878c7025f1218b3cfaf00", "transport": "udp", "stream": 46, "initiator_ip": "10.0.19.14", "initiator_port": 61564, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3856, "last_frame": 3857, "first_seen_epoch": "1647898111.857763", "last_seen_epoch": "1647898111.857959", "packets": 2, "bytes": 182, "initiator_bytes": 91, "responder_bytes": 91 }, { "flow_id": "flow-d884f520f3933567b12e7930", "transport": "udp", "stream": 47, "initiator_ip": "10.0.19.14", "initiator_port": 61565, "responder_ip": "239.255.255.250", "responder_port": 3702, "first_frame": 3866, "last_frame": 3992, "first_seen_epoch": "1647898111.901151", "last_seen_epoch": "1647898118.134544", "packets": 7, "bytes": 4662, "initiator_bytes": 4662, "responder_bytes": 0 }, { "flow_id": "flow-ba8d835a9084359f8569f47b", "transport": "udp", "stream": 48, "initiator_ip": "10.0.19.14", "initiator_port": 53785, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3867, "last_frame": 3873, "first_seen_epoch": "1647898111.960561", "last_seen_epoch": "1647898112.044407", "packets": 2, "bytes": 223, "initiator_bytes": 82, "responder_bytes": 141 }, { "flow_id": "flow-0dcd3dc47045f7a9f4eca0de", "transport": "tcp", "stream": 32, "initiator_ip": "10.0.19.14", "initiator_port": 62211, "responder_ip": "40.83.240.146", "responder_port": 443, "first_frame": 3874, "last_frame": 16257, "first_seen_epoch": "1647898112.044816", "last_seen_epoch": "1647918963.001638", "packets": 64, "bytes": 14006, "initiator_bytes": 5745, "responder_bytes": 8261 }, { "flow_id": "flow-01e4331dee8cdb27528c8b74", "transport": "udp", "stream": 49, "initiator_ip": "10.0.19.14", "initiator_port": 51359, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3894, "last_frame": 3895, "first_seen_epoch": "1647898112.354005", "last_seen_epoch": "1647898112.354302", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-72f5cd8a45844fd20f41ef5b", "transport": "udp", "stream": 50, "initiator_ip": "10.0.19.14", "initiator_port": 49827, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3915, "last_frame": 3916, "first_seen_epoch": "1647898113.838379", "last_seen_epoch": "1647898113.838694", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-c9d513b05b6bb764537858a8", "transport": "udp", "stream": 51, "initiator_ip": "10.0.19.14", "initiator_port": 50820, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 3917, "last_frame": 3918, "first_seen_epoch": "1647898113.838908", "last_seen_epoch": "1647898113.839108", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-4b25cbf106d63d4632d32b24", "transport": "udp", "stream": 52, "initiator_ip": "10.0.19.14", "initiator_port": 50821, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 3939, "last_frame": 3940, "first_seen_epoch": "1647898117.058216", "last_seen_epoch": "1647898117.058588", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-38b7c7fb4ea15dd5377f91bb", "transport": "tcp", "stream": 33, "initiator_ip": "10.0.19.14", "initiator_port": 62212, "responder_ip": "10.0.19.9", "responder_port": 139, "first_frame": 3946, "last_frame": 4005, "first_seen_epoch": "1647898117.168075", "last_seen_epoch": "1647898127.934609", "packets": 25, "bytes": 3710, "initiator_bytes": 1755, "responder_bytes": 1955 }, { "flow_id": "flow-d9fb5b36622b385502c946ae", "transport": "udp", "stream": 53, "initiator_ip": "10.0.19.14", "initiator_port": 5355, "responder_ip": "10.0.19.9", "responder_port": 62435, "first_frame": 3960, "last_frame": 3960, "first_seen_epoch": "1647898117.172807", "last_seen_epoch": "1647898117.172807", "packets": 1, "bytes": 106, "initiator_bytes": 106, "responder_bytes": 0 }, { "flow_id": "flow-b64982506cd16aa54a9256cb", "transport": "udp", "stream": 54, "initiator_ip": "10.0.19.14", "initiator_port": 5355, "responder_ip": "10.0.19.9", "responder_port": 59534, "first_frame": 3961, "last_frame": 3961, "first_seen_epoch": "1647898117.173338", "last_seen_epoch": "1647898117.173338", "packets": 1, "bytes": 140, "initiator_bytes": 140, "responder_bytes": 0 }, { "flow_id": "flow-a84f808606cd02d8038d735d", "transport": "tcp", "stream": 34, "initiator_ip": "10.0.19.9", "initiator_port": 59877, "responder_ip": "10.0.19.14", "responder_port": 139, "first_frame": 3972, "last_frame": 4012, "first_seen_epoch": "1647898117.176767", "last_seen_epoch": "1647898127.951706", "packets": 24, "bytes": 3470, "initiator_bytes": 1749, "responder_bytes": 1721 }, { "flow_id": "flow-315256a1b2becf638f360f62", "transport": "udp", "stream": 55, "initiator_ip": "10.0.19.14", "initiator_port": 61415, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4013, "last_frame": 4014, "first_seen_epoch": "1647898132.382978", "last_seen_epoch": "1647898132.38336", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-e1aba0da94b00156529c22b4", "transport": "udp", "stream": 56, "initiator_ip": "10.0.19.14", "initiator_port": 64807, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4015, "last_frame": 4016, "first_seen_epoch": "1647898132.383697", "last_seen_epoch": "1647898132.38392", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-4f64bb331de34d1aef546a3e", "transport": "udp", "stream": 57, "initiator_ip": "10.0.19.14", "initiator_port": 64808, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4017, "last_frame": 4018, "first_seen_epoch": "1647898139.617426", "last_seen_epoch": "1647898139.617855", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-892ff6e2a95cf58ab8d2a0ed", "transport": "tcp", "stream": 35, "initiator_ip": "10.0.19.14", "initiator_port": 62213, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 4019, "last_frame": 4068, "first_seen_epoch": "1647898139.726706", "last_seen_epoch": "1647898150.509112", "packets": 25, "bytes": 7625, "initiator_bytes": 5463, "responder_bytes": 2162 }, { "flow_id": "flow-610886ba51d072052edb0bab", "transport": "udp", "stream": 58, "initiator_ip": "10.0.19.14", "initiator_port": 49230, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4039, "last_frame": 4040, "first_seen_epoch": "1647898144.014429", "last_seen_epoch": "1647898144.07915", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-e340c884137b6643de6ad3cf", "transport": "tcp", "stream": 36, "initiator_ip": "10.0.19.14", "initiator_port": 62214, "responder_ip": "13.89.179.9", "responder_port": 443, "first_frame": 4041, "last_frame": 4063, "first_seen_epoch": "1647898144.079629", "last_seen_epoch": "1647898144.821071", "packets": 23, "bytes": 10345, "initiator_bytes": 4450, "responder_bytes": 5895 }, { "flow_id": "flow-ae78d0cdec40d2fc1ff12fda", "transport": "udp", "stream": 59, "initiator_ip": "10.0.19.14", "initiator_port": 58024, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4069, "last_frame": 4070, "first_seen_epoch": "1647898171.890703", "last_seen_epoch": "1647898171.973323", "packets": 2, "bytes": 279, "initiator_bytes": 83, "responder_bytes": 196 }, { "flow_id": "flow-9b0b1bca5e949c4effd361e9", "transport": "tcp", "stream": 37, "initiator_ip": "10.0.19.14", "initiator_port": 62215, "responder_ip": "68.142.107.129", "responder_port": 80, "first_frame": 4071, "last_frame": 4089, "first_seen_epoch": "1647898171.979672", "last_seen_epoch": "1647898232.395589", "packets": 11, "bytes": 1195, "initiator_bytes": 642, "responder_bytes": 553 }, { "flow_id": "flow-66e8e4054ef780e0b5b38cf4", "transport": "udp", "stream": 60, "initiator_ip": "10.0.19.14", "initiator_port": 54909, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4078, "last_frame": 4079, "first_seen_epoch": "1647898192.390075", "last_seen_epoch": "1647898192.390434", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-a8d4015d73d566dbc4092340", "transport": "udp", "stream": 61, "initiator_ip": "10.0.19.14", "initiator_port": 49946, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4080, "last_frame": 4081, "first_seen_epoch": "1647898192.391133", "last_seen_epoch": "1647898192.392675", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-2bd0a835f84a58a958122c9c", "transport": "tcp", "stream": 38, "initiator_ip": "10.0.19.14", "initiator_port": 62216, "responder_ip": "40.83.240.146", "responder_port": 443, "first_frame": 4090, "last_frame": 8484, "first_seen_epoch": "1647898233.799247", "last_seen_epoch": "1647901479.517097", "packets": 42, "bytes": 9892, "initiator_bytes": 3786, "responder_bytes": 6106 }, { "flow_id": "flow-12e8d8f254bc969da5f59174", "transport": "udp", "stream": 62, "initiator_ip": "10.0.19.14", "initiator_port": 62094, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4117, "last_frame": 4119, "first_seen_epoch": "1647898792.359885", "last_seen_epoch": "1647898792.360754", "packets": 3, "bytes": 401, "initiator_bytes": 81, "responder_bytes": 320 }, { "flow_id": "flow-a6d24f56095769346656507b", "transport": "udp", "stream": 63, "initiator_ip": "10.0.19.14", "initiator_port": 54959, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4120, "last_frame": 4121, "first_seen_epoch": "1647898792.360865", "last_seen_epoch": "1647898792.362398", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-6c1f7d8be71f1bf174ced424", "transport": "udp", "stream": 64, "initiator_ip": "10.0.19.14", "initiator_port": 54960, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4127, "last_frame": 4224, "first_seen_epoch": "1647899008.684677", "last_seen_epoch": "1647899008.795666", "packets": 8, "bytes": 2094, "initiator_bytes": 1118, "responder_bytes": 976 }, { "flow_id": "flow-58c18e334e1d4d11653f16ee", "transport": "udp", "stream": 65, "initiator_ip": "10.0.19.14", "initiator_port": 53644, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4129, "last_frame": 4130, "first_seen_epoch": "1647899008.693309", "last_seen_epoch": "1647899008.693693", "packets": 2, "bytes": 304, "initiator_bytes": 118, "responder_bytes": 186 }, { "flow_id": "flow-eb58220547b48488ae3e5648", "transport": "tcp", "stream": 39, "initiator_ip": "10.0.19.14", "initiator_port": 62217, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 4133, "last_frame": 4713, "first_seen_epoch": "1647899008.769115", "last_seen_epoch": "1647899019.479204", "packets": 65, "bytes": 17984, "initiator_bytes": 10256, "responder_bytes": 7728 }, { "flow_id": "flow-63f8d9fed9f628af66aece1f", "transport": "tcp", "stream": 40, "initiator_ip": "10.0.19.14", "initiator_port": 62218, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 4140, "last_frame": 4755, "first_seen_epoch": "1647899008.771152", "last_seen_epoch": "1647899023.65369", "packets": 14, "bytes": 1860, "initiator_bytes": 964, "responder_bytes": 896 }, { "flow_id": "flow-f85dd78ff40a496309cc0f72", "transport": "tcp", "stream": 41, "initiator_ip": "10.0.19.14", "initiator_port": 62219, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4145, "last_frame": 4163, "first_seen_epoch": "1647899008.771593", "last_seen_epoch": "1647899008.773229", "packets": 8, "bytes": 942, "initiator_bytes": 489, "responder_bytes": 453 }, { "flow_id": "flow-8c4facdf6c08f5b43a563bbb", "transport": "tcp", "stream": 42, "initiator_ip": "10.0.19.14", "initiator_port": 62220, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 4153, "last_frame": 4815, "first_seen_epoch": "1647899008.7726", "last_seen_epoch": "1647899043.655348", "packets": 23, "bytes": 6371, "initiator_bytes": 4130, "responder_bytes": 2241 }, { "flow_id": "flow-e89b69235d6888a025e22d62", "transport": "tcp", "stream": 43, "initiator_ip": "10.0.19.14", "initiator_port": 62221, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4157, "last_frame": 4167, "first_seen_epoch": "1647899008.773053", "last_seen_epoch": "1647899008.774313", "packets": 8, "bytes": 942, "initiator_bytes": 489, "responder_bytes": 453 }, { "flow_id": "flow-49cfdb79ef497554bf676cc8", "transport": "tcp", "stream": 44, "initiator_ip": "10.0.19.14", "initiator_port": 62222, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4168, "last_frame": 4177, "first_seen_epoch": "1647899008.777848", "last_seen_epoch": "1647899008.779948", "packets": 10, "bytes": 2765, "initiator_bytes": 629, "responder_bytes": 2136 }, { "flow_id": "flow-10d75ce465d826c33928ee3c", "transport": "tcp", "stream": 45, "initiator_ip": "10.0.19.14", "initiator_port": 62223, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4178, "last_frame": 4187, "first_seen_epoch": "1647899008.782545", "last_seen_epoch": "1647899008.784681", "packets": 10, "bytes": 2765, "initiator_bytes": 629, "responder_bytes": 2136 }, { "flow_id": "flow-6f53c7490c3007b337d2e929", "transport": "tcp", "stream": 46, "initiator_ip": "10.0.19.14", "initiator_port": 62224, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4188, "last_frame": 4199, "first_seen_epoch": "1647899008.78478", "last_seen_epoch": "1647899008.78768", "packets": 12, "bytes": 4491, "initiator_bytes": 2274, "responder_bytes": 2217 }, { "flow_id": "flow-a7e35b3d16dcfce4be60b8c4", "transport": "udp", "stream": 66, "initiator_ip": "10.0.19.14", "initiator_port": 53211, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4214, "last_frame": 4215, "first_seen_epoch": "1647899008.794481", "last_seen_epoch": "1647899008.794789", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-3b1f8b4f39c3e3ea8dce9e1d", "transport": "tcp", "stream": 47, "initiator_ip": "10.0.19.14", "initiator_port": 62225, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4216, "last_frame": 4240, "first_seen_epoch": "1647899008.794789", "last_seen_epoch": "1647899008.798444", "packets": 12, "bytes": 4453, "initiator_bytes": 2256, "responder_bytes": 2197 }, { "flow_id": "flow-d718fc854c162b8041d31f59", "transport": "tcp", "stream": 48, "initiator_ip": "10.0.19.14", "initiator_port": 62226, "responder_ip": "10.0.19.9", "responder_port": 49676, "first_frame": 4226, "last_frame": 4756, "first_seen_epoch": "1647899008.796286", "last_seen_epoch": "1647899023.653785", "packets": 20, "bytes": 4584, "initiator_bytes": 2658, "responder_bytes": 1926 }, { "flow_id": "flow-a94f2a9a98ae05bbda15e098", "transport": "tcp", "stream": 49, "initiator_ip": "10.0.19.14", "initiator_port": 62227, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4239, "last_frame": 4261, "first_seen_epoch": "1647899008.798444", "last_seen_epoch": "1647899008.800494", "packets": 12, "bytes": 4127, "initiator_bytes": 2049, "responder_bytes": 2078 }, { "flow_id": "flow-1f5972e19993b14de33ab28a", "transport": "tcp", "stream": 50, "initiator_ip": "10.0.19.14", "initiator_port": 62228, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4250, "last_frame": 4270, "first_seen_epoch": "1647899008.799311", "last_seen_epoch": "1647899008.801083", "packets": 8, "bytes": 926, "initiator_bytes": 481, "responder_bytes": 445 }, { "flow_id": "flow-ff34f6b1a7f23e92a7634106", "transport": "tcp", "stream": 51, "initiator_ip": "10.0.19.14", "initiator_port": 62229, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4297, "last_frame": 4310, "first_seen_epoch": "1647899008.805849", "last_seen_epoch": "1647899008.807089", "packets": 9, "bytes": 2697, "initiator_bytes": 561, "responder_bytes": 2136 }, { "flow_id": "flow-8a1748cd1e4989c015ae4486", "transport": "udp", "stream": 67, "initiator_ip": "10.0.19.14", "initiator_port": 50276, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4302, "last_frame": 4304, "first_seen_epoch": "1647899008.806161", "last_seen_epoch": "1647899008.806292", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-7fba2b23f8b0dcc9274aa360", "transport": "tcp", "stream": 52, "initiator_ip": "10.0.19.14", "initiator_port": 62230, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4312, "last_frame": 4328, "first_seen_epoch": "1647899008.807142", "last_seen_epoch": "1647899008.808907", "packets": 12, "bytes": 4192, "initiator_bytes": 2101, "responder_bytes": 2091 }, { "flow_id": "flow-6e6c2877486b64f4febc71aa", "transport": "tcp", "stream": 53, "initiator_ip": "10.0.19.14", "initiator_port": 62231, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 4347, "last_frame": 16273, "first_seen_epoch": "1647899008.900179", "last_seen_epoch": "1647918979.794112", "packets": 626, "bytes": 67207, "initiator_bytes": 28927, "responder_bytes": 38280 }, { "flow_id": "flow-c117a70e1cdabe7139afaf72", "transport": "tcp", "stream": 54, "initiator_ip": "10.0.19.14", "initiator_port": 62232, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 4352, "last_frame": 4363, "first_seen_epoch": "1647899008.901289", "last_seen_epoch": "1647899008.902976", "packets": 12, "bytes": 4402, "initiator_bytes": 2239, "responder_bytes": 2163 }, { "flow_id": "flow-75c7474fff6ca8b52a69b6f4", "transport": "tcp", "stream": 55, "initiator_ip": "10.0.19.14", "initiator_port": 62233, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4375, "last_frame": 4413, "first_seen_epoch": "1647899009.107427", "last_seen_epoch": "1647899009.437916", "packets": 21, "bytes": 8038, "initiator_bytes": 3849, "responder_bytes": 4189 }, { "flow_id": "flow-aa18f1a95b3582188f330fa7", "transport": "tcp", "stream": 56, "initiator_ip": "10.0.19.14", "initiator_port": 62234, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4388, "last_frame": 4409, "first_seen_epoch": "1647899009.118181", "last_seen_epoch": "1647899009.435755", "packets": 17, "bytes": 4188, "initiator_bytes": 3054, "responder_bytes": 1134 }, { "flow_id": "flow-f07403434d7fe7413103603a", "transport": "udp", "stream": 68, "initiator_ip": "10.0.19.14", "initiator_port": 60340, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4405, "last_frame": 4414, "first_seen_epoch": "1647899009.434906", "last_seen_epoch": "1647899009.500569", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-2162dc119a02fc08a1bae56e", "transport": "tcp", "stream": 57, "initiator_ip": "10.0.19.14", "initiator_port": 62235, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 4415, "last_frame": 4935, "first_seen_epoch": "1647899009.502241", "last_seen_epoch": "1647899075.876146", "packets": 23, "bytes": 9459, "initiator_bytes": 1323, "responder_bytes": 8136 }, { "flow_id": "flow-080928707c5d834801c76d98", "transport": "udp", "stream": 69, "initiator_ip": "10.0.19.14", "initiator_port": 61179, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4437, "last_frame": 4438, "first_seen_epoch": "1647899009.913079", "last_seen_epoch": "1647899009.985888", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-fcbc05d8bac878fd82079e8c", "transport": "tcp", "stream": 58, "initiator_ip": "10.0.19.14", "initiator_port": 62236, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 4439, "last_frame": 11124, "first_seen_epoch": "1647899009.987149", "last_seen_epoch": "1647908352.333887", "packets": 645, "bytes": 51132, "initiator_bytes": 26082, "responder_bytes": 25050 }, { "flow_id": "flow-ff89a78a05f5529cf01185c7", "transport": "udp", "stream": 70, "initiator_ip": "10.0.19.14", "initiator_port": 50941, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4446, "last_frame": 4463, "first_seen_epoch": "1647899010.276273", "last_seen_epoch": "1647899010.351545", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-3ea9525a0d7cab5069c6decc", "transport": "udp", "stream": 71, "initiator_ip": "10.0.19.14", "initiator_port": 61069, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4447, "last_frame": 4452, "first_seen_epoch": "1647899010.276273", "last_seen_epoch": "1647899010.343243", "packets": 2, "bytes": 249, "initiator_bytes": 87, "responder_bytes": 162 }, { "flow_id": "flow-a017f8423ed64e15c4cfff33", "transport": "udp", "stream": 72, "initiator_ip": "10.0.19.14", "initiator_port": 57922, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4448, "last_frame": 4453, "first_seen_epoch": "1647899010.276622", "last_seen_epoch": "1647899010.343277", "packets": 2, "bytes": 249, "initiator_bytes": 87, "responder_bytes": 162 }, { "flow_id": "flow-e32ba91bc3b0379e4ff94712", "transport": "udp", "stream": 73, "initiator_ip": "10.0.19.14", "initiator_port": 61201, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4449, "last_frame": 4454, "first_seen_epoch": "1647899010.277385", "last_seen_epoch": "1647899010.343476", "packets": 2, "bytes": 221, "initiator_bytes": 77, "responder_bytes": 144 }, { "flow_id": "flow-d081ee8e5e1cc3ca35dec1ae", "transport": "udp", "stream": 74, "initiator_ip": "10.0.19.14", "initiator_port": 61079, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4450, "last_frame": 4456, "first_seen_epoch": "1647899010.277995", "last_seen_epoch": "1647899010.343628", "packets": 2, "bytes": 225, "initiator_bytes": 79, "responder_bytes": 146 }, { "flow_id": "flow-4d557f8b6df5645757f9757b", "transport": "udp", "stream": 75, "initiator_ip": "10.0.19.14", "initiator_port": 61671, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4451, "last_frame": 4455, "first_seen_epoch": "1647899010.27864", "last_seen_epoch": "1647899010.343547", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-d5d25c076f6634d1180f20a1", "transport": "tcp", "stream": 59, "initiator_ip": "10.0.19.14", "initiator_port": 62239, "responder_ip": "72.21.81.200", "responder_port": 443, "first_frame": 4457, "last_frame": 10079, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647905602.619013", "packets": 39, "bytes": 10008, "initiator_bytes": 1816, "responder_bytes": 8192 }, { "flow_id": "flow-78f3c0b127d3438cb7d843bf", "transport": "tcp", "stream": 60, "initiator_ip": "10.0.19.14", "initiator_port": 62241, "responder_ip": "72.21.81.200", "responder_port": 443, "first_frame": 4458, "last_frame": 10077, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647905602.603418", "packets": 40, "bytes": 10054, "initiator_bytes": 1808, "responder_bytes": 8246 }, { "flow_id": "flow-c0c911dfc8c36173028afb68", "transport": "tcp", "stream": 61, "initiator_ip": "10.0.19.14", "initiator_port": 62238, "responder_ip": "13.107.246.254", "responder_port": 443, "first_frame": 4459, "last_frame": 4946, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647899133.280255", "packets": 26, "bytes": 6884, "initiator_bytes": 1238, "responder_bytes": 5646 }, { "flow_id": "flow-5a28f8866da57525dee47678", "transport": "tcp", "stream": 62, "initiator_ip": "10.0.19.14", "initiator_port": 62237, "responder_ip": "72.21.81.200", "responder_port": 443, "first_frame": 4460, "last_frame": 10078, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647905602.603533", "packets": 38, "bytes": 9948, "initiator_bytes": 1756, "responder_bytes": 8192 }, { "flow_id": "flow-799f0d9b03b60b390a9d3dae", "transport": "tcp", "stream": 63, "initiator_ip": "10.0.19.14", "initiator_port": 62240, "responder_ip": "52.113.196.254", "responder_port": 443, "first_frame": 4461, "last_frame": 4951, "first_seen_epoch": "1647899010.344065", "last_seen_epoch": "1647899135.118209", "packets": 26, "bytes": 6889, "initiator_bytes": 1242, "responder_bytes": 5647 }, { "flow_id": "flow-ea77c8ca7dbca39723633791", "transport": "udp", "stream": 76, "initiator_ip": "10.0.19.14", "initiator_port": 52171, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4462, "last_frame": 4467, "first_seen_epoch": "1647899010.344998", "last_seen_epoch": "1647899010.410006", "packets": 2, "bytes": 231, "initiator_bytes": 79, "responder_bytes": 152 }, { "flow_id": "flow-4cccea92bb2b576e3882fd2a", "transport": "tcp", "stream": 64, "initiator_ip": "10.0.19.14", "initiator_port": 62242, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 4464, "last_frame": 4957, "first_seen_epoch": "1647899010.351888", "last_seen_epoch": "1647899144.731963", "packets": 51, "bytes": 17606, "initiator_bytes": 8422, "responder_bytes": 9184 }, { "flow_id": "flow-b5ba50472beac03f69c4f261", "transport": "tcp", "stream": 65, "initiator_ip": "10.0.19.14", "initiator_port": 62243, "responder_ip": "13.107.136.254", "responder_port": 443, "first_frame": 4468, "last_frame": 4949, "first_seen_epoch": "1647899010.410387", "last_seen_epoch": "1647899134.225363", "packets": 25, "bytes": 6842, "initiator_bytes": 1240, "responder_bytes": 5602 }, { "flow_id": "flow-511bb5483fbf1089d16ed5f5", "transport": "tcp", "stream": 66, "initiator_ip": "10.0.19.14", "initiator_port": 62244, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 4487, "last_frame": 4956, "first_seen_epoch": "1647899010.429746", "last_seen_epoch": "1647899137.804579", "packets": 25, "bytes": 7649, "initiator_bytes": 1233, "responder_bytes": 6416 }, { "flow_id": "flow-4a9a3981f355d17e42364ed0", "transport": "tcp", "stream": 67, "initiator_ip": "10.0.19.14", "initiator_port": 62245, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 4488, "last_frame": 4950, "first_seen_epoch": "1647899010.438573", "last_seen_epoch": "1647899134.296939", "packets": 25, "bytes": 7649, "initiator_bytes": 1233, "responder_bytes": 6416 }, { "flow_id": "flow-65ccaea0c76ff768f91a18fb", "transport": "udp", "stream": 77, "initiator_ip": "10.0.19.14", "initiator_port": 54788, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4725, "last_frame": 4726, "first_seen_epoch": "1647899020.405676", "last_seen_epoch": "1647899020.483805", "packets": 2, "bytes": 291, "initiator_bytes": 86, "responder_bytes": 205 }, { "flow_id": "flow-0940a03ab02ca2bd34a8b1b3", "transport": "tcp", "stream": 68, "initiator_ip": "10.0.19.14", "initiator_port": 62246, "responder_ip": "20.81.51.95", "responder_port": 443, "first_frame": 4727, "last_frame": 4748, "first_seen_epoch": "1647899020.485452", "last_seen_epoch": "1647899021.13768", "packets": 22, "bytes": 9594, "initiator_bytes": 2861, "responder_bytes": 6733 }, { "flow_id": "flow-404c01a112cbbd79a5b024ac", "transport": "udp", "stream": 78, "initiator_ip": "10.0.19.14", "initiator_port": 52182, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4759, "last_frame": 4760, "first_seen_epoch": "1647899039.501726", "last_seen_epoch": "1647899039.573949", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-1a92628d2c87059e2685617b", "transport": "tcp", "stream": 69, "initiator_ip": "10.0.19.14", "initiator_port": 62247, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 4761, "last_frame": 4936, "first_seen_epoch": "1647899039.576012", "last_seen_epoch": "1647899099.892782", "packets": 33, "bytes": 11557, "initiator_bytes": 3572, "responder_bytes": 7985 }, { "flow_id": "flow-1cec7137b68d1d41f39f013e", "transport": "tcp", "stream": 70, "initiator_ip": "10.0.19.14", "initiator_port": 62248, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 4765, "last_frame": 4820, "first_seen_epoch": "1647899039.672965", "last_seen_epoch": "1647899050.400866", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-3a2699b4b2b4ee2735cd10e5", "transport": "udp", "stream": 79, "initiator_ip": "10.0.19.14", "initiator_port": 49857, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4823, "last_frame": 4824, "first_seen_epoch": "1647899069.512852", "last_seen_epoch": "1647899069.513278", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-89873745d7f45a35bb321bfd", "transport": "udp", "stream": 80, "initiator_ip": "10.0.19.14", "initiator_port": 49858, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4825, "last_frame": 4826, "first_seen_epoch": "1647899069.513749", "last_seen_epoch": "1647899069.514181", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-13dc7039522da75de420f928", "transport": "tcp", "stream": 71, "initiator_ip": "10.0.19.14", "initiator_port": 62249, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 4827, "last_frame": 4896, "first_seen_epoch": "1647899069.641982", "last_seen_epoch": "1647899069.666703", "packets": 10, "bytes": 1524, "initiator_bytes": 844, "responder_bytes": 680 }, { "flow_id": "flow-3f95fed17965c4637b30a9b1", "transport": "tcp", "stream": 72, "initiator_ip": "10.0.19.14", "initiator_port": 62250, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 4834, "last_frame": 4897, "first_seen_epoch": "1647899069.644271", "last_seen_epoch": "1647899069.666703", "packets": 22, "bytes": 6833, "initiator_bytes": 4406, "responder_bytes": 2427 }, { "flow_id": "flow-53577c3bc147b62131fbe047", "transport": "tcp", "stream": 73, "initiator_ip": "10.0.19.14", "initiator_port": 62251, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4857, "last_frame": 4895, "first_seen_epoch": "1647899069.653102", "last_seen_epoch": "1647899069.663815", "packets": 21, "bytes": 7632, "initiator_bytes": 3553, "responder_bytes": 4079 }, { "flow_id": "flow-0aab6044d2ed8a97121616f5", "transport": "tcp", "stream": 74, "initiator_ip": "10.0.19.14", "initiator_port": 62252, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 4874, "last_frame": 4894, "first_seen_epoch": "1647899069.659254", "last_seen_epoch": "1647899069.663734", "packets": 18, "bytes": 7046, "initiator_bytes": 2953, "responder_bytes": 4093 }, { "flow_id": "flow-deab7a9f991bca90725115b3", "transport": "udp", "stream": 81, "initiator_ip": "10.0.19.14", "initiator_port": 55442, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4898, "last_frame": 4899, "first_seen_epoch": "1647899069.929878", "last_seen_epoch": "1647899069.930175", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-986e62ab18516048f65da0eb", "transport": "tcp", "stream": 75, "initiator_ip": "10.0.19.14", "initiator_port": 62253, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 4900, "last_frame": 4941, "first_seen_epoch": "1647899069.934293", "last_seen_epoch": "1647899131.329246", "packets": 16, "bytes": 3746, "initiator_bytes": 1623, "responder_bytes": 2123 }, { "flow_id": "flow-997be1436a1eb7e829a367b1", "transport": "udp", "stream": 82, "initiator_ip": "10.0.19.14", "initiator_port": 51757, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 4995, "last_frame": 4996, "first_seen_epoch": "1647899371.184324", "last_seen_epoch": "1647899371.287345", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-9216c2ec95f356f18743ece8", "transport": "tcp", "stream": 76, "initiator_ip": "10.0.19.14", "initiator_port": 62254, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 4997, "last_frame": 5025, "first_seen_epoch": "1647899371.2883", "last_seen_epoch": "1647899432.682156", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-cbbcbd540f80707d65c03a14", "transport": "udp", "stream": 83, "initiator_ip": "10.0.19.14", "initiator_port": 58849, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5013, "last_frame": 5014, "first_seen_epoch": "1647899392.323744", "last_seen_epoch": "1647899392.324173", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-61ce87fbef350acd2b1790b9", "transport": "udp", "stream": 84, "initiator_ip": "10.0.19.14", "initiator_port": 49783, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5015, "last_frame": 5016, "first_seen_epoch": "1647899392.324828", "last_seen_epoch": "1647899392.326523", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-142b3c04871dd7493cf66cb0", "transport": "udp", "stream": 85, "initiator_ip": "10.0.19.14", "initiator_port": 64324, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5059, "last_frame": 5060, "first_seen_epoch": "1647899672.532037", "last_seen_epoch": "1647899672.614809", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-83aeab23db721714f98c5e3b", "transport": "tcp", "stream": 77, "initiator_ip": "10.0.19.14", "initiator_port": 62255, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 5061, "last_frame": 5832, "first_seen_epoch": "1647899672.615701", "last_seen_epoch": "1647899739.07936", "packets": 19, "bytes": 3435, "initiator_bytes": 1051, "responder_bytes": 2384 }, { "flow_id": "flow-0990b9a574ac40e70d3e4f34", "transport": "udp", "stream": 86, "initiator_ip": "10.0.19.14", "initiator_port": 63899, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5073, "last_frame": 5075, "first_seen_epoch": "1647899673.951105", "last_seen_epoch": "1647899674.021764", "packets": 2, "bytes": 158, "initiator_bytes": 71, "responder_bytes": 87 }, { "flow_id": "flow-8441747b7cb133cd6b32d327", "transport": "tcp", "stream": 78, "initiator_ip": "10.0.19.14", "initiator_port": 62256, "responder_ip": "185.47.40.36", "responder_port": 443, "first_frame": 5076, "last_frame": 5780, "first_seen_epoch": "1647899674.022682", "last_seen_epoch": "1647899705.307172", "packets": 25, "bytes": 7385, "initiator_bytes": 1059, "responder_bytes": 6326 }, { "flow_id": "flow-8af8c9a7ab1060ca7763645b", "transport": "udp", "stream": 87, "initiator_ip": "10.0.19.14", "initiator_port": 54025, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5098, "last_frame": 5100, "first_seen_epoch": "1647899675.035792", "last_seen_epoch": "1647899675.140469", "packets": 2, "bytes": 186, "initiator_bytes": 77, "responder_bytes": 109 }, { "flow_id": "flow-c69c08283eaac8af111d3fc7", "transport": "tcp", "stream": 79, "initiator_ip": "10.0.19.14", "initiator_port": 62257, "responder_ip": "87.238.33.8", "responder_port": 443, "first_frame": 5101, "last_frame": 5734, "first_seen_epoch": "1647899675.141417", "last_seen_epoch": "1647899683.583035", "packets": 632, "bytes": 525427, "initiator_bytes": 17480, "responder_bytes": 507947 }, { "flow_id": "flow-cad9479112d73b152882076f", "transport": "udp", "stream": 88, "initiator_ip": "10.0.19.14", "initiator_port": 61936, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5735, "last_frame": 5736, "first_seen_epoch": "1647899683.660908", "last_seen_epoch": "1647899683.825443", "packets": 2, "bytes": 160, "initiator_bytes": 72, "responder_bytes": 88 }, { "flow_id": "flow-0b8055d7bd637c46e230a3e7", "transport": "tcp", "stream": 80, "initiator_ip": "10.0.19.14", "initiator_port": 62258, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5737, "last_frame": 5774, "first_seen_epoch": "1647899683.83167", "last_seen_epoch": "1647899684.91845", "packets": 28, "bytes": 7827, "initiator_bytes": 1658, "responder_bytes": 6169 }, { "flow_id": "flow-bd778979f8434b90221a2ec6", "transport": "udp", "stream": 89, "initiator_ip": "10.0.19.14", "initiator_port": 59513, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5748, "last_frame": 5749, "first_seen_epoch": "1647899684.209025", "last_seen_epoch": "1647899684.275556", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-37f318443558d1042b174b3c", "transport": "tcp", "stream": 81, "initiator_ip": "10.0.19.14", "initiator_port": 62259, "responder_ip": "104.80.96.219", "responder_port": 80, "first_frame": 5750, "last_frame": 5863, "first_seen_epoch": "1647899684.276322", "last_seen_epoch": "1647899794.277797", "packets": 11, "bytes": 2366, "initiator_bytes": 475, "responder_bytes": 1891 }, { "flow_id": "flow-8f6c8f70a0a2a36ab792d226", "transport": "udp", "stream": 90, "initiator_ip": "10.0.19.14", "initiator_port": 53445, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5781, "last_frame": 5782, "first_seen_epoch": "1647899730.28654", "last_seen_epoch": "1647899730.286884", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-b6351e8baa9ec72c8d7c6463", "transport": "udp", "stream": 91, "initiator_ip": "10.0.19.14", "initiator_port": 51427, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5783, "last_frame": 5784, "first_seen_epoch": "1647899730.287071", "last_seen_epoch": "1647899730.288672", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-fd50d6060f71ca09e54c1cea", "transport": "udp", "stream": 92, "initiator_ip": "10.0.19.14", "initiator_port": 61929, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 5787, "last_frame": 5788, "first_seen_epoch": "1647899730.289101", "last_seen_epoch": "1647899730.698141", "packets": 2, "bytes": 128, "initiator_bytes": 128, "responder_bytes": 0 }, { "flow_id": "flow-687149ac86a6f738cc2a6ed1", "transport": "tcp", "stream": 82, "initiator_ip": "10.0.19.14", "initiator_port": 62260, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5800, "last_frame": 5825, "first_seen_epoch": "1647899737.224424", "last_seen_epoch": "1647899737.814462", "packets": 26, "bytes": 7638, "initiator_bytes": 3292, "responder_bytes": 4346 }, { "flow_id": "flow-1b06365b32fc2a84ce0f88ee", "transport": "tcp", "stream": 83, "initiator_ip": "10.0.19.14", "initiator_port": 62261, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5835, "last_frame": 5860, "first_seen_epoch": "1647899787.604743", "last_seen_epoch": "1647899789.243607", "packets": 26, "bytes": 7620, "initiator_bytes": 3274, "responder_bytes": 4346 }, { "flow_id": "flow-885b90daea79b067db8a888c", "transport": "tcp", "stream": 84, "initiator_ip": "10.0.19.14", "initiator_port": 62262, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5871, "last_frame": 5877, "first_seen_epoch": "1647899822.63073", "last_seen_epoch": "1647899837.657135", "packets": 5, "bytes": 330, "initiator_bytes": 330, "responder_bytes": 0 }, { "flow_id": "flow-2df710ebc1e98b576ddea5ea", "transport": "tcp", "stream": 85, "initiator_ip": "10.0.19.14", "initiator_port": 62263, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5878, "last_frame": 5906, "first_seen_epoch": "1647899843.666523", "last_seen_epoch": "1647899847.400079", "packets": 29, "bytes": 7806, "initiator_bytes": 3400, "responder_bytes": 4406 }, { "flow_id": "flow-051db53c4baf1603ad6676af", "transport": "tcp", "stream": 86, "initiator_ip": "10.0.19.14", "initiator_port": 62264, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 5917, "last_frame": 5943, "first_seen_epoch": "1647899900.508996", "last_seen_epoch": "1647899901.119019", "packets": 27, "bytes": 7674, "initiator_bytes": 3268, "responder_bytes": 4406 }, { "flow_id": "flow-8d5dce883e2c9c5416162889", "transport": "udp", "stream": 93, "initiator_ip": "10.0.19.14", "initiator_port": 58496, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5944, "last_frame": 5945, "first_seen_epoch": "1647899910.255986", "last_seen_epoch": "1647899910.335698", "packets": 2, "bytes": 309, "initiator_bytes": 89, "responder_bytes": 220 }, { "flow_id": "flow-50cfeba1d24d189ae3cb279a", "transport": "tcp", "stream": 87, "initiator_ip": "10.0.19.14", "initiator_port": 62265, "responder_ip": "13.69.116.104", "responder_port": 443, "first_frame": 5946, "last_frame": 5968, "first_seen_epoch": "1647899910.33688", "last_seen_epoch": "1647899911.627494", "packets": 23, "bytes": 10447, "initiator_bytes": 4552, "responder_bytes": 5895 }, { "flow_id": "flow-b12bb2306b041f8143b889fb", "transport": "udp", "stream": 94, "initiator_ip": "10.0.19.14", "initiator_port": 57636, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 5969, "last_frame": 5970, "first_seen_epoch": "1647899911.916838", "last_seen_epoch": "1647899911.99906", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-b15a21c22497d8a0bee09ee1", "transport": "tcp", "stream": 88, "initiator_ip": "10.0.19.14", "initiator_port": 62266, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 5971, "last_frame": 5995, "first_seen_epoch": "1647899912.000258", "last_seen_epoch": "1647899912.827137", "packets": 25, "bytes": 7695, "initiator_bytes": 2132, "responder_bytes": 5563 }, { "flow_id": "flow-fc9bcbb725a2253abe2e8818", "transport": "tcp", "stream": 89, "initiator_ip": "10.0.19.14", "initiator_port": 62267, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 6004, "last_frame": 6040, "first_seen_epoch": "1647899939.639968", "last_seen_epoch": "1647899950.333256", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-128f89b1bbfb5476832ab494", "transport": "tcp", "stream": 90, "initiator_ip": "10.0.19.14", "initiator_port": 62268, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6025, "last_frame": 6053, "first_seen_epoch": "1647899949.990157", "last_seen_epoch": "1647899950.596668", "packets": 24, "bytes": 7494, "initiator_bytes": 3088, "responder_bytes": 4406 }, { "flow_id": "flow-b88ee1950d9772f1c7e9eed6", "transport": "udp", "stream": 95, "initiator_ip": "10.0.19.14", "initiator_port": 60834, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6054, "last_frame": 6055, "first_seen_epoch": "1647899971.010337", "last_seen_epoch": "1647899971.120928", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-e5965514785981862b634314", "transport": "tcp", "stream": 91, "initiator_ip": "10.0.19.14", "initiator_port": 62269, "responder_ip": "104.80.96.219", "responder_port": 80, "first_frame": 6056, "last_frame": 6131, "first_seen_epoch": "1647899971.127356", "last_seen_epoch": "1647900031.803004", "packets": 10, "bytes": 1090, "initiator_bytes": 587, "responder_bytes": 503 }, { "flow_id": "flow-1f5de30047e432feecacc586", "transport": "udp", "stream": 96, "initiator_ip": "10.0.19.14", "initiator_port": 49873, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6062, "last_frame": 6064, "first_seen_epoch": "1647899971.353169", "last_seen_epoch": "1647899971.439881", "packets": 2, "bytes": 279, "initiator_bytes": 83, "responder_bytes": 196 }, { "flow_id": "flow-65eae9fd15894d2c3782af31", "transport": "tcp", "stream": 92, "initiator_ip": "10.0.19.14", "initiator_port": 62270, "responder_ip": "69.28.162.0", "responder_port": 80, "first_frame": 6065, "last_frame": 6132, "first_seen_epoch": "1647899971.440943", "last_seen_epoch": "1647900031.866614", "packets": 11, "bytes": 1195, "initiator_bytes": 642, "responder_bytes": 553 }, { "flow_id": "flow-0d97cfd63cab78049a2663af", "transport": "udp", "stream": 97, "initiator_ip": "10.0.19.14", "initiator_port": 57322, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6072, "last_frame": 6073, "first_seen_epoch": "1647899973.933269", "last_seen_epoch": "1647899974.003979", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-9b8994b46dd52bec058de0a4", "transport": "tcp", "stream": 93, "initiator_ip": "10.0.19.14", "initiator_port": 62271, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 6074, "last_frame": 6135, "first_seen_epoch": "1647899974.004897", "last_seen_epoch": "1647900035.470446", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-4438aef310168acda77a029a", "transport": "udp", "stream": 98, "initiator_ip": "10.0.19.14", "initiator_port": 55909, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6090, "last_frame": 6091, "first_seen_epoch": "1647899992.295984", "last_seen_epoch": "1647899992.296362", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-3d10bd119726dd2fb3a3b578", "transport": "udp", "stream": 99, "initiator_ip": "10.0.19.14", "initiator_port": 57264, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6092, "last_frame": 6093, "first_seen_epoch": "1647899992.296749", "last_seen_epoch": "1647899992.298308", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-a62500e1cffa8a99674259f9", "transport": "tcp", "stream": 94, "initiator_ip": "10.0.19.14", "initiator_port": 62272, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6094, "last_frame": 6123, "first_seen_epoch": "1647899996.808672", "last_seen_epoch": "1647899997.42529", "packets": 26, "bytes": 7614, "initiator_bytes": 3268, "responder_bytes": 4346 }, { "flow_id": "flow-407f5e12c42ec0cfe373bbc8", "transport": "tcp", "stream": 95, "initiator_ip": "10.0.19.14", "initiator_port": 62273, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6142, "last_frame": 6167, "first_seen_epoch": "1647900047.675753", "last_seen_epoch": "1647900048.282297", "packets": 26, "bytes": 7614, "initiator_bytes": 3268, "responder_bytes": 4346 }, { "flow_id": "flow-aeba8cc8e15b0dbdf7d151f5", "transport": "tcp", "stream": 96, "initiator_ip": "10.0.19.14", "initiator_port": 62274, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6172, "last_frame": 6196, "first_seen_epoch": "1647900096.982112", "last_seen_epoch": "1647900097.595854", "packets": 25, "bytes": 7554, "initiator_bytes": 3268, "responder_bytes": 4286 }, { "flow_id": "flow-74fefe6c947d0f37e617c81d", "transport": "tcp", "stream": 97, "initiator_ip": "10.0.19.14", "initiator_port": 62275, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6201, "last_frame": 6226, "first_seen_epoch": "1647900140.19199", "last_seen_epoch": "1647900140.793054", "packets": 26, "bytes": 7614, "initiator_bytes": 3268, "responder_bytes": 4346 }, { "flow_id": "flow-3e80ab92e82646a09f2db3bf", "transport": "tcp", "stream": 98, "initiator_ip": "10.0.19.14", "initiator_port": 62276, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6235, "last_frame": 6260, "first_seen_epoch": "1647900186.835954", "last_seen_epoch": "1647900187.453698", "packets": 26, "bytes": 7614, "initiator_bytes": 3208, "responder_bytes": 4406 }, { "flow_id": "flow-a9bea18080d58b23ea0ff625", "transport": "tcp", "stream": 99, "initiator_ip": "10.0.19.14", "initiator_port": 62277, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6265, "last_frame": 6290, "first_seen_epoch": "1647900237.6122", "last_seen_epoch": "1647900238.222208", "packets": 26, "bytes": 7614, "initiator_bytes": 3208, "responder_bytes": 4406 }, { "flow_id": "flow-c77b91375bdf2a1279785934", "transport": "udp", "stream": 100, "initiator_ip": "10.0.19.14", "initiator_port": 56543, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 6295, "last_frame": 6296, "first_seen_epoch": "1647900275.329202", "last_seen_epoch": "1647900275.40024", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-4ebac414340b260048980652", "transport": "tcp", "stream": 100, "initiator_ip": "10.0.19.14", "initiator_port": 62278, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 6297, "last_frame": 6345, "first_seen_epoch": "1647900275.401147", "last_seen_epoch": "1647900336.76763", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-d28df4a95e0f94540f2770d8", "transport": "tcp", "stream": 101, "initiator_ip": "10.0.19.14", "initiator_port": 62279, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6318, "last_frame": 6342, "first_seen_epoch": "1647900292.748342", "last_seen_epoch": "1647900293.398657", "packets": 25, "bytes": 7554, "initiator_bytes": 3208, "responder_bytes": 4346 }, { "flow_id": "flow-8ab2f9c16f303df7a36a45b7", "transport": "tcp", "stream": 102, "initiator_ip": "10.0.19.14", "initiator_port": 62280, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6352, "last_frame": 6378, "first_seen_epoch": "1647900347.635197", "last_seen_epoch": "1647900348.259551", "packets": 27, "bytes": 7802, "initiator_bytes": 3268, "responder_bytes": 4534 }, { "flow_id": "flow-3cd9ce3f70efd9da055a8fbf", "transport": "tcp", "stream": 103, "initiator_ip": "10.0.19.14", "initiator_port": 62281, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 6379, "last_frame": 6990, "first_seen_epoch": "1647900351.143264", "last_seen_epoch": "1647900353.105609", "packets": 612, "bytes": 442387, "initiator_bytes": 20728, "responder_bytes": 421659 }, { "flow_id": "flow-27a2e22aed84be98e5370c3d", "transport": "tcp", "stream": 104, "initiator_ip": "10.0.19.14", "initiator_port": 62283, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 6991, "last_frame": 7022, "first_seen_epoch": "1647900354.448667", "last_seen_epoch": "1647900354.459759", "packets": 20, "bytes": 9837, "initiator_bytes": 3127, "responder_bytes": 6710 }, { "flow_id": "flow-1d4627840589e472c9645a26", "transport": "tcp", "stream": 105, "initiator_ip": "10.0.19.14", "initiator_port": 62284, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 6998, "last_frame": 7009, "first_seen_epoch": "1647900354.450537", "last_seen_epoch": "1647900354.453838", "packets": 12, "bytes": 4453, "initiator_bytes": 2256, "responder_bytes": 2197 }, { "flow_id": "flow-e49a03294e23d2b83f1e7eb1", "transport": "tcp", "stream": 106, "initiator_ip": "10.0.19.14", "initiator_port": 62285, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 7023, "last_frame": 7859, "first_seen_epoch": "1647900354.460521", "last_seen_epoch": "1647900404.682754", "packets": 353, "bytes": 345567, "initiator_bytes": 10947, "responder_bytes": 334620 }, { "flow_id": "flow-c160a56824ab264580dda540", "transport": "udp", "stream": 101, "initiator_ip": "10.0.19.14", "initiator_port": 57036, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 7375, "last_frame": 7376, "first_seen_epoch": "1647900354.63651", "last_seen_epoch": "1647900354.636703", "packets": 2, "bytes": 263, "initiator_bytes": 92, "responder_bytes": 171 }, { "flow_id": "flow-09e75bf5f1c9139462dd2959", "transport": "tcp", "stream": 107, "initiator_ip": "10.0.19.14", "initiator_port": 62286, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 7379, "last_frame": 7927, "first_seen_epoch": "1647900354.648728", "last_seen_epoch": "1647900537.271076", "packets": 109, "bytes": 24361, "initiator_bytes": 13239, "responder_bytes": 11122 }, { "flow_id": "flow-f9c55e3de01f1d2de708a88f", "transport": "tcp", "stream": 108, "initiator_ip": "10.0.19.14", "initiator_port": 62288, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7453, "last_frame": 7477, "first_seen_epoch": "1647900355.531745", "last_seen_epoch": "1647900356.159427", "packets": 25, "bytes": 6504, "initiator_bytes": 3959, "responder_bytes": 2545 }, { "flow_id": "flow-8901bb34a644cab40fb326e3", "transport": "tcp", "stream": 109, "initiator_ip": "10.0.19.14", "initiator_port": 62289, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7478, "last_frame": 7506, "first_seen_epoch": "1647900359.051298", "last_seen_epoch": "1647900359.642418", "packets": 27, "bytes": 7674, "initiator_bytes": 3268, "responder_bytes": 4406 }, { "flow_id": "flow-fa96262314bbde7695020558", "transport": "tcp", "stream": 110, "initiator_ip": "10.0.19.14", "initiator_port": 62290, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7503, "last_frame": 7530, "first_seen_epoch": "1647900359.52574", "last_seen_epoch": "1647900360.136415", "packets": 26, "bytes": 6865, "initiator_bytes": 4320, "responder_bytes": 2545 }, { "flow_id": "flow-977e01d2fcad9aa78c40b2c6", "transport": "tcp", "stream": 111, "initiator_ip": "10.0.19.14", "initiator_port": 62291, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7531, "last_frame": 7557, "first_seen_epoch": "1647900363.034802", "last_seen_epoch": "1647900363.629554", "packets": 27, "bytes": 7846, "initiator_bytes": 3268, "responder_bytes": 4578 }, { "flow_id": "flow-afcb96ab7c8d5a2cf99e2645", "transport": "tcp", "stream": 112, "initiator_ip": "10.0.19.14", "initiator_port": 62292, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7561, "last_frame": 7587, "first_seen_epoch": "1647900368.518694", "last_seen_epoch": "1647900369.145247", "packets": 27, "bytes": 7791, "initiator_bytes": 5186, "responder_bytes": 2605 }, { "flow_id": "flow-11f2119772e433c53d821b7b", "transport": "tcp", "stream": 113, "initiator_ip": "10.0.19.14", "initiator_port": 62293, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7590, "last_frame": 7617, "first_seen_epoch": "1647900372.033167", "last_seen_epoch": "1647900373.670159", "packets": 28, "bytes": 7740, "initiator_bytes": 3334, "responder_bytes": 4406 }, { "flow_id": "flow-7c389aa8096f4d302b54eebe", "transport": "tcp", "stream": 114, "initiator_ip": "10.0.19.14", "initiator_port": 62294, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7618, "last_frame": 7643, "first_seen_epoch": "1647900376.565835", "last_seen_epoch": "1647900377.16628", "packets": 26, "bytes": 7614, "initiator_bytes": 3268, "responder_bytes": 4346 }, { "flow_id": "flow-76a4e43c74bd0232d149463a", "transport": "tcp", "stream": 115, "initiator_ip": "10.0.19.14", "initiator_port": 62295, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7644, "last_frame": 7668, "first_seen_epoch": "1647900380.049384", "last_seen_epoch": "1647900380.679277", "packets": 25, "bytes": 7554, "initiator_bytes": 3208, "responder_bytes": 4346 }, { "flow_id": "flow-539815c4b0bb7cc843cce237", "transport": "tcp", "stream": 116, "initiator_ip": "10.0.19.14", "initiator_port": 62296, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7669, "last_frame": 7696, "first_seen_epoch": "1647900383.553259", "last_seen_epoch": "1647900384.687877", "packets": 28, "bytes": 8295, "initiator_bytes": 3889, "responder_bytes": 4406 }, { "flow_id": "flow-31ac849749c71e7f5b0a5254", "transport": "tcp", "stream": 117, "initiator_ip": "10.0.19.14", "initiator_port": 62297, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7697, "last_frame": 7724, "first_seen_epoch": "1647900387.56861", "last_seen_epoch": "1647900389.204775", "packets": 28, "bytes": 7740, "initiator_bytes": 3334, "responder_bytes": 4406 }, { "flow_id": "flow-e06e2d397194f1f8200ab104", "transport": "tcp", "stream": 118, "initiator_ip": "10.0.19.14", "initiator_port": 62298, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7725, "last_frame": 7751, "first_seen_epoch": "1647900392.099375", "last_seen_epoch": "1647900392.747377", "packets": 27, "bytes": 7674, "initiator_bytes": 3268, "responder_bytes": 4406 }, { "flow_id": "flow-7a2d924b2d6d15c6fac196bc", "transport": "tcp", "stream": 119, "initiator_ip": "10.0.19.14", "initiator_port": 62299, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7754, "last_frame": 7779, "first_seen_epoch": "1647900395.630327", "last_seen_epoch": "1647900396.325314", "packets": 26, "bytes": 7614, "initiator_bytes": 3268, "responder_bytes": 4346 }, { "flow_id": "flow-b4a62461cd113a96f3605a2b", "transport": "tcp", "stream": 120, "initiator_ip": "10.0.19.14", "initiator_port": 62300, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7784, "last_frame": 7810, "first_seen_epoch": "1647900399.176716", "last_seen_epoch": "1647900399.798639", "packets": 27, "bytes": 7674, "initiator_bytes": 3268, "responder_bytes": 4406 }, { "flow_id": "flow-e220b2e88045b773c07dd01a", "transport": "tcp", "stream": 121, "initiator_ip": "10.0.19.14", "initiator_port": 62301, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7813, "last_frame": 7838, "first_seen_epoch": "1647900402.675952", "last_seen_epoch": "1647900404.305623", "packets": 25, "bytes": 7688, "initiator_bytes": 3154, "responder_bytes": 4534 }, { "flow_id": "flow-b11afebaba8f0764c235eec4", "transport": "tcp", "stream": 122, "initiator_ip": "10.0.19.14", "initiator_port": 62302, "responder_ip": "23.227.198.203", "responder_port": 757, "first_frame": 7837, "last_frame": 7861, "first_seen_epoch": "1647900404.187874", "last_seen_epoch": "1647900404.787459", "packets": 23, "bytes": 5549, "initiator_bytes": 3064, "responder_bytes": 2485 }, { "flow_id": "flow-cecea99e1c874734430ef567", "transport": "udp", "stream": 102, "initiator_ip": "10.0.19.14", "initiator_port": 50758, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 7930, "last_frame": 7931, "first_seen_epoch": "1647900576.625833", "last_seen_epoch": "1647900576.716133", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-ab0ee367cfb294aca8984329", "transport": "tcp", "stream": 123, "initiator_ip": "10.0.19.14", "initiator_port": 62303, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 7932, "last_frame": 7985, "first_seen_epoch": "1647900576.71702", "last_seen_epoch": "1647900638.209807", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-5713ab923c8c2a8c6824c87a", "transport": "udp", "stream": 103, "initiator_ip": "10.0.19.14", "initiator_port": 51679, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 7950, "last_frame": 7951, "first_seen_epoch": "1647900592.255784", "last_seen_epoch": "1647900592.25609", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-efaf5c913e88aa3f46e59ff0", "transport": "udp", "stream": 104, "initiator_ip": "10.0.19.14", "initiator_port": 57357, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 7952, "last_frame": 7953, "first_seen_epoch": "1647900592.256339", "last_seen_epoch": "1647900592.257878", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-f878168d3faf36b9e4fe6b6c", "transport": "udp", "stream": 105, "initiator_ip": "10.0.19.14", "initiator_port": 58087, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 7956, "last_frame": 7957, "first_seen_epoch": "1647900608.854196", "last_seen_epoch": "1647900608.859056", "packets": 2, "bytes": 291, "initiator_bytes": 86, "responder_bytes": 205 }, { "flow_id": "flow-4c5b19e66f49a3ce46ab67f5", "transport": "tcp", "stream": 124, "initiator_ip": "10.0.19.14", "initiator_port": 62304, "responder_ip": "20.81.52.156", "responder_port": 443, "first_frame": 7958, "last_frame": 7982, "first_seen_epoch": "1647900608.860697", "last_seen_epoch": "1647900610.563893", "packets": 23, "bytes": 9659, "initiator_bytes": 2926, "responder_bytes": 6733 }, { "flow_id": "flow-3d5c67652fdeacbfccf9fbac", "transport": "udp", "stream": 106, "initiator_ip": "10.0.19.14", "initiator_port": 58077, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8001, "last_frame": 8002, "first_seen_epoch": "1647900730.088507", "last_seen_epoch": "1647900730.088913", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-5d1ebf1dc803b4fca8329546", "transport": "udp", "stream": 107, "initiator_ip": "10.0.19.14", "initiator_port": 58078, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 8003, "last_frame": 8004, "first_seen_epoch": "1647900730.089547", "last_seen_epoch": "1647900730.089887", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-af4ae7cf7029e2b9ad2b047d", "transport": "tcp", "stream": 125, "initiator_ip": "10.0.19.14", "initiator_port": 62305, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 8005, "last_frame": 8074, "first_seen_epoch": "1647900730.220074", "last_seen_epoch": "1647900730.251592", "packets": 10, "bytes": 1524, "initiator_bytes": 844, "responder_bytes": 680 }, { "flow_id": "flow-f275838c3ed25c0960616a1a", "transport": "tcp", "stream": 126, "initiator_ip": "10.0.19.14", "initiator_port": 62306, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 8012, "last_frame": 8075, "first_seen_epoch": "1647900730.226434", "last_seen_epoch": "1647900730.251637", "packets": 22, "bytes": 6833, "initiator_bytes": 4406, "responder_bytes": 2427 }, { "flow_id": "flow-8cc098a01a18dc0af72779ff", "transport": "tcp", "stream": 127, "initiator_ip": "10.0.19.14", "initiator_port": 62307, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 8035, "last_frame": 8073, "first_seen_epoch": "1647900730.239078", "last_seen_epoch": "1647900730.250505", "packets": 21, "bytes": 7632, "initiator_bytes": 3553, "responder_bytes": 4079 }, { "flow_id": "flow-0eb428e5cf1b14fbd1fa4727", "transport": "tcp", "stream": 128, "initiator_ip": "10.0.19.14", "initiator_port": 62308, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 8052, "last_frame": 8071, "first_seen_epoch": "1647900730.245997", "last_seen_epoch": "1647900730.250444", "packets": 18, "bytes": 7046, "initiator_bytes": 2953, "responder_bytes": 4093 }, { "flow_id": "flow-d456667774f7c6358412cf8f", "transport": "tcp", "stream": 129, "initiator_ip": "10.0.19.14", "initiator_port": 62309, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 8082, "last_frame": 8284, "first_seen_epoch": "1647900774.080735", "last_seen_epoch": "1647900789.025781", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-d88c9c6a9b20a6c24cb8e127", "transport": "tcp", "stream": 130, "initiator_ip": "10.0.19.14", "initiator_port": 62310, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 8089, "last_frame": 8290, "first_seen_epoch": "1647900774.082243", "last_seen_epoch": "1647900809.023844", "packets": 21, "bytes": 5581, "initiator_bytes": 3742, "responder_bytes": 1839 }, { "flow_id": "flow-3d03b1ea358da15bfdc6aa44", "transport": "tcp", "stream": 131, "initiator_ip": "10.0.19.14", "initiator_port": 62311, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 8108, "last_frame": 8278, "first_seen_epoch": "1647900774.396234", "last_seen_epoch": "1647900774.793054", "packets": 21, "bytes": 10421, "initiator_bytes": 3852, "responder_bytes": 6569 }, { "flow_id": "flow-4de406d9587fbb70d00e77c8", "transport": "tcp", "stream": 132, "initiator_ip": "10.0.19.14", "initiator_port": 62312, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 8121, "last_frame": 8274, "first_seen_epoch": "1647900774.408254", "last_seen_epoch": "1647900774.78813", "packets": 17, "bytes": 4114, "initiator_bytes": 2980, "responder_bytes": 1134 }, { "flow_id": "flow-0edf168ba6a4c37432c8c1ad", "transport": "tcp", "stream": 133, "initiator_ip": "10.0.19.14", "initiator_port": 62313, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 8138, "last_frame": 8372, "first_seen_epoch": "1647900774.727271", "last_seen_epoch": "1647900957.354081", "packets": 177, "bytes": 46621, "initiator_bytes": 24113, "responder_bytes": 22508 }, { "flow_id": "flow-f534bb13ef787657035bfcb0", "transport": "udp", "stream": 108, "initiator_ip": "10.0.19.14", "initiator_port": 54793, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8318, "last_frame": 8319, "first_seen_epoch": "1647900878.064611", "last_seen_epoch": "1647900878.134945", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-a06ba607041e7f045723daf7", "transport": "tcp", "stream": 134, "initiator_ip": "10.0.19.14", "initiator_port": 62314, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8320, "last_frame": 8349, "first_seen_epoch": "1647900878.135836", "last_seen_epoch": "1647900939.745503", "packets": 16, "bytes": 3149, "initiator_bytes": 1026, "responder_bytes": 2123 }, { "flow_id": "flow-ada01ebfe482b33112857f44", "transport": "udp", "stream": 109, "initiator_ip": "10.0.19.14", "initiator_port": 52180, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8408, "last_frame": 8409, "first_seen_epoch": "1647901179.293128", "last_seen_epoch": "1647901179.367274", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-1048f0905f1c4ec3db76fb90", "transport": "tcp", "stream": 135, "initiator_ip": "10.0.19.14", "initiator_port": 62315, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8410, "last_frame": 8440, "first_seen_epoch": "1647901179.36823", "last_seen_epoch": "1647901240.683226", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-472f50e746861cc9a2fd6287", "transport": "udp", "stream": 110, "initiator_ip": "10.0.19.14", "initiator_port": 53944, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8430, "last_frame": 8431, "first_seen_epoch": "1647901192.229988", "last_seen_epoch": "1647901192.230372", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-657025adb2883d8954652fc1", "transport": "udp", "stream": 111, "initiator_ip": "10.0.19.14", "initiator_port": 63004, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8432, "last_frame": 8433, "first_seen_epoch": "1647901192.230561", "last_seen_epoch": "1647901192.23224", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-b7d36b53520ed073274d5468", "transport": "udp", "stream": 112, "initiator_ip": "10.0.19.14", "initiator_port": 58606, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8485, "last_frame": 8486, "first_seen_epoch": "1647901480.55548", "last_seen_epoch": "1647901480.625418", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-7f097ede213f7cdd2f98a6a4", "transport": "tcp", "stream": 136, "initiator_ip": "10.0.19.14", "initiator_port": 62316, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8487, "last_frame": 8507, "first_seen_epoch": "1647901480.626474", "last_seen_epoch": "1647901542.035765", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-13d33db31fba03dc330c01e2", "transport": "udp", "stream": 113, "initiator_ip": "10.0.19.14", "initiator_port": 64920, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8536, "last_frame": 8537, "first_seen_epoch": "1647901712.694874", "last_seen_epoch": "1647901712.776868", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-ac41d3b4d7da7b00db93008d", "transport": "tcp", "stream": 137, "initiator_ip": "10.0.19.14", "initiator_port": 62317, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 8538, "last_frame": 8559, "first_seen_epoch": "1647901712.77803", "last_seen_epoch": "1647901713.298328", "packets": 22, "bytes": 6761, "initiator_bytes": 2223, "responder_bytes": 4538 }, { "flow_id": "flow-33f6c183accf51e2da21f09c", "transport": "udp", "stream": 114, "initiator_ip": "10.0.19.14", "initiator_port": 50368, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8569, "last_frame": 8570, "first_seen_epoch": "1647901731.556468", "last_seen_epoch": "1647901731.556759", "packets": 2, "bytes": 245, "initiator_bytes": 90, "responder_bytes": 155 }, { "flow_id": "flow-1c2aa24a3a1ece91a69f601f", "transport": "tcp", "stream": 138, "initiator_ip": "10.0.19.14", "initiator_port": 62318, "responder_ip": "52.109.8.20", "responder_port": 443, "first_frame": 8571, "last_frame": 8673, "first_seen_epoch": "1647901731.557791", "last_seen_epoch": "1647901853.903099", "packets": 23, "bytes": 8457, "initiator_bytes": 1563, "responder_bytes": 6894 }, { "flow_id": "flow-c3e282e07e99f469495ecadd", "transport": "udp", "stream": 115, "initiator_ip": "10.0.19.14", "initiator_port": 52897, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8593, "last_frame": 10159, "first_seen_epoch": "1647901739.547395", "last_seen_epoch": "1647905991.989608", "packets": 4, "bytes": 350, "initiator_bytes": 167, "responder_bytes": 183 }, { "flow_id": "flow-80169a9b3a5ad1369f62efe9", "transport": "tcp", "stream": 139, "initiator_ip": "10.0.19.14", "initiator_port": 62319, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 8595, "last_frame": 8618, "first_seen_epoch": "1647901739.550554", "last_seen_epoch": "1647901750.339267", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-50647820c5f27777c6e60d08", "transport": "udp", "stream": 116, "initiator_ip": "10.0.19.14", "initiator_port": 59151, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8621, "last_frame": 8622, "first_seen_epoch": "1647901774.196387", "last_seen_epoch": "1647901774.201605", "packets": 2, "bytes": 258, "initiator_bytes": 83, "responder_bytes": 175 }, { "flow_id": "flow-07f54ceda2c25e7442ee22e2", "transport": "tcp", "stream": 140, "initiator_ip": "10.0.19.14", "initiator_port": 62320, "responder_ip": "209.197.3.8", "responder_port": 80, "first_frame": 8623, "last_frame": 8663, "first_seen_epoch": "1647901774.208156", "last_seen_epoch": "1647901835.447552", "packets": 13, "bytes": 1259, "initiator_bytes": 768, "responder_bytes": 491 }, { "flow_id": "flow-7e8f2fde99caab9dcbde7c3e", "transport": "udp", "stream": 117, "initiator_ip": "10.0.19.14", "initiator_port": 59640, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8631, "last_frame": 8632, "first_seen_epoch": "1647901781.894821", "last_seen_epoch": "1647901781.967039", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-25d06a430a3191cb3e9180d1", "transport": "tcp", "stream": 141, "initiator_ip": "10.0.19.14", "initiator_port": 62321, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8633, "last_frame": 8668, "first_seen_epoch": "1647901781.967933", "last_seen_epoch": "1647901843.387792", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-0cd5de0bb5ca1230ae635ad4", "transport": "udp", "stream": 118, "initiator_ip": "10.0.19.14", "initiator_port": 61076, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8653, "last_frame": 8654, "first_seen_epoch": "1647901792.204896", "last_seen_epoch": "1647901792.205809", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-78c05589ed136d93e0a24286", "transport": "udp", "stream": 119, "initiator_ip": "10.0.19.14", "initiator_port": 54045, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8690, "last_frame": 8691, "first_seen_epoch": "1647901985.572592", "last_seen_epoch": "1647901985.638021", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-16bc038560039416468be861", "transport": "tcp", "stream": 142, "initiator_ip": "10.0.19.14", "initiator_port": 62322, "responder_ip": "13.89.179.10", "responder_port": 443, "first_frame": 8692, "last_frame": 8710, "first_seen_epoch": "1647901985.639193", "last_seen_epoch": "1647901986.206635", "packets": 19, "bytes": 8216, "initiator_bytes": 2844, "responder_bytes": 5372 }, { "flow_id": "flow-708d4434b238f5779816986f", "transport": "udp", "stream": 120, "initiator_ip": "10.0.19.14", "initiator_port": 60172, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8725, "last_frame": 8726, "first_seen_epoch": "1647902083.229061", "last_seen_epoch": "1647902083.298925", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-524db7f0e0d832ed193bbf1e", "transport": "tcp", "stream": 143, "initiator_ip": "10.0.19.14", "initiator_port": 62323, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8727, "last_frame": 8747, "first_seen_epoch": "1647902083.299838", "last_seen_epoch": "1647902144.66552", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-1967458eb4a33482e48b1cd3", "transport": "udp", "stream": 121, "initiator_ip": "10.0.19.14", "initiator_port": 52339, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8797, "last_frame": 8798, "first_seen_epoch": "1647902384.525848", "last_seen_epoch": "1647902384.595952", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-30e1adb7a02f5efa25a169ae", "transport": "tcp", "stream": 144, "initiator_ip": "10.0.19.14", "initiator_port": 62324, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8799, "last_frame": 8829, "first_seen_epoch": "1647902384.59686", "last_seen_epoch": "1647902446.05425", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-fdc3d9e235ac771f181f024f", "transport": "udp", "stream": 122, "initiator_ip": "10.0.19.14", "initiator_port": 55476, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8817, "last_frame": 8818, "first_seen_epoch": "1647902392.176478", "last_seen_epoch": "1647902392.17683", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-247f8af7b6ae6c85cb090836", "transport": "udp", "stream": 123, "initiator_ip": "10.0.19.14", "initiator_port": 53475, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8819, "last_frame": 8820, "first_seen_epoch": "1647902392.177525", "last_seen_epoch": "1647902392.17878", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-b2c9743f45d287a87f92b548", "transport": "udp", "stream": 124, "initiator_ip": "10.0.19.14", "initiator_port": 61010, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8845, "last_frame": 8846, "first_seen_epoch": "1647902554.350747", "last_seen_epoch": "1647902554.431788", "packets": 2, "bytes": 260, "initiator_bytes": 88, "responder_bytes": 172 }, { "flow_id": "flow-ed96087eeeac2d13817dd2c0", "transport": "tcp", "stream": 145, "initiator_ip": "10.0.19.14", "initiator_port": 62325, "responder_ip": "40.124.168.44", "responder_port": 443, "first_frame": 8847, "last_frame": 8916, "first_seen_epoch": "1647902554.445978", "last_seen_epoch": "1647902556.058194", "packets": 36, "bytes": 10915, "initiator_bytes": 3852, "responder_bytes": 7063 }, { "flow_id": "flow-ba2329a499a10b34f34ef4a6", "transport": "udp", "stream": 125, "initiator_ip": "10.0.19.14", "initiator_port": 62652, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8880, "last_frame": 8881, "first_seen_epoch": "1647902555.456382", "last_seen_epoch": "1647902555.517525", "packets": 2, "bytes": 322, "initiator_bytes": 81, "responder_bytes": 241 }, { "flow_id": "flow-87f6705ed9df1f16a7e4ea0a", "transport": "tcp", "stream": 146, "initiator_ip": "10.0.19.14", "initiator_port": 62326, "responder_ip": "13.107.42.16", "responder_port": 443, "first_frame": 8882, "last_frame": 8914, "first_seen_epoch": "1647902555.521824", "last_seen_epoch": "1647902556.01824", "packets": 32, "bytes": 9940, "initiator_bytes": 2382, "responder_bytes": 7558 }, { "flow_id": "flow-34c6cc5cdb9f05c2316c84cb", "transport": "tcp", "stream": 147, "initiator_ip": "10.0.19.14", "initiator_port": 62327, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 8929, "last_frame": 8952, "first_seen_epoch": "1647902639.511964", "last_seen_epoch": "1647902650.220486", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-181cd8e242cdc395f4061902", "transport": "udp", "stream": 126, "initiator_ip": "10.0.19.14", "initiator_port": 56906, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 8955, "last_frame": 8956, "first_seen_epoch": "1647902685.92214", "last_seen_epoch": "1647902685.997939", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-1a8bcc2df2ccfc31fa874ca0", "transport": "tcp", "stream": 148, "initiator_ip": "10.0.19.14", "initiator_port": 62328, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 8957, "last_frame": 8978, "first_seen_epoch": "1647902685.998816", "last_seen_epoch": "1647902747.38326", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-7c10e44fd677b8da106ef922", "transport": "udp", "stream": 127, "initiator_ip": "10.0.19.14", "initiator_port": 51473, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9020, "last_frame": 9021, "first_seen_epoch": "1647902987.23683", "last_seen_epoch": "1647902987.313412", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-e2e1741a917cce60c9793ef4", "transport": "tcp", "stream": 149, "initiator_ip": "10.0.19.14", "initiator_port": 62329, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9022, "last_frame": 9052, "first_seen_epoch": "1647902987.314307", "last_seen_epoch": "1647903048.714609", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-861e6f9d207a0477171f49bf", "transport": "udp", "stream": 128, "initiator_ip": "10.0.19.14", "initiator_port": 60234, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9040, "last_frame": 9041, "first_seen_epoch": "1647902992.140009", "last_seen_epoch": "1647902992.140343", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-2ba486fd1b6ce275e7995542", "transport": "udp", "stream": 129, "initiator_ip": "10.0.19.14", "initiator_port": 65383, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9042, "last_frame": 9043, "first_seen_epoch": "1647902992.14104", "last_seen_epoch": "1647902992.142589", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-b523d5af748751b16de2099a", "transport": "udp", "stream": 130, "initiator_ip": "10.0.19.14", "initiator_port": 57633, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9088, "last_frame": 9089, "first_seen_epoch": "1647903288.562711", "last_seen_epoch": "1647903288.631759", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-dd68a06e07f8785b41587d09", "transport": "tcp", "stream": 150, "initiator_ip": "10.0.19.14", "initiator_port": 62330, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9090, "last_frame": 9114, "first_seen_epoch": "1647903288.632712", "last_seen_epoch": "1647903350.016539", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-cc05c46b885c450720aab9eb", "transport": "tcp", "stream": 151, "initiator_ip": "10.0.19.14", "initiator_port": 62331, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 9152, "last_frame": 9175, "first_seen_epoch": "1647903539.47731", "last_seen_epoch": "1647903550.204303", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-8707409dfd8cf4078a8e2688", "transport": "udp", "stream": 131, "initiator_ip": "10.0.19.14", "initiator_port": 54790, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9178, "last_frame": 9179, "first_seen_epoch": "1647903589.879369", "last_seen_epoch": "1647903589.952458", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-a0519602c42280914c68ff19", "transport": "tcp", "stream": 152, "initiator_ip": "10.0.19.14", "initiator_port": 62332, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9180, "last_frame": 9208, "first_seen_epoch": "1647903589.953369", "last_seen_epoch": "1647903651.39447", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-f7bb1b8d19a583e3ede625e2", "transport": "udp", "stream": 132, "initiator_ip": "10.0.19.14", "initiator_port": 59416, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9196, "last_frame": 9197, "first_seen_epoch": "1647903592.104979", "last_seen_epoch": "1647903592.105367", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-08fbaab7c72a2ab249c30d2e", "transport": "udp", "stream": 133, "initiator_ip": "10.0.19.14", "initiator_port": 59921, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9198, "last_frame": 9199, "first_seen_epoch": "1647903592.106", "last_seen_epoch": "1647903592.110381", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-23f42b9e5d2ebd239b541790", "transport": "udp", "stream": 134, "initiator_ip": "10.0.19.14", "initiator_port": 52242, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9232, "last_frame": 9233, "first_seen_epoch": "1647903785.463465", "last_seen_epoch": "1647903785.528028", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-ed135b18c99c2dd3f3499a85", "transport": "tcp", "stream": 153, "initiator_ip": "10.0.19.14", "initiator_port": 62333, "responder_ip": "20.44.10.123", "responder_port": 443, "first_frame": 9234, "last_frame": 9252, "first_seen_epoch": "1647903785.529205", "last_seen_epoch": "1647903786.097667", "packets": 19, "bytes": 8211, "initiator_bytes": 2839, "responder_bytes": 5372 }, { "flow_id": "flow-d1de6746f4f9285e46149e1c", "transport": "udp", "stream": 135, "initiator_ip": "10.0.19.14", "initiator_port": 65201, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9263, "last_frame": 9264, "first_seen_epoch": "1647903845.891286", "last_seen_epoch": "1647903845.962934", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-d5cb27a778ca47fa4f9fa35f", "transport": "tcp", "stream": 154, "initiator_ip": "10.0.19.14", "initiator_port": 62334, "responder_ip": "104.80.96.219", "responder_port": 80, "first_frame": 9265, "last_frame": 9317, "first_seen_epoch": "1647903845.969023", "last_seen_epoch": "1647903906.593088", "packets": 12, "bytes": 1222, "initiator_bytes": 653, "responder_bytes": 569 }, { "flow_id": "flow-5d9dd3b566bfd7feda7854b7", "transport": "udp", "stream": 136, "initiator_ip": "10.0.19.14", "initiator_port": 61154, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9273, "last_frame": 9275, "first_seen_epoch": "1647903846.159132", "last_seen_epoch": "1647903846.224583", "packets": 2, "bytes": 279, "initiator_bytes": 83, "responder_bytes": 196 }, { "flow_id": "flow-98f4941f441080a823597126", "transport": "tcp", "stream": 155, "initiator_ip": "10.0.19.14", "initiator_port": 62335, "responder_ip": "69.28.162.128", "responder_port": 80, "first_frame": 9276, "last_frame": 9318, "first_seen_epoch": "1647903846.225642", "last_seen_epoch": "1647903906.629425", "packets": 11, "bytes": 1195, "initiator_bytes": 642, "responder_bytes": 553 }, { "flow_id": "flow-a791f18d9cfd7c55013abefe", "transport": "udp", "stream": 137, "initiator_ip": "10.0.19.14", "initiator_port": 53727, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9290, "last_frame": 9291, "first_seen_epoch": "1647903891.254544", "last_seen_epoch": "1647903891.324821", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-2455f89a7f5894fe0bb62264", "transport": "tcp", "stream": 156, "initiator_ip": "10.0.19.14", "initiator_port": 62336, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9292, "last_frame": 9324, "first_seen_epoch": "1647903891.325789", "last_seen_epoch": "1647903952.642053", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-c8a7a8e77d0b416471b6d3d6", "transport": "udp", "stream": 138, "initiator_ip": "10.0.19.14", "initiator_port": 59797, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9367, "last_frame": 9368, "first_seen_epoch": "1647904192.084672", "last_seen_epoch": "1647904192.085004", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-56bb7749add8d4a9d1489e54", "transport": "udp", "stream": 139, "initiator_ip": "10.0.19.14", "initiator_port": 60764, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9369, "last_frame": 9370, "first_seen_epoch": "1647904192.08569", "last_seen_epoch": "1647904192.087383", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-0995257931112f88bd6f45ed", "transport": "udp", "stream": 140, "initiator_ip": "10.0.19.14", "initiator_port": 53316, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9371, "last_frame": 9372, "first_seen_epoch": "1647904192.502601", "last_seen_epoch": "1647904192.591784", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-446040898e84ce878ae61c2c", "transport": "tcp", "stream": 157, "initiator_ip": "10.0.19.14", "initiator_port": 62337, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9373, "last_frame": 9398, "first_seen_epoch": "1647904192.592661", "last_seen_epoch": "1647904254.017356", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-30c087b076941caf0275353a", "transport": "udp", "stream": 141, "initiator_ip": "10.0.19.14", "initiator_port": 53864, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9418, "last_frame": 9419, "first_seen_epoch": "1647904329.9324", "last_seen_epoch": "1647904329.932844", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-f734c3ecf78291f45bcd1a19", "transport": "udp", "stream": 142, "initiator_ip": "10.0.19.14", "initiator_port": 53865, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9420, "last_frame": 9421, "first_seen_epoch": "1647904329.933423", "last_seen_epoch": "1647904329.93394", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-d349175d8fcc55a680df9fb3", "transport": "tcp", "stream": 158, "initiator_ip": "10.0.19.14", "initiator_port": 62338, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 9422, "last_frame": 9493, "first_seen_epoch": "1647904330.052452", "last_seen_epoch": "1647904330.192265", "packets": 12, "bytes": 1816, "initiator_bytes": 910, "responder_bytes": 906 }, { "flow_id": "flow-8d3d6bcdd9cb839f7217f648", "transport": "tcp", "stream": 159, "initiator_ip": "10.0.19.14", "initiator_port": 62339, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 9429, "last_frame": 9494, "first_seen_epoch": "1647904330.054666", "last_seen_epoch": "1647904330.192319", "packets": 24, "bytes": 7093, "initiator_bytes": 4472, "responder_bytes": 2621 }, { "flow_id": "flow-df455427197925a008a27200", "transport": "udp", "stream": 143, "initiator_ip": "10.0.19.14", "initiator_port": 53867, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9452, "last_frame": 9453, "first_seen_epoch": "1647904330.06368", "last_seen_epoch": "1647904330.06407", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-34d81edfd32c3901639b50a2", "transport": "tcp", "stream": 160, "initiator_ip": "10.0.19.14", "initiator_port": 62340, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9458, "last_frame": 9492, "first_seen_epoch": "1647904330.169477", "last_seen_epoch": "1647904330.187646", "packets": 19, "bytes": 7512, "initiator_bytes": 3493, "responder_bytes": 4019 }, { "flow_id": "flow-b411de35865bbebf9c161f2b", "transport": "tcp", "stream": 161, "initiator_ip": "10.0.19.14", "initiator_port": 62341, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9475, "last_frame": 9490, "first_seen_epoch": "1647904330.181147", "last_seen_epoch": "1647904330.187285", "packets": 16, "bytes": 6926, "initiator_bytes": 2893, "responder_bytes": 4033 }, { "flow_id": "flow-925a7da9b275cf16196308bf", "transport": "tcp", "stream": 162, "initiator_ip": "10.0.19.14", "initiator_port": 62342, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 9507, "last_frame": 9532, "first_seen_epoch": "1647904439.446431", "last_seen_epoch": "1647904450.195044", "packets": 24, "bytes": 7565, "initiator_bytes": 5463, "responder_bytes": 2102 }, { "flow_id": "flow-3f69e5de7c90288ccf5d2b8e", "transport": "udp", "stream": 144, "initiator_ip": "10.0.19.14", "initiator_port": 60361, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9535, "last_frame": 9536, "first_seen_epoch": "1647904493.970621", "last_seen_epoch": "1647904493.981823", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-0dbc9f7cb90907aedb3d3842", "transport": "tcp", "stream": 163, "initiator_ip": "10.0.19.14", "initiator_port": 62343, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9537, "last_frame": 9561, "first_seen_epoch": "1647904493.982759", "last_seen_epoch": "1647904555.394473", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-196e8a07b319b221bde3948e", "transport": "udp", "stream": 145, "initiator_ip": "10.0.19.14", "initiator_port": 60362, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9572, "last_frame": 9576, "first_seen_epoch": "1647904588.482076", "last_seen_epoch": "1647904588.482555", "packets": 2, "bytes": 556, "initiator_bytes": 312, "responder_bytes": 244 }, { "flow_id": "flow-ca878028dd4f9a5717d163a6", "transport": "tcp", "stream": 164, "initiator_ip": "10.0.19.14", "initiator_port": 62344, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 9573, "last_frame": 9659, "first_seen_epoch": "1647904588.482076", "last_seen_epoch": "1647904603.419125", "packets": 17, "bytes": 2480, "initiator_bytes": 1036, "responder_bytes": 1444 }, { "flow_id": "flow-b989b85a4cd63e1a5c9c4a04", "transport": "tcp", "stream": 165, "initiator_ip": "10.0.19.14", "initiator_port": 62345, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 9581, "last_frame": 9671, "first_seen_epoch": "1647904588.483887", "last_seen_epoch": "1647904623.424368", "packets": 21, "bytes": 5615, "initiator_bytes": 3792, "responder_bytes": 1823 }, { "flow_id": "flow-30fea6022cf1491fe797c44e", "transport": "tcp", "stream": 166, "initiator_ip": "10.0.19.14", "initiator_port": 62346, "responder_ip": "10.0.19.9", "responder_port": 49676, "first_frame": 9602, "last_frame": 9660, "first_seen_epoch": "1647904588.594599", "last_seen_epoch": "1647904603.419152", "packets": 13, "bytes": 4232, "initiator_bytes": 1692, "responder_bytes": 2540 }, { "flow_id": "flow-318c2e230f48d7eb89b5fa4f", "transport": "udp", "stream": 146, "initiator_ip": "10.0.19.14", "initiator_port": 65146, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9609, "last_frame": 9610, "first_seen_epoch": "1647904588.611287", "last_seen_epoch": "1647904588.61157", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-7fec92d5b9e0041d92b6e880", "transport": "tcp", "stream": 167, "initiator_ip": "10.0.19.14", "initiator_port": 62347, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9615, "last_frame": 9652, "first_seen_epoch": "1647904588.927351", "last_seen_epoch": "1647904589.25789", "packets": 21, "bytes": 8038, "initiator_bytes": 3849, "responder_bytes": 4189 }, { "flow_id": "flow-3ec89251ac6d166c60f680d4", "transport": "tcp", "stream": 168, "initiator_ip": "10.0.19.14", "initiator_port": 62348, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 9628, "last_frame": 9648, "first_seen_epoch": "1647904588.937078", "last_seen_epoch": "1647904589.255515", "packets": 17, "bytes": 4188, "initiator_bytes": 3054, "responder_bytes": 1134 }, { "flow_id": "flow-a7b9704e79181b18642d1c82", "transport": "udp", "stream": 147, "initiator_ip": "10.0.19.14", "initiator_port": 61704, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9698, "last_frame": 9699, "first_seen_epoch": "1647904792.054425", "last_seen_epoch": "1647904792.054737", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-22fd7e7412f29eda33e1eedf", "transport": "udp", "stream": 148, "initiator_ip": "10.0.19.14", "initiator_port": 57624, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9700, "last_frame": 9701, "first_seen_epoch": "1647904792.055489", "last_seen_epoch": "1647904792.056888", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-a4f390487dbed9bbd743c126", "transport": "udp", "stream": 149, "initiator_ip": "10.0.19.14", "initiator_port": 58822, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9702, "last_frame": 9703, "first_seen_epoch": "1647904795.243636", "last_seen_epoch": "1647904795.312746", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-a614369125ad5bae8161c3d1", "transport": "tcp", "stream": 169, "initiator_ip": "10.0.19.14", "initiator_port": 62349, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9704, "last_frame": 9761, "first_seen_epoch": "1647904795.313632", "last_seen_epoch": "1647904856.663972", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-af470d0aa5bebda9d071fff5", "transport": "udp", "stream": 150, "initiator_ip": "10.0.19.14", "initiator_port": 62515, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9726, "last_frame": 9727, "first_seen_epoch": "1647904855.490035", "last_seen_epoch": "1647904855.570192", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-1fe8f2213db21ba7a0bebfec", "transport": "tcp", "stream": 170, "initiator_ip": "10.0.19.14", "initiator_port": 62350, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 9728, "last_frame": 9749, "first_seen_epoch": "1647904855.576413", "last_seen_epoch": "1647904856.097328", "packets": 22, "bytes": 6220, "initiator_bytes": 1673, "responder_bytes": 4547 }, { "flow_id": "flow-7c65ab72792e618d7a8dac41", "transport": "tcp", "stream": 171, "initiator_ip": "10.0.19.14", "initiator_port": 62351, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 9750, "last_frame": 9775, "first_seen_epoch": "1647904856.407143", "last_seen_epoch": "1647904856.959772", "packets": 23, "bytes": 6849, "initiator_bytes": 2082, "responder_bytes": 4767 }, { "flow_id": "flow-09fd5a588b34719552a81660", "transport": "udp", "stream": 151, "initiator_ip": "10.0.19.14", "initiator_port": 56983, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9784, "last_frame": 9785, "first_seen_epoch": "1647904915.972082", "last_seen_epoch": "1647904915.97254", "packets": 2, "bytes": 375, "initiator_bytes": 83, "responder_bytes": 292 }, { "flow_id": "flow-fad4303ed49303fbf8e0be25", "transport": "tcp", "stream": 172, "initiator_ip": "10.0.19.14", "initiator_port": 62352, "responder_ip": "72.21.81.240", "responder_port": 80, "first_frame": 9786, "last_frame": 9805, "first_seen_epoch": "1647904915.978802", "last_seen_epoch": "1647904976.210479", "packets": 10, "bytes": 1177, "initiator_bytes": 647, "responder_bytes": 530 }, { "flow_id": "flow-ff0428183c5207c9da368755", "transport": "udp", "stream": 152, "initiator_ip": "10.0.19.14", "initiator_port": 51378, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9822, "last_frame": 9823, "first_seen_epoch": "1647905096.536819", "last_seen_epoch": "1647905096.604985", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-c479eeca81f6c6c96636c802", "transport": "tcp", "stream": 173, "initiator_ip": "10.0.19.14", "initiator_port": 62353, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9824, "last_frame": 9844, "first_seen_epoch": "1647905096.605956", "last_seen_epoch": "1647905158.035534", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-34ceafec966b013a13d0731d", "transport": "udp", "stream": 153, "initiator_ip": "10.0.19.14", "initiator_port": 54607, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9879, "last_frame": 9880, "first_seen_epoch": "1647905313.116471", "last_seen_epoch": "1647905313.19758", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-5f522ad4fb7a7428f46ed7ca", "transport": "tcp", "stream": 174, "initiator_ip": "10.0.19.14", "initiator_port": 62354, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 9881, "last_frame": 9908, "first_seen_epoch": "1647905313.198872", "last_seen_epoch": "1647905313.94338", "packets": 28, "bytes": 9329, "initiator_bytes": 4169, "responder_bytes": 5160 }, { "flow_id": "flow-dbdc03b72cabdf0114ff77db", "transport": "udp", "stream": 154, "initiator_ip": "10.0.19.14", "initiator_port": 64451, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9914, "last_frame": 9915, "first_seen_epoch": "1647905339.407608", "last_seen_epoch": "1647905339.407918", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-07b4345deec8318aaa9605b9", "transport": "tcp", "stream": 175, "initiator_ip": "10.0.19.14", "initiator_port": 62355, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 9916, "last_frame": 9943, "first_seen_epoch": "1647905339.410625", "last_seen_epoch": "1647905350.151327", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-765b8727543bec65820daf25", "transport": "udp", "stream": 155, "initiator_ip": "10.0.19.14", "initiator_port": 50792, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9946, "last_frame": 9947, "first_seen_epoch": "1647905392.017202", "last_seen_epoch": "1647905392.017569", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-1164316f4207bdb828acc8a9", "transport": "udp", "stream": 156, "initiator_ip": "10.0.19.14", "initiator_port": 59885, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9948, "last_frame": 9949, "first_seen_epoch": "1647905392.018223", "last_seen_epoch": "1647905392.019817", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-5997df183e13373cbd0aff12", "transport": "udp", "stream": 157, "initiator_ip": "10.0.19.14", "initiator_port": 49155, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 9952, "last_frame": 9953, "first_seen_epoch": "1647905397.909846", "last_seen_epoch": "1647905397.981337", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-8a30f5dc05f1ee26ad39a0f4", "transport": "tcp", "stream": 176, "initiator_ip": "10.0.19.14", "initiator_port": 62356, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 9954, "last_frame": 9976, "first_seen_epoch": "1647905397.982239", "last_seen_epoch": "1647905459.362916", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-7def349ab8799bf6345a49d2", "transport": "tcp", "stream": 177, "initiator_ip": "10.0.19.14", "initiator_port": 62357, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 10002, "last_frame": 10110, "first_seen_epoch": "1647905583.692997", "last_seen_epoch": "1647905710.353139", "packets": 35, "bytes": 11078, "initiator_bytes": 4076, "responder_bytes": 7002 }, { "flow_id": "flow-6fbb7bb550893cfb2c14680c", "transport": "udp", "stream": 158, "initiator_ip": "10.0.19.14", "initiator_port": 54856, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10043, "last_frame": 11977, "first_seen_epoch": "1647905585.390605", "last_seen_epoch": "1647909533.036511", "packets": 4, "bytes": 474, "initiator_bytes": 163, "responder_bytes": 311 }, { "flow_id": "flow-7c8a7940920c317fd7d4bb2e", "transport": "tcp", "stream": 178, "initiator_ip": "10.0.19.14", "initiator_port": 62358, "responder_ip": "13.69.239.74", "responder_port": 443, "first_frame": 10045, "last_frame": 10066, "first_seen_epoch": "1647905585.461493", "last_seen_epoch": "1647905586.505806", "packets": 19, "bytes": 8215, "initiator_bytes": 2843, "responder_bytes": 5372 }, { "flow_id": "flow-a8f346e51be98127c96051b5", "transport": "udp", "stream": 159, "initiator_ip": "10.0.19.14", "initiator_port": 62998, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10090, "last_frame": 10091, "first_seen_epoch": "1647905699.207184", "last_seen_epoch": "1647905699.280835", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-2d104257c7fd983ff37f4122", "transport": "tcp", "stream": 179, "initiator_ip": "10.0.19.14", "initiator_port": 62359, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10092, "last_frame": 10113, "first_seen_epoch": "1647905699.281744", "last_seen_epoch": "1647905760.682247", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-cbaa72cc78fef469899f28b6", "transport": "udp", "stream": 160, "initiator_ip": "10.0.19.14", "initiator_port": 56190, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10156, "last_frame": 10157, "first_seen_epoch": "1647905991.986886", "last_seen_epoch": "1647905991.987275", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-dc0fdf657dd83db5282d22e5", "transport": "udp", "stream": 161, "initiator_ip": "10.0.19.14", "initiator_port": 52013, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10162, "last_frame": 10163, "first_seen_epoch": "1647906000.530706", "last_seen_epoch": "1647906000.595824", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-0f06d441eea04bd7e0205335", "transport": "tcp", "stream": 180, "initiator_ip": "10.0.19.14", "initiator_port": 62360, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10164, "last_frame": 10187, "first_seen_epoch": "1647906000.596715", "last_seen_epoch": "1647906061.97543", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-777f319e5164062104d10c9a", "transport": "udp", "stream": 162, "initiator_ip": "10.0.19.14", "initiator_port": 58858, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10210, "last_frame": 10211, "first_seen_epoch": "1647906213.831441", "last_seen_epoch": "1647906213.909932", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-0526c57f435f312ca919aad0", "transport": "tcp", "stream": 181, "initiator_ip": "10.0.19.14", "initiator_port": 62361, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 10212, "last_frame": 10235, "first_seen_epoch": "1647906213.911151", "last_seen_epoch": "1647906214.409737", "packets": 24, "bytes": 7044, "initiator_bytes": 2346, "responder_bytes": 4698 }, { "flow_id": "flow-26879762994513373cb4fe88", "transport": "tcp", "stream": 182, "initiator_ip": "10.0.19.14", "initiator_port": 62362, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 10240, "last_frame": 10267, "first_seen_epoch": "1647906239.372994", "last_seen_epoch": "1647906250.09925", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-705ee640981c86346459f973", "transport": "udp", "stream": 163, "initiator_ip": "10.0.19.14", "initiator_port": 63235, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10270, "last_frame": 10271, "first_seen_epoch": "1647906274.228386", "last_seen_epoch": "1647906274.295724", "packets": 2, "bytes": 375, "initiator_bytes": 83, "responder_bytes": 292 }, { "flow_id": "flow-4ba25645d3666c1b95dbba00", "transport": "tcp", "stream": 183, "initiator_ip": "10.0.19.14", "initiator_port": 62363, "responder_ip": "72.21.81.240", "responder_port": 80, "first_frame": 10272, "last_frame": 10308, "first_seen_epoch": "1647906274.302633", "last_seen_epoch": "1647906334.828724", "packets": 13, "bytes": 1353, "initiator_bytes": 762, "responder_bytes": 591 }, { "flow_id": "flow-b122b006bae83093ca1136ab", "transport": "udp", "stream": 164, "initiator_ip": "10.0.19.14", "initiator_port": 49300, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10279, "last_frame": 10280, "first_seen_epoch": "1647906301.840534", "last_seen_epoch": "1647906301.907024", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-7121750dcbf16bcc0e4d5e93", "transport": "tcp", "stream": 184, "initiator_ip": "10.0.19.14", "initiator_port": 62364, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10281, "last_frame": 10313, "first_seen_epoch": "1647906301.907939", "last_seen_epoch": "1647906363.304822", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-cae4ac4962927cf2e47d1e94", "transport": "udp", "stream": 165, "initiator_ip": "10.0.19.14", "initiator_port": 59128, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10354, "last_frame": 10355, "first_seen_epoch": "1647906591.949889", "last_seen_epoch": "1647906591.950253", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-cfbb54bb75b53d0bc5591742", "transport": "udp", "stream": 166, "initiator_ip": "10.0.19.14", "initiator_port": 63278, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10356, "last_frame": 10357, "first_seen_epoch": "1647906591.950939", "last_seen_epoch": "1647906591.952736", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-2d11a2637bb0b2ed0c467aa2", "transport": "udp", "stream": 167, "initiator_ip": "10.0.19.14", "initiator_port": 53282, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10360, "last_frame": 10361, "first_seen_epoch": "1647906603.155864", "last_seen_epoch": "1647906603.224852", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-983137b3bfaa462759af5558", "transport": "tcp", "stream": 185, "initiator_ip": "10.0.19.14", "initiator_port": 62365, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10362, "last_frame": 10384, "first_seen_epoch": "1647906603.225753", "last_seen_epoch": "1647906664.772081", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-377098d9f73476ea666595e9", "transport": "udp", "stream": 168, "initiator_ip": "10.0.19.14", "initiator_port": 50954, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10418, "last_frame": 10419, "first_seen_epoch": "1647906904.639324", "last_seen_epoch": "1647906904.713136", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-388595f9360835587d0e9f68", "transport": "tcp", "stream": 186, "initiator_ip": "10.0.19.14", "initiator_port": 62366, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10420, "last_frame": 10649, "first_seen_epoch": "1647906904.71405", "last_seen_epoch": "1647906966.132177", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-f3cf8247d38d8daa45b05bac", "transport": "udp", "stream": 169, "initiator_ip": "10.0.19.14", "initiator_port": 50955, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10442, "last_frame": 10443, "first_seen_epoch": "1647906954.739614", "last_seen_epoch": "1647906954.740081", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-479c1741846fb72f74de81da", "transport": "tcp", "stream": 187, "initiator_ip": "10.0.19.14", "initiator_port": 62367, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 10444, "last_frame": 10657, "first_seen_epoch": "1647906954.84992", "last_seen_epoch": "1647906969.685938", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-7d6cc262ce68f777b5b604c7", "transport": "tcp", "stream": 188, "initiator_ip": "10.0.19.14", "initiator_port": 62368, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 10451, "last_frame": 10667, "first_seen_epoch": "1647906954.85259", "last_seen_epoch": "1647906989.68678", "packets": 21, "bytes": 5583, "initiator_bytes": 3743, "responder_bytes": 1840 }, { "flow_id": "flow-5c9c51b383802e2dca922bf5", "transport": "tcp", "stream": 189, "initiator_ip": "10.0.19.14", "initiator_port": 62369, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10470, "last_frame": 10644, "first_seen_epoch": "1647906955.059743", "last_seen_epoch": "1647906955.557086", "packets": 23, "bytes": 11033, "initiator_bytes": 3919, "responder_bytes": 7114 }, { "flow_id": "flow-07e978553a3e33a83d7c7830", "transport": "udp", "stream": 170, "initiator_ip": "10.0.19.14", "initiator_port": 50957, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10483, "last_frame": 10484, "first_seen_epoch": "1647906955.070651", "last_seen_epoch": "1647906955.070993", "packets": 2, "bytes": 512, "initiator_bytes": 268, "responder_bytes": 244 }, { "flow_id": "flow-17fef55da8d1a7b5f65521a5", "transport": "tcp", "stream": 190, "initiator_ip": "10.0.19.14", "initiator_port": 62370, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10487, "last_frame": 10640, "first_seen_epoch": "1647906955.177236", "last_seen_epoch": "1647906955.553508", "packets": 17, "bytes": 4116, "initiator_bytes": 2981, "responder_bytes": 1135 }, { "flow_id": "flow-1b05911e2ca863ea535ccc19", "transport": "tcp", "stream": 191, "initiator_ip": "10.0.19.14", "initiator_port": 62371, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 10504, "last_frame": 10720, "first_seen_epoch": "1647906955.499867", "last_seen_epoch": "1647907138.071178", "packets": 166, "bytes": 41563, "initiator_bytes": 19796, "responder_bytes": 21767 }, { "flow_id": "flow-1c41545f9ee67c9002918e45", "transport": "tcp", "stream": 192, "initiator_ip": "10.0.19.14", "initiator_port": 62372, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 10721, "last_frame": 10748, "first_seen_epoch": "1647907139.343082", "last_seen_epoch": "1647907150.050028", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-39119ba86a976a8e5d58b360", "transport": "udp", "stream": 171, "initiator_ip": "10.0.19.14", "initiator_port": 49589, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10753, "last_frame": 10754, "first_seen_epoch": "1647907191.917456", "last_seen_epoch": "1647907191.917931", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-94a632850b25cff255f755c9", "transport": "udp", "stream": 172, "initiator_ip": "10.0.19.14", "initiator_port": 50906, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10755, "last_frame": 10756, "first_seen_epoch": "1647907191.918645", "last_seen_epoch": "1647907191.920306", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-e3463c82ab6f31a645d949c5", "transport": "udp", "stream": 173, "initiator_ip": "10.0.19.14", "initiator_port": 52322, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10759, "last_frame": 10760, "first_seen_epoch": "1647907205.982858", "last_seen_epoch": "1647907206.056611", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-2e0c32f2e47837d1832c5604", "transport": "tcp", "stream": 193, "initiator_ip": "10.0.19.14", "initiator_port": 62373, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10761, "last_frame": 10786, "first_seen_epoch": "1647907206.0575", "last_seen_epoch": "1647907267.436652", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-4b252cb6a49582798a99f6c9", "transport": "udp", "stream": 174, "initiator_ip": "10.0.19.14", "initiator_port": 58343, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10807, "last_frame": 10808, "first_seen_epoch": "1647907385.286879", "last_seen_epoch": "1647907385.351605", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-400dc8766c4bd9e4eb95de70", "transport": "tcp", "stream": 194, "initiator_ip": "10.0.19.14", "initiator_port": 62374, "responder_ip": "20.189.173.2", "responder_port": 443, "first_frame": 10809, "last_frame": 10827, "first_seen_epoch": "1647907385.352782", "last_seen_epoch": "1647907385.761153", "packets": 19, "bytes": 8213, "initiator_bytes": 2841, "responder_bytes": 5372 }, { "flow_id": "flow-d7ac44dfd68f14568519d3cd", "transport": "udp", "stream": 175, "initiator_ip": "10.0.19.14", "initiator_port": 51312, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10847, "last_frame": 10848, "first_seen_epoch": "1647907507.290689", "last_seen_epoch": "1647907507.363585", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-e7be0a437f51a6a56f78eeb3", "transport": "tcp", "stream": 195, "initiator_ip": "10.0.19.14", "initiator_port": 62375, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10849, "last_frame": 10871, "first_seen_epoch": "1647907507.364487", "last_seen_epoch": "1647907568.764546", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-1f264df4be0fbd8b77a2ea30", "transport": "udp", "stream": 176, "initiator_ip": "10.0.19.14", "initiator_port": 55346, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10912, "last_frame": 10913, "first_seen_epoch": "1647907791.889072", "last_seen_epoch": "1647907791.889455", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-d719acda9be222de0e0a31d3", "transport": "udp", "stream": 177, "initiator_ip": "10.0.19.14", "initiator_port": 51103, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10914, "last_frame": 10915, "first_seen_epoch": "1647907791.890064", "last_seen_epoch": "1647907791.891321", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-9b7ee0f8966d8307c11c0b9e", "transport": "udp", "stream": 178, "initiator_ip": "10.0.19.14", "initiator_port": 49790, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10916, "last_frame": 10917, "first_seen_epoch": "1647907808.608248", "last_seen_epoch": "1647907808.676124", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-72b3d2466ff791b32d5e105e", "transport": "tcp", "stream": 196, "initiator_ip": "10.0.19.14", "initiator_port": 62376, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 10918, "last_frame": 10942, "first_seen_epoch": "1647907808.677023", "last_seen_epoch": "1647907870.051023", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-8137a9556a54cdcc881d3ca8", "transport": "udp", "stream": 179, "initiator_ip": "10.0.19.14", "initiator_port": 62166, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 10949, "last_frame": 10950, "first_seen_epoch": "1647907929.982029", "last_seen_epoch": "1647907929.982475", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-04dfb761ce0bb55de5858639", "transport": "udp", "stream": 180, "initiator_ip": "10.0.19.14", "initiator_port": 62167, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10951, "last_frame": 10952, "first_seen_epoch": "1647907929.982943", "last_seen_epoch": "1647907929.983453", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-a3f8d7e7cb3ecc7b576cf649", "transport": "tcp", "stream": 197, "initiator_ip": "10.0.19.14", "initiator_port": 62377, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 10953, "last_frame": 11022, "first_seen_epoch": "1647907930.104197", "last_seen_epoch": "1647907930.124281", "packets": 10, "bytes": 1524, "initiator_bytes": 844, "responder_bytes": 680 }, { "flow_id": "flow-9ef48da9b78989136cf5ebd7", "transport": "tcp", "stream": 198, "initiator_ip": "10.0.19.14", "initiator_port": 62378, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 10960, "last_frame": 11023, "first_seen_epoch": "1647907930.106531", "last_seen_epoch": "1647907930.124326", "packets": 22, "bytes": 6834, "initiator_bytes": 4406, "responder_bytes": 2428 }, { "flow_id": "flow-b80d36c6a16cb653ed29c91f", "transport": "tcp", "stream": 199, "initiator_ip": "10.0.19.14", "initiator_port": 62379, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 10983, "last_frame": 11021, "first_seen_epoch": "1647907930.114866", "last_seen_epoch": "1647907930.12305", "packets": 21, "bytes": 7634, "initiator_bytes": 3554, "responder_bytes": 4080 }, { "flow_id": "flow-541c4d83617e82b5a6b57ebf", "transport": "tcp", "stream": 200, "initiator_ip": "10.0.19.14", "initiator_port": 62380, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 11000, "last_frame": 11018, "first_seen_epoch": "1647907930.11966", "last_seen_epoch": "1647907930.122986", "packets": 18, "bytes": 7048, "initiator_bytes": 2954, "responder_bytes": 4094 }, { "flow_id": "flow-23a9bd413592d61c8d4bb03f", "transport": "tcp", "stream": 201, "initiator_ip": "10.0.19.14", "initiator_port": 62381, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 11038, "last_frame": 11061, "first_seen_epoch": "1647908039.311221", "last_seen_epoch": "1647908050.013707", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-88ba9298defeb5db51fe0a7b", "transport": "udp", "stream": 181, "initiator_ip": "10.0.19.14", "initiator_port": 57346, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11070, "last_frame": 11071, "first_seen_epoch": "1647908109.912806", "last_seen_epoch": "1647908109.988365", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-785a18f35dc2f31b92f6095b", "transport": "tcp", "stream": 202, "initiator_ip": "10.0.19.14", "initiator_port": 62382, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11072, "last_frame": 11094, "first_seen_epoch": "1647908109.988758", "last_seen_epoch": "1647908171.421547", "packets": 15, "bytes": 3089, "initiator_bytes": 966, "responder_bytes": 2123 }, { "flow_id": "flow-21c7aa63d248e591c5a54c8b", "transport": "udp", "stream": 182, "initiator_ip": "10.0.19.14", "initiator_port": 63371, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11127, "last_frame": 11128, "first_seen_epoch": "1647908352.791444", "last_seen_epoch": "1647908352.791792", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-5a24d3d6476a5d3b2ad84ea7", "transport": "tcp", "stream": 203, "initiator_ip": "10.0.19.14", "initiator_port": 62383, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11129, "last_frame": 11146, "first_seen_epoch": "1647908352.792739", "last_seen_epoch": "1647908384.859608", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-5712623b4d84d1ee353070c1", "transport": "tcp", "stream": 204, "initiator_ip": "10.0.19.14", "initiator_port": 62384, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11147, "last_frame": 11180, "first_seen_epoch": "1647908390.165834", "last_seen_epoch": "1647908422.236526", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-cc8ac2a08610f79de33f94cd", "transport": "udp", "stream": 183, "initiator_ip": "10.0.19.14", "initiator_port": 53863, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11157, "last_frame": 11158, "first_seen_epoch": "1647908391.85704", "last_seen_epoch": "1647908391.857378", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-72b1b02dde4cd2dee2460b52", "transport": "udp", "stream": 184, "initiator_ip": "10.0.19.14", "initiator_port": 52683, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11159, "last_frame": 11160, "first_seen_epoch": "1647908391.858032", "last_seen_epoch": "1647908391.859182", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-ad39890b6f345f3a361074de", "transport": "udp", "stream": 185, "initiator_ip": "10.0.19.14", "initiator_port": 49798, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11161, "last_frame": 11162, "first_seen_epoch": "1647908411.282666", "last_seen_epoch": "1647908411.362112", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-84a8f6ec035a2d360a21808a", "transport": "tcp", "stream": 205, "initiator_ip": "10.0.19.14", "initiator_port": 62385, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11163, "last_frame": 11195, "first_seen_epoch": "1647908411.363031", "last_seen_epoch": "1647908443.344129", "packets": 13, "bytes": 3143, "initiator_bytes": 906, "responder_bytes": 2237 }, { "flow_id": "flow-a7f86988d503a7218c7bcffb", "transport": "udp", "stream": 186, "initiator_ip": "10.0.19.14", "initiator_port": 63240, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11181, "last_frame": 11182, "first_seen_epoch": "1647908427.524835", "last_seen_epoch": "1647908427.525115", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-9d47941269a739b765f9d1de", "transport": "tcp", "stream": 206, "initiator_ip": "10.0.19.14", "initiator_port": 62386, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11183, "last_frame": 11211, "first_seen_epoch": "1647908427.525839", "last_seen_epoch": "1647908459.603799", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-91c30df24840916c869386d3", "transport": "udp", "stream": 187, "initiator_ip": "10.0.19.14", "initiator_port": 58414, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11196, "last_frame": 11197, "first_seen_epoch": "1647908448.299104", "last_seen_epoch": "1647908448.369261", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-47bf969512db4d58f2a8847c", "transport": "tcp", "stream": 207, "initiator_ip": "10.0.19.14", "initiator_port": 62387, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11198, "last_frame": 11230, "first_seen_epoch": "1647908448.370194", "last_seen_epoch": "1647908480.71546", "packets": 13, "bytes": 3141, "initiator_bytes": 904, "responder_bytes": 2237 }, { "flow_id": "flow-79eafe61f8b7c556541223c1", "transport": "udp", "stream": 188, "initiator_ip": "10.0.19.14", "initiator_port": 64099, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11212, "last_frame": 11213, "first_seen_epoch": "1647908464.863822", "last_seen_epoch": "1647908464.864132", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-b3892de97de5707bef072d7b", "transport": "tcp", "stream": 208, "initiator_ip": "10.0.19.14", "initiator_port": 62388, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11214, "last_frame": 11246, "first_seen_epoch": "1647908464.864849", "last_seen_epoch": "1647908497.765696", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-998093c428686a5be6f24e98", "transport": "udp", "stream": 189, "initiator_ip": "10.0.19.14", "initiator_port": 49594, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11231, "last_frame": 11232, "first_seen_epoch": "1647908484.39465", "last_seen_epoch": "1647908484.447812", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-1d2391350488d47379efb950", "transport": "tcp", "stream": 209, "initiator_ip": "10.0.19.14", "initiator_port": 62389, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11233, "last_frame": 11423, "first_seen_epoch": "1647908484.44874", "last_seen_epoch": "1647908589.707547", "packets": 23, "bytes": 4442, "initiator_bytes": 1385, "responder_bytes": 3057 }, { "flow_id": "flow-2c6468fdc3e2309b840385ff", "transport": "udp", "stream": 190, "initiator_ip": "10.0.19.14", "initiator_port": 56153, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11249, "last_frame": 11250, "first_seen_epoch": "1647908503.229161", "last_seen_epoch": "1647908503.229541", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-de37f561c58a5c770372069c", "transport": "tcp", "stream": 210, "initiator_ip": "10.0.19.14", "initiator_port": 62390, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11251, "last_frame": 11264, "first_seen_epoch": "1647908503.230248", "last_seen_epoch": "1647908504.281986", "packets": 14, "bytes": 3246, "initiator_bytes": 886, "responder_bytes": 2360 }, { "flow_id": "flow-7f7e62b8331e93cbcae738dc", "transport": "udp", "stream": 191, "initiator_ip": "10.0.19.14", "initiator_port": 59779, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11265, "last_frame": 11266, "first_seen_epoch": "1647908506.018605", "last_seen_epoch": "1647908506.092539", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-2dbfb5d85ce73943f1ffb290", "transport": "tcp", "stream": 211, "initiator_ip": "10.0.19.14", "initiator_port": 62391, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11267, "last_frame": 11426, "first_seen_epoch": "1647908506.093486", "last_seen_epoch": "1647908590.137286", "packets": 19, "bytes": 4162, "initiator_bytes": 1306, "responder_bytes": 2856 }, { "flow_id": "flow-58cb72a8bd6df8b1dbdd52b8", "transport": "udp", "stream": 192, "initiator_ip": "10.0.19.14", "initiator_port": 55741, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11279, "last_frame": 11280, "first_seen_epoch": "1647908509.232882", "last_seen_epoch": "1647908509.233184", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-f377a2623e25fdf3aa905814", "transport": "tcp", "stream": 212, "initiator_ip": "10.0.19.14", "initiator_port": 62392, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11281, "last_frame": 11294, "first_seen_epoch": "1647908509.233899", "last_seen_epoch": "1647908510.441126", "packets": 14, "bytes": 3252, "initiator_bytes": 890, "responder_bytes": 2362 }, { "flow_id": "flow-edba59057f1227c8877f4065", "transport": "tcp", "stream": 213, "initiator_ip": "10.0.19.14", "initiator_port": 62393, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11297, "last_frame": 11409, "first_seen_epoch": "1647908512.095193", "last_seen_epoch": "1647908578.222702", "packets": 19, "bytes": 3602, "initiator_bytes": 1051, "responder_bytes": 2551 }, { "flow_id": "flow-68b6ff4b209832dcab7a508d", "transport": "tcp", "stream": 214, "initiator_ip": "10.0.19.14", "initiator_port": 62394, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11309, "last_frame": 11322, "first_seen_epoch": "1647908515.263055", "last_seen_epoch": "1647908516.34508", "packets": 14, "bytes": 3249, "initiator_bytes": 888, "responder_bytes": 2361 }, { "flow_id": "flow-200783c5f70af47e5cce21a1", "transport": "tcp", "stream": 215, "initiator_ip": "10.0.19.14", "initiator_port": 62395, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11323, "last_frame": 11416, "first_seen_epoch": "1647908518.078694", "last_seen_epoch": "1647908584.262247", "packets": 19, "bytes": 3599, "initiator_bytes": 1049, "responder_bytes": 2550 }, { "flow_id": "flow-a7a80b9ee978dd07f8756f21", "transport": "tcp", "stream": 216, "initiator_ip": "10.0.19.14", "initiator_port": 62396, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11335, "last_frame": 11348, "first_seen_epoch": "1647908521.293305", "last_seen_epoch": "1647908522.518473", "packets": 14, "bytes": 3246, "initiator_bytes": 886, "responder_bytes": 2360 }, { "flow_id": "flow-973df5a3cd426d2c5dd411d2", "transport": "tcp", "stream": 217, "initiator_ip": "10.0.19.14", "initiator_port": 62397, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11353, "last_frame": 11366, "first_seen_epoch": "1647908527.310524", "last_seen_epoch": "1647908528.377528", "packets": 14, "bytes": 3246, "initiator_bytes": 886, "responder_bytes": 2360 }, { "flow_id": "flow-e18cae5700ea1a190537a3e4", "transport": "tcp", "stream": 218, "initiator_ip": "10.0.19.14", "initiator_port": 62398, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11371, "last_frame": 11386, "first_seen_epoch": "1647908533.341043", "last_seen_epoch": "1647908534.522758", "packets": 14, "bytes": 3252, "initiator_bytes": 890, "responder_bytes": 2362 }, { "flow_id": "flow-e6c50e9a46368e97ddb31ba2", "transport": "tcp", "stream": 219, "initiator_ip": "10.0.19.14", "initiator_port": 62399, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11389, "last_frame": 11402, "first_seen_epoch": "1647908539.365441", "last_seen_epoch": "1647908540.566934", "packets": 14, "bytes": 3252, "initiator_bytes": 890, "responder_bytes": 2362 }, { "flow_id": "flow-d1d2c47081afdc7e04b925ce", "transport": "udp", "stream": 193, "initiator_ip": "10.0.19.14", "initiator_port": 50225, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11437, "last_frame": 11438, "first_seen_epoch": "1647908834.950001", "last_seen_epoch": "1647908835.020571", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-1ab685e06d83a1952e1ea94e", "transport": "tcp", "stream": 220, "initiator_ip": "10.0.19.14", "initiator_port": 62400, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11439, "last_frame": 11644, "first_seen_epoch": "1647908835.021542", "last_seen_epoch": "1647908866.939992", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-c871b5a3c8d6def6e40e810e", "transport": "udp", "stream": 194, "initiator_ip": "10.0.19.14", "initiator_port": 50472, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11453, "last_frame": 11454, "first_seen_epoch": "1647908840.549542", "last_seen_epoch": "1647908840.62", "packets": 2, "bytes": 292, "initiator_bytes": 72, "responder_bytes": 220 }, { "flow_id": "flow-535a9cef943ed97481523b1f", "transport": "tcp", "stream": 221, "initiator_ip": "10.0.19.14", "initiator_port": 62401, "responder_ip": "204.79.197.200", "responder_port": 443, "first_frame": 11455, "last_frame": 11667, "first_seen_epoch": "1647908840.620738", "last_seen_epoch": "1647908900.927898", "packets": 32, "bytes": 11523, "initiator_bytes": 3442, "responder_bytes": 8081 }, { "flow_id": "flow-cc44dc1fef121869f48a672c", "transport": "tcp", "stream": 222, "initiator_ip": "10.0.19.14", "initiator_port": 62402, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 11456, "last_frame": 11643, "first_seen_epoch": "1647908840.692067", "last_seen_epoch": "1647908855.47328", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-bfab130673058ba305bdc6bb", "transport": "tcp", "stream": 223, "initiator_ip": "10.0.19.14", "initiator_port": 62403, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 11463, "last_frame": 11660, "first_seen_epoch": "1647908840.693573", "last_seen_epoch": "1647908875.465733", "packets": 21, "bytes": 5585, "initiator_bytes": 3793, "responder_bytes": 1792 }, { "flow_id": "flow-ea74c7259c5fcf0c632b5631", "transport": "tcp", "stream": 224, "initiator_ip": "10.0.19.14", "initiator_port": 62404, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 11471, "last_frame": 11608, "first_seen_epoch": "1647908840.695707", "last_seen_epoch": "1647908841.796751", "packets": 12, "bytes": 1816, "initiator_bytes": 910, "responder_bytes": 906 }, { "flow_id": "flow-2cec77155a909fc0b75be1c7", "transport": "tcp", "stream": 225, "initiator_ip": "10.0.19.14", "initiator_port": 62405, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 11484, "last_frame": 11607, "first_seen_epoch": "1647908840.697862", "last_seen_epoch": "1647908841.796707", "packets": 24, "bytes": 7145, "initiator_bytes": 4523, "responder_bytes": 2622 }, { "flow_id": "flow-63bebd9361a67619c6b89c2d", "transport": "udp", "stream": 195, "initiator_ip": "10.0.19.14", "initiator_port": 50474, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 11511, "last_frame": 11512, "first_seen_epoch": "1647908840.706471", "last_seen_epoch": "1647908840.706792", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-7ff5b2ea9248fa18eea8f167", "transport": "tcp", "stream": 226, "initiator_ip": "10.0.19.14", "initiator_port": 62406, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 11534, "last_frame": 11572, "first_seen_epoch": "1647908840.81055", "last_seen_epoch": "1647908840.820157", "packets": 21, "bytes": 7684, "initiator_bytes": 3604, "responder_bytes": 4080 }, { "flow_id": "flow-2b4b3de34800754901033682", "transport": "tcp", "stream": 227, "initiator_ip": "10.0.19.14", "initiator_port": 62407, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 11551, "last_frame": 11569, "first_seen_epoch": "1647908840.816618", "last_seen_epoch": "1647908840.820007", "packets": 18, "bytes": 7098, "initiator_bytes": 3004, "responder_bytes": 4094 }, { "flow_id": "flow-dc79a7661180ae30f5bc07f6", "transport": "udp", "stream": 196, "initiator_ip": "10.0.19.14", "initiator_port": 56753, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11573, "last_frame": 11583, "first_seen_epoch": "1647908840.836334", "last_seen_epoch": "1647908840.907101", "packets": 2, "bytes": 381, "initiator_bytes": 85, "responder_bytes": 296 }, { "flow_id": "flow-9b1e179adf704fd8de1da17d", "transport": "tcp", "stream": 228, "initiator_ip": "10.0.19.14", "initiator_port": 62408, "responder_ip": "40.126.26.134", "responder_port": 443, "first_frame": 11584, "last_frame": 11609, "first_seen_epoch": "1647908840.908296", "last_seen_epoch": "1647908841.797057", "packets": 19, "bytes": 7040, "initiator_bytes": 1865, "responder_bytes": 5175 }, { "flow_id": "flow-e2ef60699ff74f79a348167b", "transport": "udp", "stream": 197, "initiator_ip": "10.0.19.14", "initiator_port": 49627, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11610, "last_frame": 11611, "first_seen_epoch": "1647908842.090282", "last_seen_epoch": "1647908842.157512", "packets": 2, "bytes": 256, "initiator_bytes": 71, "responder_bytes": 185 }, { "flow_id": "flow-f6a5f5e83233aab77e7651ca", "transport": "tcp", "stream": 229, "initiator_ip": "10.0.19.14", "initiator_port": 62409, "responder_ip": "20.69.130.185", "responder_port": 443, "first_frame": 11612, "last_frame": 11639, "first_seen_epoch": "1647908842.158646", "last_seen_epoch": "1647908842.657325", "packets": 28, "bytes": 9407, "initiator_bytes": 3358, "responder_bytes": 6049 }, { "flow_id": "flow-381b7a331d2a7dcdab4b7139", "transport": "udp", "stream": 198, "initiator_ip": "10.0.19.14", "initiator_port": 50354, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11645, "last_frame": 11646, "first_seen_epoch": "1647908871.947232", "last_seen_epoch": "1647908872.02319", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-512d95c33c8d1c8949b15d11", "transport": "tcp", "stream": 230, "initiator_ip": "10.0.19.14", "initiator_port": 62410, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11647, "last_frame": 11668, "first_seen_epoch": "1647908872.024177", "last_seen_epoch": "1647908902.952416", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-de671cd5ff8d0f27817c08b1", "transport": "udp", "stream": 199, "initiator_ip": "10.0.19.14", "initiator_port": 61449, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11669, "last_frame": 11670, "first_seen_epoch": "1647908907.97117", "last_seen_epoch": "1647908908.046392", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-6e0133c98f4c4598cc7c324d", "transport": "tcp", "stream": 231, "initiator_ip": "10.0.19.14", "initiator_port": 62411, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11671, "last_frame": 11708, "first_seen_epoch": "1647908908.047403", "last_seen_epoch": "1647908938.937553", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-50591957c2db755c447b90ed", "transport": "udp", "stream": 200, "initiator_ip": "10.0.19.14", "initiator_port": 55002, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11681, "last_frame": 11682, "first_seen_epoch": "1647908914.36605", "last_seen_epoch": "1647908914.373928", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-49d75f8cc7d530251ec05640", "transport": "tcp", "stream": 232, "initiator_ip": "10.0.19.14", "initiator_port": 62412, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 11683, "last_frame": 11704, "first_seen_epoch": "1647908914.37511", "last_seen_epoch": "1647908914.892812", "packets": 22, "bytes": 6761, "initiator_bytes": 2223, "responder_bytes": 4538 }, { "flow_id": "flow-2e8ee72947adc64ba37070ef", "transport": "udp", "stream": 201, "initiator_ip": "10.0.19.14", "initiator_port": 59239, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11709, "last_frame": 11710, "first_seen_epoch": "1647908939.270586", "last_seen_epoch": "1647908939.27096", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-7b91adc2040216ea227ea4a9", "transport": "tcp", "stream": 233, "initiator_ip": "10.0.19.14", "initiator_port": 62413, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 11711, "last_frame": 11749, "first_seen_epoch": "1647908939.273773", "last_seen_epoch": "1647908949.984164", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-6a73dba15bfedf717cc13562", "transport": "udp", "stream": 202, "initiator_ip": "10.0.19.14", "initiator_port": 55485, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11733, "last_frame": 11734, "first_seen_epoch": "1647908943.956509", "last_seen_epoch": "1647908944.028205", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-ec599198d2fd309fd088038c", "transport": "tcp", "stream": 234, "initiator_ip": "10.0.19.14", "initiator_port": 62414, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11735, "last_frame": 11758, "first_seen_epoch": "1647908944.029158", "last_seen_epoch": "1647908974.939036", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-3e12a0f90758d8e84e2a177c", "transport": "udp", "stream": 203, "initiator_ip": "10.0.19.14", "initiator_port": 62994, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11752, "last_frame": 11753, "first_seen_epoch": "1647908974.712537", "last_seen_epoch": "1647908974.793242", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-758f59d8b89f2bbdf2a38a7a", "transport": "tcp", "stream": 235, "initiator_ip": "10.0.19.14", "initiator_port": 62415, "responder_ip": "104.80.96.219", "responder_port": 80, "first_frame": 11754, "last_frame": 11831, "first_seen_epoch": "1647908974.799487", "last_seen_epoch": "1647909035.371964", "packets": 10, "bytes": 1090, "initiator_bytes": 587, "responder_bytes": 503 }, { "flow_id": "flow-190fe94e669cd811db8bf633", "transport": "udp", "stream": 204, "initiator_ip": "10.0.19.14", "initiator_port": 56152, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11762, "last_frame": 11763, "first_seen_epoch": "1647908975.095262", "last_seen_epoch": "1647908975.099405", "packets": 2, "bytes": 258, "initiator_bytes": 83, "responder_bytes": 175 }, { "flow_id": "flow-d9a971eb4c9e83dadd2b5913", "transport": "tcp", "stream": 236, "initiator_ip": "10.0.19.14", "initiator_port": 62416, "responder_ip": "209.197.3.8", "responder_port": 80, "first_frame": 11764, "last_frame": 11833, "first_seen_epoch": "1647908975.100439", "last_seen_epoch": "1647909035.372847", "packets": 12, "bytes": 1193, "initiator_bytes": 702, "responder_bytes": 491 }, { "flow_id": "flow-44f8f6b43c0367a3e55ccc25", "transport": "tcp", "stream": 237, "initiator_ip": "10.0.19.14", "initiator_port": 62417, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11771, "last_frame": 11787, "first_seen_epoch": "1647908979.948078", "last_seen_epoch": "1647909010.930689", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-85f25427b898ff9210e16683", "transport": "udp", "stream": 205, "initiator_ip": "10.0.19.14", "initiator_port": 61421, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11781, "last_frame": 11782, "first_seen_epoch": "1647908991.826814", "last_seen_epoch": "1647908991.827209", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-a269ec059743710c1a6275ca", "transport": "udp", "stream": 206, "initiator_ip": "10.0.19.14", "initiator_port": 51225, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11783, "last_frame": 11784, "first_seen_epoch": "1647908991.827494", "last_seen_epoch": "1647908991.828577", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-6680ff5537564def1ab767ee", "transport": "tcp", "stream": 238, "initiator_ip": "10.0.19.14", "initiator_port": 62418, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11790, "last_frame": 11836, "first_seen_epoch": "1647909015.943827", "last_seen_epoch": "1647909047.990466", "packets": 13, "bytes": 3143, "initiator_bytes": 906, "responder_bytes": 2237 }, { "flow_id": "flow-f70770eb9619ef6cf95b015f", "transport": "udp", "stream": 207, "initiator_ip": "10.0.19.14", "initiator_port": 59638, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11802, "last_frame": 11803, "first_seen_epoch": "1647909021.912173", "last_seen_epoch": "1647909021.990143", "packets": 2, "bytes": 245, "initiator_bytes": 90, "responder_bytes": 155 }, { "flow_id": "flow-375e26aef61f156987f4013e", "transport": "tcp", "stream": 239, "initiator_ip": "10.0.19.14", "initiator_port": 62419, "responder_ip": "52.109.8.19", "responder_port": 443, "first_frame": 11804, "last_frame": 11875, "first_seen_epoch": "1647909021.9912", "last_seen_epoch": "1647909144.433464", "packets": 23, "bytes": 8457, "initiator_bytes": 1563, "responder_bytes": 6894 }, { "flow_id": "flow-20e6bc54dad73e8b45406cc2", "transport": "tcp", "stream": 240, "initiator_ip": "10.0.19.14", "initiator_port": 62420, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11837, "last_frame": 11847, "first_seen_epoch": "1647909051.947504", "last_seen_epoch": "1647909082.926908", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-9bc41dc2ac61a16b7202a18a", "transport": "tcp", "stream": 241, "initiator_ip": "10.0.19.14", "initiator_port": 62421, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11848, "last_frame": 11858, "first_seen_epoch": "1647909087.944812", "last_seen_epoch": "1647909118.929442", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-d92dad883c2e9175eb805e67", "transport": "udp", "stream": 208, "initiator_ip": "10.0.19.14", "initiator_port": 57690, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11863, "last_frame": 11864, "first_seen_epoch": "1647909140.335688", "last_seen_epoch": "1647909140.335995", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-780c9d4f96ffcf108f0eb0a0", "transport": "tcp", "stream": 242, "initiator_ip": "10.0.19.14", "initiator_port": 62422, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11865, "last_frame": 11879, "first_seen_epoch": "1647909140.336904", "last_seen_epoch": "1647909172.556939", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-25c8d2b7e916a939affa8672", "transport": "udp", "stream": 209, "initiator_ip": "10.0.19.14", "initiator_port": 62361, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11880, "last_frame": 11881, "first_seen_epoch": "1647909185.185821", "last_seen_epoch": "1647909185.251727", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-6cb8ab0ae10fc1a70de0579d", "transport": "tcp", "stream": 243, "initiator_ip": "10.0.19.14", "initiator_port": 62423, "responder_ip": "40.74.98.194", "responder_port": 443, "first_frame": 11882, "last_frame": 11910, "first_seen_epoch": "1647909185.252926", "last_seen_epoch": "1647909186.212051", "packets": 29, "bytes": 8650, "initiator_bytes": 2940, "responder_bytes": 5710 }, { "flow_id": "flow-55468bfdade10f402061fd94", "transport": "udp", "stream": 210, "initiator_ip": "10.0.19.14", "initiator_port": 63304, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11923, "last_frame": 11924, "first_seen_epoch": "1647909423.949276", "last_seen_epoch": "1647909424.02685", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-b591f365ffed873aa3bae456", "transport": "tcp", "stream": 244, "initiator_ip": "10.0.19.14", "initiator_port": 62424, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11925, "last_frame": 11941, "first_seen_epoch": "1647909424.027818", "last_seen_epoch": "1647909456.03601", "packets": 13, "bytes": 3141, "initiator_bytes": 904, "responder_bytes": 2237 }, { "flow_id": "flow-5c2f088bcb4ad8d22410f052", "transport": "udp", "stream": 211, "initiator_ip": "10.0.19.14", "initiator_port": 51715, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11942, "last_frame": 11943, "first_seen_epoch": "1647909460.971903", "last_seen_epoch": "1647909461.04636", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-2b3739b62910d0c9584ac5e5", "transport": "tcp", "stream": 245, "initiator_ip": "10.0.19.14", "initiator_port": 62425, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11944, "last_frame": 11954, "first_seen_epoch": "1647909461.047341", "last_seen_epoch": "1647909491.948843", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-9327a1ca2c3d8f8695066e03", "transport": "udp", "stream": 212, "initiator_ip": "10.0.19.14", "initiator_port": 58808, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 11961, "last_frame": 11962, "first_seen_epoch": "1647909496.965253", "last_seen_epoch": "1647909497.039908", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-ef9d94019e3cba755534cd4a", "transport": "tcp", "stream": 246, "initiator_ip": "10.0.19.14", "initiator_port": 62426, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11963, "last_frame": 11975, "first_seen_epoch": "1647909497.040872", "last_seen_epoch": "1647909527.934963", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-8d592ed350a8fc01d4948075", "transport": "tcp", "stream": 247, "initiator_ip": "10.0.19.14", "initiator_port": 62427, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 11978, "last_frame": 11992, "first_seen_epoch": "1647909533.037476", "last_seen_epoch": "1647909563.946464", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-91eba849b210f2ff3f6faacf", "transport": "tcp", "stream": 248, "initiator_ip": "10.0.19.14", "initiator_port": 62428, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 11993, "last_frame": 12009, "first_seen_epoch": "1647909568.965113", "last_seen_epoch": "1647909599.938233", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f0eb42dbde68ddac4e92a46d", "transport": "udp", "stream": 213, "initiator_ip": "10.0.19.14", "initiator_port": 60079, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12003, "last_frame": 12004, "first_seen_epoch": "1647909591.793934", "last_seen_epoch": "1647909591.794268", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-b9e2b359db091dcd0dca8ceb", "transport": "udp", "stream": 214, "initiator_ip": "10.0.19.14", "initiator_port": 55357, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12005, "last_frame": 12006, "first_seen_epoch": "1647909591.794974", "last_seen_epoch": "1647909591.796744", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-28a7af639bcfe362ce5c77ff", "transport": "tcp", "stream": 249, "initiator_ip": "10.0.19.14", "initiator_port": 62429, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12010, "last_frame": 12024, "first_seen_epoch": "1647909604.944666", "last_seen_epoch": "1647909635.929351", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-58d73c731043ccb74ff0f3c9", "transport": "tcp", "stream": 250, "initiator_ip": "10.0.19.14", "initiator_port": 62430, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12025, "last_frame": 12036, "first_seen_epoch": "1647909640.942096", "last_seen_epoch": "1647909671.927521", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-d5272ab2f00f24b3bae5bf65", "transport": "tcp", "stream": 251, "initiator_ip": "10.0.19.14", "initiator_port": 62431, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12037, "last_frame": 12047, "first_seen_epoch": "1647909676.938397", "last_seen_epoch": "1647909707.932394", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-b586fd382767b97ca9bf972e", "transport": "udp", "stream": 215, "initiator_ip": "10.0.19.14", "initiator_port": 50958, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12052, "last_frame": 12053, "first_seen_epoch": "1647909772.652427", "last_seen_epoch": "1647909772.652796", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-e0674c3996210f7057d187c6", "transport": "tcp", "stream": 252, "initiator_ip": "10.0.19.14", "initiator_port": 62432, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12054, "last_frame": 12069, "first_seen_epoch": "1647909772.653699", "last_seen_epoch": "1647909805.14061", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-ec8b488c7bf8e92a9dbe7fba", "transport": "tcp", "stream": 253, "initiator_ip": "10.0.19.14", "initiator_port": 62433, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 12070, "last_frame": 12093, "first_seen_epoch": "1647909839.242634", "last_seen_epoch": "1647909849.981778", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-6824fa24e7404407b51289e6", "transport": "udp", "stream": 216, "initiator_ip": "10.0.19.14", "initiator_port": 61061, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12100, "last_frame": 12101, "first_seen_epoch": "1647910012.936622", "last_seen_epoch": "1647910013.007175", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-e5b8558b95c643e1d923284f", "transport": "tcp", "stream": 254, "initiator_ip": "10.0.19.14", "initiator_port": 62434, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12102, "last_frame": 12114, "first_seen_epoch": "1647910013.008173", "last_seen_epoch": "1647910044.925631", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-8abaa6287b381b32c0f97cfe", "transport": "udp", "stream": 217, "initiator_ip": "10.0.19.14", "initiator_port": 62557, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12115, "last_frame": 12116, "first_seen_epoch": "1647910049.945298", "last_seen_epoch": "1647910050.021645", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-1c1eb3cdd0f3905965986841", "transport": "tcp", "stream": 255, "initiator_ip": "10.0.19.14", "initiator_port": 62435, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12117, "last_frame": 12129, "first_seen_epoch": "1647910050.022605", "last_seen_epoch": "1647910080.924282", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-fe6c410a25e5d8770f7c2cd1", "transport": "udp", "stream": 218, "initiator_ip": "10.0.19.14", "initiator_port": 51748, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12130, "last_frame": 12131, "first_seen_epoch": "1647910085.943073", "last_seen_epoch": "1647910086.023225", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-93ec55794ecaf20179eb1bba", "transport": "tcp", "stream": 256, "initiator_ip": "10.0.19.14", "initiator_port": 62436, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12132, "last_frame": 12274, "first_seen_epoch": "1647910086.024205", "last_seen_epoch": "1647910183.981516", "packets": 22, "bytes": 5124, "initiator_bytes": 1266, "responder_bytes": 3858 }, { "flow_id": "flow-3970bf6360ec9bf5482bcbe3", "transport": "udp", "stream": 219, "initiator_ip": "10.0.19.14", "initiator_port": 50113, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12155, "last_frame": 13898, "first_seen_epoch": "1647910123.800651", "last_seen_epoch": "1647913591.936378", "packets": 4, "bytes": 332, "initiator_bytes": 150, "responder_bytes": 182 }, { "flow_id": "flow-9899cd086226172b97bf9976", "transport": "tcp", "stream": 257, "initiator_ip": "10.0.19.14", "initiator_port": 62437, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12157, "last_frame": 12310, "first_seen_epoch": "1647910123.881473", "last_seen_epoch": "1647910221.038997", "packets": 19, "bytes": 3553, "initiator_bytes": 1051, "responder_bytes": 2502 }, { "flow_id": "flow-f78603441d6dc893b7e83e2a", "transport": "tcp", "stream": 258, "initiator_ip": "10.0.19.14", "initiator_port": 62438, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12175, "last_frame": 12287, "first_seen_epoch": "1647910160.937933", "last_seen_epoch": "1647910192.925339", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-17fb2e2488d3b6d5a5345bd5", "transport": "udp", "stream": 220, "initiator_ip": "10.0.19.14", "initiator_port": 50114, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12185, "last_frame": 12188, "first_seen_epoch": "1647910170.188263", "last_seen_epoch": "1647910170.188812", "packets": 4, "bytes": 1069, "initiator_bytes": 581, "responder_bytes": 488 }, { "flow_id": "flow-de6f248ed2b842999168cbda", "transport": "tcp", "stream": 259, "initiator_ip": "10.0.19.14", "initiator_port": 62439, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 12189, "last_frame": 12282, "first_seen_epoch": "1647910170.299355", "last_seen_epoch": "1647910185.130176", "packets": 17, "bytes": 2480, "initiator_bytes": 1036, "responder_bytes": 1444 }, { "flow_id": "flow-1e3e86e903b25ad5194af2f5", "transport": "tcp", "stream": 260, "initiator_ip": "10.0.19.14", "initiator_port": 62440, "responder_ip": "10.0.19.9", "responder_port": 49676, "first_frame": 12196, "last_frame": 12281, "first_seen_epoch": "1647910170.301893", "last_seen_epoch": "1647910185.130031", "packets": 13, "bytes": 4232, "initiator_bytes": 1692, "responder_bytes": 2540 }, { "flow_id": "flow-a2ec6eacc08dc08c4e4a6d87", "transport": "udp", "stream": 221, "initiator_ip": "10.0.19.14", "initiator_port": 57604, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12203, "last_frame": 12204, "first_seen_epoch": "1647910170.319167", "last_seen_epoch": "1647910170.319478", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-fd53622e942e9b9367b0bdb0", "transport": "tcp", "stream": 261, "initiator_ip": "10.0.19.14", "initiator_port": 62441, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 12211, "last_frame": 12301, "first_seen_epoch": "1647910170.408279", "last_seen_epoch": "1647910205.124436", "packets": 21, "bytes": 5617, "initiator_bytes": 3793, "responder_bytes": 1824 }, { "flow_id": "flow-bf953b0af6d7f395664a0a38", "transport": "tcp", "stream": 262, "initiator_ip": "10.0.19.14", "initiator_port": 62442, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12230, "last_frame": 12267, "first_seen_epoch": "1647910170.632796", "last_seen_epoch": "1647910170.978855", "packets": 21, "bytes": 8040, "initiator_bytes": 3850, "responder_bytes": 4190 }, { "flow_id": "flow-dcbdc46176775a3508dfa066", "transport": "tcp", "stream": 263, "initiator_ip": "10.0.19.14", "initiator_port": 62443, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12243, "last_frame": 12263, "first_seen_epoch": "1647910170.653926", "last_seen_epoch": "1647910170.97671", "packets": 17, "bytes": 4190, "initiator_bytes": 3055, "responder_bytes": 1135 }, { "flow_id": "flow-78f5ccae876947345e25f75e", "transport": "udp", "stream": 222, "initiator_ip": "10.0.19.14", "initiator_port": 51248, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12283, "last_frame": 12284, "first_seen_epoch": "1647910191.759236", "last_seen_epoch": "1647910191.759611", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-5669275a21e92d9a3ef311da", "transport": "udp", "stream": 223, "initiator_ip": "10.0.19.14", "initiator_port": 58508, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12285, "last_frame": 12286, "first_seen_epoch": "1647910191.76027", "last_seen_epoch": "1647910191.761968", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-42271f75e70d301e74707faa", "transport": "tcp", "stream": 264, "initiator_ip": "10.0.19.14", "initiator_port": 62444, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12288, "last_frame": 12311, "first_seen_epoch": "1647910197.941447", "last_seen_epoch": "1647910228.920707", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-6438b21bf5869da164ebf0c5", "transport": "tcp", "stream": 265, "initiator_ip": "10.0.19.14", "initiator_port": 62445, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12312, "last_frame": 12322, "first_seen_epoch": "1647910233.927179", "last_seen_epoch": "1647910264.915008", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-01c669b7ebc1d274a9fdb309", "transport": "tcp", "stream": 266, "initiator_ip": "10.0.19.14", "initiator_port": 62446, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12323, "last_frame": 12333, "first_seen_epoch": "1647910269.931804", "last_seen_epoch": "1647910300.920022", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-10516925a8b6c139a078b226", "transport": "udp", "stream": 224, "initiator_ip": "10.0.19.14", "initiator_port": 64870, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12341, "last_frame": 12342, "first_seen_epoch": "1647910404.964815", "last_seen_epoch": "1647910404.965177", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-f61dfbfea6c3a9ba055bc2b5", "transport": "tcp", "stream": 267, "initiator_ip": "10.0.19.14", "initiator_port": 62447, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12343, "last_frame": 12360, "first_seen_epoch": "1647910404.966078", "last_seen_epoch": "1647910437.126468", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-22031ea4c9eca233796cad8b", "transport": "udp", "stream": 225, "initiator_ip": "10.0.19.14", "initiator_port": 64560, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12369, "last_frame": 12370, "first_seen_epoch": "1647910605.918648", "last_seen_epoch": "1647910605.99385", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-c4a5ae9de73bc614e7e01e99", "transport": "tcp", "stream": 268, "initiator_ip": "10.0.19.14", "initiator_port": 62448, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12371, "last_frame": 12386, "first_seen_epoch": "1647910605.994776", "last_seen_epoch": "1647910637.936073", "packets": 13, "bytes": 3143, "initiator_bytes": 906, "responder_bytes": 2237 }, { "flow_id": "flow-75e91f2596e683a76aa97c0c", "transport": "udp", "stream": 226, "initiator_ip": "10.0.19.14", "initiator_port": 49168, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12387, "last_frame": 12388, "first_seen_epoch": "1647910642.928367", "last_seen_epoch": "1647910642.997866", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-eecab5637bd6fdb4cf2de21d", "transport": "tcp", "stream": 269, "initiator_ip": "10.0.19.14", "initiator_port": 62449, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12389, "last_frame": 12403, "first_seen_epoch": "1647910642.998824", "last_seen_epoch": "1647910673.919789", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-8cd75bbc930b5153144059e1", "transport": "udp", "stream": 227, "initiator_ip": "10.0.19.14", "initiator_port": 54672, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12404, "last_frame": 12405, "first_seen_epoch": "1647910679.014059", "last_seen_epoch": "1647910679.289365", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-e22fa46007646868f49e99ca", "transport": "tcp", "stream": 270, "initiator_ip": "10.0.19.14", "initiator_port": 62450, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12406, "last_frame": 12513, "first_seen_epoch": "1647910679.290327", "last_seen_epoch": "1647910777.821444", "packets": 18, "bytes": 3491, "initiator_bytes": 1049, "responder_bytes": 2442 }, { "flow_id": "flow-b73dbc189d7dcae865aa9ad5", "transport": "udp", "stream": 228, "initiator_ip": "10.0.19.14", "initiator_port": 59563, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12424, "last_frame": 12425, "first_seen_epoch": "1647910714.73862", "last_seen_epoch": "1647910714.821659", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-2f4d8ada6d7f166e193d0df7", "transport": "tcp", "stream": 271, "initiator_ip": "10.0.19.14", "initiator_port": 62451, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 12426, "last_frame": 12445, "first_seen_epoch": "1647910714.822852", "last_seen_epoch": "1647910715.912762", "packets": 20, "bytes": 6337, "initiator_bytes": 1859, "responder_bytes": 4478 }, { "flow_id": "flow-59ba2cd000d4682f323f5dcc", "transport": "udp", "stream": 229, "initiator_ip": "10.0.19.14", "initiator_port": 57352, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12446, "last_frame": 12447, "first_seen_epoch": "1647910717.948763", "last_seen_epoch": "1647910718.028919", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-76d039cb0625b4efe2c2fb12", "transport": "tcp", "stream": 272, "initiator_ip": "10.0.19.14", "initiator_port": 62452, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12448, "last_frame": 12479, "first_seen_epoch": "1647910718.029813", "last_seen_epoch": "1647910749.913659", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-90892c58c72dbdab286f87a0", "transport": "tcp", "stream": 273, "initiator_ip": "10.0.19.14", "initiator_port": 62453, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 12460, "last_frame": 12484, "first_seen_epoch": "1647910739.209267", "last_seen_epoch": "1647910749.930176", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-626234232baaa464c34f2b9a", "transport": "tcp", "stream": 274, "initiator_ip": "10.0.19.14", "initiator_port": 62454, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12485, "last_frame": 12514, "first_seen_epoch": "1647910754.93107", "last_seen_epoch": "1647910785.898899", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-f8409de1252bd2cb739c809a", "transport": "udp", "stream": 230, "initiator_ip": "10.0.19.14", "initiator_port": 51632, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12497, "last_frame": 12498, "first_seen_epoch": "1647910775.633696", "last_seen_epoch": "1647910775.634931", "packets": 2, "bytes": 258, "initiator_bytes": 83, "responder_bytes": 175 }, { "flow_id": "flow-2db5134589545c1fd4778533", "transport": "tcp", "stream": 275, "initiator_ip": "10.0.19.14", "initiator_port": 62455, "responder_ip": "209.197.3.8", "responder_port": 80, "first_frame": 12499, "last_frame": 12550, "first_seen_epoch": "1647910775.641286", "last_seen_epoch": "1647910835.874068", "packets": 14, "bytes": 1504, "initiator_bytes": 768, "responder_bytes": 736 }, { "flow_id": "flow-3a0605f88a128f609586d13e", "transport": "tcp", "stream": 276, "initiator_ip": "10.0.19.14", "initiator_port": 62456, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12515, "last_frame": 12535, "first_seen_epoch": "1647910790.913677", "last_seen_epoch": "1647910821.89744", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f841e03664fcf075c71e8ec0", "transport": "udp", "stream": 231, "initiator_ip": "10.0.19.14", "initiator_port": 49408, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12524, "last_frame": 12525, "first_seen_epoch": "1647910791.72137", "last_seen_epoch": "1647910791.721741", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-88876411884f51550dd5bd95", "transport": "udp", "stream": 232, "initiator_ip": "10.0.19.14", "initiator_port": 56113, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12526, "last_frame": 12527, "first_seen_epoch": "1647910791.722448", "last_seen_epoch": "1647910791.723893", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-3412eca982ea9d7c4a55c8bc", "transport": "tcp", "stream": 277, "initiator_ip": "10.0.19.14", "initiator_port": 62457, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12536, "last_frame": 12551, "first_seen_epoch": "1647910826.916547", "last_seen_epoch": "1647910857.894636", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-17487c3010745c0fa10a0536", "transport": "tcp", "stream": 278, "initiator_ip": "10.0.19.14", "initiator_port": 62458, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12552, "last_frame": 12562, "first_seen_epoch": "1647910862.905009", "last_seen_epoch": "1647910893.904523", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-b346b1d4f7b6d110229c00d4", "transport": "udp", "stream": 233, "initiator_ip": "10.0.19.14", "initiator_port": 55744, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12567, "last_frame": 12568, "first_seen_epoch": "1647910985.189193", "last_seen_epoch": "1647910985.19408", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-be25cfbeca17bc4f2c2ff715", "transport": "tcp", "stream": 279, "initiator_ip": "10.0.19.14", "initiator_port": 62459, "responder_ip": "52.182.143.210", "responder_port": 443, "first_frame": 12569, "last_frame": 12587, "first_seen_epoch": "1647910985.195333", "last_seen_epoch": "1647910985.762474", "packets": 19, "bytes": 8213, "initiator_bytes": 2841, "responder_bytes": 5372 }, { "flow_id": "flow-da2ca511c4eb884f8ec03068", "transport": "tcp", "stream": 280, "initiator_ip": "10.0.19.14", "initiator_port": 62460, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12592, "last_frame": 12669, "first_seen_epoch": "1647911020.563351", "last_seen_epoch": "1647911020.833804", "packets": 27, "bytes": 8643, "initiator_bytes": 4098, "responder_bytes": 4545 }, { "flow_id": "flow-866aa4729f6b6bd62ae2052a", "transport": "udp", "stream": 234, "initiator_ip": "10.0.19.14", "initiator_port": 55746, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12613, "last_frame": 12614, "first_seen_epoch": "1647911020.57426", "last_seen_epoch": "1647911020.574672", "packets": 2, "bytes": 512, "initiator_bytes": 268, "responder_bytes": 244 }, { "flow_id": "flow-3ba0e207c4cd37e30dcf4d03", "transport": "tcp", "stream": 281, "initiator_ip": "10.0.19.14", "initiator_port": 62461, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12617, "last_frame": 12666, "first_seen_epoch": "1647911020.684462", "last_seen_epoch": "1647911020.833554", "packets": 17, "bytes": 4965, "initiator_bytes": 3806, "responder_bytes": 1159 }, { "flow_id": "flow-b3b05a59f123313a11465f15", "transport": "udp", "stream": 235, "initiator_ip": "10.0.19.14", "initiator_port": 55747, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12626, "last_frame": 12627, "first_seen_epoch": "1647911020.70169", "last_seen_epoch": "1647911020.702062", "packets": 2, "bytes": 512, "initiator_bytes": 268, "responder_bytes": 244 }, { "flow_id": "flow-9ebf33cd5ad37867fcf8e105", "transport": "tcp", "stream": 282, "initiator_ip": "10.0.19.14", "initiator_port": 62462, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 12630, "last_frame": 12637, "first_seen_epoch": "1647911020.809315", "last_seen_epoch": "1647911020.810983", "packets": 8, "bytes": 960, "initiator_bytes": 488, "responder_bytes": 472 }, { "flow_id": "flow-bfa4be43b60b12497c7fb146", "transport": "tcp", "stream": 283, "initiator_ip": "10.0.19.14", "initiator_port": 62463, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 12638, "last_frame": 12647, "first_seen_epoch": "1647911020.824795", "last_seen_epoch": "1647911020.827176", "packets": 10, "bytes": 2733, "initiator_bytes": 628, "responder_bytes": 2105 }, { "flow_id": "flow-8e97ca8681be468b4d29b117", "transport": "tcp", "stream": 284, "initiator_ip": "10.0.19.14", "initiator_port": 62464, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 12648, "last_frame": 12659, "first_seen_epoch": "1647911020.827339", "last_seen_epoch": "1647911020.83039", "packets": 12, "bytes": 4226, "initiator_bytes": 2151, "responder_bytes": 2075 }, { "flow_id": "flow-0cd350fe7d9b82333892bf24", "transport": "udp", "stream": 236, "initiator_ip": "10.0.19.14", "initiator_port": 56307, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12670, "last_frame": 12671, "first_seen_epoch": "1647911021.994279", "last_seen_epoch": "1647911022.071953", "packets": 2, "bytes": 355, "initiator_bytes": 86, "responder_bytes": 269 }, { "flow_id": "flow-2ee17512a16dea5a4edad72d", "transport": "tcp", "stream": 285, "initiator_ip": "10.0.19.14", "initiator_port": 62465, "responder_ip": "52.137.108.250", "responder_port": 443, "first_frame": 12672, "last_frame": 12744, "first_seen_epoch": "1647911022.073573", "last_seen_epoch": "1647911022.723564", "packets": 50, "bytes": 22551, "initiator_bytes": 7532, "responder_bytes": 15019 }, { "flow_id": "flow-0c98fa1a4408c513f8c0315c", "transport": "udp", "stream": 237, "initiator_ip": "10.0.19.14", "initiator_port": 62810, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12673, "last_frame": 12674, "first_seen_epoch": "1647911022.097836", "last_seen_epoch": "1647911022.178753", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-ac3e85b2a56b7536b8ac68ec", "transport": "tcp", "stream": 286, "initiator_ip": "10.0.19.14", "initiator_port": 62466, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 12675, "last_frame": 12745, "first_seen_epoch": "1647911022.180293", "last_seen_epoch": "1647911022.723678", "packets": 22, "bytes": 6541, "initiator_bytes": 1994, "responder_bytes": 4547 }, { "flow_id": "flow-5c320d56418c8e7cce8bb717", "transport": "tcp", "stream": 287, "initiator_ip": "10.0.19.14", "initiator_port": 62467, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 12746, "last_frame": 12767, "first_seen_epoch": "1647911022.830357", "last_seen_epoch": "1647911023.330786", "packets": 22, "bytes": 6220, "initiator_bytes": 1673, "responder_bytes": 4547 }, { "flow_id": "flow-62d93bf0c8d5bf6febb2a904", "transport": "udp", "stream": 238, "initiator_ip": "10.0.19.14", "initiator_port": 54585, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12768, "last_frame": 12769, "first_seen_epoch": "1647911025.667607", "last_seen_epoch": "1647911025.745073", "packets": 2, "bytes": 343, "initiator_bytes": 109, "responder_bytes": 234 }, { "flow_id": "flow-d62272b7312161d544ef157c", "transport": "tcp", "stream": 288, "initiator_ip": "10.0.19.14", "initiator_port": 62468, "responder_ip": "184.85.64.91", "responder_port": 443, "first_frame": 12770, "last_frame": 12794, "first_seen_epoch": "1647911025.746285", "last_seen_epoch": "1647911026.176746", "packets": 25, "bytes": 8384, "initiator_bytes": 1228, "responder_bytes": 7156 }, { "flow_id": "flow-bc863b9c678630a5632a0815", "transport": "udp", "stream": 239, "initiator_ip": "10.0.19.14", "initiator_port": 51155, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12795, "last_frame": 12796, "first_seen_epoch": "1647911037.330182", "last_seen_epoch": "1647911037.410122", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-60cbb418d43b71db857348c7", "transport": "tcp", "stream": 289, "initiator_ip": "10.0.19.14", "initiator_port": 62469, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12797, "last_frame": 12812, "first_seen_epoch": "1647911037.410446", "last_seen_epoch": "1647911069.988223", "packets": 14, "bytes": 3187, "initiator_bytes": 890, "responder_bytes": 2297 }, { "flow_id": "flow-df02d7fd28e13103ec6d036f", "transport": "udp", "stream": 240, "initiator_ip": "10.0.19.14", "initiator_port": 61494, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12813, "last_frame": 12814, "first_seen_epoch": "1647911082.802391", "last_seen_epoch": "1647911082.885047", "packets": 2, "bytes": 375, "initiator_bytes": 83, "responder_bytes": 292 }, { "flow_id": "flow-27bebcb75af9ca14bc48b8c7", "transport": "tcp", "stream": 290, "initiator_ip": "10.0.19.14", "initiator_port": 62470, "responder_ip": "72.21.81.240", "responder_port": 80, "first_frame": 12815, "last_frame": 12827, "first_seen_epoch": "1647911082.891353", "last_seen_epoch": "1647911143.108974", "packets": 10, "bytes": 1177, "initiator_bytes": 647, "responder_bytes": 530 }, { "flow_id": "flow-2f172b6d672a52cb4248e2ba", "transport": "udp", "stream": 241, "initiator_ip": "10.0.19.14", "initiator_port": 49759, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12834, "last_frame": 12835, "first_seen_epoch": "1647911198.910591", "last_seen_epoch": "1647911198.910947", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-41743781cb3c1b20b844e5f2", "transport": "tcp", "stream": 291, "initiator_ip": "10.0.19.14", "initiator_port": 62471, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12836, "last_frame": 12846, "first_seen_epoch": "1647911198.911947", "last_seen_epoch": "1647911230.905819", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-ce7b1cda051d3738143eddb2", "transport": "udp", "stream": 242, "initiator_ip": "10.0.19.14", "initiator_port": 59041, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12847, "last_frame": 12848, "first_seen_epoch": "1647911235.925383", "last_seen_epoch": "1647911235.998312", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-84b2a5bdd96e8e2f22af986d", "transport": "tcp", "stream": 292, "initiator_ip": "10.0.19.14", "initiator_port": 62472, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12849, "last_frame": 12863, "first_seen_epoch": "1647911235.999276", "last_seen_epoch": "1647911266.911702", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-df18a059ecb908a21cc54346", "transport": "udp", "stream": 243, "initiator_ip": "10.0.19.14", "initiator_port": 54190, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12864, "last_frame": 12865, "first_seen_epoch": "1647911271.917415", "last_seen_epoch": "1647911271.991372", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-84f747f242d57ca9a6042bde", "transport": "tcp", "stream": 293, "initiator_ip": "10.0.19.14", "initiator_port": 62473, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12866, "last_frame": 12882, "first_seen_epoch": "1647911271.992323", "last_seen_epoch": "1647911302.90672", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-a454ad72f1064c9bed00525f", "transport": "udp", "stream": 244, "initiator_ip": "10.0.19.14", "initiator_port": 64471, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12883, "last_frame": 12884, "first_seen_epoch": "1647911307.912343", "last_seen_epoch": "1647911307.98708", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-097358fe1bc7fc414eacbd7d", "transport": "tcp", "stream": 294, "initiator_ip": "10.0.19.14", "initiator_port": 62474, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12885, "last_frame": 12897, "first_seen_epoch": "1647911307.988044", "last_seen_epoch": "1647911338.90996", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-92d4e5afe30080ea275b0927", "transport": "udp", "stream": 245, "initiator_ip": "10.0.19.14", "initiator_port": 49269, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12898, "last_frame": 12899, "first_seen_epoch": "1647911343.929581", "last_seen_epoch": "1647911344.013831", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-8c86f302c6324420da52b6ca", "transport": "tcp", "stream": 295, "initiator_ip": "10.0.19.14", "initiator_port": 62475, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12900, "last_frame": 12914, "first_seen_epoch": "1647911344.014797", "last_seen_epoch": "1647911374.892147", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-a9f5060206ee6379954d376f", "transport": "tcp", "stream": 296, "initiator_ip": "10.0.19.14", "initiator_port": 62476, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12915, "last_frame": 12931, "first_seen_epoch": "1647911379.911486", "last_seen_epoch": "1647911410.891407", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-a0dfe7e696f83355e12c1df8", "transport": "udp", "stream": 246, "initiator_ip": "10.0.19.14", "initiator_port": 51922, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12925, "last_frame": 12926, "first_seen_epoch": "1647911391.683861", "last_seen_epoch": "1647911391.684226", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-f7b504934d495a81b0ecea4f", "transport": "udp", "stream": 247, "initiator_ip": "10.0.19.14", "initiator_port": 62180, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12927, "last_frame": 12928, "first_seen_epoch": "1647911391.684952", "last_seen_epoch": "1647911391.68664", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-feb7b94b8dcdc11e1777c076", "transport": "tcp", "stream": 297, "initiator_ip": "10.0.19.14", "initiator_port": 62477, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 12934, "last_frame": 12946, "first_seen_epoch": "1647911415.910519", "last_seen_epoch": "1647911446.897654", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-fb9a4fe4bf05b6ed07f32de2", "transport": "tcp", "stream": 298, "initiator_ip": "10.0.19.14", "initiator_port": 62478, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 12947, "last_frame": 12957, "first_seen_epoch": "1647911451.917187", "last_seen_epoch": "1647911482.885915", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-6fb3be81a0d1546c163e84a7", "transport": "udp", "stream": 248, "initiator_ip": "10.0.19.14", "initiator_port": 62223, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 12958, "last_frame": 12959, "first_seen_epoch": "1647911529.875434", "last_seen_epoch": "1647911529.875891", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-a1733203fe305f02070ea6fb", "transport": "udp", "stream": 249, "initiator_ip": "10.0.19.14", "initiator_port": 62224, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12960, "last_frame": 12961, "first_seen_epoch": "1647911529.876486", "last_seen_epoch": "1647911529.876974", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-5659a1717bee10e062f1864a", "transport": "tcp", "stream": 299, "initiator_ip": "10.0.19.14", "initiator_port": 62479, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 12962, "last_frame": 13031, "first_seen_epoch": "1647911529.997048", "last_seen_epoch": "1647911530.019589", "packets": 10, "bytes": 1524, "initiator_bytes": 844, "responder_bytes": 680 }, { "flow_id": "flow-9fc533bfbfbe324dfdf4459a", "transport": "tcp", "stream": 300, "initiator_ip": "10.0.19.14", "initiator_port": 62480, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 12969, "last_frame": 13032, "first_seen_epoch": "1647911529.999449", "last_seen_epoch": "1647911530.019589", "packets": 22, "bytes": 6834, "initiator_bytes": 4406, "responder_bytes": 2428 }, { "flow_id": "flow-665856919e779b682e49b6d0", "transport": "tcp", "stream": 301, "initiator_ip": "10.0.19.14", "initiator_port": 62481, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 12992, "last_frame": 13030, "first_seen_epoch": "1647911530.008246", "last_seen_epoch": "1647911530.018527", "packets": 21, "bytes": 7634, "initiator_bytes": 3554, "responder_bytes": 4080 }, { "flow_id": "flow-b6a196fdcfd0adbbb1152a14", "transport": "tcp", "stream": 302, "initiator_ip": "10.0.19.14", "initiator_port": 62482, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 13009, "last_frame": 13028, "first_seen_epoch": "1647911530.014137", "last_seen_epoch": "1647911530.018395", "packets": 18, "bytes": 7048, "initiator_bytes": 2954, "responder_bytes": 4094 }, { "flow_id": "flow-e8b0ece61b04600163d2babb", "transport": "tcp", "stream": 303, "initiator_ip": "10.0.19.14", "initiator_port": 62483, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 13035, "last_frame": 13058, "first_seen_epoch": "1647911639.167129", "last_seen_epoch": "1647911649.891203", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-76b030ed7672fe9ddd591135", "transport": "udp", "stream": 250, "initiator_ip": "10.0.19.14", "initiator_port": 53165, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13061, "last_frame": 13063, "first_seen_epoch": "1647911670.707342", "last_seen_epoch": "1647911670.806801", "packets": 3, "bytes": 238, "initiator_bytes": 148, "responder_bytes": 90 }, { "flow_id": "flow-77e0ac269887260d230a2e99", "transport": "tcp", "stream": 304, "initiator_ip": "10.0.19.14", "initiator_port": 62484, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13064, "last_frame": 13077, "first_seen_epoch": "1647911670.807654", "last_seen_epoch": "1647911702.976704", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-2a9f9ba700f1dfd04b091524", "transport": "udp", "stream": 251, "initiator_ip": "10.0.19.14", "initiator_port": 55418, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13082, "last_frame": 13083, "first_seen_epoch": "1647911787.888846", "last_seen_epoch": "1647911787.8892", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-b125529257f37d5dce2fa76b", "transport": "tcp", "stream": 305, "initiator_ip": "10.0.19.14", "initiator_port": 62485, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13084, "last_frame": 13132, "first_seen_epoch": "1647911787.890164", "last_seen_epoch": "1647911884.974755", "packets": 19, "bytes": 3551, "initiator_bytes": 1049, "responder_bytes": 2502 }, { "flow_id": "flow-aa04c69ca2836af1fca57f07", "transport": "udp", "stream": 252, "initiator_ip": "10.0.19.14", "initiator_port": 64423, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13097, "last_frame": 13098, "first_seen_epoch": "1647911824.845402", "last_seen_epoch": "1647911824.921618", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-da0c6a8fb422fa5986bfe3f1", "transport": "tcp", "stream": 306, "initiator_ip": "10.0.19.14", "initiator_port": 62486, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13099, "last_frame": 13111, "first_seen_epoch": "1647911824.922551", "last_seen_epoch": "1647911855.879974", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-a2b1a6530b3046882aea1778", "transport": "udp", "stream": 253, "initiator_ip": "10.0.19.14", "initiator_port": 63678, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13112, "last_frame": 13113, "first_seen_epoch": "1647911860.899508", "last_seen_epoch": "1647911860.977254", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-002afb8bc0f3967aa44994b0", "transport": "tcp", "stream": 307, "initiator_ip": "10.0.19.14", "initiator_port": 62487, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13114, "last_frame": 13133, "first_seen_epoch": "1647911860.97818", "last_seen_epoch": "1647911891.885838", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-c3169fe21dc1bcc3af8442b4", "transport": "udp", "stream": 254, "initiator_ip": "10.0.19.14", "initiator_port": 63497, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13140, "last_frame": 13141, "first_seen_epoch": "1647911896.909321", "last_seen_epoch": "1647911896.988464", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-8146ab8865928e94d0627727", "transport": "tcp", "stream": 308, "initiator_ip": "10.0.19.14", "initiator_port": 62488, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13142, "last_frame": 13154, "first_seen_epoch": "1647911896.989442", "last_seen_epoch": "1647911927.873917", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-3049b1eeee7cf649b044cc8c", "transport": "udp", "stream": 255, "initiator_ip": "10.0.19.14", "initiator_port": 60068, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13155, "last_frame": 13156, "first_seen_epoch": "1647911928.459649", "last_seen_epoch": "1647911928.525445", "packets": 2, "bytes": 306, "initiator_bytes": 89, "responder_bytes": 217 }, { "flow_id": "flow-7c65ad3642cddc9ff4dba333", "transport": "tcp", "stream": 309, "initiator_ip": "10.0.19.14", "initiator_port": 62489, "responder_ip": "51.105.71.137", "responder_port": 443, "first_frame": 13157, "last_frame": 13175, "first_seen_epoch": "1647911928.526635", "last_seen_epoch": "1647911929.532832", "packets": 19, "bytes": 8579, "initiator_bytes": 3207, "responder_bytes": 5372 }, { "flow_id": "flow-def9754b43e649e5646c0a86", "transport": "tcp", "stream": 310, "initiator_ip": "10.0.19.14", "initiator_port": 62490, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13176, "last_frame": 13190, "first_seen_epoch": "1647911932.888888", "last_seen_epoch": "1647911963.885679", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f2f74700b92920f1727db4a9", "transport": "tcp", "stream": 311, "initiator_ip": "10.0.19.14", "initiator_port": 62491, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13191, "last_frame": 13205, "first_seen_epoch": "1647911968.890594", "last_seen_epoch": "1647911999.868906", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-2ed6346d0f861792479c11a3", "transport": "udp", "stream": 256, "initiator_ip": "10.0.19.14", "initiator_port": 54572, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13201, "last_frame": 13202, "first_seen_epoch": "1647911991.653725", "last_seen_epoch": "1647911991.654034", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-632f59f85d029acc42c10c82", "transport": "udp", "stream": 257, "initiator_ip": "10.0.19.14", "initiator_port": 61971, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13203, "last_frame": 13204, "first_seen_epoch": "1647911991.654731", "last_seen_epoch": "1647911991.656408", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-f217931f7444bc1606b5a084", "transport": "tcp", "stream": 312, "initiator_ip": "10.0.19.14", "initiator_port": 62492, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13206, "last_frame": 13220, "first_seen_epoch": "1647912004.875423", "last_seen_epoch": "1647912035.874567", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-a551d8b2b7cae0247389c945", "transport": "tcp", "stream": 313, "initiator_ip": "10.0.19.14", "initiator_port": 62493, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13221, "last_frame": 13231, "first_seen_epoch": "1647912040.885039", "last_seen_epoch": "1647912071.873515", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-fadbd8fd4bbfc73fd85f371c", "transport": "udp", "stream": 258, "initiator_ip": "10.0.19.14", "initiator_port": 50831, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13240, "last_frame": 13242, "first_seen_epoch": "1647912303.161494", "last_seen_epoch": "1647912303.235697", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-d93f683d1cc4fbab94b7e889", "transport": "tcp", "stream": 314, "initiator_ip": "10.0.19.14", "initiator_port": 62494, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13243, "last_frame": 13260, "first_seen_epoch": "1647912303.236548", "last_seen_epoch": "1647912335.856145", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-7b6af7e2a289461311dc1e85", "transport": "udp", "stream": 259, "initiator_ip": "10.0.19.14", "initiator_port": 55874, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13263, "last_frame": 13264, "first_seen_epoch": "1647912376.891844", "last_seen_epoch": "1647912376.892017", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-6fd330e2d942336daedac90e", "transport": "tcp", "stream": 315, "initiator_ip": "10.0.19.14", "initiator_port": 62495, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13265, "last_frame": 13280, "first_seen_epoch": "1647912376.893042", "last_seen_epoch": "1647912408.889491", "packets": 14, "bytes": 4251, "initiator_bytes": 1057, "responder_bytes": 3194 }, { "flow_id": "flow-17c1bc49a36171b8bbeb2b5d", "transport": "udp", "stream": 260, "initiator_ip": "10.0.19.14", "initiator_port": 50455, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13281, "last_frame": 13282, "first_seen_epoch": "1647912413.901241", "last_seen_epoch": "1647912413.987476", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-c1a479bd2e655ee9e199066d", "transport": "tcp", "stream": 316, "initiator_ip": "10.0.19.14", "initiator_port": 62496, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13283, "last_frame": 13295, "first_seen_epoch": "1647912413.988446", "last_seen_epoch": "1647912444.882918", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-65daf5c34d7ba892200820dc", "transport": "udp", "stream": 261, "initiator_ip": "10.0.19.14", "initiator_port": 52119, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13298, "last_frame": 13299, "first_seen_epoch": "1647912449.898802", "last_seen_epoch": "1647912449.976208", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-e69dd86cf864c52006ea7ccf", "transport": "tcp", "stream": 317, "initiator_ip": "10.0.19.14", "initiator_port": 62497, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13300, "last_frame": 13312, "first_seen_epoch": "1647912449.97718", "last_seen_epoch": "1647912480.893068", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-d0b22b4e4a25e9f5bf3306ee", "transport": "udp", "stream": 262, "initiator_ip": "10.0.19.14", "initiator_port": 55193, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13313, "last_frame": 13314, "first_seen_epoch": "1647912485.899289", "last_seen_epoch": "1647912485.984783", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-275bbbfd0abbf2e9e3cf3adb", "transport": "tcp", "stream": 318, "initiator_ip": "10.0.19.14", "initiator_port": 62498, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13315, "last_frame": 13357, "first_seen_epoch": "1647912485.98581", "last_seen_epoch": "1647912516.876074", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-a62db23e936a3a2cbe178b40", "transport": "udp", "stream": 263, "initiator_ip": "10.0.19.14", "initiator_port": 63658, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13333, "last_frame": 13334, "first_seen_epoch": "1647912515.745092", "last_seen_epoch": "1647912515.828585", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-686415a78472eced8d778caf", "transport": "tcp", "stream": 319, "initiator_ip": "10.0.19.14", "initiator_port": 62499, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 13335, "last_frame": 13356, "first_seen_epoch": "1647912515.829826", "last_seen_epoch": "1647912516.352489", "packets": 22, "bytes": 6761, "initiator_bytes": 2223, "responder_bytes": 4538 }, { "flow_id": "flow-b343d08b87b3168c73d9e259", "transport": "tcp", "stream": 320, "initiator_ip": "10.0.19.14", "initiator_port": 62500, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13358, "last_frame": 13397, "first_seen_epoch": "1647912521.895669", "last_seen_epoch": "1647912552.87965", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-77258fdc678c011e7aa49031", "transport": "udp", "stream": 264, "initiator_ip": "10.0.19.14", "initiator_port": 55784, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13371, "last_frame": 13372, "first_seen_epoch": "1647912539.132317", "last_seen_epoch": "1647912539.13263", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-e9670835d6e0415de31e3f06", "transport": "tcp", "stream": 321, "initiator_ip": "10.0.19.14", "initiator_port": 62501, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 13373, "last_frame": 13396, "first_seen_epoch": "1647912539.135472", "last_seen_epoch": "1647912549.868054", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-cbe71cf438afd59d2f6117c0", "transport": "tcp", "stream": 322, "initiator_ip": "10.0.19.14", "initiator_port": 62502, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13400, "last_frame": 13410, "first_seen_epoch": "1647912557.892837", "last_seen_epoch": "1647912588.872013", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-50d161ff9045e13114d1b557", "transport": "udp", "stream": 265, "initiator_ip": "10.0.19.14", "initiator_port": 51909, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13411, "last_frame": 13412, "first_seen_epoch": "1647912591.626948", "last_seen_epoch": "1647912591.627274", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-004efb42ddf9c433e36d7688", "transport": "udp", "stream": 266, "initiator_ip": "10.0.19.14", "initiator_port": 50676, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13413, "last_frame": 13414, "first_seen_epoch": "1647912591.627659", "last_seen_epoch": "1647912591.62933", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-4a2038c177afd2dfde115550", "transport": "tcp", "stream": 323, "initiator_ip": "10.0.19.14", "initiator_port": 62503, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13415, "last_frame": 13433, "first_seen_epoch": "1647912593.882543", "last_seen_epoch": "1647912626.198817", "packets": 13, "bytes": 3145, "initiator_bytes": 908, "responder_bytes": 2237 }, { "flow_id": "flow-3897fdfdb651ff0944379cc3", "transport": "tcp", "stream": 324, "initiator_ip": "10.0.19.14", "initiator_port": 62504, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13434, "last_frame": 13444, "first_seen_epoch": "1647912629.892321", "last_seen_epoch": "1647912660.869654", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-504190840ac813c0ad03c74e", "transport": "udp", "stream": 267, "initiator_ip": "10.0.19.14", "initiator_port": 62945, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13453, "last_frame": 13454, "first_seen_epoch": "1647912936.644416", "last_seen_epoch": "1647912936.71764", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-113ad5fc8049d7ef45f4177b", "transport": "tcp", "stream": 325, "initiator_ip": "10.0.19.14", "initiator_port": 62505, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13455, "last_frame": 13484, "first_seen_epoch": "1647912936.718456", "last_seen_epoch": "1647912968.857505", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-36fbb756904e7baeea8e3ba0", "transport": "udp", "stream": 268, "initiator_ip": "10.0.19.14", "initiator_port": 51059, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13469, "last_frame": 13470, "first_seen_epoch": "1647912965.873126", "last_seen_epoch": "1647912965.873451", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-7e9f299fbfd57513d3b5e076", "transport": "tcp", "stream": 326, "initiator_ip": "10.0.19.14", "initiator_port": 62506, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13471, "last_frame": 13489, "first_seen_epoch": "1647912965.874376", "last_seen_epoch": "1647912997.895467", "packets": 13, "bytes": 3143, "initiator_bytes": 906, "responder_bytes": 2237 }, { "flow_id": "flow-dfe333feddc29bb82ed7b8b6", "transport": "udp", "stream": 269, "initiator_ip": "10.0.19.14", "initiator_port": 62859, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13490, "last_frame": 13491, "first_seen_epoch": "1647913002.885186", "last_seen_epoch": "1647913002.95818", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-92187b202f611f698f9136c4", "transport": "tcp", "stream": 327, "initiator_ip": "10.0.19.14", "initiator_port": 62507, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13492, "last_frame": 13504, "first_seen_epoch": "1647913002.959154", "last_seen_epoch": "1647913033.876644", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-63ded0e642f371e605b119b3", "transport": "udp", "stream": 270, "initiator_ip": "10.0.19.14", "initiator_port": 52286, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13505, "last_frame": 13506, "first_seen_epoch": "1647913038.886448", "last_seen_epoch": "1647913038.957254", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-2ac9fae77001c1b9cf44ee8e", "transport": "tcp", "stream": 328, "initiator_ip": "10.0.19.14", "initiator_port": 62508, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13507, "last_frame": 13519, "first_seen_epoch": "1647913038.958229", "last_seen_epoch": "1647913069.859961", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-7ca21c442446010b341b125c", "transport": "udp", "stream": 271, "initiator_ip": "10.0.19.14", "initiator_port": 58187, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13520, "last_frame": 13521, "first_seen_epoch": "1647913074.866637", "last_seen_epoch": "1647913074.938461", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-53f5f1f1800440fceecb11e9", "transport": "tcp", "stream": 329, "initiator_ip": "10.0.19.14", "initiator_port": 62509, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13522, "last_frame": 13540, "first_seen_epoch": "1647913074.939431", "last_seen_epoch": "1647913105.869195", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-ff068a42f7a1fb07a42beba8", "transport": "tcp", "stream": 330, "initiator_ip": "10.0.19.14", "initiator_port": 62510, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13541, "last_frame": 13760, "first_seen_epoch": "1647913110.87871", "last_seen_epoch": "1647913141.866362", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-ebc65a04ca1082408358135a", "transport": "tcp", "stream": 331, "initiator_ip": "10.0.19.14", "initiator_port": 62511, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 13553, "last_frame": 13764, "first_seen_epoch": "1647913134.464455", "last_seen_epoch": "1647913146.402776", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-cfa52ecf0cfa656cee417ca0", "transport": "tcp", "stream": 332, "initiator_ip": "10.0.19.14", "initiator_port": 62512, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 13560, "last_frame": 13782, "first_seen_epoch": "1647913134.465895", "last_seen_epoch": "1647913166.40219", "packets": 21, "bytes": 5583, "initiator_bytes": 3743, "responder_bytes": 1840 }, { "flow_id": "flow-15bb9cc12568f295434e624c", "transport": "tcp", "stream": 333, "initiator_ip": "10.0.19.14", "initiator_port": 62513, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 13579, "last_frame": 13757, "first_seen_epoch": "1647913134.783313", "last_seen_epoch": "1647913135.399353", "packets": 25, "bytes": 11364, "initiator_bytes": 3985, "responder_bytes": 7379 }, { "flow_id": "flow-b825f0186770ef1247181464", "transport": "udp", "stream": 272, "initiator_ip": "10.0.19.14", "initiator_port": 58189, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 13590, "last_frame": 13591, "first_seen_epoch": "1647913134.79132", "last_seen_epoch": "1647913134.791738", "packets": 2, "bytes": 556, "initiator_bytes": 312, "responder_bytes": 244 }, { "flow_id": "flow-b188fbb59784fb893b8af568", "transport": "udp", "stream": 273, "initiator_ip": "10.0.19.14", "initiator_port": 58190, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 13596, "last_frame": 13597, "first_seen_epoch": "1647913134.910002", "last_seen_epoch": "1647913134.910393", "packets": 2, "bytes": 512, "initiator_bytes": 268, "responder_bytes": 244 }, { "flow_id": "flow-740b3d08ec0df265b2d3dea5", "transport": "tcp", "stream": 334, "initiator_ip": "10.0.19.14", "initiator_port": 62514, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 13600, "last_frame": 13753, "first_seen_epoch": "1647913135.025795", "last_seen_epoch": "1647913135.395817", "packets": 17, "bytes": 4116, "initiator_bytes": 2981, "responder_bytes": 1135 }, { "flow_id": "flow-7e4f8102f83ce559488b677e", "transport": "tcp", "stream": 335, "initiator_ip": "10.0.19.14", "initiator_port": 62515, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 13617, "last_frame": 13837, "first_seen_epoch": "1647913135.348007", "last_seen_epoch": "1647913318.059473", "packets": 162, "bytes": 40675, "initiator_bytes": 19552, "responder_bytes": 21123 }, { "flow_id": "flow-2345f6f9fe57cea14bc8017c", "transport": "tcp", "stream": 336, "initiator_ip": "10.0.19.14", "initiator_port": 62516, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13765, "last_frame": 13783, "first_seen_epoch": "1647913146.875394", "last_seen_epoch": "1647913177.854224", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-df06d3493bcc9d5cd5a7a2f1", "transport": "tcp", "stream": 337, "initiator_ip": "10.0.19.14", "initiator_port": 62517, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13784, "last_frame": 13800, "first_seen_epoch": "1647913182.867157", "last_seen_epoch": "1647913213.849813", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-e56d53406614c03c599c68e2", "transport": "udp", "stream": 274, "initiator_ip": "10.0.19.14", "initiator_port": 49760, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13794, "last_frame": 13795, "first_seen_epoch": "1647913191.595725", "last_seen_epoch": "1647913191.596107", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-8b2af622b7fab9e9162e4161", "transport": "udp", "stream": 275, "initiator_ip": "10.0.19.14", "initiator_port": 56413, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13796, "last_frame": 13797, "first_seen_epoch": "1647913191.596723", "last_seen_epoch": "1647913191.597895", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-fd97f1afc18fa9e2a4d64c20", "transport": "tcp", "stream": 338, "initiator_ip": "10.0.19.14", "initiator_port": 62518, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13803, "last_frame": 13816, "first_seen_epoch": "1647913218.869154", "last_seen_epoch": "1647913249.850312", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-519764d6128697f363614e00", "transport": "tcp", "stream": 339, "initiator_ip": "10.0.19.14", "initiator_port": 62519, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 13840, "last_frame": 13863, "first_seen_epoch": "1647913439.105319", "last_seen_epoch": "1647913449.868839", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-d2813e9f4b2a6e6e35086686", "transport": "udp", "stream": 276, "initiator_ip": "10.0.19.14", "initiator_port": 50979, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13866, "last_frame": 13867, "first_seen_epoch": "1647913554.85721", "last_seen_epoch": "1647913554.937046", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-8ddc06ce14907dcd970aff6a", "transport": "tcp", "stream": 340, "initiator_ip": "10.0.19.14", "initiator_port": 62520, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13868, "last_frame": 13896, "first_seen_epoch": "1647913554.938067", "last_seen_epoch": "1647913586.85363", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-72924cb0935978425adde546", "transport": "udp", "stream": 277, "initiator_ip": "10.0.19.14", "initiator_port": 49821, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13882, "last_frame": 13883, "first_seen_epoch": "1647913569.076657", "last_seen_epoch": "1647913569.07695", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-1bf9914ffa598502aec53002", "transport": "tcp", "stream": 341, "initiator_ip": "10.0.19.14", "initiator_port": 62521, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13884, "last_frame": 13912, "first_seen_epoch": "1647913569.077811", "last_seen_epoch": "1647913601.70543", "packets": 14, "bytes": 3187, "initiator_bytes": 890, "responder_bytes": 2297 }, { "flow_id": "flow-de98d710b9a5ce71546267fa", "transport": "tcp", "stream": 342, "initiator_ip": "10.0.19.14", "initiator_port": 62522, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13899, "last_frame": 13913, "first_seen_epoch": "1647913591.937244", "last_seen_epoch": "1647913622.851379", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-ad4179a66c52ad39511c30ed", "transport": "udp", "stream": 278, "initiator_ip": "10.0.19.14", "initiator_port": 56411, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13914, "last_frame": 13915, "first_seen_epoch": "1647913627.856625", "last_seen_epoch": "1647913627.930808", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-f757e7bee131e42c830df2f8", "transport": "tcp", "stream": 343, "initiator_ip": "10.0.19.14", "initiator_port": 62523, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13916, "last_frame": 13930, "first_seen_epoch": "1647913627.931777", "last_seen_epoch": "1647913658.847965", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-2af3793421efec0efcaac079", "transport": "udp", "stream": 279, "initiator_ip": "10.0.19.14", "initiator_port": 49205, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13931, "last_frame": 13932, "first_seen_epoch": "1647913663.86711", "last_seen_epoch": "1647913663.935696", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-b2d477a2197afb1ee8350948", "transport": "tcp", "stream": 344, "initiator_ip": "10.0.19.14", "initiator_port": 62524, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13933, "last_frame": 13943, "first_seen_epoch": "1647913663.936664", "last_seen_epoch": "1647913694.848327", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-8f1763a77c95fd06cec7027d", "transport": "tcp", "stream": 345, "initiator_ip": "10.0.19.14", "initiator_port": 62525, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13950, "last_frame": 13962, "first_seen_epoch": "1647913699.854426", "last_seen_epoch": "1647913730.84977", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-f528792005f355bb1324c2d2", "transport": "tcp", "stream": 346, "initiator_ip": "10.0.19.14", "initiator_port": 62526, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13963, "last_frame": 13977, "first_seen_epoch": "1647913735.857078", "last_seen_epoch": "1647913766.846208", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-3ee20b469b5dd29aab5c8a17", "transport": "tcp", "stream": 347, "initiator_ip": "10.0.19.14", "initiator_port": 62527, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 13978, "last_frame": 13992, "first_seen_epoch": "1647913771.865105", "last_seen_epoch": "1647913802.834816", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-3d2f5c8f40e6afda4d7bba68", "transport": "udp", "stream": 280, "initiator_ip": "10.0.19.14", "initiator_port": 49590, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13988, "last_frame": 13989, "first_seen_epoch": "1647913791.565756", "last_seen_epoch": "1647913791.566161", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-26206b991579550b7f83b3c7", "transport": "udp", "stream": 281, "initiator_ip": "10.0.19.14", "initiator_port": 51237, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 13990, "last_frame": 13991, "first_seen_epoch": "1647913791.566878", "last_seen_epoch": "1647913791.56831", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-b63ea23a294488b42fe752a1", "transport": "tcp", "stream": 348, "initiator_ip": "10.0.19.14", "initiator_port": 62528, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 13993, "last_frame": 14007, "first_seen_epoch": "1647913807.854925", "last_seen_epoch": "1647913838.833311", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-1eeb5e6a98dadbc888b1d4ed", "transport": "udp", "stream": 282, "initiator_ip": "10.0.19.14", "initiator_port": 60860, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14022, "last_frame": 14023, "first_seen_epoch": "1647914143.852358", "last_seen_epoch": "1647914143.930245", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-3c4dcaf3c45fd42e08683465", "transport": "tcp", "stream": 349, "initiator_ip": "10.0.19.14", "initiator_port": 62529, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14024, "last_frame": 14040, "first_seen_epoch": "1647914143.931227", "last_seen_epoch": "1647914175.956598", "packets": 13, "bytes": 3141, "initiator_bytes": 904, "responder_bytes": 2237 }, { "flow_id": "flow-070efcd7cc6c0a8b1e6ccd00", "transport": "udp", "stream": 283, "initiator_ip": "10.0.19.14", "initiator_port": 51361, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14043, "last_frame": 14044, "first_seen_epoch": "1647914180.854286", "last_seen_epoch": "1647914180.933195", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-dd7954f6f9170dfba578c85c", "transport": "tcp", "stream": 350, "initiator_ip": "10.0.19.14", "initiator_port": 62530, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14045, "last_frame": 14069, "first_seen_epoch": "1647914180.934171", "last_seen_epoch": "1647914211.844254", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-5e1eac77b74ee7ca06512610", "transport": "udp", "stream": 284, "initiator_ip": "10.0.19.14", "initiator_port": 51595, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14055, "last_frame": 14056, "first_seen_epoch": "1647914202.414062", "last_seen_epoch": "1647914202.414465", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-147dbcf2b14bfd56512b581f", "transport": "tcp", "stream": 351, "initiator_ip": "10.0.19.14", "initiator_port": 62531, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14057, "last_frame": 14218, "first_seen_epoch": "1647914202.415273", "last_seen_epoch": "1647914235.646724", "packets": 16, "bytes": 3313, "initiator_bytes": 950, "responder_bytes": 2363 }, { "flow_id": "flow-67283295af5768dccb6860a6", "transport": "udp", "stream": 285, "initiator_ip": "10.0.19.14", "initiator_port": 58458, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14070, "last_frame": 14071, "first_seen_epoch": "1647914216.854621", "last_seen_epoch": "1647914216.924885", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-561bd457229e4959ab36950d", "transport": "tcp", "stream": 352, "initiator_ip": "10.0.19.14", "initiator_port": 62532, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14072, "last_frame": 14222, "first_seen_epoch": "1647914216.925785", "last_seen_epoch": "1647914247.846824", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-b5e9dd0282c5346ccaaf7686", "transport": "udp", "stream": 286, "initiator_ip": "10.0.19.14", "initiator_port": 58459, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14073, "last_frame": 14074, "first_seen_epoch": "1647914217.033516", "last_seen_epoch": "1647914217.033944", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-3757046f073668a241e37e59", "transport": "udp", "stream": 287, "initiator_ip": "10.0.19.14", "initiator_port": 54685, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14078, "last_frame": 14079, "first_seen_epoch": "1647914217.065831", "last_seen_epoch": "1647914217.136915", "packets": 2, "bytes": 303, "initiator_bytes": 74, "responder_bytes": 229 }, { "flow_id": "flow-16506d27a265eedab29722ab", "transport": "tcp", "stream": 353, "initiator_ip": "10.0.19.14", "initiator_port": 62533, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 14080, "last_frame": 14178, "first_seen_epoch": "1647914217.139741", "last_seen_epoch": "1647914217.504646", "packets": 50, "bytes": 33807, "initiator_bytes": 2880, "responder_bytes": 30927 }, { "flow_id": "flow-57b5f33da59fe3f61c44922c", "transport": "tcp", "stream": 354, "initiator_ip": "10.0.19.14", "initiator_port": 62534, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 14081, "last_frame": 14219, "first_seen_epoch": "1647914217.139767", "last_seen_epoch": "1647914239.425691", "packets": 48, "bytes": 33694, "initiator_bytes": 2880, "responder_bytes": 30814 }, { "flow_id": "flow-7245babab7e1b3abb605abd6", "transport": "tcp", "stream": 355, "initiator_ip": "10.0.19.14", "initiator_port": 62535, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 14082, "last_frame": 14212, "first_seen_epoch": "1647914217.143537", "last_seen_epoch": "1647914229.034568", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-f006ffddf061b1c74fa8169c", "transport": "tcp", "stream": 356, "initiator_ip": "10.0.19.14", "initiator_port": 62536, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 14089, "last_frame": 14226, "first_seen_epoch": "1647914217.145259", "last_seen_epoch": "1647914249.034436", "packets": 21, "bytes": 5585, "initiator_bytes": 3793, "responder_bytes": 1792 }, { "flow_id": "flow-82c5bbf902af7d38d0b79beb", "transport": "udp", "stream": 288, "initiator_ip": "10.0.19.14", "initiator_port": 53249, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14227, "last_frame": 14229, "first_seen_epoch": "1647914252.866004", "last_seen_epoch": "1647914252.968249", "packets": 3, "bytes": 238, "initiator_bytes": 148, "responder_bytes": 90 }, { "flow_id": "flow-dc4f227cca2f8c2a7a316d09", "transport": "tcp", "stream": 357, "initiator_ip": "10.0.19.14", "initiator_port": 62537, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14230, "last_frame": 14242, "first_seen_epoch": "1647914252.969235", "last_seen_epoch": "1647914283.841087", "packets": 13, "bytes": 3240, "initiator_bytes": 1396, "responder_bytes": 1844 }, { "flow_id": "flow-2f75334bd1f1679d82b45d9e", "transport": "tcp", "stream": 358, "initiator_ip": "10.0.19.14", "initiator_port": 62538, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14245, "last_frame": 14261, "first_seen_epoch": "1647914288.856259", "last_seen_epoch": "1647914319.833939", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-02c8fddbf08cb1f6b9a29807", "transport": "tcp", "stream": 359, "initiator_ip": "10.0.19.14", "initiator_port": 62539, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14262, "last_frame": 14298, "first_seen_epoch": "1647914324.840221", "last_seen_epoch": "1647914355.82566", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-cdbcb112e256d4b812e9c074", "transport": "tcp", "stream": 360, "initiator_ip": "10.0.19.14", "initiator_port": 62540, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 14274, "last_frame": 14297, "first_seen_epoch": "1647914339.067543", "last_seen_epoch": "1647914349.81794", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-e7a4f99496a12d1311591a46", "transport": "tcp", "stream": 361, "initiator_ip": "10.0.19.14", "initiator_port": 62541, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14301, "last_frame": 14315, "first_seen_epoch": "1647914360.845184", "last_seen_epoch": "1647914391.834236", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-8134341b47c99777f09aeb08", "transport": "udp", "stream": 289, "initiator_ip": "10.0.19.14", "initiator_port": 54887, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14311, "last_frame": 14312, "first_seen_epoch": "1647914391.542516", "last_seen_epoch": "1647914391.542881", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-42ad5b3719865fedaff42562", "transport": "udp", "stream": 290, "initiator_ip": "10.0.19.14", "initiator_port": 62047, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14313, "last_frame": 14314, "first_seen_epoch": "1647914391.543582", "last_seen_epoch": "1647914391.544845", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-6e20a76fed7845d959ba1737", "transport": "tcp", "stream": 362, "initiator_ip": "10.0.19.14", "initiator_port": 62542, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14318, "last_frame": 14332, "first_seen_epoch": "1647914396.842441", "last_seen_epoch": "1647914427.835815", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-a0ce1062c4139039d41b7b03", "transport": "udp", "stream": 291, "initiator_ip": "10.0.19.14", "initiator_port": 53030, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14341, "last_frame": 14342, "first_seen_epoch": "1647914584.889529", "last_seen_epoch": "1647914584.964691", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-4641db9d2f4bb59125652abc", "transport": "tcp", "stream": 363, "initiator_ip": "10.0.19.14", "initiator_port": 62543, "responder_ip": "52.168.117.170", "responder_port": 443, "first_frame": 14343, "last_frame": 14361, "first_seen_epoch": "1647914584.965886", "last_seen_epoch": "1647914585.612981", "packets": 19, "bytes": 8215, "initiator_bytes": 2843, "responder_bytes": 5372 }, { "flow_id": "flow-6b77f36c705cda911f27a6c0", "transport": "udp", "stream": 292, "initiator_ip": "10.0.19.14", "initiator_port": 65367, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14366, "last_frame": 14367, "first_seen_epoch": "1647914646.361799", "last_seen_epoch": "1647914646.445953", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-64127683b7fe59dbe1e73c82", "transport": "tcp", "stream": 364, "initiator_ip": "10.0.19.14", "initiator_port": 62544, "responder_ip": "104.80.96.219", "responder_port": 80, "first_frame": 14368, "last_frame": 14399, "first_seen_epoch": "1647914646.452233", "last_seen_epoch": "1647914707.237515", "packets": 10, "bytes": 1090, "initiator_bytes": 587, "responder_bytes": 503 }, { "flow_id": "flow-8628f9c0ce2c6bfa92820a84", "transport": "udp", "stream": 293, "initiator_ip": "10.0.19.14", "initiator_port": 50134, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14374, "last_frame": 14376, "first_seen_epoch": "1647914646.617477", "last_seen_epoch": "1647914646.687373", "packets": 2, "bytes": 279, "initiator_bytes": 83, "responder_bytes": 196 }, { "flow_id": "flow-f061627e0aba585ff580d0f4", "transport": "tcp", "stream": 365, "initiator_ip": "10.0.19.14", "initiator_port": 62545, "responder_ip": "68.142.107.1", "responder_port": 80, "first_frame": 14377, "last_frame": 14400, "first_seen_epoch": "1647914646.688413", "last_seen_epoch": "1647914707.298546", "packets": 14, "bytes": 1897, "initiator_bytes": 978, "responder_bytes": 919 }, { "flow_id": "flow-12ce8ea73e244e6ddbdc67f5", "transport": "udp", "stream": 294, "initiator_ip": "10.0.19.14", "initiator_port": 57319, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14403, "last_frame": 14404, "first_seen_epoch": "1647914732.837408", "last_seen_epoch": "1647914732.903579", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-13e6d93677bb5ab19871831c", "transport": "tcp", "stream": 366, "initiator_ip": "10.0.19.14", "initiator_port": 62546, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14405, "last_frame": 14419, "first_seen_epoch": "1647914732.90459", "last_seen_epoch": "1647914764.842286", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f2be53164750043637d29057", "transport": "udp", "stream": 295, "initiator_ip": "10.0.19.14", "initiator_port": 51514, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14420, "last_frame": 14421, "first_seen_epoch": "1647914769.861701", "last_seen_epoch": "1647914769.936341", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-9fc895797dd97143be64b666", "transport": "tcp", "stream": 367, "initiator_ip": "10.0.19.14", "initiator_port": 62547, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14422, "last_frame": 14434, "first_seen_epoch": "1647914769.937327", "last_seen_epoch": "1647914800.827262", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-fadd4c36e505fe9060ee83a2", "transport": "udp", "stream": 296, "initiator_ip": "10.0.19.14", "initiator_port": 63207, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14435, "last_frame": 14436, "first_seen_epoch": "1647914805.84604", "last_seen_epoch": "1647914805.915567", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-f339eabbf03ed70ff2154087", "transport": "tcp", "stream": 368, "initiator_ip": "10.0.19.14", "initiator_port": 62548, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14437, "last_frame": 14461, "first_seen_epoch": "1647914805.916548", "last_seen_epoch": "1647914836.825355", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-025dcdb43968c320ae54b356", "transport": "udp", "stream": 297, "initiator_ip": "10.0.19.14", "initiator_port": 51450, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14449, "last_frame": 14450, "first_seen_epoch": "1647914835.779987", "last_seen_epoch": "1647914835.780307", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-42cb539d421d8165a2baa1cb", "transport": "tcp", "stream": 369, "initiator_ip": "10.0.19.14", "initiator_port": 62549, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14451, "last_frame": 14479, "first_seen_epoch": "1647914835.781157", "last_seen_epoch": "1647914868.333396", "packets": 14, "bytes": 3187, "initiator_bytes": 890, "responder_bytes": 2297 }, { "flow_id": "flow-48064190a12d93d73cfe0c83", "transport": "udp", "stream": 298, "initiator_ip": "10.0.19.14", "initiator_port": 53581, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14464, "last_frame": 14465, "first_seen_epoch": "1647914841.844864", "last_seen_epoch": "1647914841.921365", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-73c6a7beccaeab92701cbddc", "transport": "tcp", "stream": 370, "initiator_ip": "10.0.19.14", "initiator_port": 62550, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14466, "last_frame": 14480, "first_seen_epoch": "1647914841.922262", "last_seen_epoch": "1647914872.82264", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-8f7705ee5df089f79b97e70b", "transport": "tcp", "stream": 371, "initiator_ip": "10.0.19.14", "initiator_port": 62551, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14481, "last_frame": 14497, "first_seen_epoch": "1647914877.841837", "last_seen_epoch": "1647914908.825947", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-320e8a5527eec52b8e04936a", "transport": "tcp", "stream": 372, "initiator_ip": "10.0.19.14", "initiator_port": 62552, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14498, "last_frame": 14510, "first_seen_epoch": "1647914913.840723", "last_seen_epoch": "1647914944.824769", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-c6ebf87bc1792f90a6e026da", "transport": "tcp", "stream": 373, "initiator_ip": "10.0.19.14", "initiator_port": 62553, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14511, "last_frame": 14525, "first_seen_epoch": "1647914949.832348", "last_seen_epoch": "1647914980.819968", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-fd8262ef093f76062f9c2929", "transport": "tcp", "stream": 374, "initiator_ip": "10.0.19.14", "initiator_port": 62554, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14526, "last_frame": 14540, "first_seen_epoch": "1647914985.833772", "last_seen_epoch": "1647915016.81489", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-2d25c52c5e524a7af14e1347", "transport": "udp", "stream": 299, "initiator_ip": "10.0.19.14", "initiator_port": 62893, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14536, "last_frame": 14537, "first_seen_epoch": "1647914991.517672", "last_seen_epoch": "1647914991.518068", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-7e57d4d1e01faf7b7bea6c18", "transport": "udp", "stream": 300, "initiator_ip": "10.0.19.14", "initiator_port": 55630, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14538, "last_frame": 14539, "first_seen_epoch": "1647914991.518747", "last_seen_epoch": "1647914991.520269", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-75f7a731e873d71f255a8fc9", "transport": "udp", "stream": 301, "initiator_ip": "10.0.19.14", "initiator_port": 61379, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14545, "last_frame": 14546, "first_seen_epoch": "1647915129.729751", "last_seen_epoch": "1647915129.730185", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-9ac1c9e576f532dcfa936dbc", "transport": "udp", "stream": 302, "initiator_ip": "10.0.19.14", "initiator_port": 61380, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14547, "last_frame": 14548, "first_seen_epoch": "1647915129.730603", "last_seen_epoch": "1647915129.731102", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-ccbb99a633880f2170fe6269", "transport": "tcp", "stream": 375, "initiator_ip": "10.0.19.14", "initiator_port": 62555, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 14549, "last_frame": 14624, "first_seen_epoch": "1647915129.850805", "last_seen_epoch": "1647915129.978132", "packets": 12, "bytes": 1816, "initiator_bytes": 910, "responder_bytes": 906 }, { "flow_id": "flow-b22407a4efee15185c30377b", "transport": "tcp", "stream": 376, "initiator_ip": "10.0.19.14", "initiator_port": 62556, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 14556, "last_frame": 14625, "first_seen_epoch": "1647915129.853181", "last_seen_epoch": "1647915129.978219", "packets": 24, "bytes": 7095, "initiator_bytes": 4473, "responder_bytes": 2622 }, { "flow_id": "flow-ed303cbfad9e518c95173876", "transport": "udp", "stream": 303, "initiator_ip": "10.0.19.14", "initiator_port": 61382, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14579, "last_frame": 14580, "first_seen_epoch": "1647915129.861853", "last_seen_epoch": "1647915129.86224", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-63257794325cf9ac43806203", "transport": "tcp", "stream": 377, "initiator_ip": "10.0.19.14", "initiator_port": 62557, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14585, "last_frame": 14623, "first_seen_epoch": "1647915129.965692", "last_seen_epoch": "1647915129.976849", "packets": 21, "bytes": 7634, "initiator_bytes": 3554, "responder_bytes": 4080 }, { "flow_id": "flow-f2bbdb6528d2c12487e52ba3", "transport": "tcp", "stream": 378, "initiator_ip": "10.0.19.14", "initiator_port": 62558, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14602, "last_frame": 14620, "first_seen_epoch": "1647915129.973676", "last_seen_epoch": "1647915129.97679", "packets": 18, "bytes": 7048, "initiator_bytes": 2954, "responder_bytes": 4094 }, { "flow_id": "flow-dc83cbdfb4a329b98beafa76", "transport": "tcp", "stream": 379, "initiator_ip": "10.0.19.14", "initiator_port": 62559, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 14628, "last_frame": 14651, "first_seen_epoch": "1647915239.025605", "last_seen_epoch": "1647915249.754185", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-e253bfc8e9b724614e925f0f", "transport": "udp", "stream": 304, "initiator_ip": "10.0.19.14", "initiator_port": 54081, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14654, "last_frame": 14655, "first_seen_epoch": "1647915321.826821", "last_seen_epoch": "1647915321.896478", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-d4697aa8a1ba0b1af0b4c1f7", "transport": "tcp", "stream": 380, "initiator_ip": "10.0.19.14", "initiator_port": 62560, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14656, "last_frame": 14670, "first_seen_epoch": "1647915321.897489", "last_seen_epoch": "1647915353.825865", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-0a2cd79164863ba54fb32016", "transport": "udp", "stream": 305, "initiator_ip": "10.0.19.14", "initiator_port": 61905, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14671, "last_frame": 14672, "first_seen_epoch": "1647915358.837356", "last_seen_epoch": "1647915358.90938", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-3d5368f9da2b37a9556ab077", "transport": "tcp", "stream": 381, "initiator_ip": "10.0.19.14", "initiator_port": 62561, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14673, "last_frame": 14687, "first_seen_epoch": "1647915358.91034", "last_seen_epoch": "1647915389.816414", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-abde3746d0970cc279c68eb1", "transport": "udp", "stream": 306, "initiator_ip": "10.0.19.14", "initiator_port": 63344, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14688, "last_frame": 14689, "first_seen_epoch": "1647915394.835846", "last_seen_epoch": "1647915394.91883", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-8555aadd6d7f4ce083d02360", "transport": "tcp", "stream": 382, "initiator_ip": "10.0.19.14", "initiator_port": 62562, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14690, "last_frame": 14701, "first_seen_epoch": "1647915394.919796", "last_seen_epoch": "1647915425.819272", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-fe676e90e241d14bf6aa51d1", "transport": "udp", "stream": 307, "initiator_ip": "10.0.19.14", "initiator_port": 63906, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14702, "last_frame": 14703, "first_seen_epoch": "1647915430.825507", "last_seen_epoch": "1647915430.895107", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-4bc1874bcdc1063cbc38a701", "transport": "tcp", "stream": 383, "initiator_ip": "10.0.19.14", "initiator_port": 62563, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14704, "last_frame": 14718, "first_seen_epoch": "1647915430.896081", "last_seen_epoch": "1647915461.818964", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-3a082719827bd29f735ee32f", "transport": "tcp", "stream": 384, "initiator_ip": "10.0.19.14", "initiator_port": 62564, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14719, "last_frame": 14743, "first_seen_epoch": "1647915466.838482", "last_seen_epoch": "1647915497.811398", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-236fa2b7679d395c853f749f", "transport": "udp", "stream": 308, "initiator_ip": "10.0.19.14", "initiator_port": 58492, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14729, "last_frame": 14730, "first_seen_epoch": "1647915468.115838", "last_seen_epoch": "1647915468.116199", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-f8448306bf78fa1216314162", "transport": "tcp", "stream": 385, "initiator_ip": "10.0.19.14", "initiator_port": 62565, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14731, "last_frame": 14751, "first_seen_epoch": "1647915468.117037", "last_seen_epoch": "1647915500.328402", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-95d0dee879191efea0362368", "transport": "tcp", "stream": 386, "initiator_ip": "10.0.19.14", "initiator_port": 62566, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14752, "last_frame": 14790, "first_seen_epoch": "1647915502.820325", "last_seen_epoch": "1647915533.806685", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-b6f8220305973c812fea59d7", "transport": "udp", "stream": 309, "initiator_ip": "10.0.19.14", "initiator_port": 55053, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14762, "last_frame": 14763, "first_seen_epoch": "1647915526.243988", "last_seen_epoch": "1647915526.311808", "packets": 2, "bytes": 312, "initiator_bytes": 91, "responder_bytes": 221 }, { "flow_id": "flow-d3e9fcaf25a4b57024b8c303", "transport": "tcp", "stream": 387, "initiator_ip": "10.0.19.14", "initiator_port": 62567, "responder_ip": "20.72.205.209", "responder_port": 443, "first_frame": 14764, "last_frame": 14787, "first_seen_epoch": "1647915526.315936", "last_seen_epoch": "1647915526.824334", "packets": 24, "bytes": 6044, "initiator_bytes": 1410, "responder_bytes": 4634 }, { "flow_id": "flow-81126734bf3b0dbdbf7b8240", "transport": "tcp", "stream": 388, "initiator_ip": "10.0.19.14", "initiator_port": 62568, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14791, "last_frame": 14805, "first_seen_epoch": "1647915538.819185", "last_seen_epoch": "1647915569.804888", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-ce43e95a9079c98e9f0d6477", "transport": "tcp", "stream": 389, "initiator_ip": "10.0.19.14", "initiator_port": 62569, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14806, "last_frame": 14829, "first_seen_epoch": "1647915574.813636", "last_seen_epoch": "1647915605.805702", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-cbc9bca8b446717bd5d6b2ed", "transport": "udp", "stream": 310, "initiator_ip": "10.0.19.14", "initiator_port": 63517, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14816, "last_frame": 14817, "first_seen_epoch": "1647915587.160392", "last_seen_epoch": "1647915587.238901", "packets": 2, "bytes": 325, "initiator_bytes": 83, "responder_bytes": 242 }, { "flow_id": "flow-eb7f0901fe1e4d551dbb1e33", "transport": "tcp", "stream": 390, "initiator_ip": "10.0.19.14", "initiator_port": 62570, "responder_ip": "23.219.38.10", "responder_port": 80, "first_frame": 14818, "last_frame": 14836, "first_seen_epoch": "1647915587.245045", "last_seen_epoch": "1647915647.491893", "packets": 10, "bytes": 1154, "initiator_bytes": 647, "responder_bytes": 507 }, { "flow_id": "flow-2539526654e1e5778b06c727", "transport": "udp", "stream": 311, "initiator_ip": "10.0.19.14", "initiator_port": 54717, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14825, "last_frame": 14826, "first_seen_epoch": "1647915591.487173", "last_seen_epoch": "1647915591.487537", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-71d37ef6d627ad13959a9d36", "transport": "udp", "stream": 312, "initiator_ip": "10.0.19.14", "initiator_port": 58459, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14827, "last_frame": 14828, "first_seen_epoch": "1647915591.487905", "last_seen_epoch": "1647915591.489576", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-4427935382e34f6185a5a6da", "transport": "tcp", "stream": 391, "initiator_ip": "10.0.19.14", "initiator_port": 62571, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 14846, "last_frame": 14945, "first_seen_epoch": "1647915749.938647", "last_seen_epoch": "1647915761.875413", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-22c2594e95cb10f94754e16a", "transport": "tcp", "stream": 392, "initiator_ip": "10.0.19.14", "initiator_port": 62572, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 14847, "last_frame": 14943, "first_seen_epoch": "1647915749.938798", "last_seen_epoch": "1647915761.875241", "packets": 13, "bytes": 1716, "initiator_bytes": 748, "responder_bytes": 968 }, { "flow_id": "flow-b1a74cca234686e1a65b6db4", "transport": "tcp", "stream": 393, "initiator_ip": "10.0.19.14", "initiator_port": 62573, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 14860, "last_frame": 14949, "first_seen_epoch": "1647915749.940438", "last_seen_epoch": "1647915781.875858", "packets": 21, "bytes": 5617, "initiator_bytes": 3793, "responder_bytes": 1824 }, { "flow_id": "flow-34e0693db7443582d143f1c5", "transport": "tcp", "stream": 394, "initiator_ip": "10.0.19.14", "initiator_port": 62574, "responder_ip": "10.0.19.9", "responder_port": 49676, "first_frame": 14861, "last_frame": 14944, "first_seen_epoch": "1647915749.940608", "last_seen_epoch": "1647915761.875261", "packets": 13, "bytes": 4232, "initiator_bytes": 1692, "responder_bytes": 2540 }, { "flow_id": "flow-7a5a3e6c570d3e9aea083fc7", "transport": "udp", "stream": 313, "initiator_ip": "10.0.19.14", "initiator_port": 59123, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14882, "last_frame": 14883, "first_seen_epoch": "1647915749.946515", "last_seen_epoch": "1647915749.94675", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-67544850d96f912ddf0e8e3a", "transport": "tcp", "stream": 395, "initiator_ip": "10.0.19.14", "initiator_port": 62575, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14892, "last_frame": 14933, "first_seen_epoch": "1647915750.257709", "last_seen_epoch": "1647915750.696983", "packets": 23, "bytes": 8371, "initiator_bytes": 3916, "responder_bytes": 4455 }, { "flow_id": "flow-797ea81a63a264cd67695893", "transport": "udp", "stream": 314, "initiator_ip": "10.0.19.14", "initiator_port": 59125, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14903, "last_frame": 14904, "first_seen_epoch": "1647915750.265118", "last_seen_epoch": "1647915750.26553", "packets": 2, "bytes": 556, "initiator_bytes": 312, "responder_bytes": 244 }, { "flow_id": "flow-5eda001c271027e42c8a3ff7", "transport": "tcp", "stream": 396, "initiator_ip": "10.0.19.14", "initiator_port": 62576, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 14909, "last_frame": 14929, "first_seen_epoch": "1647915750.380896", "last_seen_epoch": "1647915750.694775", "packets": 17, "bytes": 4190, "initiator_bytes": 3055, "responder_bytes": 1135 }, { "flow_id": "flow-d4554fa0931c0fe99d9b823b", "transport": "udp", "stream": 315, "initiator_ip": "10.0.19.14", "initiator_port": 64144, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14954, "last_frame": 14955, "first_seen_epoch": "1647915910.810838", "last_seen_epoch": "1647915910.885374", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-ebaee4a7702ab5d08f3a4bf1", "transport": "tcp", "stream": 397, "initiator_ip": "10.0.19.14", "initiator_port": 62577, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14956, "last_frame": 14970, "first_seen_epoch": "1647915910.886363", "last_seen_epoch": "1647915942.806955", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-c000086d3bb9b280b9504598", "transport": "udp", "stream": 316, "initiator_ip": "10.0.19.14", "initiator_port": 63848, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14971, "last_frame": 14972, "first_seen_epoch": "1647915947.823689", "last_seen_epoch": "1647915947.892487", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-d3fd10151ef9a6107855b14e", "transport": "tcp", "stream": 398, "initiator_ip": "10.0.19.14", "initiator_port": 62578, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 14973, "last_frame": 14985, "first_seen_epoch": "1647915947.893414", "last_seen_epoch": "1647915978.801524", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-caa0a51403d1971850fc11ce", "transport": "udp", "stream": 317, "initiator_ip": "10.0.19.14", "initiator_port": 61556, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 14988, "last_frame": 14989, "first_seen_epoch": "1647915983.805909", "last_seen_epoch": "1647915983.882981", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-af4ebcdbd1bfafe2a1fea0c0", "transport": "tcp", "stream": 399, "initiator_ip": "10.0.19.14", "initiator_port": 62579, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 14990, "last_frame": 15000, "first_seen_epoch": "1647915983.883962", "last_seen_epoch": "1647916014.806202", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-cf09345e1104ce84e908cc00", "transport": "udp", "stream": 318, "initiator_ip": "10.0.19.14", "initiator_port": 59324, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15001, "last_frame": 15003, "first_seen_epoch": "1647916019.825394", "last_seen_epoch": "1647916019.971345", "packets": 3, "bytes": 238, "initiator_bytes": 148, "responder_bytes": 90 }, { "flow_id": "flow-44637e8b4c7b309376de3646", "transport": "tcp", "stream": 400, "initiator_ip": "10.0.19.14", "initiator_port": 62580, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15004, "last_frame": 15016, "first_seen_epoch": "1647916019.972315", "last_seen_epoch": "1647916050.806789", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-6f8d8d3612ea2f8afaf3f69d", "transport": "tcp", "stream": 401, "initiator_ip": "10.0.19.14", "initiator_port": 62581, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15017, "last_frame": 15027, "first_seen_epoch": "1647916055.82214", "last_seen_epoch": "1647916086.806762", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-fe9ef654f8c103c7cdda8af2", "transport": "tcp", "stream": 402, "initiator_ip": "10.0.19.14", "initiator_port": 62582, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15028, "last_frame": 15087, "first_seen_epoch": "1647916091.825774", "last_seen_epoch": "1647916122.80099", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-d928dfee44c3752e01b87c4e", "transport": "udp", "stream": 319, "initiator_ip": "10.0.19.14", "initiator_port": 64219, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15044, "last_frame": 15045, "first_seen_epoch": "1647916100.492656", "last_seen_epoch": "1647916100.492986", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-bc321927a26273cd8e1d62c4", "transport": "tcp", "stream": 403, "initiator_ip": "10.0.19.14", "initiator_port": 62583, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15046, "last_frame": 15104, "first_seen_epoch": "1647916100.493796", "last_seen_epoch": "1647916132.614289", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-de1c427f148b13d9dcebd139", "transport": "udp", "stream": 320, "initiator_ip": "10.0.19.14", "initiator_port": 63297, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15056, "last_frame": 15057, "first_seen_epoch": "1647916116.221098", "last_seen_epoch": "1647916116.299439", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-5c198fa9ab9f1ffa0ac5edb3", "transport": "tcp", "stream": 404, "initiator_ip": "10.0.19.14", "initiator_port": 62584, "responder_ip": "52.185.211.133", "responder_port": 443, "first_frame": 15058, "last_frame": 15086, "first_seen_epoch": "1647916116.300608", "last_seen_epoch": "1647916118.064576", "packets": 29, "bytes": 9394, "initiator_bytes": 4235, "responder_bytes": 5159 }, { "flow_id": "flow-bb4f1329d99e9c2834380458", "transport": "tcp", "stream": 405, "initiator_ip": "10.0.19.14", "initiator_port": 62585, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15088, "last_frame": 15133, "first_seen_epoch": "1647916127.819812", "last_seen_epoch": "1647916158.792981", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-81772e2ebce7e54599fe9c76", "transport": "udp", "stream": 321, "initiator_ip": "10.0.19.14", "initiator_port": 59382, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15105, "last_frame": 15106, "first_seen_epoch": "1647916138.996304", "last_seen_epoch": "1647916138.996603", "packets": 2, "bytes": 200, "initiator_bytes": 92, "responder_bytes": 108 }, { "flow_id": "flow-c1d0236710037028d7b1416f", "transport": "tcp", "stream": 406, "initiator_ip": "10.0.19.14", "initiator_port": 62586, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 15107, "last_frame": 15130, "first_seen_epoch": "1647916138.999409", "last_seen_epoch": "1647916149.710375", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-6203458407fa5c9217914cb3", "transport": "tcp", "stream": 407, "initiator_ip": "10.0.19.14", "initiator_port": 62587, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15134, "last_frame": 15148, "first_seen_epoch": "1647916163.806693", "last_seen_epoch": "1647916194.786478", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-1e3718d7f54f1134bb91a403", "transport": "udp", "stream": 322, "initiator_ip": "10.0.19.14", "initiator_port": 49893, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15144, "last_frame": 15145, "first_seen_epoch": "1647916191.461005", "last_seen_epoch": "1647916191.461328", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-014ea6d66b25a5fd04df1ac6", "transport": "udp", "stream": 323, "initiator_ip": "10.0.19.14", "initiator_port": 60551, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15146, "last_frame": 15147, "first_seen_epoch": "1647916191.462066", "last_seen_epoch": "1647916191.463679", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-d30854f6d04ce570dbb767e4", "transport": "udp", "stream": 324, "initiator_ip": "10.0.19.14", "initiator_port": 50723, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15155, "last_frame": 15156, "first_seen_epoch": "1647916312.509495", "last_seen_epoch": "1647916312.580226", "packets": 2, "bytes": 245, "initiator_bytes": 90, "responder_bytes": 155 }, { "flow_id": "flow-2a5c24d8cb59acf73a01c6bd", "transport": "tcp", "stream": 408, "initiator_ip": "10.0.19.14", "initiator_port": 62588, "responder_ip": "52.109.8.21", "responder_port": 443, "first_frame": 15157, "last_frame": 15230, "first_seen_epoch": "1647916312.581248", "last_seen_epoch": "1647916414.502035", "packets": 43, "bytes": 20625, "initiator_bytes": 2277, "responder_bytes": 18348 }, { "flow_id": "flow-3f107d073c8c2fcd10171def", "transport": "udp", "stream": 325, "initiator_ip": "10.0.19.14", "initiator_port": 61335, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15203, "last_frame": 15204, "first_seen_epoch": "1647916384.790803", "last_seen_epoch": "1647916384.861314", "packets": 2, "bytes": 305, "initiator_bytes": 89, "responder_bytes": 216 }, { "flow_id": "flow-6038b2792b5d090c3065a868", "transport": "tcp", "stream": 409, "initiator_ip": "10.0.19.14", "initiator_port": 62589, "responder_ip": "20.42.65.89", "responder_port": 443, "first_frame": 15205, "last_frame": 15223, "first_seen_epoch": "1647916384.862486", "last_seen_epoch": "1647916385.506155", "packets": 19, "bytes": 8214, "initiator_bytes": 2842, "responder_bytes": 5372 }, { "flow_id": "flow-a59e0ce24aaea502812de8fe", "transport": "udp", "stream": 326, "initiator_ip": "10.0.19.14", "initiator_port": 54371, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15235, "last_frame": 15236, "first_seen_epoch": "1647916499.799625", "last_seen_epoch": "1647916499.870219", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-622e8a80d0a8459252edbb82", "transport": "tcp", "stream": 410, "initiator_ip": "10.0.19.14", "initiator_port": 62590, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15237, "last_frame": 15251, "first_seen_epoch": "1647916499.871227", "last_seen_epoch": "1647916531.820906", "packets": 13, "bytes": 3141, "initiator_bytes": 904, "responder_bytes": 2237 }, { "flow_id": "flow-010c0fd91203ed98b408a1f6", "transport": "udp", "stream": 327, "initiator_ip": "10.0.19.14", "initiator_port": 55390, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15252, "last_frame": 15253, "first_seen_epoch": "1647916536.80899", "last_seen_epoch": "1647916536.88257", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-dcd020f181520e60a44c910a", "transport": "tcp", "stream": 411, "initiator_ip": "10.0.19.14", "initiator_port": 62591, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15254, "last_frame": 15266, "first_seen_epoch": "1647916536.883604", "last_seen_epoch": "1647916567.794276", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-1b603a290579fdd0b5c5dff3", "transport": "udp", "stream": 328, "initiator_ip": "10.0.19.14", "initiator_port": 62162, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15267, "last_frame": 15268, "first_seen_epoch": "1647916572.809319", "last_seen_epoch": "1647916572.88398", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-f1f4545f84d29869f04d082d", "transport": "tcp", "stream": 412, "initiator_ip": "10.0.19.14", "initiator_port": 62592, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15269, "last_frame": 15283, "first_seen_epoch": "1647916572.884957", "last_seen_epoch": "1647916603.799882", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-3b8c4260042e39cc9d3364ef", "transport": "udp", "stream": 329, "initiator_ip": "10.0.19.14", "initiator_port": 59280, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15284, "last_frame": 15285, "first_seen_epoch": "1647916608.809972", "last_seen_epoch": "1647916608.887028", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-2014c3ef58b4b7e842f35fd8", "transport": "tcp", "stream": 413, "initiator_ip": "10.0.19.14", "initiator_port": 62593, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15286, "last_frame": 15298, "first_seen_epoch": "1647916608.888023", "last_seen_epoch": "1647916639.797867", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-05a0946a7040a78150a7d945", "transport": "tcp", "stream": 414, "initiator_ip": "10.0.19.14", "initiator_port": 62594, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15299, "last_frame": 15309, "first_seen_epoch": "1647916644.818208", "last_seen_epoch": "1647916675.793801", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-1ecc170cdab7feb3c7567ea5", "transport": "tcp", "stream": 415, "initiator_ip": "10.0.19.14", "initiator_port": 62595, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15310, "last_frame": 15326, "first_seen_epoch": "1647916680.804526", "last_seen_epoch": "1647916711.780139", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-a87f5ece216e4e043db0d504", "transport": "tcp", "stream": 416, "initiator_ip": "10.0.19.14", "initiator_port": 62596, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15327, "last_frame": 15351, "first_seen_epoch": "1647916716.799962", "last_seen_epoch": "1647916747.780597", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-0b7d74ebe5463a326d5599a7", "transport": "udp", "stream": 330, "initiator_ip": "10.0.19.14", "initiator_port": 52742, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15339, "last_frame": 15340, "first_seen_epoch": "1647916732.772785", "last_seen_epoch": "1647916732.77313", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-ad4bf6f01723eba969be207c", "transport": "tcp", "stream": 417, "initiator_ip": "10.0.19.14", "initiator_port": 62597, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15341, "last_frame": 15369, "first_seen_epoch": "1647916732.773931", "last_seen_epoch": "1647916764.916999", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-946feda93d23902c302040dc", "transport": "tcp", "stream": 418, "initiator_ip": "10.0.19.14", "initiator_port": 62598, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15352, "last_frame": 15370, "first_seen_epoch": "1647916752.789603", "last_seen_epoch": "1647916783.778284", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-a3e14b5ad7d41b04bde007be", "transport": "udp", "stream": 331, "initiator_ip": "10.0.19.14", "initiator_port": 49463, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15371, "last_frame": 15372, "first_seen_epoch": "1647916791.43409", "last_seen_epoch": "1647916791.434427", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-1ce0b7348b5a8b68dec13d33", "transport": "udp", "stream": 332, "initiator_ip": "10.0.19.14", "initiator_port": 65450, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15373, "last_frame": 15374, "first_seen_epoch": "1647916791.435119", "last_seen_epoch": "1647916791.436655", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-34d2e4dd30540f01aa7b5e30", "transport": "tcp", "stream": 419, "initiator_ip": "10.0.19.14", "initiator_port": 62599, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 15384, "last_frame": 15435, "first_seen_epoch": "1647917038.963882", "last_seen_epoch": "1647917049.733783", "packets": 26, "bytes": 7999, "initiator_bytes": 5530, "responder_bytes": 2469 }, { "flow_id": "flow-a8ed041036b97a26c5662a8c", "transport": "udp", "stream": 333, "initiator_ip": "10.0.19.14", "initiator_port": 65451, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 15391, "last_frame": 15392, "first_seen_epoch": "1647917038.968321", "last_seen_epoch": "1647917038.968757", "packets": 2, "bytes": 512, "initiator_bytes": 268, "responder_bytes": 244 }, { "flow_id": "flow-0170635f18b3cf4dbf43b302", "transport": "tcp", "stream": 420, "initiator_ip": "10.0.19.14", "initiator_port": 62600, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 15395, "last_frame": 15406, "first_seen_epoch": "1647917039.076173", "last_seen_epoch": "1647917039.07875", "packets": 12, "bytes": 4041, "initiator_bytes": 2013, "responder_bytes": 2028 }, { "flow_id": "flow-92542dabe27fc86b023ce53b", "transport": "tcp", "stream": 421, "initiator_ip": "10.0.19.14", "initiator_port": 62601, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 15407, "last_frame": 15418, "first_seen_epoch": "1647917039.07941", "last_seen_epoch": "1647917039.081908", "packets": 12, "bytes": 4028, "initiator_bytes": 2000, "responder_bytes": 2028 }, { "flow_id": "flow-bb4d3020b9af050b397c4508", "transport": "udp", "stream": 334, "initiator_ip": "10.0.19.14", "initiator_port": 50690, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15438, "last_frame": 15439, "first_seen_epoch": "1647917088.779052", "last_seen_epoch": "1647917088.857418", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-3543d6cec7a71e84bfe9db73", "transport": "tcp", "stream": 422, "initiator_ip": "10.0.19.14", "initiator_port": 62602, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15440, "last_frame": 15450, "first_seen_epoch": "1647917088.858377", "last_seen_epoch": "1647917120.775306", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-8b421245e833b8d2e542abcb", "transport": "udp", "stream": 335, "initiator_ip": "10.0.19.14", "initiator_port": 53074, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15451, "last_frame": 15452, "first_seen_epoch": "1647917125.785281", "last_seen_epoch": "1647917125.858522", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-cd4276fc32be23bf879a69ea", "transport": "tcp", "stream": 423, "initiator_ip": "10.0.19.14", "initiator_port": 62603, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15453, "last_frame": 15467, "first_seen_epoch": "1647917125.859485", "last_seen_epoch": "1647917156.779942", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f31f8aaa873783208b047c43", "transport": "udp", "stream": 336, "initiator_ip": "10.0.19.14", "initiator_port": 61609, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15468, "last_frame": 15469, "first_seen_epoch": "1647917161.799272", "last_seen_epoch": "1647917161.867341", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-09839a8ea8be1ae558880c10", "transport": "tcp", "stream": 424, "initiator_ip": "10.0.19.14", "initiator_port": 62604, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15470, "last_frame": 15484, "first_seen_epoch": "1647917161.868296", "last_seen_epoch": "1647917192.777283", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-6b14335a1010097f6321b0a9", "transport": "udp", "stream": 337, "initiator_ip": "10.0.19.14", "initiator_port": 60848, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15485, "last_frame": 15486, "first_seen_epoch": "1647917197.796405", "last_seen_epoch": "1647917197.870639", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-0e648c1a5fc101d515688109", "transport": "tcp", "stream": 425, "initiator_ip": "10.0.19.14", "initiator_port": 62605, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15487, "last_frame": 15497, "first_seen_epoch": "1647917197.871592", "last_seen_epoch": "1647917228.766222", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-7e22503b32117e574c08901a", "transport": "tcp", "stream": 426, "initiator_ip": "10.0.19.14", "initiator_port": 62606, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15498, "last_frame": 15508, "first_seen_epoch": "1647917233.781056", "last_seen_epoch": "1647917264.760394", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-272d29840daa249db27e5fb3", "transport": "tcp", "stream": 427, "initiator_ip": "10.0.19.14", "initiator_port": 62607, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15509, "last_frame": 15528, "first_seen_epoch": "1647917269.779458", "last_seen_epoch": "1647917300.758219", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-ec433742eeae3f7b1f7ead71", "transport": "tcp", "stream": 428, "initiator_ip": "10.0.19.14", "initiator_port": 62608, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15529, "last_frame": 15541, "first_seen_epoch": "1647917305.765829", "last_seen_epoch": "1647917336.762116", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-6a9e55b5d1b43567448c45bd", "transport": "tcp", "stream": 429, "initiator_ip": "10.0.19.14", "initiator_port": 62609, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15542, "last_frame": 15568, "first_seen_epoch": "1647917341.781161", "last_seen_epoch": "1647917372.755757", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-18aecc78313f432f4512ad53", "transport": "udp", "stream": 338, "initiator_ip": "10.0.19.14", "initiator_port": 58220, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15556, "last_frame": 15557, "first_seen_epoch": "1647917365.11306", "last_seen_epoch": "1647917365.11338", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-9b126e3c32e48eb7ec4a3d2d", "transport": "tcp", "stream": 430, "initiator_ip": "10.0.19.14", "initiator_port": 62610, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15558, "last_frame": 15576, "first_seen_epoch": "1647917365.114183", "last_seen_epoch": "1647917397.19974", "packets": 14, "bytes": 3185, "initiator_bytes": 888, "responder_bytes": 2297 }, { "flow_id": "flow-42957ef81842660e358de79c", "transport": "udp", "stream": 339, "initiator_ip": "10.0.19.14", "initiator_port": 58696, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15569, "last_frame": 15570, "first_seen_epoch": "1647917391.39893", "last_seen_epoch": "1647917391.399245", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-7620942bdcacf1041ce269bb", "transport": "udp", "stream": 340, "initiator_ip": "10.0.19.14", "initiator_port": 53659, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15571, "last_frame": 15572, "first_seen_epoch": "1647917391.399933", "last_seen_epoch": "1647917391.401519", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-0c78e6bf03b13e13f3c4c13f", "transport": "udp", "stream": 341, "initiator_ip": "10.0.19.14", "initiator_port": 52219, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15590, "last_frame": 15591, "first_seen_epoch": "1647917677.756173", "last_seen_epoch": "1647917677.825301", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-4c9f1bc849adb184dd49a64f", "transport": "tcp", "stream": 431, "initiator_ip": "10.0.19.14", "initiator_port": 62611, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15592, "last_frame": 15604, "first_seen_epoch": "1647917677.826309", "last_seen_epoch": "1647917709.88056", "packets": 13, "bytes": 3143, "initiator_bytes": 906, "responder_bytes": 2237 }, { "flow_id": "flow-75511a765a21c7294505a8ea", "transport": "udp", "stream": 342, "initiator_ip": "10.0.19.14", "initiator_port": 60705, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15605, "last_frame": 15606, "first_seen_epoch": "1647917714.766117", "last_seen_epoch": "1647917714.838494", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-c1f57b19371eea8b74f1a874", "transport": "tcp", "stream": 432, "initiator_ip": "10.0.19.14", "initiator_port": 62612, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15607, "last_frame": 15621, "first_seen_epoch": "1647917714.839459", "last_seen_epoch": "1647917745.757287", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-f43d90ace502cd24807590d8", "transport": "udp", "stream": 343, "initiator_ip": "10.0.19.14", "initiator_port": 62853, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15622, "last_frame": 15623, "first_seen_epoch": "1647917750.77629", "last_seen_epoch": "1647917750.851264", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-9288bcb8283b440803c90d7a", "transport": "tcp", "stream": 433, "initiator_ip": "10.0.19.14", "initiator_port": 62613, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15624, "last_frame": 15636, "first_seen_epoch": "1647917750.852245", "last_seen_epoch": "1647917781.749792", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-5cb202345f7f4f2308189e3f", "transport": "udp", "stream": 344, "initiator_ip": "10.0.19.14", "initiator_port": 51467, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15639, "last_frame": 15640, "first_seen_epoch": "1647917786.757155", "last_seen_epoch": "1647917786.830596", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-f8374987ced2971bd80fac78", "transport": "tcp", "stream": 434, "initiator_ip": "10.0.19.14", "initiator_port": 62614, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15641, "last_frame": 15651, "first_seen_epoch": "1647917786.831602", "last_seen_epoch": "1647917817.753665", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-78ff89b82cb72964947f0611", "transport": "tcp", "stream": 435, "initiator_ip": "10.0.19.14", "initiator_port": 62615, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15652, "last_frame": 15662, "first_seen_epoch": "1647917822.772755", "last_seen_epoch": "1647917853.746613", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-727a8fa396998a4d14a824c3", "transport": "tcp", "stream": 436, "initiator_ip": "10.0.19.14", "initiator_port": 62616, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15663, "last_frame": 15673, "first_seen_epoch": "1647917858.764437", "last_seen_epoch": "1647917889.743321", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-8df8403a21957ad8ec0894cd", "transport": "tcp", "stream": 437, "initiator_ip": "10.0.19.14", "initiator_port": 62617, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15674, "last_frame": 15714, "first_seen_epoch": "1647917894.762995", "last_seen_epoch": "1647917925.736818", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-23e9eebab1caa28e139ce065", "transport": "udp", "stream": 345, "initiator_ip": "10.0.19.14", "initiator_port": 52511, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15690, "last_frame": 15691, "first_seen_epoch": "1647917917.881994", "last_seen_epoch": "1647917917.954719", "packets": 2, "bytes": 319, "initiator_bytes": 91, "responder_bytes": 228 }, { "flow_id": "flow-4061f836f6c8288165bd4547", "transport": "tcp", "stream": 438, "initiator_ip": "10.0.19.14", "initiator_port": 62618, "responder_ip": "52.183.220.149", "responder_port": 443, "first_frame": 15692, "last_frame": 15713, "first_seen_epoch": "1647917917.955886", "last_seen_epoch": "1647917918.498928", "packets": 22, "bytes": 6888, "initiator_bytes": 2286, "responder_bytes": 4602 }, { "flow_id": "flow-fd668df7e660584e724f5e85", "transport": "tcp", "stream": 439, "initiator_ip": "10.0.19.14", "initiator_port": 62619, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15717, "last_frame": 15765, "first_seen_epoch": "1647917930.753525", "last_seen_epoch": "1647917961.736748", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-5bd5ad6286ea27d9e9b0dba5", "transport": "tcp", "stream": 440, "initiator_ip": "10.0.19.14", "initiator_port": 62620, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 15727, "last_frame": 15762, "first_seen_epoch": "1647917939.042073", "last_seen_epoch": "1647917949.794955", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-431a615f5edfb04ed8be2fe9", "transport": "tcp", "stream": 441, "initiator_ip": "10.0.19.14", "initiator_port": 62621, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 15734, "last_frame": 15745, "first_seen_epoch": "1647917939.044535", "last_seen_epoch": "1647917939.04824", "packets": 12, "bytes": 4354, "initiator_bytes": 2207, "responder_bytes": 2147 }, { "flow_id": "flow-5b1990f829f9ad30a5bff231", "transport": "udp", "stream": 346, "initiator_ip": "10.0.19.14", "initiator_port": 63623, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15766, "last_frame": 15767, "first_seen_epoch": "1647917991.360368", "last_seen_epoch": "1647917991.360726", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-66b917a4f07264122f0cbd2f", "transport": "udp", "stream": 347, "initiator_ip": "10.0.19.14", "initiator_port": 56928, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15768, "last_frame": 15769, "first_seen_epoch": "1647917991.361142", "last_seen_epoch": "1647917991.362925", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-2a11af3c5d73bb9e5387e2b9", "transport": "udp", "stream": 348, "initiator_ip": "10.0.19.14", "initiator_port": 64885, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15772, "last_frame": 15773, "first_seen_epoch": "1647917997.429679", "last_seen_epoch": "1647917997.430015", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-b526dc87e9716f4580f288e2", "transport": "tcp", "stream": 442, "initiator_ip": "10.0.19.14", "initiator_port": 62622, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15774, "last_frame": 15791, "first_seen_epoch": "1647917997.43089", "last_seen_epoch": "1647918029.808245", "packets": 14, "bytes": 3187, "initiator_bytes": 890, "responder_bytes": 2297 }, { "flow_id": "flow-db1ce80951f68bea485c0a61", "transport": "udp", "stream": 349, "initiator_ip": "10.0.19.14", "initiator_port": 64656, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15796, "last_frame": 15797, "first_seen_epoch": "1647918184.692935", "last_seen_epoch": "1647918184.767153", "packets": 2, "bytes": 308, "initiator_bytes": 89, "responder_bytes": 219 }, { "flow_id": "flow-6f03a5742d2491e64e42b29b", "transport": "tcp", "stream": 443, "initiator_ip": "10.0.19.14", "initiator_port": 62623, "responder_ip": "52.182.143.208", "responder_port": 443, "first_frame": 15798, "last_frame": 15816, "first_seen_epoch": "1647918184.768351", "last_seen_epoch": "1647918185.314307", "packets": 19, "bytes": 8214, "initiator_bytes": 2842, "responder_bytes": 5372 }, { "flow_id": "flow-a232478e38070e0489a6b190", "transport": "udp", "stream": 350, "initiator_ip": "10.0.19.14", "initiator_port": 53213, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15823, "last_frame": 15824, "first_seen_epoch": "1647918266.223832", "last_seen_epoch": "1647918266.29601", "packets": 2, "bytes": 303, "initiator_bytes": 74, "responder_bytes": 229 }, { "flow_id": "flow-db0bf6520e53949511f61a9e", "transport": "tcp", "stream": 444, "initiator_ip": "10.0.19.14", "initiator_port": 62624, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 15825, "last_frame": 15939, "first_seen_epoch": "1647918266.297309", "last_seen_epoch": "1647918376.276832", "packets": 60, "bytes": 34950, "initiator_bytes": 2286, "responder_bytes": 32664 }, { "flow_id": "flow-d0c7f1924d214017fcf48387", "transport": "udp", "stream": 351, "initiator_ip": "10.0.19.14", "initiator_port": 58723, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15881, "last_frame": 15882, "first_seen_epoch": "1647918266.742037", "last_seen_epoch": "1647918266.82342", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-f8f5459de206109d80ca407e", "transport": "tcp", "stream": 445, "initiator_ip": "10.0.19.14", "initiator_port": 62625, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15883, "last_frame": 15894, "first_seen_epoch": "1647918266.824395", "last_seen_epoch": "1647918298.742983", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-7a08123d8cce1721d376e5de", "transport": "udp", "stream": 352, "initiator_ip": "10.0.19.14", "initiator_port": 58598, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15895, "last_frame": 15896, "first_seen_epoch": "1647918303.749128", "last_seen_epoch": "1647918303.82286", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-c4941b250092ea1ddf47330e", "transport": "tcp", "stream": 446, "initiator_ip": "10.0.19.14", "initiator_port": 62626, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15897, "last_frame": 15909, "first_seen_epoch": "1647918303.823819", "last_seen_epoch": "1647918334.750594", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-8ff0a80a13ee746253f001ad", "transport": "udp", "stream": 353, "initiator_ip": "10.0.19.14", "initiator_port": 59799, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15910, "last_frame": 15911, "first_seen_epoch": "1647918339.769513", "last_seen_epoch": "1647918339.850895", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-725f8be50070cdca38adcd36", "transport": "tcp", "stream": 447, "initiator_ip": "10.0.19.14", "initiator_port": 62627, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15912, "last_frame": 15924, "first_seen_epoch": "1647918339.851882", "last_seen_epoch": "1647918370.740752", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-edd6e8fb7e8ac85374c902aa", "transport": "udp", "stream": 354, "initiator_ip": "10.0.19.14", "initiator_port": 62282, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 15925, "last_frame": 15926, "first_seen_epoch": "1647918375.749312", "last_seen_epoch": "1647918375.829346", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-d67eac87846d43b516997b09", "transport": "tcp", "stream": 448, "initiator_ip": "10.0.19.14", "initiator_port": 62628, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15927, "last_frame": 15943, "first_seen_epoch": "1647918375.830334", "last_seen_epoch": "1647918406.745649", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-519d6f8c71c6f411daa19f39", "transport": "tcp", "stream": 449, "initiator_ip": "10.0.19.14", "initiator_port": 62629, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15944, "last_frame": 15954, "first_seen_epoch": "1647918411.750849", "last_seen_epoch": "1647918442.743188", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-04e7dba525fbabae16dbed18", "transport": "tcp", "stream": 450, "initiator_ip": "10.0.19.14", "initiator_port": 62630, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15955, "last_frame": 15965, "first_seen_epoch": "1647918447.76305", "last_seen_epoch": "1647918478.726415", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-5c09697a1e4bb45afe7dbf19", "transport": "tcp", "stream": 451, "initiator_ip": "10.0.19.14", "initiator_port": 62631, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 15966, "last_frame": 15982, "first_seen_epoch": "1647918483.738737", "last_seen_epoch": "1647918514.733087", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-e7a347e302419c270eefec0c", "transport": "tcp", "stream": 452, "initiator_ip": "10.0.19.14", "initiator_port": 62632, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 15983, "last_frame": 15995, "first_seen_epoch": "1647918519.741844", "last_seen_epoch": "1647918550.727887", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-5e8163a1631f9db8dafbe896", "transport": "udp", "stream": 355, "initiator_ip": "10.0.19.14", "initiator_port": 60475, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16000, "last_frame": 16001, "first_seen_epoch": "1647918591.326073", "last_seen_epoch": "1647918591.32644", "packets": 2, "bytes": 241, "initiator_bytes": 81, "responder_bytes": 160 }, { "flow_id": "flow-9c553b3c3c43a254772c0dfd", "transport": "udp", "stream": 356, "initiator_ip": "10.0.19.14", "initiator_port": 59394, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16002, "last_frame": 16003, "first_seen_epoch": "1647918591.327138", "last_seen_epoch": "1647918591.328918", "packets": 2, "bytes": 150, "initiator_bytes": 75, "responder_bytes": 75 }, { "flow_id": "flow-0e0f4d117606d4595ed3d925", "transport": "udp", "stream": 357, "initiator_ip": "10.0.19.14", "initiator_port": 49271, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16010, "last_frame": 16011, "first_seen_epoch": "1647918629.775443", "last_seen_epoch": "1647918629.775802", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-d7396decdd203269383c608b", "transport": "tcp", "stream": 453, "initiator_ip": "10.0.19.14", "initiator_port": 62633, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 16012, "last_frame": 16025, "first_seen_epoch": "1647918629.776652", "last_seen_epoch": "1647918662.052405", "packets": 14, "bytes": 3183, "initiator_bytes": 886, "responder_bytes": 2297 }, { "flow_id": "flow-bdaa6c5f3b68c0994a72af6b", "transport": "udp", "stream": 358, "initiator_ip": "10.0.19.14", "initiator_port": 57422, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16026, "last_frame": 16027, "first_seen_epoch": "1647918729.616549", "last_seen_epoch": "1647918729.61694", "packets": 2, "bytes": 324, "initiator_bytes": 128, "responder_bytes": 196 }, { "flow_id": "flow-66c0c5c1056740d668c95876", "transport": "udp", "stream": 359, "initiator_ip": "10.0.19.14", "initiator_port": 57423, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 16028, "last_frame": 16029, "first_seen_epoch": "1647918729.617397", "last_seen_epoch": "1647918729.617815", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-5012aab2a9fb72e68bb1c4f6", "transport": "tcp", "stream": 454, "initiator_ip": "10.0.19.14", "initiator_port": 62634, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 16030, "last_frame": 16147, "first_seen_epoch": "1647918729.747762", "last_seen_epoch": "1647918729.922039", "packets": 14, "bytes": 2108, "initiator_bytes": 976, "responder_bytes": 1132 }, { "flow_id": "flow-2d0d9b435d4be7a0998b45bd", "transport": "tcp", "stream": 455, "initiator_ip": "10.0.19.14", "initiator_port": 62635, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 16037, "last_frame": 16148, "first_seen_epoch": "1647918729.754754", "last_seen_epoch": "1647918729.922171", "packets": 24, "bytes": 7095, "initiator_bytes": 4473, "responder_bytes": 2622 }, { "flow_id": "flow-607d25988686de9140d78806", "transport": "tcp", "stream": 456, "initiator_ip": "10.0.19.14", "initiator_port": 62636, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 16040, "last_frame": 16049, "first_seen_epoch": "1647918729.75588", "last_seen_epoch": "1647918729.75725", "packets": 10, "bytes": 2389, "initiator_bytes": 1953, "responder_bytes": 436 }, { "flow_id": "flow-83a68d4bdec660faadc0a427", "transport": "tcp", "stream": 457, "initiator_ip": "10.0.19.14", "initiator_port": 62637, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 16050, "last_frame": 16057, "first_seen_epoch": "1647918729.757484", "last_seen_epoch": "1647918729.758992", "packets": 8, "bytes": 960, "initiator_bytes": 488, "responder_bytes": 472 }, { "flow_id": "flow-49c44bfbd9708ac4f4480c0f", "transport": "tcp", "stream": 458, "initiator_ip": "10.0.19.14", "initiator_port": 62638, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 16058, "last_frame": 16067, "first_seen_epoch": "1647918729.779287", "last_seen_epoch": "1647918729.78163", "packets": 10, "bytes": 2733, "initiator_bytes": 628, "responder_bytes": 2105 }, { "flow_id": "flow-1a74e757c515b3e6855c78b4", "transport": "tcp", "stream": 459, "initiator_ip": "10.0.19.14", "initiator_port": 62639, "responder_ip": "10.0.19.9", "responder_port": 88, "first_frame": 16068, "last_frame": 16081, "first_seen_epoch": "1647918729.781687", "last_seen_epoch": "1647918729.784815", "packets": 12, "bytes": 4392, "initiator_bytes": 2225, "responder_bytes": 2167 }, { "flow_id": "flow-d6c095d81c7ac1b10c631040", "transport": "udp", "stream": 360, "initiator_ip": "10.0.19.14", "initiator_port": 57425, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 16102, "last_frame": 16103, "first_seen_epoch": "1647918729.793108", "last_seen_epoch": "1647918729.793459", "packets": 2, "bytes": 513, "initiator_bytes": 269, "responder_bytes": 244 }, { "flow_id": "flow-381cca63823e98165067d872", "transport": "tcp", "stream": 460, "initiator_ip": "10.0.19.14", "initiator_port": 62640, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 16108, "last_frame": 16146, "first_seen_epoch": "1647918729.899318", "last_seen_epoch": "1647918729.917633", "packets": 21, "bytes": 7634, "initiator_bytes": 3554, "responder_bytes": 4080 }, { "flow_id": "flow-75cfb643884a8fe8255b2a15", "transport": "tcp", "stream": 461, "initiator_ip": "10.0.19.14", "initiator_port": 62641, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 16125, "last_frame": 16142, "first_seen_epoch": "1647918729.910981", "last_seen_epoch": "1647918729.917337", "packets": 18, "bytes": 7048, "initiator_bytes": 2954, "responder_bytes": 4094 }, { "flow_id": "flow-c9d925aafb8e6eb2633080f4", "transport": "udp", "stream": 361, "initiator_ip": "10.0.19.14", "initiator_port": 57426, "responder_ip": "10.0.19.9", "responder_port": 389, "first_frame": 16153, "last_frame": 16154, "first_seen_epoch": "1647918742.412806", "last_seen_epoch": "1647918742.413284", "packets": 2, "bytes": 556, "initiator_bytes": 312, "responder_bytes": 244 }, { "flow_id": "flow-a3a08b00aafc7c1296bc92f3", "transport": "tcp", "stream": 462, "initiator_ip": "10.0.19.14", "initiator_port": 62645, "responder_ip": "10.0.19.9", "responder_port": 135, "first_frame": 16155, "last_frame": 16184, "first_seen_epoch": "1647918742.525245", "last_seen_epoch": "1647918754.934771", "packets": 13, "bytes": 1548, "initiator_bytes": 748, "responder_bytes": 800 }, { "flow_id": "flow-54da88b2472810ac774bdbf3", "transport": "tcp", "stream": 463, "initiator_ip": "10.0.19.14", "initiator_port": 62646, "responder_ip": "10.0.19.9", "responder_port": 49667, "first_frame": 16162, "last_frame": 16185, "first_seen_epoch": "1647918742.527781", "last_seen_epoch": "1647918754.934856", "packets": 17, "bytes": 2676, "initiator_bytes": 1464, "responder_bytes": 1212 }, { "flow_id": "flow-8168a4ba03553fb9ef212c55", "transport": "tcp", "stream": 464, "initiator_ip": "10.0.19.14", "initiator_port": 62647, "responder_ip": "10.0.19.9", "responder_port": 445, "first_frame": 16186, "last_frame": 16209, "first_seen_epoch": "1647918839.014213", "last_seen_epoch": "1647918849.761456", "packets": 24, "bytes": 7567, "initiator_bytes": 5464, "responder_bytes": 2103 }, { "flow_id": "flow-2d1a0f24354e1ade080e45f8", "transport": "udp", "stream": 362, "initiator_ip": "10.0.19.14", "initiator_port": 49777, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16210, "last_frame": 16211, "first_seen_epoch": "1647918855.741679", "last_seen_epoch": "1647918855.819124", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-3bc52235aade6a86397dbd8a", "transport": "tcp", "stream": 465, "initiator_ip": "10.0.19.14", "initiator_port": 62648, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 16212, "last_frame": 16224, "first_seen_epoch": "1647918855.820088", "last_seen_epoch": "1647918887.737098", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-a396903979fa7c1fc901c20b", "transport": "udp", "stream": 363, "initiator_ip": "10.0.19.14", "initiator_port": 50712, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16225, "last_frame": 16226, "first_seen_epoch": "1647918892.753631", "last_seen_epoch": "1647918892.827336", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-59fc81a3fa8490cf36700897", "transport": "tcp", "stream": 466, "initiator_ip": "10.0.19.14", "initiator_port": 62649, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 16227, "last_frame": 16239, "first_seen_epoch": "1647918892.828297", "last_seen_epoch": "1647918923.744736", "packets": 11, "bytes": 2686, "initiator_bytes": 848, "responder_bytes": 1838 }, { "flow_id": "flow-c8484d39c8013c2b7e3381d7", "transport": "udp", "stream": 364, "initiator_ip": "10.0.19.14", "initiator_port": 60235, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16240, "last_frame": 16241, "first_seen_epoch": "1647918928.763652", "last_seen_epoch": "1647918928.840121", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-f0d3c5564dd0f2e264294921", "transport": "tcp", "stream": 467, "initiator_ip": "10.0.19.14", "initiator_port": 62650, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 16242, "last_frame": 16254, "first_seen_epoch": "1647918928.841088", "last_seen_epoch": "1647918959.730171", "packets": 11, "bytes": 2684, "initiator_bytes": 846, "responder_bytes": 1838 }, { "flow_id": "flow-25baa0209a6354b0a804c66a", "transport": "udp", "stream": 365, "initiator_ip": "10.0.19.14", "initiator_port": 64639, "responder_ip": "10.0.19.9", "responder_port": 53, "first_frame": 16258, "last_frame": 16259, "first_seen_epoch": "1647918964.740191", "last_seen_epoch": "1647918964.817552", "packets": 2, "bytes": 164, "initiator_bytes": 74, "responder_bytes": 90 }, { "flow_id": "flow-6d75c117ab6747595d8c5c87", "transport": "tcp", "stream": 468, "initiator_ip": "10.0.19.14", "initiator_port": 62651, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 16260, "last_frame": 16274, "first_seen_epoch": "1647918964.818517", "last_seen_epoch": "1647918995.731559", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-e9195dd5bd63965f26b83ded", "transport": "tcp", "stream": 469, "initiator_ip": "10.0.19.14", "initiator_port": 62652, "responder_ip": "157.245.142.66", "responder_port": 443, "first_frame": 16275, "last_frame": 16286, "first_seen_epoch": "1647919000.751684", "last_seen_epoch": "1647919031.729478", "packets": 11, "bytes": 2682, "initiator_bytes": 844, "responder_bytes": 1838 }, { "flow_id": "flow-6652ed0d74339d0ab4c126db", "transport": "tcp", "stream": 470, "initiator_ip": "10.0.19.14", "initiator_port": 62653, "responder_ip": "91.193.16.181", "responder_port": 443, "first_frame": 16287, "last_frame": 16296, "first_seen_epoch": "1647919036.74894", "last_seen_epoch": "1647919037.589407", "packets": 10, "bytes": 2626, "initiator_bytes": 788, "responder_bytes": 1838 } ], "events": { "dns": [ { "event_id": "evt-6634e90312a60ab35a7ba081", "kind": "dns", "frame_number": 499, "timestamp_epoch": "1647896315.838802000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63313, "dst_port": 53, "tcp_stream": null, "udp_stream": 0, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-241cc3b8130c6a8d75ba705f", "kind": "dns", "frame_number": 501, "timestamp_epoch": "1647896315.891442000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63313, "tcp_stream": null, "udp_stream": 0, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-703d726cc7b93d0691be6a11", "kind": "dns", "frame_number": 517, "timestamp_epoch": "1647896327.883955000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56525, "dst_port": 53, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-94a5a37af437a5fd525f92bb", "kind": "dns", "frame_number": 518, "timestamp_epoch": "1647896327.921157000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56525, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.a": "20.189.173.15", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdwus14.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5e6b0dbe7b268fce914c48f6", "kind": "dns", "frame_number": 543, "timestamp_epoch": "1647896375.854295000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51660, "dst_port": 53, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-3f15ef9b75be9768aca53f54", "kind": "dns", "frame_number": 544, "timestamp_epoch": "1647896375.854615000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51660, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-875d82264a80d4a41300718c", "kind": "dns", "frame_number": 564, "timestamp_epoch": "1647896378.094570000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58289, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "suncoastpinball.com", "dns.qry.type": "1" } }, { "event_id": "evt-9109c0cf9a1d5a31444bbe1a", "kind": "dns", "frame_number": 566, "timestamp_epoch": "1647896378.163267000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58289, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "160.153.32.99", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "suncoastpinball.com", "dns.qry.type": "1" } }, { "event_id": "evt-1cd3da9acc8fef70127b64ab", "kind": "dns", "frame_number": 3262, "timestamp_epoch": "1647896678.078409000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55426, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-115b4478f2fd19b836efd6db", "kind": "dns", "frame_number": 3263, "timestamp_epoch": "1647896678.124960000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55426, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-57b2af0c7209a9995454d119", "kind": "dns", "frame_number": 3297, "timestamp_epoch": "1647896803.730229000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60983, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-522cac7c821a956587cb66ef", "kind": "dns", "frame_number": 3298, "timestamp_epoch": "1647896803.730603000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60983, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-60823f7a8f6888439f72e00f", "kind": "dns", "frame_number": 3299, "timestamp_epoch": "1647896803.731257000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62042, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6d35ef77942a635094cd536c", "kind": "dns", "frame_number": 3300, "timestamp_epoch": "1647896803.732244000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62042, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-f7762e4ccd56a4b8b4ecbeb2", "kind": "dns", "frame_number": 3321, "timestamp_epoch": "1647896979.101968000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50246, "dst_port": 53, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-cfbbc128e1f7257a3f1342aa", "kind": "dns", "frame_number": 3322, "timestamp_epoch": "1647896979.163440000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50246, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-f03d6dbe04725ec0388466c2", "kind": "dns", "frame_number": 3379, "timestamp_epoch": "1647897103.636741000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64886, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-73e9d83c8900f3fa3b239414", "kind": "dns", "frame_number": 3381, "timestamp_epoch": "1647897103.673485000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64886, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d2ecb65865b4666e2fea2e3", "kind": "dns", "frame_number": 3430, "timestamp_epoch": "1647897130.188230000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50514, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-498419ea9051807dc1271ce9", "kind": "dns", "frame_number": 3431, "timestamp_epoch": "1647897130.188604000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50514, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-e8aea693ed3c94cf0446e1f7", "kind": "dns", "frame_number": 3520, "timestamp_epoch": "1647897262.965449000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59627, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-68214b014fff8828f4a7364d", "kind": "dns", "frame_number": 3521, "timestamp_epoch": "1647897262.992763000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59627, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "13.87.188.105", "dns.cname": "wd-prod-ss.trafficmanager.net,wd-prod-ss-us-west-2-fe.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7ab6610146fe81ff3b8e633", "kind": "dns", "frame_number": 3546, "timestamp_epoch": "1647897280.810233000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53901, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-cd8462fa62d6f8711408dec0", "kind": "dns", "frame_number": 3547, "timestamp_epoch": "1647897280.856532000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53901, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-59674986f55255e013bbed0a", "kind": "dns", "frame_number": 3583, "timestamp_epoch": "1647897403.696275000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51112, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-9db36d4ca9283be0cb38989d", "kind": "dns", "frame_number": 3584, "timestamp_epoch": "1647897403.696658000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51112, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-d7358e9cfdeef62dc0379ec1", "kind": "dns", "frame_number": 3585, "timestamp_epoch": "1647897403.697276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62790, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8968e6a3f2e74ac75d059ec9", "kind": "dns", "frame_number": 3586, "timestamp_epoch": "1647897403.699036000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62790, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-146ab2b5dd3e9889efc8fbed", "kind": "dns", "frame_number": 3609, "timestamp_epoch": "1647897582.385735000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57152, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-788ddd408defd09ef6985f24", "kind": "dns", "frame_number": 3610, "timestamp_epoch": "1647897582.421490000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57152, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-6bb8d4c263ce81ee16b88533", "kind": "dns", "frame_number": 3787, "timestamp_epoch": "1647898110.855660000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50620, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-b1cd9a8c82f786c8ce251ac7", "kind": "dns", "frame_number": 3790, "timestamp_epoch": "1647898110.856122000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50620, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-72aa9165dd59f0f62cd39277", "kind": "dns", "frame_number": 3792, "timestamp_epoch": "1647898110.857134000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58717, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "burnincandle-dc.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-15b71ed143dda8cb519c5324", "kind": "dns", "frame_number": 3793, "timestamp_epoch": "1647898110.857406000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58717, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "burnincandle-dc.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-dd308feef675d713a66acaaf", "kind": "dns", "frame_number": 3822, "timestamp_epoch": "1647898111.386634000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62930, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-71e4815f46040bd1e2cc4321", "kind": "dns", "frame_number": 3824, "timestamp_epoch": "1647898111.450439000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62930, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-4cb75fa22d6f80a0da44e19d", "kind": "dns", "frame_number": 3826, "timestamp_epoch": "1647898111.499380000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60562, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d6b47cb23f50a828e452ec27", "kind": "dns", "frame_number": 3827, "timestamp_epoch": "1647898111.570693000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60562, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad770e3ffa9a2bf974a361cd", "kind": "dns", "frame_number": 3841, "timestamp_epoch": "1647898111.853586000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52551, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-dd3a4e0232a39e59bd80a4e1", "kind": "dns", "frame_number": 3842, "timestamp_epoch": "1647898111.853586000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53458, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-977199545a1528a6e2153ef6", "kind": "dns", "frame_number": 3845, "timestamp_epoch": "1647898111.854034000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53458, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-9308428f49a86f27b95c2b89", "kind": "dns", "frame_number": 3849, "timestamp_epoch": "1647898111.854269000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51132, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-fa3b23dc911e89f56c988569", "kind": "dns", "frame_number": 3850, "timestamp_epoch": "1647898111.855341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52551, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-f59a49df7e358e8fd24eeb06", "kind": "dns", "frame_number": 3851, "timestamp_epoch": "1647898111.855443000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51132, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6c2efec80c11e24ddd11c8a2", "kind": "dns", "frame_number": 3852, "timestamp_epoch": "1647898111.855649000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57537, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-43d05e90c4da2d28211df384", "kind": "dns", "frame_number": 3853, "timestamp_epoch": "1647898111.856462000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57537, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-97f4accc8876f040e9096f7b", "kind": "dns", "frame_number": 3854, "timestamp_epoch": "1647898111.857108000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53745, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-acdadda9c6c8587a933f6f54", "kind": "dns", "frame_number": 3855, "timestamp_epoch": "1647898111.857427000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53745, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-ac57de6300f090b9fc952300", "kind": "dns", "frame_number": 3856, "timestamp_epoch": "1647898111.857763000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61564, "dst_port": 53, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-dc75e5f9b8d14197bf459dbc", "kind": "dns", "frame_number": 3857, "timestamp_epoch": "1647898111.857959000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61564, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-e04d85a84359b1f2b8930f66", "kind": "dns", "frame_number": 3867, "timestamp_epoch": "1647898111.960561000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53785, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ebace7ec148ab4dc78c49bc", "kind": "dns", "frame_number": 3873, "timestamp_epoch": "1647898112.044407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53785, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.a": "40.83.240.146", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-dadfa5119f7ea7376dd8ba9d", "kind": "dns", "frame_number": 3894, "timestamp_epoch": "1647898112.354005000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51359, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-d8c2fcaec73786ca7e09cd09", "kind": "dns", "frame_number": 3895, "timestamp_epoch": "1647898112.354302000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51359, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-707bfaf5d56f7f68938a57ba", "kind": "dns", "frame_number": 3915, "timestamp_epoch": "1647898113.838379000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49827, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-91b1539bccdd1b208d05eb4c", "kind": "dns", "frame_number": 3916, "timestamp_epoch": "1647898113.838694000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49827, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7b777d38bf9d51f1482c3eb", "kind": "dns", "frame_number": 3917, "timestamp_epoch": "1647898113.838908000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50820, "dst_port": 53, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-50907ec7b06b50285fde5066", "kind": "dns", "frame_number": 3918, "timestamp_epoch": "1647898113.839108000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50820, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-57e6255d8bf1e2dbc4059042", "kind": "dns", "frame_number": 4013, "timestamp_epoch": "1647898132.382978000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61415, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-49aa9b7790d6ab8170d2871f", "kind": "dns", "frame_number": 4014, "timestamp_epoch": "1647898132.383360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61415, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3121089c544e5b9396a28215", "kind": "dns", "frame_number": 4015, "timestamp_epoch": "1647898132.383697000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64807, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-96e85f1290ec6d89d276d97c", "kind": "dns", "frame_number": 4016, "timestamp_epoch": "1647898132.383920000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64807, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-a36bf3a07009e4bf27246b4c", "kind": "dns", "frame_number": 4039, "timestamp_epoch": "1647898144.014429000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49230, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0736ce012ad87d1e1192a86", "kind": "dns", "frame_number": 4040, "timestamp_epoch": "1647898144.079150000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49230, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.a": "13.89.179.9", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus09.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6eac98fd1fb4b55604690565", "kind": "dns", "frame_number": 4069, "timestamp_epoch": "1647898171.890703000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58024, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-8f9f017f9b263b35370f5f62", "kind": "dns", "frame_number": 4070, "timestamp_epoch": "1647898171.973323000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58024, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "68.142.107.129,69.28.162.0", "dns.cname": "wu-bg-shim.trafficmanager.net,windowsupdatebg.s.llnwi.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-128900b7c3e80cf2bcb361dd", "kind": "dns", "frame_number": 4078, "timestamp_epoch": "1647898192.390075000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54909, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3b1fa3adbff57bb9a3ad6ba0", "kind": "dns", "frame_number": 4079, "timestamp_epoch": "1647898192.390434000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54909, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-1f0b6cdd70bfe4753896535a", "kind": "dns", "frame_number": 4080, "timestamp_epoch": "1647898192.391133000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49946, "dst_port": 53, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-fa2072326791fe46177f77e4", "kind": "dns", "frame_number": 4081, "timestamp_epoch": "1647898192.392675000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49946, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d1c135a70f1f1be8f9325aad", "kind": "dns", "frame_number": 4117, "timestamp_epoch": "1647898792.359885000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62094, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-645b9faeb3a6c76046378f83", "kind": "dns", "frame_number": 4118, "timestamp_epoch": "1647898792.360245000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62094, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-ca8cdecea84b21a159af4976", "kind": "dns", "frame_number": 4119, "timestamp_epoch": "1647898792.360754000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62094, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-4a108708ffe150f4e37e0289", "kind": "dns", "frame_number": 4120, "timestamp_epoch": "1647898792.360865000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54959, "dst_port": 53, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-cb30e8353446dfa4f03c2aff", "kind": "dns", "frame_number": 4121, "timestamp_epoch": "1647898792.362398000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54959, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-153ab51f707d5de19565655e", "kind": "dns", "frame_number": 4129, "timestamp_epoch": "1647899008.693309000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53644, "dst_port": 53, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-9830c65edf18f43abe07f87a", "kind": "dns", "frame_number": 4130, "timestamp_epoch": "1647899008.693693000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53644, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-70e24cfde51a57dd814c55c4", "kind": "dns", "frame_number": 4214, "timestamp_epoch": "1647899008.794481000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53211, "dst_port": 53, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-b318c31d7535b901c682dc72", "kind": "dns", "frame_number": 4215, "timestamp_epoch": "1647899008.794789000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53211, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-44d5c4c7443c988b35aa3a48", "kind": "dns", "frame_number": 4302, "timestamp_epoch": "1647899008.806161000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50276, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-858713e26850bce565cd8066", "kind": "dns", "frame_number": 4304, "timestamp_epoch": "1647899008.806292000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50276, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-d56b549a0226ddb6375b5454", "kind": "dns", "frame_number": 4405, "timestamp_epoch": "1647899009.434906000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60340, "dst_port": 53, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-84c941f5e9e4f45bd35e8f5f", "kind": "dns", "frame_number": 4414, "timestamp_epoch": "1647899009.500569000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60340, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-7eafaa35b8b5ce1c33a1f42d", "kind": "dns", "frame_number": 4437, "timestamp_epoch": "1647899009.913079000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61179, "dst_port": 53, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-b716825aae0d71f8ce1086cb", "kind": "dns", "frame_number": 4438, "timestamp_epoch": "1647899009.985888000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61179, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-f7cf14abfacfdf249830c0db", "kind": "dns", "frame_number": 4446, "timestamp_epoch": "1647899010.276273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50941, "dst_port": 53, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-5162bc0bf910f45b691e0e05", "kind": "dns", "frame_number": 4447, "timestamp_epoch": "1647899010.276273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61069, "dst_port": 53, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-vp-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-23ed2583cf4f4ac3d68f1ccb", "kind": "dns", "frame_number": 4448, "timestamp_epoch": "1647899010.276622000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57922, "dst_port": 53, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-vs-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-21561fda56dc034910d3465d", "kind": "dns", "frame_number": 4449, "timestamp_epoch": "1647899010.277385000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61201, "dst_port": 53, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.flags.response": "False", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-733e28f136a725948895fbef", "kind": "dns", "frame_number": 4450, "timestamp_epoch": "1647899010.277995000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61079, "dst_port": 53, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-04e1e95ef3a8c81e7768d309", "kind": "dns", "frame_number": 4451, "timestamp_epoch": "1647899010.278640000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61671, "dst_port": 53, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.flags.response": "False", "dns.qry.name": "teams-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-2eb6a2e395cff8dc982343dc", "kind": "dns", "frame_number": 4452, "timestamp_epoch": "1647899010.343243000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61069, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vp-nocache.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-vp-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-fe9c2d75f571edde20373912", "kind": "dns", "frame_number": 4453, "timestamp_epoch": "1647899010.343277000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57922, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vs-nocache.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-vs-nocache.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-b0ec77ed2f6fdeff71d54432", "kind": "dns", "frame_number": 4454, "timestamp_epoch": "1647899010.343476000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61201, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-81255cecb92f2759140f3ee5", "kind": "dns", "frame_number": 4455, "timestamp_epoch": "1647899010.343547000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61671, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.a": "52.113.196.254", "dns.cname": "teams-ring.teams-9999.teams-msedge.net,teams-9999.teams-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "teams-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-3b72ab2956795e5775bacb43", "kind": "dns", "frame_number": 4456, "timestamp_epoch": "1647899010.343628000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61079, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vp.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-da81f5cb55c3586aa5d01903", "kind": "dns", "frame_number": 4462, "timestamp_epoch": "1647899010.344998000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52171, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-d155c9e399fb7834a5403c84", "kind": "dns", "frame_number": 4463, "timestamp_epoch": "1647899010.351545000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50941, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-c3eb538e288c60b0fac2d80e", "kind": "dns", "frame_number": 4467, "timestamp_epoch": "1647899010.410006000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52171, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.a": "13.107.136.254", "dns.cname": "spo-ring.spo-9999.spo-msedge.net,spo-9999.spo-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "spo-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-26ff419cb1d3c5e941745f6c", "kind": "dns", "frame_number": 4725, "timestamp_epoch": "1647899020.405676000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54788, "dst_port": 53, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.flags.response": "False", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-59130a3257b123f5aa785714", "kind": "dns", "frame_number": 4726, "timestamp_epoch": "1647899020.483805000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54788, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.a": "20.81.51.95", "dns.cname": "wd-prod-ss.trafficmanager.net,wd-prod-ss-us-east-1-fe.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4192f0e7934542adbe35d72", "kind": "dns", "frame_number": 4759, "timestamp_epoch": "1647899039.501726000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52182, "dst_port": 53, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1b820e43967241c770723ba8", "kind": "dns", "frame_number": 4760, "timestamp_epoch": "1647899039.573949000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52182, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-c3887d27a07c375ab05e5bba", "kind": "dns", "frame_number": 4823, "timestamp_epoch": "1647899069.512852000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49857, "dst_port": 53, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-6d2dd817c52b2fda0db2eb4a", "kind": "dns", "frame_number": 4824, "timestamp_epoch": "1647899069.513278000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49857, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-284e94edcaae3c2d707fc097", "kind": "dns", "frame_number": 4898, "timestamp_epoch": "1647899069.929878000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55442, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-de9c7fe4107a19117dd71ca3", "kind": "dns", "frame_number": 4899, "timestamp_epoch": "1647899069.930175000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55442, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-ccc65aab1ac5c5fbce317e3d", "kind": "dns", "frame_number": 4995, "timestamp_epoch": "1647899371.184324000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51757, "dst_port": 53, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7003f9c6571e5ff082251dd5", "kind": "dns", "frame_number": 4996, "timestamp_epoch": "1647899371.287345000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51757, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-bdb666b28c5a5b9106c1b44a", "kind": "dns", "frame_number": 5013, "timestamp_epoch": "1647899392.323744000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58849, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-4e16e59c40474fc1331d6b2a", "kind": "dns", "frame_number": 5014, "timestamp_epoch": "1647899392.324173000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58849, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-0623b0a851378ab336d51835", "kind": "dns", "frame_number": 5015, "timestamp_epoch": "1647899392.324828000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49783, "dst_port": 53, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8e242d52ace48fcef44309c6", "kind": "dns", "frame_number": 5016, "timestamp_epoch": "1647899392.326523000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49783, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-48b51ce91d6512e85b58b4cf", "kind": "dns", "frame_number": 5059, "timestamp_epoch": "1647899672.532037000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64324, "dst_port": 53, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-10362450cea455ba009f1ad9", "kind": "dns", "frame_number": 5060, "timestamp_epoch": "1647899672.614809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64324, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-93c2de6310175067c153bd97", "kind": "dns", "frame_number": 5073, "timestamp_epoch": "1647899673.951105000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63899, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "filebin.net", "dns.qry.type": "1" } }, { "event_id": "evt-a329f191de6d2c11cf945037", "kind": "dns", "frame_number": 5075, "timestamp_epoch": "1647899674.021764000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63899, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.a": "185.47.40.36", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "filebin.net", "dns.qry.type": "1" } }, { "event_id": "evt-03903fb70f3b3357ad2a1c12", "kind": "dns", "frame_number": 5098, "timestamp_epoch": "1647899675.035792000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54025, "dst_port": 53, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.response": "False", "dns.qry.name": "situla.bitbit.net", "dns.qry.type": "1" } }, { "event_id": "evt-8207c48cdde0c21f0bbd7519", "kind": "dns", "frame_number": 5100, "timestamp_epoch": "1647899675.140469000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54025, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.a": "87.238.33.8,87.238.33.7", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "situla.bitbit.net", "dns.qry.type": "1" } }, { "event_id": "evt-c2d38ccee08e667ab513fc89", "kind": "dns", "frame_number": 5735, "timestamp_epoch": "1647899683.660908000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61936, "dst_port": 53, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.response": "False", "dns.qry.name": "bupdater.com", "dns.qry.type": "1" } }, { "event_id": "evt-7b92f936cc09d5164728f007", "kind": "dns", "frame_number": 5736, "timestamp_epoch": "1647899683.825443000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61936, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.a": "23.227.198.203", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "bupdater.com", "dns.qry.type": "1" } }, { "event_id": "evt-49ffeb17c4c6de6b9f2dfc10", "kind": "dns", "frame_number": 5748, "timestamp_epoch": "1647899684.209025000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59513, "dst_port": 53, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.flags.response": "False", "dns.qry.name": "r3.i.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-8d08746cc40a9579dbff460c", "kind": "dns", "frame_number": 5749, "timestamp_epoch": "1647899684.275556000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59513, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.a": "104.80.96.219", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r3.i.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-f172f78dbbf053db2ffc6cf3", "kind": "dns", "frame_number": 5781, "timestamp_epoch": "1647899730.286540000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53445, "dst_port": 53, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-50572f4599ef24f7d1304e4d", "kind": "dns", "frame_number": 5782, "timestamp_epoch": "1647899730.286884000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53445, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-9f95e884583ed40400a53da7", "kind": "dns", "frame_number": 5783, "timestamp_epoch": "1647899730.287071000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51427, "dst_port": 53, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-25c6151b0ea4fb2191c402f7", "kind": "dns", "frame_number": 5784, "timestamp_epoch": "1647899730.288672000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51427, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-2eec6e09ec67bbf9fcf1ae2f", "kind": "dns", "frame_number": 5944, "timestamp_epoch": "1647899910.255986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58496, "dst_port": 53, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4babf77c56e7980209ee1136", "kind": "dns", "frame_number": 5945, "timestamp_epoch": "1647899910.335698000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58496, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.a": "13.69.116.104", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdweu06.westeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f80dc5e6eb785d04502e429f", "kind": "dns", "frame_number": 5969, "timestamp_epoch": "1647899911.916838000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57636, "dst_port": 53, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a800ee53a4cfb3a2a4ff2874", "kind": "dns", "frame_number": 5970, "timestamp_epoch": "1647899911.999060000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57636, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7cb8f8f0e4f990d1715cf020", "kind": "dns", "frame_number": 6054, "timestamp_epoch": "1647899971.010337000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60834, "dst_port": 53, "tcp_stream": null, "udp_stream": 95, "fields": { "dns.flags.response": "False", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-5588841f9fbf1324d3bff669", "kind": "dns", "frame_number": 6055, "timestamp_epoch": "1647899971.120928000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60834, "tcp_stream": null, "udp_stream": 95, "fields": { "dns.a": "104.80.96.219", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-995c3aa90217b8734d332237", "kind": "dns", "frame_number": 6062, "timestamp_epoch": "1647899971.353169000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49873, "dst_port": 53, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-64ba203e44f7a0c11c9445fa", "kind": "dns", "frame_number": 6064, "timestamp_epoch": "1647899971.439881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49873, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.a": "69.28.162.0,68.142.107.129", "dns.cname": "wu-bg-shim.trafficmanager.net,windowsupdatebg.s.llnwi.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-a42a2be51bda37f5568fcfe6", "kind": "dns", "frame_number": 6072, "timestamp_epoch": "1647899973.933269000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57322, "dst_port": 53, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-df1cc24714cae3844aa8df12", "kind": "dns", "frame_number": 6073, "timestamp_epoch": "1647899974.003979000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57322, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-52040f3478c1f161a6569888", "kind": "dns", "frame_number": 6090, "timestamp_epoch": "1647899992.295984000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55909, "dst_port": 53, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-299d7e7b358034eaa2668c85", "kind": "dns", "frame_number": 6091, "timestamp_epoch": "1647899992.296362000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55909, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-51d00b8ae78427fe26f1d9c2", "kind": "dns", "frame_number": 6092, "timestamp_epoch": "1647899992.296749000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57264, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-462def57c173bcf08f923cac", "kind": "dns", "frame_number": 6093, "timestamp_epoch": "1647899992.298308000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57264, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-490af486128d79c52d5bbe1a", "kind": "dns", "frame_number": 6295, "timestamp_epoch": "1647900275.329202000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56543, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7e2683cdae9499c190ada225", "kind": "dns", "frame_number": 6296, "timestamp_epoch": "1647900275.400240000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56543, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-82cfc169a317ca6c60b8f3fe", "kind": "dns", "frame_number": 7375, "timestamp_epoch": "1647900354.636510000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57036, "dst_port": 53, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-LR77S6E.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-edb80456ba379c202e6efbfd", "kind": "dns", "frame_number": 7376, "timestamp_epoch": "1647900354.636703000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57036, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-LR77S6E.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-11473b2fe6ed5184c7d127ed", "kind": "dns", "frame_number": 7930, "timestamp_epoch": "1647900576.625833000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50758, "dst_port": 53, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-bf819e9668ee9542e953d5e3", "kind": "dns", "frame_number": 7931, "timestamp_epoch": "1647900576.716133000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50758, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7ca0f7bfb3b4a429bcb7309b", "kind": "dns", "frame_number": 7950, "timestamp_epoch": "1647900592.255784000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51679, "dst_port": 53, "tcp_stream": null, "udp_stream": 103, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-53fbc13b623d36c93980d0bd", "kind": "dns", "frame_number": 7951, "timestamp_epoch": "1647900592.256090000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51679, "tcp_stream": null, "udp_stream": 103, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-177c53c3e4d13784e1b80595", "kind": "dns", "frame_number": 7952, "timestamp_epoch": "1647900592.256339000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57357, "dst_port": 53, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-26aea582aeed539561e4dc48", "kind": "dns", "frame_number": 7953, "timestamp_epoch": "1647900592.257878000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57357, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-c9cdcc888d18226843c96bf9", "kind": "dns", "frame_number": 7956, "timestamp_epoch": "1647900608.854196000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58087, "dst_port": 53, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.flags.response": "False", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7b7324bdadbb0160c21830b", "kind": "dns", "frame_number": 7957, "timestamp_epoch": "1647900608.859056000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58087, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.a": "20.81.52.156", "dns.cname": "wd-prod-ss.trafficmanager.net,wd-prod-ss-us-east-2-fe.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e1b72c5c85ad18747a59ee95", "kind": "dns", "frame_number": 8001, "timestamp_epoch": "1647900730.088507000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58077, "dst_port": 53, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-9fd19ea9da7c118afd677588", "kind": "dns", "frame_number": 8002, "timestamp_epoch": "1647900730.088913000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58077, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-60e6de27f281177712342984", "kind": "dns", "frame_number": 8318, "timestamp_epoch": "1647900878.064611000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54793, "dst_port": 53, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-4e626e2f79917914fd9cc083", "kind": "dns", "frame_number": 8319, "timestamp_epoch": "1647900878.134945000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54793, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a6a9df8dc71f1b96bbb5080d", "kind": "dns", "frame_number": 8408, "timestamp_epoch": "1647901179.293128000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52180, "dst_port": 53, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7515711cde645cbe255a93f8", "kind": "dns", "frame_number": 8409, "timestamp_epoch": "1647901179.367274000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52180, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-c6126d6635561f0b333b5427", "kind": "dns", "frame_number": 8430, "timestamp_epoch": "1647901192.229988000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53944, "dst_port": 53, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-09bd2d002f98eb34fc1041db", "kind": "dns", "frame_number": 8431, "timestamp_epoch": "1647901192.230372000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53944, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-2d5daec3fe94de466df8f6c2", "kind": "dns", "frame_number": 8432, "timestamp_epoch": "1647901192.230561000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63004, "dst_port": 53, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-9dac7e3edd3044c26e60913e", "kind": "dns", "frame_number": 8433, "timestamp_epoch": "1647901192.232240000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63004, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-30bfbb293c0602ad909e63fb", "kind": "dns", "frame_number": 8485, "timestamp_epoch": "1647901480.555480000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58606, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-699622a3f76f56e55f6becb5", "kind": "dns", "frame_number": 8486, "timestamp_epoch": "1647901480.625418000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58606, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a26e5949d9073bcbaf0e66e6", "kind": "dns", "frame_number": 8536, "timestamp_epoch": "1647901712.694874000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64920, "dst_port": 53, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-91a9409acb2eca00a9ed4a7c", "kind": "dns", "frame_number": 8537, "timestamp_epoch": "1647901712.776868000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64920, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-78318d1d13415638656c2e90", "kind": "dns", "frame_number": 8569, "timestamp_epoch": "1647901731.556468000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50368, "dst_port": 53, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-45a7d78377a1ee055728eb8c", "kind": "dns", "frame_number": 8570, "timestamp_epoch": "1647901731.556759000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50368, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.a": "52.109.8.20", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-b7c546aee2f726b8d57f76df", "kind": "dns", "frame_number": 8593, "timestamp_epoch": "1647901739.547395000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52897, "dst_port": 53, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-739ab05698bd77f560a065a5", "kind": "dns", "frame_number": 8594, "timestamp_epoch": "1647901739.547659000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52897, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ba4b7af054e61b3f01f908e", "kind": "dns", "frame_number": 8621, "timestamp_epoch": "1647901774.196387000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59151, "dst_port": 53, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-4b5899a3a91faa3a6d28e376", "kind": "dns", "frame_number": 8622, "timestamp_epoch": "1647901774.201605000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59151, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.a": "209.197.3.8", "dns.cname": "wu-bg-shim.trafficmanager.net,cds.d2s7q6s2.hwcdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-82bacf9602a126b22aab0191", "kind": "dns", "frame_number": 8631, "timestamp_epoch": "1647901781.894821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59640, "dst_port": 53, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-40c9d1b828013d14d45c59c5", "kind": "dns", "frame_number": 8632, "timestamp_epoch": "1647901781.967039000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59640, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-d43fa92ed4fcb13c1ed7cfa2", "kind": "dns", "frame_number": 8651, "timestamp_epoch": "1647901792.203872000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50620, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-33cc10a6b9b65dd2b6601cb7", "kind": "dns", "frame_number": 8652, "timestamp_epoch": "1647901792.204194000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50620, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-c299b0bc9ed2eb4e213badd4", "kind": "dns", "frame_number": 8653, "timestamp_epoch": "1647901792.204896000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61076, "dst_port": 53, "tcp_stream": null, "udp_stream": 118, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-78247e2d9c57649e7e4d5d17", "kind": "dns", "frame_number": 8654, "timestamp_epoch": "1647901792.205809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61076, "tcp_stream": null, "udp_stream": 118, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-07c7e93e1dec76bad7be9a1d", "kind": "dns", "frame_number": 8690, "timestamp_epoch": "1647901985.572592000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54045, "dst_port": 53, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-783f8dbfd62ae3c2e7ca318a", "kind": "dns", "frame_number": 8691, "timestamp_epoch": "1647901985.638021000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54045, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.a": "13.89.179.10", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus12.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c9cedc818103301597fefa87", "kind": "dns", "frame_number": 8725, "timestamp_epoch": "1647902083.229061000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60172, "dst_port": 53, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-05d01b9935ac740f0a289d75", "kind": "dns", "frame_number": 8726, "timestamp_epoch": "1647902083.298925000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60172, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-172c6fd1618013a29c5abea8", "kind": "dns", "frame_number": 8797, "timestamp_epoch": "1647902384.525848000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52339, "dst_port": 53, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-278bc574854e32f4101b95b5", "kind": "dns", "frame_number": 8798, "timestamp_epoch": "1647902384.595952000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52339, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-8457163cdc64e4ab6695113f", "kind": "dns", "frame_number": 8817, "timestamp_epoch": "1647902392.176478000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55476, "dst_port": 53, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-67120e78505de44474a8434f", "kind": "dns", "frame_number": 8818, "timestamp_epoch": "1647902392.176830000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55476, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-1420f0bc7358d71d8e499157", "kind": "dns", "frame_number": 8819, "timestamp_epoch": "1647902392.177525000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53475, "dst_port": 53, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-28ecd4e26224dedb86702a10", "kind": "dns", "frame_number": 8820, "timestamp_epoch": "1647902392.178780000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53475, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d5f197a22fc60763154b0a39", "kind": "dns", "frame_number": 8845, "timestamp_epoch": "1647902554.350747000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61010, "dst_port": 53, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.response": "False", "dns.qry.name": "msedge.api.cdp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6cd01be82ade56b298b1dcf4", "kind": "dns", "frame_number": 8846, "timestamp_epoch": "1647902554.431788000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61010, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.a": "40.124.168.44", "dns.cname": "api.cdp.microsoft.com,glb.api.prod.dcat.dsp.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "msedge.api.cdp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c08cff5d1c35299a5b606421", "kind": "dns", "frame_number": 8880, "timestamp_epoch": "1647902555.456382000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62652, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1" } }, { "event_id": "evt-bb89f1a5a0326879ef48037e", "kind": "dns", "frame_number": 8881, "timestamp_epoch": "1647902555.517525000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62652, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.a": "13.107.42.16", "dns.cname": "config.edge.skype.com.trafficmanager.net,l-0007.config.skype.com,config-edge-skype.l-0007.l-msedge.net,l-0007.l-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1" } }, { "event_id": "evt-dfed749223a75d8374e923ff", "kind": "dns", "frame_number": 8955, "timestamp_epoch": "1647902685.922140000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56906, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-3bcd66f6826c1e52c22411bf", "kind": "dns", "frame_number": 8956, "timestamp_epoch": "1647902685.997939000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56906, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-42a4005e9d1aabcafa62a528", "kind": "dns", "frame_number": 9020, "timestamp_epoch": "1647902987.236830000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51473, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-820db912545e9badb5aa5763", "kind": "dns", "frame_number": 9021, "timestamp_epoch": "1647902987.313412000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51473, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-426abc5b2f2fc3ac1a5b56bc", "kind": "dns", "frame_number": 9040, "timestamp_epoch": "1647902992.140009000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60234, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a5ed248881ff3b36dff1ba9a", "kind": "dns", "frame_number": 9041, "timestamp_epoch": "1647902992.140343000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60234, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-42444dbe87958c6c37381c87", "kind": "dns", "frame_number": 9042, "timestamp_epoch": "1647902992.141040000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 65383, "dst_port": 53, "tcp_stream": null, "udp_stream": 129, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8bf7b8e01ad570c87f02a137", "kind": "dns", "frame_number": 9043, "timestamp_epoch": "1647902992.142589000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 65383, "tcp_stream": null, "udp_stream": 129, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-eb3d921d2ecf61e8bd9c9c91", "kind": "dns", "frame_number": 9088, "timestamp_epoch": "1647903288.562711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57633, "dst_port": 53, "tcp_stream": null, "udp_stream": 130, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-4f32490b618c1c358db46394", "kind": "dns", "frame_number": 9089, "timestamp_epoch": "1647903288.631759000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57633, "tcp_stream": null, "udp_stream": 130, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-25234c0119ac6473577720cd", "kind": "dns", "frame_number": 9178, "timestamp_epoch": "1647903589.879369000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54790, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-63eafcbce88071cf7d8f9dcb", "kind": "dns", "frame_number": 9179, "timestamp_epoch": "1647903589.952458000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54790, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-f108550d9da39607e47b0a9c", "kind": "dns", "frame_number": 9196, "timestamp_epoch": "1647903592.104979000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59416, "dst_port": 53, "tcp_stream": null, "udp_stream": 132, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-f5cb5f866ed19376f3cd6cd3", "kind": "dns", "frame_number": 9197, "timestamp_epoch": "1647903592.105367000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59416, "tcp_stream": null, "udp_stream": 132, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-fcb15f26477cd52831a91e77", "kind": "dns", "frame_number": 9198, "timestamp_epoch": "1647903592.106000000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59921, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-beae75a011a9c78fd9e50c5e", "kind": "dns", "frame_number": 9199, "timestamp_epoch": "1647903592.110381000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59921, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-7c441cd4392b0896c2b334ae", "kind": "dns", "frame_number": 9232, "timestamp_epoch": "1647903785.463465000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52242, "dst_port": 53, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-44458c10ee9d983c13a14667", "kind": "dns", "frame_number": 9233, "timestamp_epoch": "1647903785.528028000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52242, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.a": "20.44.10.123", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus05.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-10fabf0b59573aeeb79910ca", "kind": "dns", "frame_number": 9263, "timestamp_epoch": "1647903845.891286000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 65201, "dst_port": 53, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.flags.response": "False", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-58ea0509dc07b62c0ebb6083", "kind": "dns", "frame_number": 9264, "timestamp_epoch": "1647903845.962934000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 65201, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.a": "104.80.96.219", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-3314ec88f712b8e9e3c1ae3f", "kind": "dns", "frame_number": 9273, "timestamp_epoch": "1647903846.159132000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61154, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-60636d5d7e06abe225f2ac1f", "kind": "dns", "frame_number": 9275, "timestamp_epoch": "1647903846.224583000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61154, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "69.28.162.128,68.142.107.129", "dns.cname": "wu-bg-shim.trafficmanager.net,windowsupdatebg.s.llnwi.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-31016752064b17fcc3faca56", "kind": "dns", "frame_number": 9290, "timestamp_epoch": "1647903891.254544000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53727, "dst_port": 53, "tcp_stream": null, "udp_stream": 137, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a7edc4f1ed6aef20db32b268", "kind": "dns", "frame_number": 9291, "timestamp_epoch": "1647903891.324821000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53727, "tcp_stream": null, "udp_stream": 137, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-04a1003c56b8f6fc6988ee35", "kind": "dns", "frame_number": 9367, "timestamp_epoch": "1647904192.084672000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59797, "dst_port": 53, "tcp_stream": null, "udp_stream": 138, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-86c2425ead25243def480dda", "kind": "dns", "frame_number": 9368, "timestamp_epoch": "1647904192.085004000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59797, "tcp_stream": null, "udp_stream": 138, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-79f0bf455d03b1960de1981a", "kind": "dns", "frame_number": 9369, "timestamp_epoch": "1647904192.085690000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60764, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-386dff627c34f3b66c4e04c8", "kind": "dns", "frame_number": 9370, "timestamp_epoch": "1647904192.087383000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60764, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d6feb71e289877e44b6b04f3", "kind": "dns", "frame_number": 9371, "timestamp_epoch": "1647904192.502601000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53316, "dst_port": 53, "tcp_stream": null, "udp_stream": 140, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-6dcbb9d52a3647fad0cd1dd7", "kind": "dns", "frame_number": 9372, "timestamp_epoch": "1647904192.591784000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53316, "tcp_stream": null, "udp_stream": 140, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-308271e20fa7203a40c1c09f", "kind": "dns", "frame_number": 9418, "timestamp_epoch": "1647904329.932400000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53864, "dst_port": 53, "tcp_stream": null, "udp_stream": 141, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-fc40d9cf169d88416659e6d1", "kind": "dns", "frame_number": 9419, "timestamp_epoch": "1647904329.932844000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53864, "tcp_stream": null, "udp_stream": 141, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-f1ee63b916df30dadabb83c3", "kind": "dns", "frame_number": 9535, "timestamp_epoch": "1647904493.970621000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60361, "dst_port": 53, "tcp_stream": null, "udp_stream": 144, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-50dae2646cb1e1a1291209c8", "kind": "dns", "frame_number": 9536, "timestamp_epoch": "1647904493.981823000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60361, "tcp_stream": null, "udp_stream": 144, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-f925cddf42e06e3dd6b7d81c", "kind": "dns", "frame_number": 9609, "timestamp_epoch": "1647904588.611287000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 65146, "dst_port": 53, "tcp_stream": null, "udp_stream": 146, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-15ba19cb0138f2c04297fa97", "kind": "dns", "frame_number": 9610, "timestamp_epoch": "1647904588.611570000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 65146, "tcp_stream": null, "udp_stream": 146, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3188feaca337fcdcd2e4b602", "kind": "dns", "frame_number": 9698, "timestamp_epoch": "1647904792.054425000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61704, "dst_port": 53, "tcp_stream": null, "udp_stream": 147, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-01810dbbf767b25f389850c6", "kind": "dns", "frame_number": 9699, "timestamp_epoch": "1647904792.054737000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61704, "tcp_stream": null, "udp_stream": 147, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-e45044da62921df01740a5c5", "kind": "dns", "frame_number": 9700, "timestamp_epoch": "1647904792.055489000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57624, "dst_port": 53, "tcp_stream": null, "udp_stream": 148, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-c3e2098ae44a87911371cc21", "kind": "dns", "frame_number": 9701, "timestamp_epoch": "1647904792.056888000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57624, "tcp_stream": null, "udp_stream": 148, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-057b4ce659ec1fe15d9f68ae", "kind": "dns", "frame_number": 9702, "timestamp_epoch": "1647904795.243636000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58822, "dst_port": 53, "tcp_stream": null, "udp_stream": 149, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-5cb3d7c6d1248b5101c24c63", "kind": "dns", "frame_number": 9703, "timestamp_epoch": "1647904795.312746000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58822, "tcp_stream": null, "udp_stream": 149, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-595a9cb002bc94a314420464", "kind": "dns", "frame_number": 9726, "timestamp_epoch": "1647904855.490035000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 53, "tcp_stream": null, "udp_stream": 150, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-17e0ddbe7240b574293cc50b", "kind": "dns", "frame_number": 9727, "timestamp_epoch": "1647904855.570192000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62515, "tcp_stream": null, "udp_stream": 150, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-20360b115ddc4dcdbca01bc8", "kind": "dns", "frame_number": 9784, "timestamp_epoch": "1647904915.972082000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56983, "dst_port": 53, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-11e791be0d2d414800411581", "kind": "dns", "frame_number": 9785, "timestamp_epoch": "1647904915.972540000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56983, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.a": "72.21.81.240", "dns.cname": "wu-bg-shim.trafficmanager.net,wu.azureedge.net,wu.ec.azureedge.net,bg.apr-52dd2-0503.edgecastdns.net,hlb.apr-52dd2-0.edgecastdns.net,cs11.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-bc4eec203205f98a888ed072", "kind": "dns", "frame_number": 9822, "timestamp_epoch": "1647905096.536819000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51378, "dst_port": 53, "tcp_stream": null, "udp_stream": 152, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7492dc892dd36335e197d38b", "kind": "dns", "frame_number": 9823, "timestamp_epoch": "1647905096.604985000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51378, "tcp_stream": null, "udp_stream": 152, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4ddfb768ca9f6fcd1d87d42", "kind": "dns", "frame_number": 9879, "timestamp_epoch": "1647905313.116471000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54607, "dst_port": 53, "tcp_stream": null, "udp_stream": 153, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a524110c5c0e0836a4bfbee6", "kind": "dns", "frame_number": 9880, "timestamp_epoch": "1647905313.197580000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54607, "tcp_stream": null, "udp_stream": 153, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-aba39d6c01b42c773f511586", "kind": "dns", "frame_number": 9914, "timestamp_epoch": "1647905339.407608000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 154, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-58459308a00ba8a993f5bf32", "kind": "dns", "frame_number": 9915, "timestamp_epoch": "1647905339.407918000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 154, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-7c820c497d3773d0acb8b9eb", "kind": "dns", "frame_number": 9946, "timestamp_epoch": "1647905392.017202000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50792, "dst_port": 53, "tcp_stream": null, "udp_stream": 155, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-fac2978669d42751c5a0c200", "kind": "dns", "frame_number": 9947, "timestamp_epoch": "1647905392.017569000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50792, "tcp_stream": null, "udp_stream": 155, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-1156a2e3bb9db5f34e2273fe", "kind": "dns", "frame_number": 9948, "timestamp_epoch": "1647905392.018223000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59885, "dst_port": 53, "tcp_stream": null, "udp_stream": 156, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-17c2c2b1aa46cd61da214f84", "kind": "dns", "frame_number": 9949, "timestamp_epoch": "1647905392.019817000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59885, "tcp_stream": null, "udp_stream": 156, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8555ed109f3bb6495cca57e1", "kind": "dns", "frame_number": 9952, "timestamp_epoch": "1647905397.909846000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49155, "dst_port": 53, "tcp_stream": null, "udp_stream": 157, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0cafe95050f900173738d7f", "kind": "dns", "frame_number": 9953, "timestamp_epoch": "1647905397.981337000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49155, "tcp_stream": null, "udp_stream": 157, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-4397379373ed0da321c6b640", "kind": "dns", "frame_number": 10043, "timestamp_epoch": "1647905585.390605000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54856, "dst_port": 53, "tcp_stream": null, "udp_stream": 158, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a82deca562b55b9b4cb1c26b", "kind": "dns", "frame_number": 10044, "timestamp_epoch": "1647905585.460309000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54856, "tcp_stream": null, "udp_stream": 158, "fields": { "dns.a": "13.69.239.74", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdneu06.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6a9ea9406ba316cc84c95fdd", "kind": "dns", "frame_number": 10090, "timestamp_epoch": "1647905699.207184000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62998, "dst_port": 53, "tcp_stream": null, "udp_stream": 159, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-b7a0f92945b9c63557f064bb", "kind": "dns", "frame_number": 10091, "timestamp_epoch": "1647905699.280835000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62998, "tcp_stream": null, "udp_stream": 159, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-8efc9c266aa9f673d2ccec5b", "kind": "dns", "frame_number": 10156, "timestamp_epoch": "1647905991.986886000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56190, "dst_port": 53, "tcp_stream": null, "udp_stream": 160, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a49d8b559a689d27abdf5861", "kind": "dns", "frame_number": 10157, "timestamp_epoch": "1647905991.987275000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56190, "tcp_stream": null, "udp_stream": 160, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-6af1a20cc368fb86103ca119", "kind": "dns", "frame_number": 10158, "timestamp_epoch": "1647905991.987937000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52897, "dst_port": 53, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-dadb7e52b8b2c79d3796ea3a", "kind": "dns", "frame_number": 10159, "timestamp_epoch": "1647905991.989608000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52897, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-fcedc41b1466a6b34ac33853", "kind": "dns", "frame_number": 10162, "timestamp_epoch": "1647906000.530706000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52013, "dst_port": 53, "tcp_stream": null, "udp_stream": 161, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-1dbb0fd2de031520b3c5b949", "kind": "dns", "frame_number": 10163, "timestamp_epoch": "1647906000.595824000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52013, "tcp_stream": null, "udp_stream": 161, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d99ccbc20139f80bd64938f", "kind": "dns", "frame_number": 10210, "timestamp_epoch": "1647906213.831441000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58858, "dst_port": 53, "tcp_stream": null, "udp_stream": 162, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d36d4708689484391a547ff8", "kind": "dns", "frame_number": 10211, "timestamp_epoch": "1647906213.909932000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58858, "tcp_stream": null, "udp_stream": 162, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-da0c4324f5e312e85313588c", "kind": "dns", "frame_number": 10270, "timestamp_epoch": "1647906274.228386000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63235, "dst_port": 53, "tcp_stream": null, "udp_stream": 163, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-7bd95909c05d5594e0e95ae0", "kind": "dns", "frame_number": 10271, "timestamp_epoch": "1647906274.295724000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63235, "tcp_stream": null, "udp_stream": 163, "fields": { "dns.a": "72.21.81.240", "dns.cname": "wu-bg-shim.trafficmanager.net,wu.azureedge.net,wu.ec.azureedge.net,bg.apr-52dd2-0503.edgecastdns.net,hlb.apr-52dd2-0.edgecastdns.net,cs11.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-e02909a3ea1d5dc2c511ef9d", "kind": "dns", "frame_number": 10279, "timestamp_epoch": "1647906301.840534000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49300, "dst_port": 53, "tcp_stream": null, "udp_stream": 164, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-78ea453e3e147991cb1d9ce8", "kind": "dns", "frame_number": 10280, "timestamp_epoch": "1647906301.907024000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49300, "tcp_stream": null, "udp_stream": 164, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-0aa16aa1df5852f3c99f7132", "kind": "dns", "frame_number": 10354, "timestamp_epoch": "1647906591.949889000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59128, "dst_port": 53, "tcp_stream": null, "udp_stream": 165, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-39d044e5f93f73c550e2919c", "kind": "dns", "frame_number": 10355, "timestamp_epoch": "1647906591.950253000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59128, "tcp_stream": null, "udp_stream": 165, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-aab746a293c7538810a2810d", "kind": "dns", "frame_number": 10356, "timestamp_epoch": "1647906591.950939000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63278, "dst_port": 53, "tcp_stream": null, "udp_stream": 166, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-47918fe9e50a14251934df3a", "kind": "dns", "frame_number": 10357, "timestamp_epoch": "1647906591.952736000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63278, "tcp_stream": null, "udp_stream": 166, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-0fa4caf385e622be0ba379aa", "kind": "dns", "frame_number": 10360, "timestamp_epoch": "1647906603.155864000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53282, "dst_port": 53, "tcp_stream": null, "udp_stream": 167, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-5c64e04aae3294d13b4caea4", "kind": "dns", "frame_number": 10361, "timestamp_epoch": "1647906603.224852000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53282, "tcp_stream": null, "udp_stream": 167, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-419fe6f260f4c0eee26866e0", "kind": "dns", "frame_number": 10418, "timestamp_epoch": "1647906904.639324000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50954, "dst_port": 53, "tcp_stream": null, "udp_stream": 168, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-5be8c27ec2d882bc28e736c0", "kind": "dns", "frame_number": 10419, "timestamp_epoch": "1647906904.713136000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50954, "tcp_stream": null, "udp_stream": 168, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a91e6cab7c2f04f2ef99ca01", "kind": "dns", "frame_number": 10753, "timestamp_epoch": "1647907191.917456000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49589, "dst_port": 53, "tcp_stream": null, "udp_stream": 171, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a358e188ff7fa8bba06b8c86", "kind": "dns", "frame_number": 10754, "timestamp_epoch": "1647907191.917931000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49589, "tcp_stream": null, "udp_stream": 171, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-862e99e253d596f849be4bd5", "kind": "dns", "frame_number": 10755, "timestamp_epoch": "1647907191.918645000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50906, "dst_port": 53, "tcp_stream": null, "udp_stream": 172, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-3f90705abaacc9158cc9fdc1", "kind": "dns", "frame_number": 10756, "timestamp_epoch": "1647907191.920306000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50906, "tcp_stream": null, "udp_stream": 172, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-62e5f5cecec8256f8de5ab4d", "kind": "dns", "frame_number": 10759, "timestamp_epoch": "1647907205.982858000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52322, "dst_port": 53, "tcp_stream": null, "udp_stream": 173, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-409f713d653e9711eb07a0e8", "kind": "dns", "frame_number": 10760, "timestamp_epoch": "1647907206.056611000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52322, "tcp_stream": null, "udp_stream": 173, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7e4e7691089ec7c74f7983ff", "kind": "dns", "frame_number": 10807, "timestamp_epoch": "1647907385.286879000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58343, "dst_port": 53, "tcp_stream": null, "udp_stream": 174, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-fc9f73b61f158b4e187ccf1d", "kind": "dns", "frame_number": 10808, "timestamp_epoch": "1647907385.351605000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58343, "tcp_stream": null, "udp_stream": 174, "fields": { "dns.a": "20.189.173.2", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdwus01.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-17f0cd79a111056710348bef", "kind": "dns", "frame_number": 10847, "timestamp_epoch": "1647907507.290689000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51312, "dst_port": 53, "tcp_stream": null, "udp_stream": 175, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-cfb082ee9d8944a7ea25d7eb", "kind": "dns", "frame_number": 10848, "timestamp_epoch": "1647907507.363585000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51312, "tcp_stream": null, "udp_stream": 175, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-37d816bc98b8c71062770c8f", "kind": "dns", "frame_number": 10912, "timestamp_epoch": "1647907791.889072000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55346, "dst_port": 53, "tcp_stream": null, "udp_stream": 176, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-e13848c8c8a2f1fb19b50b06", "kind": "dns", "frame_number": 10913, "timestamp_epoch": "1647907791.889455000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55346, "tcp_stream": null, "udp_stream": 176, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-232be564b696ead3bcc1048f", "kind": "dns", "frame_number": 10914, "timestamp_epoch": "1647907791.890064000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51103, "dst_port": 53, "tcp_stream": null, "udp_stream": 177, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-1bde486241cf3b00502013ca", "kind": "dns", "frame_number": 10915, "timestamp_epoch": "1647907791.891321000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51103, "tcp_stream": null, "udp_stream": 177, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-85b778250d7130a709b5660c", "kind": "dns", "frame_number": 10916, "timestamp_epoch": "1647907808.608248000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49790, "dst_port": 53, "tcp_stream": null, "udp_stream": 178, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-91748d8e4e52dbddbf9d89c3", "kind": "dns", "frame_number": 10917, "timestamp_epoch": "1647907808.676124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49790, "tcp_stream": null, "udp_stream": 178, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-84519997aa63d144a75db6f6", "kind": "dns", "frame_number": 10949, "timestamp_epoch": "1647907929.982029000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62166, "dst_port": 53, "tcp_stream": null, "udp_stream": 179, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-d5b98fcf14593f3e1917a677", "kind": "dns", "frame_number": 10950, "timestamp_epoch": "1647907929.982475000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62166, "tcp_stream": null, "udp_stream": 179, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-64d1921d6fd8186e24279db5", "kind": "dns", "frame_number": 11070, "timestamp_epoch": "1647908109.912806000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57346, "dst_port": 53, "tcp_stream": null, "udp_stream": 181, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-909c04de44edba42b2f80543", "kind": "dns", "frame_number": 11071, "timestamp_epoch": "1647908109.988365000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57346, "tcp_stream": null, "udp_stream": 181, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-6b094e1dcd1e756419b97368", "kind": "dns", "frame_number": 11127, "timestamp_epoch": "1647908352.791444000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63371, "dst_port": 53, "tcp_stream": null, "udp_stream": 182, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-28dc735a94ee701cb9f4401f", "kind": "dns", "frame_number": 11128, "timestamp_epoch": "1647908352.791792000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63371, "tcp_stream": null, "udp_stream": 182, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-e54d5b2b383aaf76ed6ebbaf", "kind": "dns", "frame_number": 11157, "timestamp_epoch": "1647908391.857040000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53863, "dst_port": 53, "tcp_stream": null, "udp_stream": 183, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-65bfd8bf6f79ec33e40afef3", "kind": "dns", "frame_number": 11158, "timestamp_epoch": "1647908391.857378000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53863, "tcp_stream": null, "udp_stream": 183, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-144c3c51ee79f9b255c943b7", "kind": "dns", "frame_number": 11159, "timestamp_epoch": "1647908391.858032000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52683, "dst_port": 53, "tcp_stream": null, "udp_stream": 184, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-a85f1aca2f372ec55e4174b8", "kind": "dns", "frame_number": 11160, "timestamp_epoch": "1647908391.859182000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52683, "tcp_stream": null, "udp_stream": 184, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8e9ddfd918a14038a8281cd0", "kind": "dns", "frame_number": 11161, "timestamp_epoch": "1647908411.282666000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49798, "dst_port": 53, "tcp_stream": null, "udp_stream": 185, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-6d192692313a4d4cde6c49bf", "kind": "dns", "frame_number": 11162, "timestamp_epoch": "1647908411.362112000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49798, "tcp_stream": null, "udp_stream": 185, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-8fee7930a3f2ad1dfe7db0fd", "kind": "dns", "frame_number": 11181, "timestamp_epoch": "1647908427.524835000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63240, "dst_port": 53, "tcp_stream": null, "udp_stream": 186, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-e863c06df73a0140dd7f5ce6", "kind": "dns", "frame_number": 11182, "timestamp_epoch": "1647908427.525115000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63240, "tcp_stream": null, "udp_stream": 186, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7a1399e5a986fa87b08982c0", "kind": "dns", "frame_number": 11196, "timestamp_epoch": "1647908448.299104000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58414, "dst_port": 53, "tcp_stream": null, "udp_stream": 187, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-a04d677eb92b79498ceb680e", "kind": "dns", "frame_number": 11197, "timestamp_epoch": "1647908448.369261000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58414, "tcp_stream": null, "udp_stream": 187, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ba552b1e788fe508947310f", "kind": "dns", "frame_number": 11212, "timestamp_epoch": "1647908464.863822000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64099, "dst_port": 53, "tcp_stream": null, "udp_stream": 188, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-6e1de2126c5efc8b6618f493", "kind": "dns", "frame_number": 11213, "timestamp_epoch": "1647908464.864132000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64099, "tcp_stream": null, "udp_stream": 188, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-b71abb89838a8793f5150bb9", "kind": "dns", "frame_number": 11231, "timestamp_epoch": "1647908484.394650000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49594, "dst_port": 53, "tcp_stream": null, "udp_stream": 189, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-4fb769b71056db88d7ce4598", "kind": "dns", "frame_number": 11232, "timestamp_epoch": "1647908484.447812000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49594, "tcp_stream": null, "udp_stream": 189, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-8999a568d33615a89b94b681", "kind": "dns", "frame_number": 11249, "timestamp_epoch": "1647908503.229161000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56153, "dst_port": 53, "tcp_stream": null, "udp_stream": 190, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-fb0efe519d67428a2027a772", "kind": "dns", "frame_number": 11250, "timestamp_epoch": "1647908503.229541000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56153, "tcp_stream": null, "udp_stream": 190, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-dff947fd0b7b345ce85a1af9", "kind": "dns", "frame_number": 11265, "timestamp_epoch": "1647908506.018605000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59779, "dst_port": 53, "tcp_stream": null, "udp_stream": 191, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-2439edddde9c8228b911a2c5", "kind": "dns", "frame_number": 11266, "timestamp_epoch": "1647908506.092539000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59779, "tcp_stream": null, "udp_stream": 191, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-603a0b80f5741622aae2ac6f", "kind": "dns", "frame_number": 11279, "timestamp_epoch": "1647908509.232882000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55741, "dst_port": 53, "tcp_stream": null, "udp_stream": 192, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-3272e2ca2dbc4646efc20f1d", "kind": "dns", "frame_number": 11280, "timestamp_epoch": "1647908509.233184000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55741, "tcp_stream": null, "udp_stream": 192, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-db91cfd9e8f079f08c45aa67", "kind": "dns", "frame_number": 11437, "timestamp_epoch": "1647908834.950001000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50225, "dst_port": 53, "tcp_stream": null, "udp_stream": 193, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-5b18cf158f4cecafb5c1931a", "kind": "dns", "frame_number": 11438, "timestamp_epoch": "1647908835.020571000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50225, "tcp_stream": null, "udp_stream": 193, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-1186683e9dc5db20ae40cb72", "kind": "dns", "frame_number": 11453, "timestamp_epoch": "1647908840.549542000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50472, "dst_port": 53, "tcp_stream": null, "udp_stream": 194, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-4a6cb730388979a8a3adb76b", "kind": "dns", "frame_number": 11454, "timestamp_epoch": "1647908840.620000000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50472, "tcp_stream": null, "udp_stream": 194, "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,www-bing-com.dual-a-0001.a-msedge.net,dual-a-0001.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-7c9edfeb69866087e83e0245", "kind": "dns", "frame_number": 11573, "timestamp_epoch": "1647908840.836334000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56753, "dst_port": 53, "tcp_stream": null, "udp_stream": 196, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-b0d68e08341a59c18d73b31e", "kind": "dns", "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56753, "tcp_stream": null, "udp_stream": 196, "fields": { "dns.a": "40.126.26.134,20.190.154.17,40.126.26.135,20.190.154.137,20.190.154.18,20.190.154.19,20.190.154.16,20.190.154.139", "dns.cname": "ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-7db03b28d5ee162e1bcda35d", "kind": "dns", "frame_number": 11610, "timestamp_epoch": "1647908842.090282000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49627, "dst_port": 53, "tcp_stream": null, "udp_stream": 197, "fields": { "dns.flags.response": "False", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-4f13acd58a55136b8676234b", "kind": "dns", "frame_number": 11611, "timestamp_epoch": "1647908842.157512000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49627, "tcp_stream": null, "udp_stream": 197, "fields": { "dns.a": "20.69.130.185", "dns.cname": "arc.trafficmanager.net,iris-de-prod-azsc-wus2-b.westus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-8ac636788e05768a4f3821bb", "kind": "dns", "frame_number": 11645, "timestamp_epoch": "1647908871.947232000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50354, "dst_port": 53, "tcp_stream": null, "udp_stream": 198, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-2359c2f0128b100d70315004", "kind": "dns", "frame_number": 11646, "timestamp_epoch": "1647908872.023190000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50354, "tcp_stream": null, "udp_stream": 198, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-caaa40cb909e61d3598437e7", "kind": "dns", "frame_number": 11669, "timestamp_epoch": "1647908907.971170000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61449, "dst_port": 53, "tcp_stream": null, "udp_stream": 199, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-3f6347026290e9bfea5a3adc", "kind": "dns", "frame_number": 11670, "timestamp_epoch": "1647908908.046392000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61449, "tcp_stream": null, "udp_stream": 199, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-b97bcbb20087ea3ec99effec", "kind": "dns", "frame_number": 11681, "timestamp_epoch": "1647908914.366050000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55002, "dst_port": 53, "tcp_stream": null, "udp_stream": 200, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0fbc1e9ee1d797af08afb199", "kind": "dns", "frame_number": 11682, "timestamp_epoch": "1647908914.373928000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55002, "tcp_stream": null, "udp_stream": 200, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-aaa26cab3dbc318d3fb70bbe", "kind": "dns", "frame_number": 11709, "timestamp_epoch": "1647908939.270586000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59239, "dst_port": 53, "tcp_stream": null, "udp_stream": 201, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-28fa6ba2b51da4fd79e8b434", "kind": "dns", "frame_number": 11710, "timestamp_epoch": "1647908939.270960000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59239, "tcp_stream": null, "udp_stream": 201, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-00dcfcfcf711cb8f5a4519b1", "kind": "dns", "frame_number": 11733, "timestamp_epoch": "1647908943.956509000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55485, "dst_port": 53, "tcp_stream": null, "udp_stream": 202, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-80df46925773eea26d10c0da", "kind": "dns", "frame_number": 11734, "timestamp_epoch": "1647908944.028205000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55485, "tcp_stream": null, "udp_stream": 202, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-b8fc5c2a0020b9887d69e13a", "kind": "dns", "frame_number": 11752, "timestamp_epoch": "1647908974.712537000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62994, "dst_port": 53, "tcp_stream": null, "udp_stream": 203, "fields": { "dns.flags.response": "False", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-f30a35020ebd5eaa030efe80", "kind": "dns", "frame_number": 11753, "timestamp_epoch": "1647908974.793242000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62994, "tcp_stream": null, "udp_stream": 203, "fields": { "dns.a": "104.80.96.219", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-2dce8b05e5bf8d5c4ac7b924", "kind": "dns", "frame_number": 11762, "timestamp_epoch": "1647908975.095262000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56152, "dst_port": 53, "tcp_stream": null, "udp_stream": 204, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-799102c890a02d5be0e30c76", "kind": "dns", "frame_number": 11763, "timestamp_epoch": "1647908975.099405000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56152, "tcp_stream": null, "udp_stream": 204, "fields": { "dns.a": "209.197.3.8", "dns.cname": "wu-bg-shim.trafficmanager.net,cds.d2s7q6s2.hwcdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-1d381c7d493c9d11c8586f66", "kind": "dns", "frame_number": 11781, "timestamp_epoch": "1647908991.826814000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61421, "dst_port": 53, "tcp_stream": null, "udp_stream": 205, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3747d806be15eeff1e966ea2", "kind": "dns", "frame_number": 11782, "timestamp_epoch": "1647908991.827209000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61421, "tcp_stream": null, "udp_stream": 205, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7372b7c80fa3dc6418b7498", "kind": "dns", "frame_number": 11783, "timestamp_epoch": "1647908991.827494000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51225, "dst_port": 53, "tcp_stream": null, "udp_stream": 206, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-f4a3d111e12ea5a5819705cc", "kind": "dns", "frame_number": 11784, "timestamp_epoch": "1647908991.828577000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51225, "tcp_stream": null, "udp_stream": 206, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-cbbcf9b497e27d337d7adbdc", "kind": "dns", "frame_number": 11802, "timestamp_epoch": "1647909021.912173000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59638, "dst_port": 53, "tcp_stream": null, "udp_stream": 207, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad6745ad60d4beb7e1f95846", "kind": "dns", "frame_number": 11803, "timestamp_epoch": "1647909021.990143000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59638, "tcp_stream": null, "udp_stream": 207, "fields": { "dns.a": "52.109.8.19", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-b763316c47fe22ea4bf906e1", "kind": "dns", "frame_number": 11863, "timestamp_epoch": "1647909140.335688000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57690, "dst_port": 53, "tcp_stream": null, "udp_stream": 208, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-8239d58af6599737a697d164", "kind": "dns", "frame_number": 11864, "timestamp_epoch": "1647909140.335995000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57690, "tcp_stream": null, "udp_stream": 208, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-691563f7de540769d30603e2", "kind": "dns", "frame_number": 11880, "timestamp_epoch": "1647909185.185821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62361, "dst_port": 53, "tcp_stream": null, "udp_stream": 209, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-61f2c2379997670da76c910d", "kind": "dns", "frame_number": 11881, "timestamp_epoch": "1647909185.251727000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62361, "tcp_stream": null, "udp_stream": 209, "fields": { "dns.a": "40.74.98.194", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdjpw02.japanwest.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a61820e217b5584e6094abae", "kind": "dns", "frame_number": 11923, "timestamp_epoch": "1647909423.949276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63304, "dst_port": 53, "tcp_stream": null, "udp_stream": 210, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-66e65f15a292a750f8a5e203", "kind": "dns", "frame_number": 11924, "timestamp_epoch": "1647909424.026850000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63304, "tcp_stream": null, "udp_stream": 210, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-4d7ff508babe9970074ca25f", "kind": "dns", "frame_number": 11942, "timestamp_epoch": "1647909460.971903000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51715, "dst_port": 53, "tcp_stream": null, "udp_stream": 211, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-3f96fac655a7818a270d8735", "kind": "dns", "frame_number": 11943, "timestamp_epoch": "1647909461.046360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51715, "tcp_stream": null, "udp_stream": 211, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-20c3e271689712601154bd5a", "kind": "dns", "frame_number": 11961, "timestamp_epoch": "1647909496.965253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58808, "dst_port": 53, "tcp_stream": null, "udp_stream": 212, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-ff5e1c8427d46d3235963c06", "kind": "dns", "frame_number": 11962, "timestamp_epoch": "1647909497.039908000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58808, "tcp_stream": null, "udp_stream": 212, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-2c4c3d04793e66eafc890c13", "kind": "dns", "frame_number": 11976, "timestamp_epoch": "1647909532.954492000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54856, "dst_port": 53, "tcp_stream": null, "udp_stream": 158, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-2fc9cfeb90c7fd6bd18bdd0b", "kind": "dns", "frame_number": 11977, "timestamp_epoch": "1647909533.036511000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54856, "tcp_stream": null, "udp_stream": 158, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-849fccb86c1ad3152a040659", "kind": "dns", "frame_number": 12003, "timestamp_epoch": "1647909591.793934000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60079, "dst_port": 53, "tcp_stream": null, "udp_stream": 213, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-edcc0966da2c972cdf79f004", "kind": "dns", "frame_number": 12004, "timestamp_epoch": "1647909591.794268000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60079, "tcp_stream": null, "udp_stream": 213, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-4a71cafac6edd9fcdfccf7aa", "kind": "dns", "frame_number": 12005, "timestamp_epoch": "1647909591.794974000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55357, "dst_port": 53, "tcp_stream": null, "udp_stream": 214, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-9868a5905ba3de0e1a73d7b2", "kind": "dns", "frame_number": 12006, "timestamp_epoch": "1647909591.796744000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55357, "tcp_stream": null, "udp_stream": 214, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-f264eb844d98396e42f7aec3", "kind": "dns", "frame_number": 12052, "timestamp_epoch": "1647909772.652427000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50958, "dst_port": 53, "tcp_stream": null, "udp_stream": 215, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-2671b57e94e2f7bbbf830a60", "kind": "dns", "frame_number": 12053, "timestamp_epoch": "1647909772.652796000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50958, "tcp_stream": null, "udp_stream": 215, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-442062a8f76c6b0e80e9a1ba", "kind": "dns", "frame_number": 12100, "timestamp_epoch": "1647910012.936622000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61061, "dst_port": 53, "tcp_stream": null, "udp_stream": 216, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-e170d26741b8d3b423b3beec", "kind": "dns", "frame_number": 12101, "timestamp_epoch": "1647910013.007175000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61061, "tcp_stream": null, "udp_stream": 216, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-a56b85714ac7c5ffc03c9c1b", "kind": "dns", "frame_number": 12115, "timestamp_epoch": "1647910049.945298000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62557, "dst_port": 53, "tcp_stream": null, "udp_stream": 217, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-a9274a3d5477af3cee7a1c12", "kind": "dns", "frame_number": 12116, "timestamp_epoch": "1647910050.021645000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62557, "tcp_stream": null, "udp_stream": 217, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-5c65eef969252912e3f25ae9", "kind": "dns", "frame_number": 12130, "timestamp_epoch": "1647910085.943073000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51748, "dst_port": 53, "tcp_stream": null, "udp_stream": 218, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-b22327af13dccce763a42f72", "kind": "dns", "frame_number": 12131, "timestamp_epoch": "1647910086.023225000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51748, "tcp_stream": null, "udp_stream": 218, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-2ba09009b3ee8e3ad823e11d", "kind": "dns", "frame_number": 12155, "timestamp_epoch": "1647910123.800651000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50113, "dst_port": 53, "tcp_stream": null, "udp_stream": 219, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-476e291ce6f1e759ca925dca", "kind": "dns", "frame_number": 12156, "timestamp_epoch": "1647910123.880529000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50113, "tcp_stream": null, "udp_stream": 219, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-b049e73a7711904452b16317", "kind": "dns", "frame_number": 12203, "timestamp_epoch": "1647910170.319167000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57604, "dst_port": 53, "tcp_stream": null, "udp_stream": 221, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-4ffb3d9cacd1a061ceb4cec5", "kind": "dns", "frame_number": 12204, "timestamp_epoch": "1647910170.319478000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57604, "tcp_stream": null, "udp_stream": 221, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-946d01ab8bc8c4268c42a176", "kind": "dns", "frame_number": 12283, "timestamp_epoch": "1647910191.759236000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51248, "dst_port": 53, "tcp_stream": null, "udp_stream": 222, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-244ac9aa57b0db733805c592", "kind": "dns", "frame_number": 12284, "timestamp_epoch": "1647910191.759611000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51248, "tcp_stream": null, "udp_stream": 222, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-acfe254e1bd3f39022268e4e", "kind": "dns", "frame_number": 12285, "timestamp_epoch": "1647910191.760270000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58508, "dst_port": 53, "tcp_stream": null, "udp_stream": 223, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-eef81b35747c211889e45a49", "kind": "dns", "frame_number": 12286, "timestamp_epoch": "1647910191.761968000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58508, "tcp_stream": null, "udp_stream": 223, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-a633264f03449d67ecb40b54", "kind": "dns", "frame_number": 12341, "timestamp_epoch": "1647910404.964815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64870, "dst_port": 53, "tcp_stream": null, "udp_stream": 224, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-d6e76e08610bd666fc26bafc", "kind": "dns", "frame_number": 12342, "timestamp_epoch": "1647910404.965177000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64870, "tcp_stream": null, "udp_stream": 224, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-7f69019131fd4f8e3371171b", "kind": "dns", "frame_number": 12369, "timestamp_epoch": "1647910605.918648000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64560, "dst_port": 53, "tcp_stream": null, "udp_stream": 225, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-116d8155f28a0df4fb9ad0d6", "kind": "dns", "frame_number": 12370, "timestamp_epoch": "1647910605.993850000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64560, "tcp_stream": null, "udp_stream": 225, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4332ed635257fb919e74c68", "kind": "dns", "frame_number": 12387, "timestamp_epoch": "1647910642.928367000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49168, "dst_port": 53, "tcp_stream": null, "udp_stream": 226, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-384f4c506df7e2ccbda7d1cf", "kind": "dns", "frame_number": 12388, "timestamp_epoch": "1647910642.997866000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49168, "tcp_stream": null, "udp_stream": 226, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-cf862a3fd043b92caf86b781", "kind": "dns", "frame_number": 12404, "timestamp_epoch": "1647910679.014059000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54672, "dst_port": 53, "tcp_stream": null, "udp_stream": 227, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-0a9fcdfacb37d88f81a29493", "kind": "dns", "frame_number": 12405, "timestamp_epoch": "1647910679.289365000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54672, "tcp_stream": null, "udp_stream": 227, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-f704a5583f5ac9770d5a153e", "kind": "dns", "frame_number": 12424, "timestamp_epoch": "1647910714.738620000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59563, "dst_port": 53, "tcp_stream": null, "udp_stream": 228, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d8c1ae1deef62cafbbc075a9", "kind": "dns", "frame_number": 12425, "timestamp_epoch": "1647910714.821659000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59563, "tcp_stream": null, "udp_stream": 228, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-66fd7a75f85c9e880d946882", "kind": "dns", "frame_number": 12446, "timestamp_epoch": "1647910717.948763000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57352, "dst_port": 53, "tcp_stream": null, "udp_stream": 229, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-50521cf2680c1c979c07f1d4", "kind": "dns", "frame_number": 12447, "timestamp_epoch": "1647910718.028919000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57352, "tcp_stream": null, "udp_stream": 229, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-8fb6f1fce442c5bcbb6e2939", "kind": "dns", "frame_number": 12497, "timestamp_epoch": "1647910775.633696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51632, "dst_port": 53, "tcp_stream": null, "udp_stream": 230, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-b133810fec9262e932f285f2", "kind": "dns", "frame_number": 12498, "timestamp_epoch": "1647910775.634931000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51632, "tcp_stream": null, "udp_stream": 230, "fields": { "dns.a": "209.197.3.8", "dns.cname": "wu-bg-shim.trafficmanager.net,cds.d2s7q6s2.hwcdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a34e022ea3aa24c167cbef6", "kind": "dns", "frame_number": 12524, "timestamp_epoch": "1647910791.721370000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49408, "dst_port": 53, "tcp_stream": null, "udp_stream": 231, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-eaa140cf784a8b39cc5bd2cc", "kind": "dns", "frame_number": 12525, "timestamp_epoch": "1647910791.721741000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49408, "tcp_stream": null, "udp_stream": 231, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-7125048f6e11888af422cf84", "kind": "dns", "frame_number": 12526, "timestamp_epoch": "1647910791.722448000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56113, "dst_port": 53, "tcp_stream": null, "udp_stream": 232, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-7c6d37ff383f82863f2d7690", "kind": "dns", "frame_number": 12527, "timestamp_epoch": "1647910791.723893000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56113, "tcp_stream": null, "udp_stream": 232, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-7c03ca37a35a6d93af7a86a7", "kind": "dns", "frame_number": 12567, "timestamp_epoch": "1647910985.189193000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55744, "dst_port": 53, "tcp_stream": null, "udp_stream": 233, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c7d1b83fd042ea620eba5659", "kind": "dns", "frame_number": 12568, "timestamp_epoch": "1647910985.194080000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55744, "tcp_stream": null, "udp_stream": 233, "fields": { "dns.a": "52.182.143.210", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus10.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a6698af1a67fed91ebe0c065", "kind": "dns", "frame_number": 12670, "timestamp_epoch": "1647911021.994279000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56307, "dst_port": 53, "tcp_stream": null, "udp_stream": 236, "fields": { "dns.flags.response": "False", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a63bb91ceb9f6f3a12dd4ed4", "kind": "dns", "frame_number": 12671, "timestamp_epoch": "1647911022.071953000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56307, "tcp_stream": null, "udp_stream": 236, "fields": { "dns.a": "52.137.108.250", "dns.cname": "consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net,consumer-licensing-aks2aks-uswest.md.mp.microsoft.com.akadns.net,wus2.frontdoor.licensing.commerce.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-acc3edb63f9cfdd8dfdf204e", "kind": "dns", "frame_number": 12673, "timestamp_epoch": "1647911022.097836000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62810, "dst_port": 53, "tcp_stream": null, "udp_stream": 237, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8e7e2336a786e7987fe3bde1", "kind": "dns", "frame_number": 12674, "timestamp_epoch": "1647911022.178753000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62810, "tcp_stream": null, "udp_stream": 237, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-242f7a3435aebeb8e7035628", "kind": "dns", "frame_number": 12768, "timestamp_epoch": "1647911025.667607000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54585, "dst_port": 53, "tcp_stream": null, "udp_stream": 238, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-53ab9bcb2cbe3be6e18ca7ce", "kind": "dns", "frame_number": 12769, "timestamp_epoch": "1647911025.745073000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54585, "tcp_stream": null, "udp_stream": 238, "fields": { "dns.a": "184.85.64.91", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7c51ed189e8afe3fdaf07597", "kind": "dns", "frame_number": 12795, "timestamp_epoch": "1647911037.330182000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51155, "dst_port": 53, "tcp_stream": null, "udp_stream": 239, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-aa15900f5fdf087b71ed4ebc", "kind": "dns", "frame_number": 12796, "timestamp_epoch": "1647911037.410122000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51155, "tcp_stream": null, "udp_stream": 239, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-6e17c94b4dba957b9ee11af8", "kind": "dns", "frame_number": 12813, "timestamp_epoch": "1647911082.802391000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61494, "dst_port": 53, "tcp_stream": null, "udp_stream": 240, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-593853ca42b30a9b6567792f", "kind": "dns", "frame_number": 12814, "timestamp_epoch": "1647911082.885047000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61494, "tcp_stream": null, "udp_stream": 240, "fields": { "dns.a": "72.21.81.240", "dns.cname": "wu-bg-shim.trafficmanager.net,wu.azureedge.net,wu.ec.azureedge.net,bg.apr-52dd2-0503.edgecastdns.net,hlb.apr-52dd2-0.edgecastdns.net,cs11.wpc.v0cdn.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-efc84f43ed052c9c550c921f", "kind": "dns", "frame_number": 12834, "timestamp_epoch": "1647911198.910591000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49759, "dst_port": 53, "tcp_stream": null, "udp_stream": 241, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-2f86ad4cdd87d76e9dada8f5", "kind": "dns", "frame_number": 12835, "timestamp_epoch": "1647911198.910947000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49759, "tcp_stream": null, "udp_stream": 241, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-f730aa155cd126aeb22e2e5f", "kind": "dns", "frame_number": 12847, "timestamp_epoch": "1647911235.925383000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59041, "dst_port": 53, "tcp_stream": null, "udp_stream": 242, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-868c2473e770e866bcd3a2cc", "kind": "dns", "frame_number": 12848, "timestamp_epoch": "1647911235.998312000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59041, "tcp_stream": null, "udp_stream": 242, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-3f505bf401416a843c7b98aa", "kind": "dns", "frame_number": 12864, "timestamp_epoch": "1647911271.917415000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54190, "dst_port": 53, "tcp_stream": null, "udp_stream": 243, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-1921fc6dc82eb76fc14f56de", "kind": "dns", "frame_number": 12865, "timestamp_epoch": "1647911271.991372000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54190, "tcp_stream": null, "udp_stream": 243, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-09df2a6950c926da3ca66347", "kind": "dns", "frame_number": 12883, "timestamp_epoch": "1647911307.912343000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64471, "dst_port": 53, "tcp_stream": null, "udp_stream": 244, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-d782f76cee43ad2b1d378c5a", "kind": "dns", "frame_number": 12884, "timestamp_epoch": "1647911307.987080000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64471, "tcp_stream": null, "udp_stream": 244, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-61c2ace8685e8573e357a9d9", "kind": "dns", "frame_number": 12898, "timestamp_epoch": "1647911343.929581000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49269, "dst_port": 53, "tcp_stream": null, "udp_stream": 245, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-a1035caf272e1d129cdcf6da", "kind": "dns", "frame_number": 12899, "timestamp_epoch": "1647911344.013831000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49269, "tcp_stream": null, "udp_stream": 245, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-7009f39bf4da827b8566c686", "kind": "dns", "frame_number": 12925, "timestamp_epoch": "1647911391.683861000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51922, "dst_port": 53, "tcp_stream": null, "udp_stream": 246, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-c4e4a8483a39a34f1d2708cc", "kind": "dns", "frame_number": 12926, "timestamp_epoch": "1647911391.684226000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51922, "tcp_stream": null, "udp_stream": 246, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-7847b37c600db0e8119767a0", "kind": "dns", "frame_number": 12927, "timestamp_epoch": "1647911391.684952000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62180, "dst_port": 53, "tcp_stream": null, "udp_stream": 247, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-0099e2267fceec60a6b79d10", "kind": "dns", "frame_number": 12928, "timestamp_epoch": "1647911391.686640000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62180, "tcp_stream": null, "udp_stream": 247, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d8d51550db7af3e70aaf5356", "kind": "dns", "frame_number": 12958, "timestamp_epoch": "1647911529.875434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62223, "dst_port": 53, "tcp_stream": null, "udp_stream": 248, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-5a46ca9535a7cc027f19546c", "kind": "dns", "frame_number": 12959, "timestamp_epoch": "1647911529.875891000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62223, "tcp_stream": null, "udp_stream": 248, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-9c212c20a4429941d6e6f2b6", "kind": "dns", "frame_number": 13061, "timestamp_epoch": "1647911670.707342000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53165, "dst_port": 53, "tcp_stream": null, "udp_stream": 250, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-51318d0c7f9b91fa8d8e763b", "kind": "dns", "frame_number": 13062, "timestamp_epoch": "1647911670.800172000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53165, "dst_port": 53, "tcp_stream": null, "udp_stream": 250, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-23b52c3981be61e6346747d4", "kind": "dns", "frame_number": 13063, "timestamp_epoch": "1647911670.806801000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53165, "tcp_stream": null, "udp_stream": 250, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-ea5fdd96439f89c0d9c4de20", "kind": "dns", "frame_number": 13082, "timestamp_epoch": "1647911787.888846000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55418, "dst_port": 53, "tcp_stream": null, "udp_stream": 251, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-1518cb99fae446378147c0f1", "kind": "dns", "frame_number": 13083, "timestamp_epoch": "1647911787.889200000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55418, "tcp_stream": null, "udp_stream": 251, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-f31f7f96fc581ba41ea08bbe", "kind": "dns", "frame_number": 13097, "timestamp_epoch": "1647911824.845402000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64423, "dst_port": 53, "tcp_stream": null, "udp_stream": 252, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-4bba4182e1c3d6440d741d2b", "kind": "dns", "frame_number": 13098, "timestamp_epoch": "1647911824.921618000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64423, "tcp_stream": null, "udp_stream": 252, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-afa9a92a484db1b4d3859874", "kind": "dns", "frame_number": 13112, "timestamp_epoch": "1647911860.899508000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63678, "dst_port": 53, "tcp_stream": null, "udp_stream": 253, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-b5d3259af285cb52bba4a525", "kind": "dns", "frame_number": 13113, "timestamp_epoch": "1647911860.977254000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63678, "tcp_stream": null, "udp_stream": 253, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-0773b5505fb009c4cd8e36c1", "kind": "dns", "frame_number": 13140, "timestamp_epoch": "1647911896.909321000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63497, "dst_port": 53, "tcp_stream": null, "udp_stream": 254, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-bb45ffdccfeb118358ce9e72", "kind": "dns", "frame_number": 13141, "timestamp_epoch": "1647911896.988464000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63497, "tcp_stream": null, "udp_stream": 254, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-ffce653e617955aa4ac4c074", "kind": "dns", "frame_number": 13155, "timestamp_epoch": "1647911928.459649000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60068, "dst_port": 53, "tcp_stream": null, "udp_stream": 255, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f0b963516ba8d1e2b1a8f17a", "kind": "dns", "frame_number": 13156, "timestamp_epoch": "1647911928.525445000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60068, "tcp_stream": null, "udp_stream": 255, "fields": { "dns.a": "51.105.71.137", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprduks03.uksouth.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d15d730aa2a37a510e3c51e", "kind": "dns", "frame_number": 13201, "timestamp_epoch": "1647911991.653725000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54572, "dst_port": 53, "tcp_stream": null, "udp_stream": 256, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-af4a500d73741b9969136c90", "kind": "dns", "frame_number": 13202, "timestamp_epoch": "1647911991.654034000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54572, "tcp_stream": null, "udp_stream": 256, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-9361230a10f72967f9c89578", "kind": "dns", "frame_number": 13203, "timestamp_epoch": "1647911991.654731000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61971, "dst_port": 53, "tcp_stream": null, "udp_stream": 257, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-7ecd9b2fb5af17d0c52c173b", "kind": "dns", "frame_number": 13204, "timestamp_epoch": "1647911991.656408000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61971, "tcp_stream": null, "udp_stream": 257, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-50c61ab75624642874d53a7b", "kind": "dns", "frame_number": 13240, "timestamp_epoch": "1647912303.161494000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50831, "dst_port": 53, "tcp_stream": null, "udp_stream": 258, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-0f2692a075d765809b3cfec4", "kind": "dns", "frame_number": 13242, "timestamp_epoch": "1647912303.235697000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50831, "tcp_stream": null, "udp_stream": 258, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-67f0fed0fb9606e40ed23564", "kind": "dns", "frame_number": 13263, "timestamp_epoch": "1647912376.891844000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55874, "dst_port": 53, "tcp_stream": null, "udp_stream": 259, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-f2324ac4595665fdf94cb834", "kind": "dns", "frame_number": 13264, "timestamp_epoch": "1647912376.892017000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55874, "tcp_stream": null, "udp_stream": 259, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-fbffcae120e4c6d65c710a98", "kind": "dns", "frame_number": 13281, "timestamp_epoch": "1647912413.901241000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50455, "dst_port": 53, "tcp_stream": null, "udp_stream": 260, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-10af2cb064b5dbdba3d7c941", "kind": "dns", "frame_number": 13282, "timestamp_epoch": "1647912413.987476000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50455, "tcp_stream": null, "udp_stream": 260, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-19b4cdf3cce4e6682f3400ce", "kind": "dns", "frame_number": 13298, "timestamp_epoch": "1647912449.898802000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52119, "dst_port": 53, "tcp_stream": null, "udp_stream": 261, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-cc3a48c921f05639ce54fd4f", "kind": "dns", "frame_number": 13299, "timestamp_epoch": "1647912449.976208000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52119, "tcp_stream": null, "udp_stream": 261, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-bb1917dcdb76367ebd5d8348", "kind": "dns", "frame_number": 13313, "timestamp_epoch": "1647912485.899289000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55193, "dst_port": 53, "tcp_stream": null, "udp_stream": 262, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-11b9cd68dafb3853f315c23f", "kind": "dns", "frame_number": 13314, "timestamp_epoch": "1647912485.984783000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55193, "tcp_stream": null, "udp_stream": 262, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-51d53df2d9fdcf46ad41c24b", "kind": "dns", "frame_number": 13333, "timestamp_epoch": "1647912515.745092000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63658, "dst_port": 53, "tcp_stream": null, "udp_stream": 263, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-62601b6a205c69f08f5decb8", "kind": "dns", "frame_number": 13334, "timestamp_epoch": "1647912515.828585000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63658, "tcp_stream": null, "udp_stream": 263, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-81ec6dd76ce28db75ce89790", "kind": "dns", "frame_number": 13371, "timestamp_epoch": "1647912539.132317000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55784, "dst_port": 53, "tcp_stream": null, "udp_stream": 264, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-18271d0e502310b4172909aa", "kind": "dns", "frame_number": 13372, "timestamp_epoch": "1647912539.132630000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55784, "tcp_stream": null, "udp_stream": 264, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-0cc57d5a7acf0583db381134", "kind": "dns", "frame_number": 13411, "timestamp_epoch": "1647912591.626948000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51909, "dst_port": 53, "tcp_stream": null, "udp_stream": 265, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-60924acd29f08d870ff8d0c0", "kind": "dns", "frame_number": 13412, "timestamp_epoch": "1647912591.627274000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51909, "tcp_stream": null, "udp_stream": 265, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-056d81c873584a45a1438967", "kind": "dns", "frame_number": 13413, "timestamp_epoch": "1647912591.627659000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50676, "dst_port": 53, "tcp_stream": null, "udp_stream": 266, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-c3b7378d866a667682f8fd4e", "kind": "dns", "frame_number": 13414, "timestamp_epoch": "1647912591.629330000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50676, "tcp_stream": null, "udp_stream": 266, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8d4cee3f1ebad26b3df0c5f9", "kind": "dns", "frame_number": 13453, "timestamp_epoch": "1647912936.644416000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62945, "dst_port": 53, "tcp_stream": null, "udp_stream": 267, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-911382cba1a70f54d7f29ce7", "kind": "dns", "frame_number": 13454, "timestamp_epoch": "1647912936.717640000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62945, "tcp_stream": null, "udp_stream": 267, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-268a0cfea3a0fa65006cee9a", "kind": "dns", "frame_number": 13469, "timestamp_epoch": "1647912965.873126000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51059, "dst_port": 53, "tcp_stream": null, "udp_stream": 268, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-792b27f2fa50ae81680d0cc7", "kind": "dns", "frame_number": 13470, "timestamp_epoch": "1647912965.873451000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51059, "tcp_stream": null, "udp_stream": 268, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-39b187603334d7c539ff4f08", "kind": "dns", "frame_number": 13490, "timestamp_epoch": "1647913002.885186000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62859, "dst_port": 53, "tcp_stream": null, "udp_stream": 269, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad0c52cc425543ed34dacad2", "kind": "dns", "frame_number": 13491, "timestamp_epoch": "1647913002.958180000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62859, "tcp_stream": null, "udp_stream": 269, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-3de3e1f9fa583c96fc83aec1", "kind": "dns", "frame_number": 13505, "timestamp_epoch": "1647913038.886448000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52286, "dst_port": 53, "tcp_stream": null, "udp_stream": 270, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-db328738c59f836317d8452d", "kind": "dns", "frame_number": 13506, "timestamp_epoch": "1647913038.957254000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52286, "tcp_stream": null, "udp_stream": 270, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-3710e1cdcf43314d967ac6c8", "kind": "dns", "frame_number": 13520, "timestamp_epoch": "1647913074.866637000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58187, "dst_port": 53, "tcp_stream": null, "udp_stream": 271, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-042c44f4eba03df5d3481be6", "kind": "dns", "frame_number": 13521, "timestamp_epoch": "1647913074.938461000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58187, "tcp_stream": null, "udp_stream": 271, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-8ddd7c1f9fe05f0f228b5557", "kind": "dns", "frame_number": 13794, "timestamp_epoch": "1647913191.595725000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49760, "dst_port": 53, "tcp_stream": null, "udp_stream": 274, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-08d1be375fd70d7020261048", "kind": "dns", "frame_number": 13795, "timestamp_epoch": "1647913191.596107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49760, "tcp_stream": null, "udp_stream": 274, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-81f23a5e53f0d78b3c12986b", "kind": "dns", "frame_number": 13796, "timestamp_epoch": "1647913191.596723000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56413, "dst_port": 53, "tcp_stream": null, "udp_stream": 275, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-1282d10262b5a440b7db5633", "kind": "dns", "frame_number": 13797, "timestamp_epoch": "1647913191.597895000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56413, "tcp_stream": null, "udp_stream": 275, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-92711881b9333b8373364a8c", "kind": "dns", "frame_number": 13866, "timestamp_epoch": "1647913554.857210000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50979, "dst_port": 53, "tcp_stream": null, "udp_stream": 276, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-b070da7c85830db57e3886fe", "kind": "dns", "frame_number": 13867, "timestamp_epoch": "1647913554.937046000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50979, "tcp_stream": null, "udp_stream": 276, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-3181b3cd47ddd63791424ba4", "kind": "dns", "frame_number": 13882, "timestamp_epoch": "1647913569.076657000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49821, "dst_port": 53, "tcp_stream": null, "udp_stream": 277, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-edebe70578ebdd990d16f172", "kind": "dns", "frame_number": 13883, "timestamp_epoch": "1647913569.076950000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49821, "tcp_stream": null, "udp_stream": 277, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-1afc6dcf7b5d1e7daedaaa9b", "kind": "dns", "frame_number": 13897, "timestamp_epoch": "1647913591.866793000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50113, "dst_port": 53, "tcp_stream": null, "udp_stream": 219, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-49683d21d4a20ac09e118217", "kind": "dns", "frame_number": 13898, "timestamp_epoch": "1647913591.936378000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50113, "tcp_stream": null, "udp_stream": 219, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-c01c16e179eca1278c738c75", "kind": "dns", "frame_number": 13914, "timestamp_epoch": "1647913627.856625000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56411, "dst_port": 53, "tcp_stream": null, "udp_stream": 278, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-d74c7257b96a112a0606972e", "kind": "dns", "frame_number": 13915, "timestamp_epoch": "1647913627.930808000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56411, "tcp_stream": null, "udp_stream": 278, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-7e3333f72b50f645d4c94f21", "kind": "dns", "frame_number": 13931, "timestamp_epoch": "1647913663.867110000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49205, "dst_port": 53, "tcp_stream": null, "udp_stream": 279, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-e3fdfe0f12f48fec3bf8f7b5", "kind": "dns", "frame_number": 13932, "timestamp_epoch": "1647913663.935696000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49205, "tcp_stream": null, "udp_stream": 279, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-f768c5fb9820cf843c1f2f0c", "kind": "dns", "frame_number": 13988, "timestamp_epoch": "1647913791.565756000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49590, "dst_port": 53, "tcp_stream": null, "udp_stream": 280, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-c2f707f46be125313f02c728", "kind": "dns", "frame_number": 13989, "timestamp_epoch": "1647913791.566161000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49590, "tcp_stream": null, "udp_stream": 280, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-8cbde0958fee5d694f5470d5", "kind": "dns", "frame_number": 13990, "timestamp_epoch": "1647913791.566878000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51237, "dst_port": 53, "tcp_stream": null, "udp_stream": 281, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-f774c773f86d1f524e292516", "kind": "dns", "frame_number": 13991, "timestamp_epoch": "1647913791.568310000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51237, "tcp_stream": null, "udp_stream": 281, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-2d69acee3f5b12a22485aaf4", "kind": "dns", "frame_number": 14022, "timestamp_epoch": "1647914143.852358000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60860, "dst_port": 53, "tcp_stream": null, "udp_stream": 282, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-ecc5cbc28294984a6f6d34b4", "kind": "dns", "frame_number": 14023, "timestamp_epoch": "1647914143.930245000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60860, "tcp_stream": null, "udp_stream": 282, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-6215f60a48a1ed0808c32cfa", "kind": "dns", "frame_number": 14043, "timestamp_epoch": "1647914180.854286000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51361, "dst_port": 53, "tcp_stream": null, "udp_stream": 283, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-fa97f07e9c2221100d97bcb8", "kind": "dns", "frame_number": 14044, "timestamp_epoch": "1647914180.933195000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51361, "tcp_stream": null, "udp_stream": 283, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-d1bcc282a9066d90a5b3c765", "kind": "dns", "frame_number": 14055, "timestamp_epoch": "1647914202.414062000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51595, "dst_port": 53, "tcp_stream": null, "udp_stream": 284, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-fd040d51f146e3dea18af451", "kind": "dns", "frame_number": 14056, "timestamp_epoch": "1647914202.414465000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51595, "tcp_stream": null, "udp_stream": 284, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-f2ec7fa8d0630b315f93bfd6", "kind": "dns", "frame_number": 14070, "timestamp_epoch": "1647914216.854621000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58458, "dst_port": 53, "tcp_stream": null, "udp_stream": 285, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad29c48a3965452364ac01da", "kind": "dns", "frame_number": 14071, "timestamp_epoch": "1647914216.924885000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58458, "tcp_stream": null, "udp_stream": 285, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-31ee2f4385cef767fea092cc", "kind": "dns", "frame_number": 14078, "timestamp_epoch": "1647914217.065831000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54685, "dst_port": 53, "tcp_stream": null, "udp_stream": 287, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-bfe5fc9adc69c800c1a418c2", "kind": "dns", "frame_number": 14079, "timestamp_epoch": "1647914217.136915000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54685, "tcp_stream": null, "udp_stream": 287, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-327784c5e94b771d0564e23f", "kind": "dns", "frame_number": 14227, "timestamp_epoch": "1647914252.866004000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53249, "dst_port": 53, "tcp_stream": null, "udp_stream": 288, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-de08c87f57c059515c751984", "kind": "dns", "frame_number": 14228, "timestamp_epoch": "1647914252.955756000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53249, "dst_port": 53, "tcp_stream": null, "udp_stream": 288, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-d948ce5b2edfb673d55ad4a2", "kind": "dns", "frame_number": 14229, "timestamp_epoch": "1647914252.968249000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53249, "tcp_stream": null, "udp_stream": 288, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-2fda80c161966f51980fed8a", "kind": "dns", "frame_number": 14311, "timestamp_epoch": "1647914391.542516000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54887, "dst_port": 53, "tcp_stream": null, "udp_stream": 289, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-71efc49f2526f02becda2922", "kind": "dns", "frame_number": 14312, "timestamp_epoch": "1647914391.542881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54887, "tcp_stream": null, "udp_stream": 289, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-7cb6994dab7fd3673549c38f", "kind": "dns", "frame_number": 14313, "timestamp_epoch": "1647914391.543582000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62047, "dst_port": 53, "tcp_stream": null, "udp_stream": 290, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6813ef1e2b13cc39d38e8e0e", "kind": "dns", "frame_number": 14314, "timestamp_epoch": "1647914391.544845000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62047, "tcp_stream": null, "udp_stream": 290, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-5432217037ada1d044f2e602", "kind": "dns", "frame_number": 14341, "timestamp_epoch": "1647914584.889529000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53030, "dst_port": 53, "tcp_stream": null, "udp_stream": 291, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e93529ad8e9a5b804ba7ced2", "kind": "dns", "frame_number": 14342, "timestamp_epoch": "1647914584.964691000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53030, "tcp_stream": null, "udp_stream": 291, "fields": { "dns.a": "52.168.117.170", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdeus13.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-3ab54f3e31b19f7cef8e709f", "kind": "dns", "frame_number": 14366, "timestamp_epoch": "1647914646.361799000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 65367, "dst_port": 53, "tcp_stream": null, "udp_stream": 292, "fields": { "dns.flags.response": "False", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-972e5f424f1560c0f7664bc1", "kind": "dns", "frame_number": 14367, "timestamp_epoch": "1647914646.445953000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 65367, "tcp_stream": null, "udp_stream": 292, "fields": { "dns.a": "104.80.96.219", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-da552de4d421d1003e7c01a9", "kind": "dns", "frame_number": 14374, "timestamp_epoch": "1647914646.617477000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50134, "dst_port": 53, "tcp_stream": null, "udp_stream": 293, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-4fc5f2abaccd7bec6b9a0c57", "kind": "dns", "frame_number": 14376, "timestamp_epoch": "1647914646.687373000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50134, "tcp_stream": null, "udp_stream": 293, "fields": { "dns.a": "68.142.107.1,68.142.107.129", "dns.cname": "wu-bg-shim.trafficmanager.net,windowsupdatebg.s.llnwi.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-e9ad835c0e0d1b407ade5800", "kind": "dns", "frame_number": 14403, "timestamp_epoch": "1647914732.837408000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57319, "dst_port": 53, "tcp_stream": null, "udp_stream": 294, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-205a78b92664756a0a722eca", "kind": "dns", "frame_number": 14404, "timestamp_epoch": "1647914732.903579000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57319, "tcp_stream": null, "udp_stream": 294, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-27b7eb455aef2f1fb6471013", "kind": "dns", "frame_number": 14420, "timestamp_epoch": "1647914769.861701000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51514, "dst_port": 53, "tcp_stream": null, "udp_stream": 295, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-38719a491e703d3ed79506d5", "kind": "dns", "frame_number": 14421, "timestamp_epoch": "1647914769.936341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51514, "tcp_stream": null, "udp_stream": 295, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-4e95e095011ff4d22758931a", "kind": "dns", "frame_number": 14435, "timestamp_epoch": "1647914805.846040000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63207, "dst_port": 53, "tcp_stream": null, "udp_stream": 296, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-d846bb8ff031a5f0f61bc9c8", "kind": "dns", "frame_number": 14436, "timestamp_epoch": "1647914805.915567000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63207, "tcp_stream": null, "udp_stream": 296, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-e34de0440c9f4de6acd7595a", "kind": "dns", "frame_number": 14449, "timestamp_epoch": "1647914835.779987000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51450, "dst_port": 53, "tcp_stream": null, "udp_stream": 297, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-25edb8c8a6e1bdaff5fb6d37", "kind": "dns", "frame_number": 14450, "timestamp_epoch": "1647914835.780307000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51450, "tcp_stream": null, "udp_stream": 297, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-d25ea7bbc959b2803e5978a1", "kind": "dns", "frame_number": 14464, "timestamp_epoch": "1647914841.844864000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53581, "dst_port": 53, "tcp_stream": null, "udp_stream": 298, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-39f3f8e5b2502ebce470e8d6", "kind": "dns", "frame_number": 14465, "timestamp_epoch": "1647914841.921365000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53581, "tcp_stream": null, "udp_stream": 298, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-718a9d904207e258307f827e", "kind": "dns", "frame_number": 14536, "timestamp_epoch": "1647914991.517672000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62893, "dst_port": 53, "tcp_stream": null, "udp_stream": 299, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-1788fe11117e8976f9badf49", "kind": "dns", "frame_number": 14537, "timestamp_epoch": "1647914991.518068000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62893, "tcp_stream": null, "udp_stream": 299, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-05b814e5941550ef382f0352", "kind": "dns", "frame_number": 14538, "timestamp_epoch": "1647914991.518747000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55630, "dst_port": 53, "tcp_stream": null, "udp_stream": 300, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d51387a2fdfc1bcc0ef49d12", "kind": "dns", "frame_number": 14539, "timestamp_epoch": "1647914991.520269000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55630, "tcp_stream": null, "udp_stream": 300, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-9bc49603eac154f73c27bc2d", "kind": "dns", "frame_number": 14545, "timestamp_epoch": "1647915129.729751000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61379, "dst_port": 53, "tcp_stream": null, "udp_stream": 301, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-2f1d61cea76f1af99942baa9", "kind": "dns", "frame_number": 14546, "timestamp_epoch": "1647915129.730185000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61379, "tcp_stream": null, "udp_stream": 301, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-3aa7167ee9491d526e6c7bb3", "kind": "dns", "frame_number": 14654, "timestamp_epoch": "1647915321.826821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54081, "dst_port": 53, "tcp_stream": null, "udp_stream": 304, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-088002097af143716d761644", "kind": "dns", "frame_number": 14655, "timestamp_epoch": "1647915321.896478000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54081, "tcp_stream": null, "udp_stream": 304, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-caa8107c21fec400c7aee438", "kind": "dns", "frame_number": 14671, "timestamp_epoch": "1647915358.837356000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61905, "dst_port": 53, "tcp_stream": null, "udp_stream": 305, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-1ea1f349c5aade01bf9056c8", "kind": "dns", "frame_number": 14672, "timestamp_epoch": "1647915358.909380000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61905, "tcp_stream": null, "udp_stream": 305, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-b848315338a7dcc5256ce81f", "kind": "dns", "frame_number": 14688, "timestamp_epoch": "1647915394.835846000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63344, "dst_port": 53, "tcp_stream": null, "udp_stream": 306, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-346e8c8b619e9a9684789a72", "kind": "dns", "frame_number": 14689, "timestamp_epoch": "1647915394.918830000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63344, "tcp_stream": null, "udp_stream": 306, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-ef356294c74bf73ac47dd922", "kind": "dns", "frame_number": 14702, "timestamp_epoch": "1647915430.825507000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63906, "dst_port": 53, "tcp_stream": null, "udp_stream": 307, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-360e1dd43f4983e391f6ee90", "kind": "dns", "frame_number": 14703, "timestamp_epoch": "1647915430.895107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63906, "tcp_stream": null, "udp_stream": 307, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-260cc836a1340757a6eecba0", "kind": "dns", "frame_number": 14729, "timestamp_epoch": "1647915468.115838000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58492, "dst_port": 53, "tcp_stream": null, "udp_stream": 308, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-b16de811b7cd417c428cef8a", "kind": "dns", "frame_number": 14730, "timestamp_epoch": "1647915468.116199000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58492, "tcp_stream": null, "udp_stream": 308, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-51856ad0673e43a1ddc06e17", "kind": "dns", "frame_number": 14762, "timestamp_epoch": "1647915526.243988000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55053, "dst_port": 53, "tcp_stream": null, "udp_stream": 309, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4242e489bc1eb1bc32248f00", "kind": "dns", "frame_number": 14763, "timestamp_epoch": "1647915526.311808000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55053, "tcp_stream": null, "udp_stream": 309, "fields": { "dns.a": "20.72.205.209", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-wus2-2.westus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-17d94d3a3cbc08117d9a1fc1", "kind": "dns", "frame_number": 14816, "timestamp_epoch": "1647915587.160392000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63517, "dst_port": 53, "tcp_stream": null, "udp_stream": 310, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-7c84662b9ce0918aa9a1be75", "kind": "dns", "frame_number": 14817, "timestamp_epoch": "1647915587.238901000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63517, "tcp_stream": null, "udp_stream": 310, "fields": { "dns.a": "23.219.38.10,23.219.38.40", "dns.cname": "wu-bg-shim.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-b3d9e46b5c72de21101bff8d", "kind": "dns", "frame_number": 14825, "timestamp_epoch": "1647915591.487173000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54717, "dst_port": 53, "tcp_stream": null, "udp_stream": 311, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-91b983bfd2771fa8acc6988b", "kind": "dns", "frame_number": 14826, "timestamp_epoch": "1647915591.487537000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54717, "tcp_stream": null, "udp_stream": 311, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0137dda0c62586b3053a26c", "kind": "dns", "frame_number": 14827, "timestamp_epoch": "1647915591.487905000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58459, "dst_port": 53, "tcp_stream": null, "udp_stream": 312, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-fb8fd5d2620b1e997ca34ffa", "kind": "dns", "frame_number": 14828, "timestamp_epoch": "1647915591.489576000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58459, "tcp_stream": null, "udp_stream": 312, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-066daac4afa4d29194fb7d0d", "kind": "dns", "frame_number": 14882, "timestamp_epoch": "1647915749.946515000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59123, "dst_port": 53, "tcp_stream": null, "udp_stream": 313, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-fd36a32409899796398de004", "kind": "dns", "frame_number": 14883, "timestamp_epoch": "1647915749.946750000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59123, "tcp_stream": null, "udp_stream": 313, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-629c29a28914dc8de1fec532", "kind": "dns", "frame_number": 14954, "timestamp_epoch": "1647915910.810838000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64144, "dst_port": 53, "tcp_stream": null, "udp_stream": 315, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-f275b2063741d7304f76f426", "kind": "dns", "frame_number": 14955, "timestamp_epoch": "1647915910.885374000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64144, "tcp_stream": null, "udp_stream": 315, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-6c6d30a129ecc31376ad7dfd", "kind": "dns", "frame_number": 14971, "timestamp_epoch": "1647915947.823689000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63848, "dst_port": 53, "tcp_stream": null, "udp_stream": 316, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-f8d91bc467b0641033fe5a4a", "kind": "dns", "frame_number": 14972, "timestamp_epoch": "1647915947.892487000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63848, "tcp_stream": null, "udp_stream": 316, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-c1d0fe254cd904e25364c4fd", "kind": "dns", "frame_number": 14988, "timestamp_epoch": "1647915983.805909000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61556, "dst_port": 53, "tcp_stream": null, "udp_stream": 317, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-464a9bd97b2efc7b644cf9d8", "kind": "dns", "frame_number": 14989, "timestamp_epoch": "1647915983.882981000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61556, "tcp_stream": null, "udp_stream": 317, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-68b4c3c63a9a4c8f483a1704", "kind": "dns", "frame_number": 15001, "timestamp_epoch": "1647916019.825394000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59324, "dst_port": 53, "tcp_stream": null, "udp_stream": 318, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-989ba49db6cb46ef28254d1c", "kind": "dns", "frame_number": 15002, "timestamp_epoch": "1647916019.914795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59324, "dst_port": 53, "tcp_stream": null, "udp_stream": 318, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-5f2a7f34a71ae834a7f9134e", "kind": "dns", "frame_number": 15003, "timestamp_epoch": "1647916019.971345000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59324, "tcp_stream": null, "udp_stream": 318, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-197eeae7aac850b9ade50c6d", "kind": "dns", "frame_number": 15044, "timestamp_epoch": "1647916100.492656000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64219, "dst_port": 53, "tcp_stream": null, "udp_stream": 319, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-854f68ba200aee80a1d3dbfa", "kind": "dns", "frame_number": 15045, "timestamp_epoch": "1647916100.492986000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64219, "tcp_stream": null, "udp_stream": 319, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-1d7874df90fd570029d0f1e0", "kind": "dns", "frame_number": 15056, "timestamp_epoch": "1647916116.221098000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63297, "dst_port": 53, "tcp_stream": null, "udp_stream": 320, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-35f372ad1daec17fbf20ad0f", "kind": "dns", "frame_number": 15057, "timestamp_epoch": "1647916116.299439000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63297, "tcp_stream": null, "udp_stream": 320, "fields": { "dns.a": "52.185.211.133", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-1.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a7e6d2adb40db91cd3a41aa5", "kind": "dns", "frame_number": 15105, "timestamp_epoch": "1647916138.996304000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59382, "dst_port": 53, "tcp_stream": null, "udp_stream": 321, "fields": { "dns.flags.response": "False", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-8cbb6fdf31d93ddd0078e033", "kind": "dns", "frame_number": 15106, "timestamp_epoch": "1647916138.996603000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59382, "tcp_stream": null, "udp_stream": 321, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "BURNINCANDLE-DC.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-328766765823677aa851dff0", "kind": "dns", "frame_number": 15144, "timestamp_epoch": "1647916191.461005000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49893, "dst_port": 53, "tcp_stream": null, "udp_stream": 322, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-cc93a27b64a4b0097e540acb", "kind": "dns", "frame_number": 15145, "timestamp_epoch": "1647916191.461328000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49893, "tcp_stream": null, "udp_stream": 322, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-8115ee43f2f6ddfc636658b4", "kind": "dns", "frame_number": 15146, "timestamp_epoch": "1647916191.462066000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60551, "dst_port": 53, "tcp_stream": null, "udp_stream": 323, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-1e3ed50d870c2f13eff0d088", "kind": "dns", "frame_number": 15147, "timestamp_epoch": "1647916191.463679000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60551, "tcp_stream": null, "udp_stream": 323, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-deb4175037b700d4ceb2f211", "kind": "dns", "frame_number": 15155, "timestamp_epoch": "1647916312.509495000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50723, "dst_port": 53, "tcp_stream": null, "udp_stream": 324, "fields": { "dns.flags.response": "False", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-1ed4ad5b0b2f3a0aec65da0f", "kind": "dns", "frame_number": 15156, "timestamp_epoch": "1647916312.580226000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50723, "tcp_stream": null, "udp_stream": 324, "fields": { "dns.a": "52.109.8.21", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-77dc68435eb834077889728b", "kind": "dns", "frame_number": 15203, "timestamp_epoch": "1647916384.790803000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61335, "dst_port": 53, "tcp_stream": null, "udp_stream": 325, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-895ef25d595818cb9a530e79", "kind": "dns", "frame_number": 15204, "timestamp_epoch": "1647916384.861314000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61335, "tcp_stream": null, "udp_stream": 325, "fields": { "dns.a": "20.42.65.89", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdeus11.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-15c54202aebc0a254b1cb05c", "kind": "dns", "frame_number": 15235, "timestamp_epoch": "1647916499.799625000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 54371, "dst_port": 53, "tcp_stream": null, "udp_stream": 326, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-4530669fa04c3f8f7e1fc4e2", "kind": "dns", "frame_number": 15236, "timestamp_epoch": "1647916499.870219000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 54371, "tcp_stream": null, "udp_stream": 326, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-8569a950b67c01aa2d65d562", "kind": "dns", "frame_number": 15252, "timestamp_epoch": "1647916536.808990000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 55390, "dst_port": 53, "tcp_stream": null, "udp_stream": 327, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-3675d4b09774353852e56408", "kind": "dns", "frame_number": 15253, "timestamp_epoch": "1647916536.882570000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 55390, "tcp_stream": null, "udp_stream": 327, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-0a426b45631871bc5701870e", "kind": "dns", "frame_number": 15267, "timestamp_epoch": "1647916572.809319000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62162, "dst_port": 53, "tcp_stream": null, "udp_stream": 328, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-1a97cef704665f3c9305b6d7", "kind": "dns", "frame_number": 15268, "timestamp_epoch": "1647916572.883980000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62162, "tcp_stream": null, "udp_stream": 328, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-27181e692a06ea7ed0e00bbb", "kind": "dns", "frame_number": 15284, "timestamp_epoch": "1647916608.809972000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59280, "dst_port": 53, "tcp_stream": null, "udp_stream": 329, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-fc726f29151219e252eac578", "kind": "dns", "frame_number": 15285, "timestamp_epoch": "1647916608.887028000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59280, "tcp_stream": null, "udp_stream": 329, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-4609cb88848b37700279d1c6", "kind": "dns", "frame_number": 15339, "timestamp_epoch": "1647916732.772785000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52742, "dst_port": 53, "tcp_stream": null, "udp_stream": 330, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-20868f48e3b39fede6ec50d4", "kind": "dns", "frame_number": 15340, "timestamp_epoch": "1647916732.773130000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52742, "tcp_stream": null, "udp_stream": 330, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-563666c5f19d0c555538b404", "kind": "dns", "frame_number": 15371, "timestamp_epoch": "1647916791.434090000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49463, "dst_port": 53, "tcp_stream": null, "udp_stream": 331, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a8111b8758bbb39bd8db4288", "kind": "dns", "frame_number": 15372, "timestamp_epoch": "1647916791.434427000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49463, "tcp_stream": null, "udp_stream": 331, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-c95b3b286ae321279426c36e", "kind": "dns", "frame_number": 15373, "timestamp_epoch": "1647916791.435119000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 65450, "dst_port": 53, "tcp_stream": null, "udp_stream": 332, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-902a5b78dd494db14c4d2350", "kind": "dns", "frame_number": 15374, "timestamp_epoch": "1647916791.436655000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 65450, "tcp_stream": null, "udp_stream": 332, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6ebedf5bd1c319ba0a2635e5", "kind": "dns", "frame_number": 15438, "timestamp_epoch": "1647917088.779052000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50690, "dst_port": 53, "tcp_stream": null, "udp_stream": 334, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-29d340387b4b247c5991449d", "kind": "dns", "frame_number": 15439, "timestamp_epoch": "1647917088.857418000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50690, "tcp_stream": null, "udp_stream": 334, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-194960448a22f472ea2fb74c", "kind": "dns", "frame_number": 15451, "timestamp_epoch": "1647917125.785281000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53074, "dst_port": 53, "tcp_stream": null, "udp_stream": 335, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-5fd6b1854a2c411f32ce9c4f", "kind": "dns", "frame_number": 15452, "timestamp_epoch": "1647917125.858522000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53074, "tcp_stream": null, "udp_stream": 335, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-e717c40eff48d8e1bf11f4ca", "kind": "dns", "frame_number": 15468, "timestamp_epoch": "1647917161.799272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 61609, "dst_port": 53, "tcp_stream": null, "udp_stream": 336, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-9899ceee65023158cfb319cc", "kind": "dns", "frame_number": 15469, "timestamp_epoch": "1647917161.867341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 61609, "tcp_stream": null, "udp_stream": 336, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-b3f69a285fbf63a2ac4e2ca4", "kind": "dns", "frame_number": 15485, "timestamp_epoch": "1647917197.796405000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60848, "dst_port": 53, "tcp_stream": null, "udp_stream": 337, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-722e8569b68540f56b4e8986", "kind": "dns", "frame_number": 15486, "timestamp_epoch": "1647917197.870639000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60848, "tcp_stream": null, "udp_stream": 337, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-d2d0c58909c1ea85026d492f", "kind": "dns", "frame_number": 15556, "timestamp_epoch": "1647917365.113060000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58220, "dst_port": 53, "tcp_stream": null, "udp_stream": 338, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-ea447df473d6b47ed2d25299", "kind": "dns", "frame_number": 15557, "timestamp_epoch": "1647917365.113380000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58220, "tcp_stream": null, "udp_stream": 338, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-71fbd87e8ee9e8afa4466756", "kind": "dns", "frame_number": 15569, "timestamp_epoch": "1647917391.398930000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58696, "dst_port": 53, "tcp_stream": null, "udp_stream": 339, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3b5a9286faea29e1dc6067ee", "kind": "dns", "frame_number": 15570, "timestamp_epoch": "1647917391.399245000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58696, "tcp_stream": null, "udp_stream": 339, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-a436852da587180375525791", "kind": "dns", "frame_number": 15571, "timestamp_epoch": "1647917391.399933000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53659, "dst_port": 53, "tcp_stream": null, "udp_stream": 340, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-760607f09a707f07d01bbb78", "kind": "dns", "frame_number": 15572, "timestamp_epoch": "1647917391.401519000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53659, "tcp_stream": null, "udp_stream": 340, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-ad719990707aa2e92fb42730", "kind": "dns", "frame_number": 15590, "timestamp_epoch": "1647917677.756173000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52219, "dst_port": 53, "tcp_stream": null, "udp_stream": 341, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-c9a956fb8e838f9da044cd4a", "kind": "dns", "frame_number": 15591, "timestamp_epoch": "1647917677.825301000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52219, "tcp_stream": null, "udp_stream": 341, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-24c5a4bb7f209b3b8c47b8c1", "kind": "dns", "frame_number": 15605, "timestamp_epoch": "1647917714.766117000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60705, "dst_port": 53, "tcp_stream": null, "udp_stream": 342, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-549c06e1f35db71067ff82e3", "kind": "dns", "frame_number": 15606, "timestamp_epoch": "1647917714.838494000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60705, "tcp_stream": null, "udp_stream": 342, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-69b9b5a6c156654ea0bea4ae", "kind": "dns", "frame_number": 15622, "timestamp_epoch": "1647917750.776290000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62853, "dst_port": 53, "tcp_stream": null, "udp_stream": 343, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-f456d8bbaa770f11bbc7d92b", "kind": "dns", "frame_number": 15623, "timestamp_epoch": "1647917750.851264000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62853, "tcp_stream": null, "udp_stream": 343, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-4efacfbc6a3bf75776e16b57", "kind": "dns", "frame_number": 15639, "timestamp_epoch": "1647917786.757155000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 51467, "dst_port": 53, "tcp_stream": null, "udp_stream": 344, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-6633f0001d1d9d91946c4b29", "kind": "dns", "frame_number": 15640, "timestamp_epoch": "1647917786.830596000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 51467, "tcp_stream": null, "udp_stream": 344, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-dba48ea7cb64e0ff7106bfdb", "kind": "dns", "frame_number": 15690, "timestamp_epoch": "1647917917.881994000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 52511, "dst_port": 53, "tcp_stream": null, "udp_stream": 345, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-85254d7f945ce6b7bea2824d", "kind": "dns", "frame_number": 15691, "timestamp_epoch": "1647917917.954719000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 52511, "tcp_stream": null, "udp_stream": 345, "fields": { "dns.a": "52.183.220.149", "dns.cname": "atm-settingsfe-prod-geo.trafficmanager.net,settings-prod-scus-2.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-276272a2aaf8b00b07cd7e17", "kind": "dns", "frame_number": 15766, "timestamp_epoch": "1647917991.360368000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 63623, "dst_port": 53, "tcp_stream": null, "udp_stream": 346, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-3ae762755462426e55377baa", "kind": "dns", "frame_number": 15767, "timestamp_epoch": "1647917991.360726000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 63623, "tcp_stream": null, "udp_stream": 346, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-341712a0518a6c7e379860c5", "kind": "dns", "frame_number": 15768, "timestamp_epoch": "1647917991.361142000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 56928, "dst_port": 53, "tcp_stream": null, "udp_stream": 347, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-755148570e72eeae09a3f699", "kind": "dns", "frame_number": 15769, "timestamp_epoch": "1647917991.362925000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 56928, "tcp_stream": null, "udp_stream": 347, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6b34be31b5f569f34db5209e", "kind": "dns", "frame_number": 15772, "timestamp_epoch": "1647917997.429679000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64885, "dst_port": 53, "tcp_stream": null, "udp_stream": 348, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-4a5744ad2c360fa98aa10c0f", "kind": "dns", "frame_number": 15773, "timestamp_epoch": "1647917997.430015000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64885, "tcp_stream": null, "udp_stream": 348, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-cd8c8fe240387c338d566a15", "kind": "dns", "frame_number": 15796, "timestamp_epoch": "1647918184.692935000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64656, "dst_port": 53, "tcp_stream": null, "udp_stream": 349, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-213a92dcc9303703ec38fc84", "kind": "dns", "frame_number": 15797, "timestamp_epoch": "1647918184.767153000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64656, "tcp_stream": null, "udp_stream": 349, "fields": { "dns.a": "52.182.143.208", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdcus04.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c2aab9fdf35f1a55376c3ea6", "kind": "dns", "frame_number": 15823, "timestamp_epoch": "1647918266.223832000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 53213, "dst_port": 53, "tcp_stream": null, "udp_stream": 350, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-efd2ffec6ceaf434113469d1", "kind": "dns", "frame_number": 15824, "timestamp_epoch": "1647918266.296010000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 53213, "tcp_stream": null, "udp_stream": 350, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-54b929cc94040777f184dc94", "kind": "dns", "frame_number": 15881, "timestamp_epoch": "1647918266.742037000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58723, "dst_port": 53, "tcp_stream": null, "udp_stream": 351, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-d53fc218b36c2b8220e0400b", "kind": "dns", "frame_number": 15882, "timestamp_epoch": "1647918266.823420000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58723, "tcp_stream": null, "udp_stream": 351, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-6e2c090c5b2db5b5e21307c9", "kind": "dns", "frame_number": 15895, "timestamp_epoch": "1647918303.749128000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 58598, "dst_port": 53, "tcp_stream": null, "udp_stream": 352, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-be94fe4af4f2b983c2e7a42b", "kind": "dns", "frame_number": 15896, "timestamp_epoch": "1647918303.822860000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 58598, "tcp_stream": null, "udp_stream": 352, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-e410efdf3c90201882f7feae", "kind": "dns", "frame_number": 15910, "timestamp_epoch": "1647918339.769513000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59799, "dst_port": 53, "tcp_stream": null, "udp_stream": 353, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-4d738b2c94a37b6867a0e363", "kind": "dns", "frame_number": 15911, "timestamp_epoch": "1647918339.850895000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59799, "tcp_stream": null, "udp_stream": 353, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-17af1c8960ecf264f51e74bc", "kind": "dns", "frame_number": 15925, "timestamp_epoch": "1647918375.749312000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62282, "dst_port": 53, "tcp_stream": null, "udp_stream": 354, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-1beee1f15e6ac1847e6bb97f", "kind": "dns", "frame_number": 15926, "timestamp_epoch": "1647918375.829346000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 62282, "tcp_stream": null, "udp_stream": 354, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-1f25b9a97f5cdae0587023f6", "kind": "dns", "frame_number": 16000, "timestamp_epoch": "1647918591.326073000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60475, "dst_port": 53, "tcp_stream": null, "udp_stream": 355, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-693128f79a09fa0e1d0e5aa4", "kind": "dns", "frame_number": 16001, "timestamp_epoch": "1647918591.326440000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60475, "tcp_stream": null, "udp_stream": 355, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.burnincandle.com", "dns.qry.type": "1" } }, { "event_id": "evt-dabe48a9bb7d7d689ead2ecc", "kind": "dns", "frame_number": 16002, "timestamp_epoch": "1647918591.327138000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 59394, "dst_port": 53, "tcp_stream": null, "udp_stream": 356, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-9dd2f91b898588d026c143bb", "kind": "dns", "frame_number": 16003, "timestamp_epoch": "1647918591.328918000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 59394, "tcp_stream": null, "udp_stream": 356, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-ec05e41224da7af53a033d4b", "kind": "dns", "frame_number": 16010, "timestamp_epoch": "1647918629.775443000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49271, "dst_port": 53, "tcp_stream": null, "udp_stream": 357, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-be6fb6f6d1c95b5cb771cc82", "kind": "dns", "frame_number": 16011, "timestamp_epoch": "1647918629.775802000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49271, "tcp_stream": null, "udp_stream": 357, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-2968322566fa7c1648d6f12c", "kind": "dns", "frame_number": 16026, "timestamp_epoch": "1647918729.616549000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 57422, "dst_port": 53, "tcp_stream": null, "udp_stream": 358, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-c23c0d251c86e958620cb27c", "kind": "dns", "frame_number": 16027, "timestamp_epoch": "1647918729.616940000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 57422, "tcp_stream": null, "udp_stream": 358, "fields": { "dns.a": "10.0.19.9", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.burnincandle.com", "dns.qry.type": "33" } }, { "event_id": "evt-6142d898462c4218badd01dc", "kind": "dns", "frame_number": 16210, "timestamp_epoch": "1647918855.741679000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 49777, "dst_port": 53, "tcp_stream": null, "udp_stream": 362, "fields": { "dns.flags.response": "False", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-1153c81a282626ff2a21beb8", "kind": "dns", "frame_number": 16211, "timestamp_epoch": "1647918855.819124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 49777, "tcp_stream": null, "udp_stream": 362, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "otectagain.top", "dns.qry.type": "1" } }, { "event_id": "evt-2d755463b96d05f84ef6c211", "kind": "dns", "frame_number": 16225, "timestamp_epoch": "1647918892.753631000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 50712, "dst_port": 53, "tcp_stream": null, "udp_stream": 363, "fields": { "dns.flags.response": "False", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-83e386b2aaa047e9b33086e4", "kind": "dns", "frame_number": 16226, "timestamp_epoch": "1647918892.827336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 50712, "tcp_stream": null, "udp_stream": 363, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dilimoretast.com", "dns.qry.type": "1" } }, { "event_id": "evt-e600206b9a7f8e04777f5cd4", "kind": "dns", "frame_number": 16240, "timestamp_epoch": "1647918928.763652000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 60235, "dst_port": 53, "tcp_stream": null, "udp_stream": 364, "fields": { "dns.flags.response": "False", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-a337b46f7155808d4e095746", "kind": "dns", "frame_number": 16241, "timestamp_epoch": "1647918928.840121000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 60235, "tcp_stream": null, "udp_stream": 364, "fields": { "dns.a": "157.245.142.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "antnosience.com", "dns.qry.type": "1" } }, { "event_id": "evt-1fd471ac75395c8b5535644a", "kind": "dns", "frame_number": 16258, "timestamp_epoch": "1647918964.740191000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 64639, "dst_port": 53, "tcp_stream": null, "udp_stream": 365, "fields": { "dns.flags.response": "False", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } }, { "event_id": "evt-80c3fcb4dbe5aada9ab454ae", "kind": "dns", "frame_number": 16259, "timestamp_epoch": "1647918964.817552000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 53, "dst_port": 64639, "tcp_stream": null, "udp_stream": 365, "fields": { "dns.a": "91.193.16.181", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "seaskysafe.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-1ba10c373636c6dad70270b8", "kind": "http_request", "frame_number": 4, "timestamp_epoch": "1647896291.303409000", "src_ip": "10.0.19.14", "dst_ip": "188.166.154.118", "src_port": 62179, "dst_port": 80, "tcp_stream": 0, "udp_stream": null, "fields": { "http.host": "oceriesfornot.top", "http.request.full_uri": "http://oceriesfornot.top/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "498" } }, { "event_id": "evt-939a66c428988d0b225cd309", "kind": "http_request", "frame_number": 3730, "timestamp_epoch": "1647898090.369579000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-8147962b1cc9ae1772b5283d", "kind": "http_request", "frame_number": 3739, "timestamp_epoch": "1647898093.369769000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-065f98a8694360c62dba1900", "kind": "http_request", "frame_number": 3742, "timestamp_epoch": "1647898095.120037000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-ae00d4777e7f5ba5d5aec839", "kind": "http_request", "frame_number": 3745, "timestamp_epoch": "1647898096.371268000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-ccee924f077328b7bce14aa5", "kind": "http_request", "frame_number": 3747, "timestamp_epoch": "1647898098.120255000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-79c98175e89130b73f0dbc3b", "kind": "http_request", "frame_number": 3749, "timestamp_epoch": "1647898099.370494000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a1fa1a8982693deb037bd8bb", "kind": "http_request", "frame_number": 3752, "timestamp_epoch": "1647898102.370736000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-df6caabdc99a20cbeb5501f9", "kind": "http_request", "frame_number": 3762, "timestamp_epoch": "1647898105.385194000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-8a8b6cbe9741827b7c64d084", "kind": "http_request", "frame_number": 3767, "timestamp_epoch": "1647898108.384633000", "src_ip": "169.254.179.89", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-beb03e4993912d846dd29bbb", "kind": "http_request", "frame_number": 3817, "timestamp_epoch": "1647898111.072041000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-cbf4c782df77b2f9ac1e977c", "kind": "http_request", "frame_number": 3823, "timestamp_epoch": "1647898111.400073000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-4120ab7d4d2418ac11b21516", "kind": "http_request", "frame_number": 3833, "timestamp_epoch": "1647898111.721068000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-14e051b34900b6dc2603fc48", "kind": "http_request", "frame_number": 3921, "timestamp_epoch": "1647898114.072232000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-67f63676363c6f2dcba7fa70", "kind": "http_request", "frame_number": 3925, "timestamp_epoch": "1647898114.400258000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-3a519390a1e5324a89224bff", "kind": "http_request", "frame_number": 3927, "timestamp_epoch": "1647898115.385356000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-4849726d81a83f5fa407385a", "kind": "http_request", "frame_number": 3993, "timestamp_epoch": "1647898118.400032000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-f4d586dcbaea55ca471640be", "kind": "http_request", "frame_number": 3998, "timestamp_epoch": "1647898121.403287000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-cf6066ffb2e383a4646303d7", "kind": "http_request", "frame_number": 4074, "timestamp_epoch": "1647898172.135617000", "src_ip": "10.0.19.14", "dst_ip": "68.142.107.129", "src_port": 62215, "dst_port": 80, "tcp_stream": 37, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d1adc478adff0d72", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d1adc478adff0d72", "http.response_in": "4076", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-98ed081cd29b3948e633464f", "kind": "http_request", "frame_number": 5753, "timestamp_epoch": "1647899684.353032000", "src_ip": "10.0.19.14", "dst_ip": "104.80.96.219", "src_port": 62259, "dst_port": 80, "tcp_stream": 81, "udp_stream": null, "fields": { "http.host": "r3.i.lencr.org", "http.request.full_uri": "http://r3.i.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "5756", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-07838d696bb6c20a01e0133b", "kind": "http_request", "frame_number": 6059, "timestamp_epoch": "1647899971.243136000", "src_ip": "10.0.19.14", "dst_ip": "104.80.96.219", "src_port": 62269, "dst_port": 80, "tcp_stream": 91, "udp_stream": null, "fields": { "http.host": "x1.c.lencr.org", "http.request.full_uri": "http://x1.c.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "6061", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-211087678684a99016fae323", "kind": "http_request", "frame_number": 6068, "timestamp_epoch": "1647899971.580964000", "src_ip": "10.0.19.14", "dst_ip": "69.28.162.0", "src_port": 62270, "dst_port": 80, "tcp_stream": 92, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?48e7354130cbe0e4", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?48e7354130cbe0e4", "http.response_in": "6070", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-db121e812716bc5adb0f7f39", "kind": "http_request", "frame_number": 8627, "timestamp_epoch": "1647901775.281200000", "src_ip": "10.0.19.14", "dst_ip": "209.197.3.8", "src_port": 62320, "dst_port": 80, "tcp_stream": 140, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?fcfd7669d19bb421", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?fcfd7669d19bb421", "http.response_in": "8629", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-18048d87cc4048254e82a46b", "kind": "http_request", "frame_number": 9268, "timestamp_epoch": "1647903846.058127000", "src_ip": "10.0.19.14", "dst_ip": "104.80.96.219", "src_port": 62334, "dst_port": 80, "tcp_stream": 154, "udp_stream": null, "fields": { "http.host": "x1.c.lencr.org", "http.request.full_uri": "http://x1.c.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "9272", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-018360e9622a3c228b1ad33f", "kind": "http_request", "frame_number": 9279, "timestamp_epoch": "1647903846.356989000", "src_ip": "10.0.19.14", "dst_ip": "69.28.162.128", "src_port": 62335, "dst_port": 80, "tcp_stream": 155, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?161b4282e13b6962", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?161b4282e13b6962", "http.response_in": "9281", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-dc4fe6d07f9fef6c0c4a699c", "kind": "http_request", "frame_number": 9789, "timestamp_epoch": "1647904916.047306000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.240", "src_port": 62352, "dst_port": 80, "tcp_stream": 172, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1131f2daab4034ba", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1131f2daab4034ba", "http.response_in": "9791", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-42745072f1a9ce7a091c0949", "kind": "http_request", "frame_number": 10275, "timestamp_epoch": "1647906274.371334000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.240", "src_port": 62363, "dst_port": 80, "tcp_stream": 183, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9770388e0c613755", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9770388e0c613755", "http.response_in": "10277", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-b87d9aa3b430ed2ae18b3185", "kind": "http_request", "frame_number": 11757, "timestamp_epoch": "1647908974.887435000", "src_ip": "10.0.19.14", "dst_ip": "104.80.96.219", "src_port": 62415, "dst_port": 80, "tcp_stream": 235, "udp_stream": null, "fields": { "http.host": "x1.c.lencr.org", "http.request.full_uri": "http://x1.c.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11760", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-659ada72161ac2bd5145c3dd", "kind": "http_request", "frame_number": 11767, "timestamp_epoch": "1647908975.179327000", "src_ip": "10.0.19.14", "dst_ip": "209.197.3.8", "src_port": 62416, "dst_port": 80, "tcp_stream": 236, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6c9c220471a286c", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6c9c220471a286c", "http.response_in": "11769", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-04ef445ff02663899172a9b3", "kind": "http_request", "frame_number": 12502, "timestamp_epoch": "1647910775.716220000", "src_ip": "10.0.19.14", "dst_ip": "209.197.3.8", "src_port": 62455, "dst_port": 80, "tcp_stream": 275, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?36a063424dfa7851", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?36a063424dfa7851", "http.response_in": "12504", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-cac252023c880dfec7c93b54", "kind": "http_request", "frame_number": 12818, "timestamp_epoch": "1647911082.964033000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.240", "src_port": 62470, "dst_port": 80, "tcp_stream": 290, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0356947035b28e34", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0356947035b28e34", "http.response_in": "12820", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-b314a7cea1d2d8a88cf93ec9", "kind": "http_request", "frame_number": 14371, "timestamp_epoch": "1647914646.526312000", "src_ip": "10.0.19.14", "dst_ip": "104.80.96.219", "src_port": 62544, "dst_port": 80, "tcp_stream": 364, "udp_stream": null, "fields": { "http.host": "x1.c.lencr.org", "http.request.full_uri": "http://x1.c.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14373", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-12423fb17a9f9d0e05daedc4", "kind": "http_request", "frame_number": 14380, "timestamp_epoch": "1647914646.880749000", "src_ip": "10.0.19.14", "dst_ip": "68.142.107.1", "src_port": 62545, "dst_port": 80, "tcp_stream": 365, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c66ea67221454a2e", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c66ea67221454a2e", "http.response_in": "14382", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-5dfbbb1a9a72609facf0d0c8", "kind": "http_request", "frame_number": 14383, "timestamp_epoch": "1647914647.025310000", "src_ip": "10.0.19.14", "dst_ip": "68.142.107.1", "src_port": 62545, "dst_port": 80, "tcp_stream": 365, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?416ee1a6826abea5", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?416ee1a6826abea5", "http.response_in": "14385", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-dde8452f412e9ed4533c5273", "kind": "http_request", "frame_number": 14821, "timestamp_epoch": "1647915587.324783000", "src_ip": "10.0.19.14", "dst_ip": "23.219.38.10", "src_port": 62570, "dst_port": 80, "tcp_stream": 390, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fd0590036de0ddd", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fd0590036de0ddd", "http.response_in": "14823", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-b42919413b12995c12f6f024", "kind": "http_request", "frame_number": 16149, "timestamp_epoch": "1647918738.205627000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-dfcbad81b07313a1759b7d66", "kind": "http_request", "frame_number": 16152, "timestamp_epoch": "1647918741.211965000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-7edb1d8d7fb8768f244df58c", "kind": "http_request", "frame_number": 16177, "timestamp_epoch": "1647918744.211724000", "src_ip": "10.0.19.14", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } } ], "http_response": [ { "event_id": "evt-7641c62110bfe3e7fa0b505b", "kind": "http_response", "frame_number": 498, "timestamp_epoch": "1647896315.807524000", "src_ip": "188.166.154.118", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62179, "tcp_stream": 0, "udp_stream": null, "fields": { "http.content_length": "393277", "http.content_type": "application/gzip", "http.request_in": "4", "http.response.code": "200" } }, { "event_id": "evt-f8f6ae9e41aa91e9edb794be", "kind": "http_response", "frame_number": 4076, "timestamp_epoch": "1647898172.281318000", "src_ip": "68.142.107.129", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62215, "tcp_stream": 37, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "4074", "http.response.code": "304" } }, { "event_id": "evt-5d196feedb63a8b370e3ddc1", "kind": "http_response", "frame_number": 5756, "timestamp_epoch": "1647899684.434631000", "src_ip": "104.80.96.219", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62259, "tcp_stream": 81, "udp_stream": null, "fields": { "http.content_length": "1306", "http.content_type": "application/pkix-cert", "http.request_in": "5753", "http.response.code": "200" } }, { "event_id": "evt-92263e99ecfedf6b25a850f3", "kind": "http_response", "frame_number": 6061, "timestamp_epoch": "1647899971.340323000", "src_ip": "104.80.96.219", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62269, "tcp_stream": 91, "udp_stream": null, "fields": { "http.content_type": "application/pkix-crl", "http.request_in": "6059", "http.response.code": "304" } }, { "event_id": "evt-7d8e3a735593bcc32c37cd86", "kind": "http_response", "frame_number": 6070, "timestamp_epoch": "1647899971.721251000", "src_ip": "69.28.162.0", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62270, "tcp_stream": 92, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "6068", "http.response.code": "304" } }, { "event_id": "evt-b2e87c3148972aa42743edcf", "kind": "http_response", "frame_number": 8629, "timestamp_epoch": "1647901775.371638000", "src_ip": "209.197.3.8", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62320, "tcp_stream": 140, "udp_stream": null, "fields": { "http.request_in": "8627", "http.response.code": "304" } }, { "event_id": "evt-e9fe37931b66231fe7134887", "kind": "http_response", "frame_number": 9272, "timestamp_epoch": "1647903846.146127000", "src_ip": "104.80.96.219", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62334, "tcp_stream": 154, "udp_stream": null, "fields": { "http.content_type": "application/pkix-crl", "http.request_in": "9268", "http.response.code": "304" } }, { "event_id": "evt-c009f472f879726af6881242", "kind": "http_response", "frame_number": 9281, "timestamp_epoch": "1647903846.495844000", "src_ip": "69.28.162.128", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62335, "tcp_stream": 155, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "9279", "http.response.code": "304" } }, { "event_id": "evt-2bd8e70518a9be7893b77b6c", "kind": "http_response", "frame_number": 9791, "timestamp_epoch": "1647904916.118733000", "src_ip": "72.21.81.240", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62352, "tcp_stream": 172, "udp_stream": null, "fields": { "http.request_in": "9789", "http.response.code": "304" } }, { "event_id": "evt-5c02eb18dce3c86c3cb57d5a", "kind": "http_response", "frame_number": 10277, "timestamp_epoch": "1647906274.446980000", "src_ip": "72.21.81.240", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62363, "tcp_stream": 183, "udp_stream": null, "fields": { "http.request_in": "10275", "http.response.code": "304" } }, { "event_id": "evt-f78da794c57eea178972f0fd", "kind": "http_response", "frame_number": 11760, "timestamp_epoch": "1647908974.993636000", "src_ip": "104.80.96.219", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62415, "tcp_stream": 235, "udp_stream": null, "fields": { "http.content_type": "application/pkix-crl", "http.request_in": "11757", "http.response.code": "304" } }, { "event_id": "evt-36e1afab200f737275282070", "kind": "http_response", "frame_number": 11769, "timestamp_epoch": "1647908975.290241000", "src_ip": "209.197.3.8", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62416, "tcp_stream": 236, "udp_stream": null, "fields": { "http.request_in": "11767", "http.response.code": "304" } }, { "event_id": "evt-9ba1d809ce2959423d8f69d6", "kind": "http_response", "frame_number": 12504, "timestamp_epoch": "1647910775.812297000", "src_ip": "209.197.3.8", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62455, "tcp_stream": 275, "udp_stream": null, "fields": { "http.request_in": "12502", "http.response.code": "304" } }, { "event_id": "evt-1170136073efccb7f5832a7a", "kind": "http_response", "frame_number": 12820, "timestamp_epoch": "1647911083.042923000", "src_ip": "72.21.81.240", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62470, "tcp_stream": 290, "udp_stream": null, "fields": { "http.request_in": "12818", "http.response.code": "304" } }, { "event_id": "evt-738632548d4011f39b3b1ad1", "kind": "http_response", "frame_number": 14373, "timestamp_epoch": "1647914646.604690000", "src_ip": "104.80.96.219", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62544, "tcp_stream": 364, "udp_stream": null, "fields": { "http.content_type": "application/pkix-crl", "http.request_in": "14371", "http.response.code": "304" } }, { "event_id": "evt-de1251c90ed34df7b346b1ae", "kind": "http_response", "frame_number": 14382, "timestamp_epoch": "1647914647.016554000", "src_ip": "68.142.107.1", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62545, "tcp_stream": 365, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "14380", "http.response.code": "304" } }, { "event_id": "evt-3db9a6c06098d9737b133305", "kind": "http_response", "frame_number": 14385, "timestamp_epoch": "1647914647.153557000", "src_ip": "68.142.107.1", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62545, "tcp_stream": 365, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "14383", "http.response.code": "304" } }, { "event_id": "evt-6e383d97727cf9c8c5108bc9", "kind": "http_response", "frame_number": 14823, "timestamp_epoch": "1647915587.401404000", "src_ip": "23.219.38.10", "dst_ip": "10.0.19.14", "src_port": 80, "dst_port": 62570, "tcp_stream": 390, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "14821", "http.response.code": "304" } } ], "tls_client_hello": [ { "event_id": "evt-2217c4dd14b01fa02a47287f", "kind": "tls_client_hello", "frame_number": 505, "timestamp_epoch": "1647896315.996143000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62180, "dst_port": 443, "tcp_stream": 1, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-1a1f0652d76a8c46b8823afd", "kind": "tls_client_hello", "frame_number": 522, "timestamp_epoch": "1647896328.036073000", "src_ip": "10.0.19.14", "dst_ip": "20.189.173.15", "src_port": 62181, "dst_port": 443, "tcp_stream": 2, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-6a74b58f9811402d9e73ac61", "kind": "tls_client_hello", "frame_number": 550, "timestamp_epoch": "1647896376.982682000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62182, "dst_port": 443, "tcp_stream": 3, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9545c0422e31d285bce942c3", "kind": "tls_client_hello", "frame_number": 570, "timestamp_epoch": "1647896378.204975000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62184, "dst_port": 443, "tcp_stream": 4, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b6be470ababac3a604333781", "kind": "tls_client_hello", "frame_number": 573, "timestamp_epoch": "1647896378.273018000", "src_ip": "10.0.19.14", "dst_ip": "160.153.32.99", "src_port": 62185, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "suncoastpinball.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-371465924cabdf5a11bd46c1", "kind": "tls_client_hello", "frame_number": 597, "timestamp_epoch": "1647896378.802591000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62186, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-92348b0c524b588d963eae21", "kind": "tls_client_hello", "frame_number": 613, "timestamp_epoch": "1647896379.212110000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62183, "dst_port": 443, "tcp_stream": 7, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-764d02d09a00c0881f6e9cf7", "kind": "tls_client_hello", "frame_number": 1107, "timestamp_epoch": "1647896384.773124000", "src_ip": "10.0.19.14", "dst_ip": "160.153.32.99", "src_port": 62192, "dst_port": 443, "tcp_stream": 13, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "suncoastpinball.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f36bbff3a53fdc98b1200ba5", "kind": "tls_client_hello", "frame_number": 1703, "timestamp_epoch": "1647896390.406451000", "src_ip": "10.0.19.14", "dst_ip": "160.153.32.99", "src_port": 62193, "dst_port": 443, "tcp_stream": 14, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "suncoastpinball.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-dd658256e5984699b604abc4", "kind": "tls_client_hello", "frame_number": 2253, "timestamp_epoch": "1647896399.499457000", "src_ip": "10.0.19.14", "dst_ip": "160.153.32.99", "src_port": 62194, "dst_port": 443, "tcp_stream": 15, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "suncoastpinball.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-da78edd26f0370e6e75ecd8f", "kind": "tls_client_hello", "frame_number": 2438, "timestamp_epoch": "1647896406.787125000", "src_ip": "10.0.19.14", "dst_ip": "160.153.32.99", "src_port": 62195, "dst_port": 443, "tcp_stream": 16, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "suncoastpinball.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a1f0814d47102f48aea5dc86", "kind": "tls_client_hello", "frame_number": 3267, "timestamp_epoch": "1647896678.223403000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62196, "dst_port": 443, "tcp_stream": 17, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ac7b9fe74ab87f59350066ba", "kind": "tls_client_hello", "frame_number": 3326, "timestamp_epoch": "1647896979.376171000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62197, "dst_port": 443, "tcp_stream": 18, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f0623e765e47348d3c5f2c0f", "kind": "tls_client_hello", "frame_number": 3385, "timestamp_epoch": "1647897103.747128000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62199, "dst_port": 443, "tcp_stream": 20, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-8a31b5abefbb7af456e3b877", "kind": "tls_client_hello", "frame_number": 3407, "timestamp_epoch": "1647897104.093038000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62200, "dst_port": 443, "tcp_stream": 21, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-498787f2bf10b561097c24d0", "kind": "tls_client_hello", "frame_number": 3525, "timestamp_epoch": "1647897263.120360000", "src_ip": "10.0.19.14", "dst_ip": "13.87.188.105", "src_port": 62205, "dst_port": 443, "tcp_stream": 26, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "checkappexec.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-ce96b4eafb5ddd0e5adbdbf7", "kind": "tls_client_hello", "frame_number": 3551, "timestamp_epoch": "1647897280.971962000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62206, "dst_port": 443, "tcp_stream": 27, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-bee1851d15b61b595eb5c0cb", "kind": "tls_client_hello", "frame_number": 3614, "timestamp_epoch": "1647897582.543838000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62207, "dst_port": 443, "tcp_stream": 28, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-026d1a4bd9e51333a296c1e7", "kind": "tls_client_hello", "frame_number": 3832, "timestamp_epoch": "1647898111.668568000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62210, "dst_port": 443, "tcp_stream": 31, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4782c65038301e990140da53", "kind": "tls_client_hello", "frame_number": 3880, "timestamp_epoch": "1647898112.120655000", "src_ip": "10.0.19.14", "dst_ip": "40.83.240.146", "src_port": 62211, "dst_port": 443, "tcp_stream": 32, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-d86744cb525b2cadb7a50e6b", "kind": "tls_client_hello", "frame_number": 4044, "timestamp_epoch": "1647898144.192840000", "src_ip": "10.0.19.14", "dst_ip": "13.89.179.9", "src_port": 62214, "dst_port": 443, "tcp_stream": 36, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-6e76fbe6bd308ba26815b2c5", "kind": "tls_client_hello", "frame_number": 4093, "timestamp_epoch": "1647898233.876453000", "src_ip": "10.0.19.14", "dst_ip": "40.83.240.146", "src_port": 62216, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-05b4e3720c50d8604cbd338d", "kind": "tls_client_hello", "frame_number": 4418, "timestamp_epoch": "1647899009.573706000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.203", "src_port": 62235, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-cfa39e1a4161033799b67eb7", "kind": "tls_client_hello", "frame_number": 4442, "timestamp_epoch": "1647899010.127524000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62236, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-9bc7b26d8a5ba3480c1dcea2", "kind": "tls_client_hello", "frame_number": 4479, "timestamp_epoch": "1647899010.412558000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.200", "src_port": 62237, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-vs-nocache.azureedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-517d16f481ca3d41b1ab8b38", "kind": "tls_client_hello", "frame_number": 4480, "timestamp_epoch": "1647899010.412558000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.200", "src_port": 62241, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-vp.azureedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-5675908f90c60d6a59b54263", "kind": "tls_client_hello", "frame_number": 4481, "timestamp_epoch": "1647899010.412558000", "src_ip": "10.0.19.14", "dst_ip": "72.21.81.200", "src_port": 62239, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp-vp-nocache.azureedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-e11fdee45964b8f39f0e810c", "kind": "tls_client_hello", "frame_number": 4482, "timestamp_epoch": "1647899010.412599000", "src_ip": "10.0.19.14", "dst_ip": "52.113.196.254", "src_port": 62240, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "teams-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-ce982b69e9baaf4f73925a19", "kind": "tls_client_hello", "frame_number": 4483, "timestamp_epoch": "1647899010.412599000", "src_ip": "10.0.19.14", "dst_ip": "13.107.246.254", "src_port": 62238, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "t-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-ef398535ed3af1fbc3b3c0bd", "kind": "tls_client_hello", "frame_number": 4486, "timestamp_epoch": "1647899010.425633000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62242, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-457d304910ab496b1058e2e8", "kind": "tls_client_hello", "frame_number": 4494, "timestamp_epoch": "1647899010.486057000", "src_ip": "10.0.19.14", "dst_ip": "13.107.136.254", "src_port": 62243, "dst_port": 443, "tcp_stream": 65, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "spo-ring.msedge.net", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-d5b220c097ee9fcec515f2ec", "kind": "tls_client_hello", "frame_number": 4569, "timestamp_epoch": "1647899010.498005000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62244, "dst_port": 443, "tcp_stream": 66, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-aefc4c39430edd48edc89f49", "kind": "tls_client_hello", "frame_number": 4572, "timestamp_epoch": "1647899010.504176000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62245, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-88b937d83d15b3bf621c2cbe", "kind": "tls_client_hello", "frame_number": 4730, "timestamp_epoch": "1647899020.612258000", "src_ip": "10.0.19.14", "dst_ip": "20.81.51.95", "src_port": 62246, "dst_port": 443, "tcp_stream": 68, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "checkappexec.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-80998e6a6f2ca2e302e0d942", "kind": "tls_client_hello", "frame_number": 4764, "timestamp_epoch": "1647899039.649817000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62247, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-b93a79d3c66eaedf74d0a394", "kind": "tls_client_hello", "frame_number": 4903, "timestamp_epoch": "1647899070.073098000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62253, "dst_port": 443, "tcp_stream": 75, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-443f1a6a9837c5a311f89f9f", "kind": "tls_client_hello", "frame_number": 5000, "timestamp_epoch": "1647899371.433479000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62254, "dst_port": 443, "tcp_stream": 76, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-171bc4acdcd083335ee4c127", "kind": "tls_client_hello", "frame_number": 5064, "timestamp_epoch": "1647899672.755120000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62255, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c824f1593e11bec0215c47d3", "kind": "tls_client_hello", "frame_number": 5081, "timestamp_epoch": "1647899674.239763000", "src_ip": "10.0.19.14", "dst_ip": "185.47.40.36", "src_port": 62256, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "filebin.net", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6cac069c73996e1b4f8c1f8b", "kind": "tls_client_hello", "frame_number": 5104, "timestamp_epoch": "1647899675.358295000", "src_ip": "10.0.19.14", "dst_ip": "87.238.33.8", "src_port": 62257, "dst_port": 443, "tcp_stream": 79, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "situla.bitbit.net", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-710403dcb65b45e473dd2823", "kind": "tls_client_hello", "frame_number": 5740, "timestamp_epoch": "1647899683.949375000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62258, "dst_port": 757, "tcp_stream": 80, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-2d6966137878c1287f8f9796", "kind": "tls_client_hello", "frame_number": 5804, "timestamp_epoch": "1647899737.335769000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62260, "dst_port": 757, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-cddd9b8c768b3c695f7ebeb9", "kind": "tls_client_hello", "frame_number": 5840, "timestamp_epoch": "1647899788.744707000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62261, "dst_port": 757, "tcp_stream": 83, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-47a07b11b35aeaeb26ebd986", "kind": "tls_client_hello", "frame_number": 5885, "timestamp_epoch": "1647899846.925124000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62263, "dst_port": 757, "tcp_stream": 85, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-1f46eeacfdca867bb6443be3", "kind": "tls_client_hello", "frame_number": 5921, "timestamp_epoch": "1647899900.628517000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62264, "dst_port": 757, "tcp_stream": 86, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-a0b0f7ab76e7f2bf5a82a146", "kind": "tls_client_hello", "frame_number": 5949, "timestamp_epoch": "1647899910.545288000", "src_ip": "10.0.19.14", "dst_ip": "13.69.116.104", "src_port": 62265, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4a95fae61fa762112b63b719", "kind": "tls_client_hello", "frame_number": 5974, "timestamp_epoch": "1647899912.099981000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62266, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-8539d0a270f64b53d0da313d", "kind": "tls_client_hello", "frame_number": 6029, "timestamp_epoch": "1647899950.105443000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62268, "dst_port": 757, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-94433aeccb26f6040d6c1ffa", "kind": "tls_client_hello", "frame_number": 6077, "timestamp_epoch": "1647899974.152615000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62271, "dst_port": 443, "tcp_stream": 93, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f398cdd5f458caa73d392429", "kind": "tls_client_hello", "frame_number": 6100, "timestamp_epoch": "1647899996.939371000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62272, "dst_port": 757, "tcp_stream": 94, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-44530aad735678e56f1b7553", "kind": "tls_client_hello", "frame_number": 6146, "timestamp_epoch": "1647900047.787833000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62273, "dst_port": 757, "tcp_stream": 95, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-3f6550f54284e2101a44d333", "kind": "tls_client_hello", "frame_number": 6176, "timestamp_epoch": "1647900097.098030000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62274, "dst_port": 757, "tcp_stream": 96, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-feaa5db2342312ba4a7b30ae", "kind": "tls_client_hello", "frame_number": 6205, "timestamp_epoch": "1647900140.318377000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62275, "dst_port": 757, "tcp_stream": 97, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-035b46651a8df3d128fafe36", "kind": "tls_client_hello", "frame_number": 6239, "timestamp_epoch": "1647900186.948538000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62276, "dst_port": 757, "tcp_stream": 98, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-51c888a9d897b1ccfae30713", "kind": "tls_client_hello", "frame_number": 6269, "timestamp_epoch": "1647900237.726544000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62277, "dst_port": 757, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-5f8bc9ebc2353d04265f25c8", "kind": "tls_client_hello", "frame_number": 6300, "timestamp_epoch": "1647900275.540229000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62278, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c43b78b515e5e1622ee64859", "kind": "tls_client_hello", "frame_number": 6322, "timestamp_epoch": "1647900292.865402000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62279, "dst_port": 757, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-d878e9c7f1a47f494e2dcaa8", "kind": "tls_client_hello", "frame_number": 6356, "timestamp_epoch": "1647900347.763979000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62280, "dst_port": 757, "tcp_stream": 102, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-1f4b19c6cdcd4c59b365a53b", "kind": "tls_client_hello", "frame_number": 6383, "timestamp_epoch": "1647900351.254840000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62281, "dst_port": 757, "tcp_stream": 103, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-732dfaf65807bea9939660be", "kind": "tls_client_hello", "frame_number": 7457, "timestamp_epoch": "1647900355.657462000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62288, "dst_port": 757, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-1b158e91096f122ad9c2d9b7", "kind": "tls_client_hello", "frame_number": 7482, "timestamp_epoch": "1647900359.167016000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62289, "dst_port": 757, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-5e317e4c30703ccbc5e7455e", "kind": "tls_client_hello", "frame_number": 7509, "timestamp_epoch": "1647900359.643154000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62290, "dst_port": 757, "tcp_stream": 110, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-820f6740418cacaadb3329c2", "kind": "tls_client_hello", "frame_number": 7535, "timestamp_epoch": "1647900363.153620000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62291, "dst_port": 757, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-cc2e4666c08b82c0d116f6eb", "kind": "tls_client_hello", "frame_number": 7565, "timestamp_epoch": "1647900368.640131000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62292, "dst_port": 757, "tcp_stream": 112, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-7d556e42ca76976a30f20d1f", "kind": "tls_client_hello", "frame_number": 7595, "timestamp_epoch": "1647900373.167970000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62293, "dst_port": 757, "tcp_stream": 113, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-032d54ebe704cd41d588e780", "kind": "tls_client_hello", "frame_number": 7622, "timestamp_epoch": "1647900376.682173000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62294, "dst_port": 757, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-150bb1df0609a09ffad3c75b", "kind": "tls_client_hello", "frame_number": 7648, "timestamp_epoch": "1647900380.171304000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62295, "dst_port": 757, "tcp_stream": 115, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-7e7ea2da0dedfd4fd99694ea", "kind": "tls_client_hello", "frame_number": 7673, "timestamp_epoch": "1647900383.681170000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62296, "dst_port": 757, "tcp_stream": 116, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-d00ef7759084a78b50a1edb0", "kind": "tls_client_hello", "frame_number": 7702, "timestamp_epoch": "1647900388.696901000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62297, "dst_port": 757, "tcp_stream": 117, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-d53c5e389954bf5a1bc4fea5", "kind": "tls_client_hello", "frame_number": 7729, "timestamp_epoch": "1647900392.234667000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62298, "dst_port": 757, "tcp_stream": 118, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-dac978e629ea9c4bce462649", "kind": "tls_client_hello", "frame_number": 7758, "timestamp_epoch": "1647900395.748503000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62299, "dst_port": 757, "tcp_stream": 119, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-f1568b364a3684303124e01f", "kind": "tls_client_hello", "frame_number": 7788, "timestamp_epoch": "1647900399.297314000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62300, "dst_port": 757, "tcp_stream": 120, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-77f57b7f7ee01371a00e97e0", "kind": "tls_client_hello", "frame_number": 7818, "timestamp_epoch": "1647900403.801988000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62301, "dst_port": 757, "tcp_stream": 121, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-7e99bd362f5c4cfa8ce9b8c3", "kind": "tls_client_hello", "frame_number": 7842, "timestamp_epoch": "1647900404.306429000", "src_ip": "10.0.19.14", "dst_ip": "23.227.198.203", "src_port": 62302, "dst_port": 757, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bupdater.com", "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19" } }, { "event_id": "evt-55be94f604c9b545589fb31d", "kind": "tls_client_hello", "frame_number": 7935, "timestamp_epoch": "1647900576.883045000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62303, "dst_port": 443, "tcp_stream": 123, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-10d9c191057d7beb9be02ffe", "kind": "tls_client_hello", "frame_number": 7964, "timestamp_epoch": "1647900610.001383000", "src_ip": "10.0.19.14", "dst_ip": "20.81.52.156", "src_port": 62304, "dst_port": 443, "tcp_stream": 124, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "checkappexec.microsoft.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-23d248d37b5f208a1d1e5126", "kind": "tls_client_hello", "frame_number": 8323, "timestamp_epoch": "1647900878.268041000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62314, "dst_port": 443, "tcp_stream": 134, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-cb0e0a06836b4dc29c34fa1e", "kind": "tls_client_hello", "frame_number": 8413, "timestamp_epoch": "1647901179.505168000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62315, "dst_port": 443, "tcp_stream": 135, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7a90e1ffea72875b2cf3a731", "kind": "tls_client_hello", "frame_number": 8490, "timestamp_epoch": "1647901480.769807000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62316, "dst_port": 443, "tcp_stream": 136, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6a372d24ccb984b3ec583011", "kind": "tls_client_hello", "frame_number": 8541, "timestamp_epoch": "1647901712.880554000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62317, "dst_port": 443, "tcp_stream": 137, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-be440b003e04674cc7f670b9", "kind": "tls_client_hello", "frame_number": 8574, "timestamp_epoch": "1647901731.671276000", "src_ip": "10.0.19.14", "dst_ip": "52.109.8.20", "src_port": 62318, "dst_port": 443, "tcp_stream": 138, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-3065117d897cb930764ca5f2", "kind": "tls_client_hello", "frame_number": 8636, "timestamp_epoch": "1647901782.104350000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62321, "dst_port": 443, "tcp_stream": 141, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-38fa6d31816f6b84489886ad", "kind": "tls_client_hello", "frame_number": 8695, "timestamp_epoch": "1647901985.750481000", "src_ip": "10.0.19.14", "dst_ip": "13.89.179.10", "src_port": 62322, "dst_port": 443, "tcp_stream": 142, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-a3140dc69e5325a78084c745", "kind": "tls_client_hello", "frame_number": 8730, "timestamp_epoch": "1647902083.439477000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62323, "dst_port": 443, "tcp_stream": 143, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f6e404ec95dd57881d8c8837", "kind": "tls_client_hello", "frame_number": 8802, "timestamp_epoch": "1647902384.736619000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62324, "dst_port": 443, "tcp_stream": 144, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-03ce53a45b79c7b9bcf15ccd", "kind": "tls_client_hello", "frame_number": 8850, "timestamp_epoch": "1647902554.549722000", "src_ip": "10.0.19.14", "dst_ip": "40.124.168.44", "src_port": 62325, "dst_port": 443, "tcp_stream": 145, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "msedge.api.cdp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c498a4cc5803d0c53cabcfb0", "kind": "tls_client_hello", "frame_number": 8885, "timestamp_epoch": "1647902555.586899000", "src_ip": "10.0.19.14", "dst_ip": "13.107.42.16", "src_port": 62326, "dst_port": 443, "tcp_stream": 146, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "config.edge.skype.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f598f08c953e86751e617516", "kind": "tls_client_hello", "frame_number": 8960, "timestamp_epoch": "1647902686.141358000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62328, "dst_port": 443, "tcp_stream": 148, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6196b9518ae9250f83d1b25a", "kind": "tls_client_hello", "frame_number": 9025, "timestamp_epoch": "1647902987.447047000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62329, "dst_port": 443, "tcp_stream": 149, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-dfafcf68c6a673acd5de00c1", "kind": "tls_client_hello", "frame_number": 9093, "timestamp_epoch": "1647903288.763195000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62330, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a896707e8ff7fff760ec8a71", "kind": "tls_client_hello", "frame_number": 9183, "timestamp_epoch": "1647903590.094090000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62332, "dst_port": 443, "tcp_stream": 152, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-fe28f57ef923219e413ff36b", "kind": "tls_client_hello", "frame_number": 9237, "timestamp_epoch": "1647903785.637959000", "src_ip": "10.0.19.14", "dst_ip": "20.44.10.123", "src_port": 62333, "dst_port": 443, "tcp_stream": 153, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f31780676caefc326914bfd9", "kind": "tls_client_hello", "frame_number": 9295, "timestamp_epoch": "1647903891.462682000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62336, "dst_port": 443, "tcp_stream": 156, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f08fb5ab9c040ae57b5b9f54", "kind": "tls_client_hello", "frame_number": 9376, "timestamp_epoch": "1647904192.734189000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62337, "dst_port": 443, "tcp_stream": 157, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-744adef8447b4bd4a632e9d6", "kind": "tls_client_hello", "frame_number": 9540, "timestamp_epoch": "1647904494.128983000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62343, "dst_port": 443, "tcp_stream": 163, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-664515105dee193995508e1a", "kind": "tls_client_hello", "frame_number": 9707, "timestamp_epoch": "1647904795.453734000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62349, "dst_port": 443, "tcp_stream": 169, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-82abd60bbc1ea56a6cbd8034", "kind": "tls_client_hello", "frame_number": 9731, "timestamp_epoch": "1647904855.678758000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62350, "dst_port": 443, "tcp_stream": 170, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-a5e2b009660b79f67d1986d4", "kind": "tls_client_hello", "frame_number": 9753, "timestamp_epoch": "1647904856.504908000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62351, "dst_port": 443, "tcp_stream": 171, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-44acbb391679da7e0a0c5932", "kind": "tls_client_hello", "frame_number": 9827, "timestamp_epoch": "1647905096.737664000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62353, "dst_port": 443, "tcp_stream": 173, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b76c8cb5a3e714c0fff64200", "kind": "tls_client_hello", "frame_number": 9884, "timestamp_epoch": "1647905313.298989000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62354, "dst_port": 443, "tcp_stream": 174, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c0192fd202d28bdd1523253a", "kind": "tls_client_hello", "frame_number": 9957, "timestamp_epoch": "1647905398.112246000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62356, "dst_port": 443, "tcp_stream": 176, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9faab413c04c94dd0ae0cfb0", "kind": "tls_client_hello", "frame_number": 10006, "timestamp_epoch": "1647905583.762922000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62357, "dst_port": 443, "tcp_stream": 177, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-f2442e93ba2b5996ad92bca1", "kind": "tls_client_hello", "frame_number": 10048, "timestamp_epoch": "1647905585.664402000", "src_ip": "10.0.19.14", "dst_ip": "13.69.239.74", "src_port": 62358, "dst_port": 443, "tcp_stream": 178, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f01e66f6bef355216a92fc93", "kind": "tls_client_hello", "frame_number": 10095, "timestamp_epoch": "1647905699.414612000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62359, "dst_port": 443, "tcp_stream": 179, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-656c322a66bdc405ee06fffc", "kind": "tls_client_hello", "frame_number": 10167, "timestamp_epoch": "1647906000.746577000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62360, "dst_port": 443, "tcp_stream": 180, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2f3a1a4ecaa52ebe29e6e5b2", "kind": "tls_client_hello", "frame_number": 10215, "timestamp_epoch": "1647906214.008016000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62361, "dst_port": 443, "tcp_stream": 181, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-7a6ea6302988cbc3eec47171", "kind": "tls_client_hello", "frame_number": 10284, "timestamp_epoch": "1647906302.047241000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62364, "dst_port": 443, "tcp_stream": 184, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-26386a299f76c6a8f503f108", "kind": "tls_client_hello", "frame_number": 10365, "timestamp_epoch": "1647906603.358563000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62365, "dst_port": 443, "tcp_stream": 185, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-3d819d9e97e7ddd1ff3c4e3c", "kind": "tls_client_hello", "frame_number": 10423, "timestamp_epoch": "1647906904.846413000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62366, "dst_port": 443, "tcp_stream": 186, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5fb35f870b79a3948b28508e", "kind": "tls_client_hello", "frame_number": 10764, "timestamp_epoch": "1647907206.191197000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62373, "dst_port": 443, "tcp_stream": 193, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5c832220d8d0783e7e9242f1", "kind": "tls_client_hello", "frame_number": 10812, "timestamp_epoch": "1647907385.424509000", "src_ip": "10.0.19.14", "dst_ip": "20.189.173.2", "src_port": 62374, "dst_port": 443, "tcp_stream": 194, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c252627034dd0c93fad13b59", "kind": "tls_client_hello", "frame_number": 10852, "timestamp_epoch": "1647907507.500452000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62375, "dst_port": 443, "tcp_stream": 195, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9d2e671aaa4fcd4f1360cb4c", "kind": "tls_client_hello", "frame_number": 10921, "timestamp_epoch": "1647907808.810928000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62376, "dst_port": 443, "tcp_stream": 196, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7d1bf93ef2504382690cc346", "kind": "tls_client_hello", "frame_number": 11075, "timestamp_epoch": "1647908110.122173000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62382, "dst_port": 443, "tcp_stream": 202, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-90aae04a6adaa5e0ef1325e3", "kind": "tls_client_hello", "frame_number": 11132, "timestamp_epoch": "1647908352.931041000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62383, "dst_port": 443, "tcp_stream": 203, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-bf975b44526a899101d00457", "kind": "tls_client_hello", "frame_number": 11150, "timestamp_epoch": "1647908390.298652000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62384, "dst_port": 443, "tcp_stream": 204, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-252b06a1d0bd87dc87fe0b3a", "kind": "tls_client_hello", "frame_number": 11166, "timestamp_epoch": "1647908411.494301000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62385, "dst_port": 443, "tcp_stream": 205, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2c897fe85f210582aa777599", "kind": "tls_client_hello", "frame_number": 11186, "timestamp_epoch": "1647908427.663740000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62386, "dst_port": 443, "tcp_stream": 206, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-a0736a7045ca9986a0592f2f", "kind": "tls_client_hello", "frame_number": 11201, "timestamp_epoch": "1647908448.566996000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62387, "dst_port": 443, "tcp_stream": 207, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-64a422460aafdf5d17866f88", "kind": "tls_client_hello", "frame_number": 11217, "timestamp_epoch": "1647908465.063552000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62388, "dst_port": 443, "tcp_stream": 208, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-7e0646a2a3daaa3895d9ad24", "kind": "tls_client_hello", "frame_number": 11236, "timestamp_epoch": "1647908484.580240000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62389, "dst_port": 443, "tcp_stream": 209, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c1eb5b3f9fc482744af1d19f", "kind": "tls_client_hello", "frame_number": 11254, "timestamp_epoch": "1647908503.363311000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62390, "dst_port": 443, "tcp_stream": 210, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-d43b451367553f7861cae015", "kind": "tls_client_hello", "frame_number": 11270, "timestamp_epoch": "1647908506.295628000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62391, "dst_port": 443, "tcp_stream": 211, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-35258d06d3240b42dc968965", "kind": "tls_client_hello", "frame_number": 11284, "timestamp_epoch": "1647908509.437071000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62392, "dst_port": 443, "tcp_stream": 212, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-d6a285cd6ccd7fd42fcf83c4", "kind": "tls_client_hello", "frame_number": 11300, "timestamp_epoch": "1647908512.232433000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62393, "dst_port": 443, "tcp_stream": 213, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-3a7653d0c5b097446e703114", "kind": "tls_client_hello", "frame_number": 11312, "timestamp_epoch": "1647908515.401190000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62394, "dst_port": 443, "tcp_stream": 214, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-ba98ebd5bfb96f6fa564a719", "kind": "tls_client_hello", "frame_number": 11326, "timestamp_epoch": "1647908518.280730000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62395, "dst_port": 443, "tcp_stream": 215, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-42328c7b97707f21d48c3303", "kind": "tls_client_hello", "frame_number": 11338, "timestamp_epoch": "1647908521.494078000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62396, "dst_port": 443, "tcp_stream": 216, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-bc93ed13bfe62c0467f476c6", "kind": "tls_client_hello", "frame_number": 11356, "timestamp_epoch": "1647908527.446384000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62397, "dst_port": 443, "tcp_stream": 217, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-aca00136d948a1253e00f242", "kind": "tls_client_hello", "frame_number": 11374, "timestamp_epoch": "1647908533.536591000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62398, "dst_port": 443, "tcp_stream": 218, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-0e6528b0f21de732d659878c", "kind": "tls_client_hello", "frame_number": 11392, "timestamp_epoch": "1647908539.565614000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62399, "dst_port": 443, "tcp_stream": 219, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-764e21e7b91a6d8ec625e3a6", "kind": "tls_client_hello", "frame_number": 11442, "timestamp_epoch": "1647908835.225486000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62400, "dst_port": 443, "tcp_stream": 220, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-77cc6bfee65aa7f24615f4a8", "kind": "tls_client_hello", "frame_number": 11496, "timestamp_epoch": "1647908840.700762000", "src_ip": "10.0.19.14", "dst_ip": "204.79.197.200", "src_port": 62401, "dst_port": 443, "tcp_stream": 221, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-b933a7a8c96b929715577ac5", "kind": "tls_client_hello", "frame_number": 11592, "timestamp_epoch": "1647908841.010710000", "src_ip": "10.0.19.14", "dst_ip": "40.126.26.134", "src_port": 62408, "dst_port": 443, "tcp_stream": 228, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-e35e3c02d2b88060fc8cacb1", "kind": "tls_client_hello", "frame_number": 11615, "timestamp_epoch": "1647908842.258357000", "src_ip": "10.0.19.14", "dst_ip": "20.69.130.185", "src_port": 62409, "dst_port": 443, "tcp_stream": 229, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "arc.msn.com", "tls.handshake.ja3": "6271f898ce5be7dd52b0fc260d0662b3" } }, { "event_id": "evt-f62b0a7fea2dfe01ec897a41", "kind": "tls_client_hello", "frame_number": 11650, "timestamp_epoch": "1647908872.158364000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62410, "dst_port": 443, "tcp_stream": 230, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a9675674afa99a2f64a25d8d", "kind": "tls_client_hello", "frame_number": 11674, "timestamp_epoch": "1647908908.248148000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62411, "dst_port": 443, "tcp_stream": 231, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-76051cbd11d7d57e8bd0dccc", "kind": "tls_client_hello", "frame_number": 11686, "timestamp_epoch": "1647908914.476305000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62412, "dst_port": 443, "tcp_stream": 232, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-00150a627ea709d8925581a7", "kind": "tls_client_hello", "frame_number": 11738, "timestamp_epoch": "1647908944.159527000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62414, "dst_port": 443, "tcp_stream": 234, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-54721c40d38c1b03f3456881", "kind": "tls_client_hello", "frame_number": 11774, "timestamp_epoch": "1647908980.145355000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62417, "dst_port": 443, "tcp_stream": 237, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-57cd92a121a3f7a4a72a3b04", "kind": "tls_client_hello", "frame_number": 11793, "timestamp_epoch": "1647909016.082985000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62418, "dst_port": 443, "tcp_stream": 238, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9945d4e7f1ae02c43d7b84c2", "kind": "tls_client_hello", "frame_number": 11807, "timestamp_epoch": "1647909022.109690000", "src_ip": "10.0.19.14", "dst_ip": "52.109.8.19", "src_port": 62419, "dst_port": 443, "tcp_stream": 239, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-16b56ba10b28e37a3dce4218", "kind": "tls_client_hello", "frame_number": 11840, "timestamp_epoch": "1647909052.145506000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62420, "dst_port": 443, "tcp_stream": 240, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-93662f40378679e819c6481f", "kind": "tls_client_hello", "frame_number": 11851, "timestamp_epoch": "1647909088.079350000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62421, "dst_port": 443, "tcp_stream": 241, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-644ff0bf985fc17bd081b408", "kind": "tls_client_hello", "frame_number": 11868, "timestamp_epoch": "1647909140.471706000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62422, "dst_port": 443, "tcp_stream": 242, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-71406e2d6069b5087fb2b4ac", "kind": "tls_client_hello", "frame_number": 11885, "timestamp_epoch": "1647909185.437679000", "src_ip": "10.0.19.14", "dst_ip": "40.74.98.194", "src_port": 62423, "dst_port": 443, "tcp_stream": 243, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-79e7e7e526e9a19989bc794e", "kind": "tls_client_hello", "frame_number": 11928, "timestamp_epoch": "1647909424.158337000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62424, "dst_port": 443, "tcp_stream": 244, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2df784402443bb217a4f98d7", "kind": "tls_client_hello", "frame_number": 11947, "timestamp_epoch": "1647909461.248565000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62425, "dst_port": 443, "tcp_stream": 245, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6ad0032d6aab8805a386eca7", "kind": "tls_client_hello", "frame_number": 11966, "timestamp_epoch": "1647909497.174229000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62426, "dst_port": 443, "tcp_stream": 246, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f94ca308564995327f0de79d", "kind": "tls_client_hello", "frame_number": 11981, "timestamp_epoch": "1647909533.240684000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62427, "dst_port": 443, "tcp_stream": 247, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d4b69b1d1f80bd2a7397d167", "kind": "tls_client_hello", "frame_number": 11996, "timestamp_epoch": "1647909569.111577000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62428, "dst_port": 443, "tcp_stream": 248, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-13cc54779d75f530e737064e", "kind": "tls_client_hello", "frame_number": 12013, "timestamp_epoch": "1647909605.145603000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62429, "dst_port": 443, "tcp_stream": 249, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4aaa2472ca0a239c1b1c4eaf", "kind": "tls_client_hello", "frame_number": 12028, "timestamp_epoch": "1647909641.074567000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62430, "dst_port": 443, "tcp_stream": 250, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b9104700ea305fed1b16bf76", "kind": "tls_client_hello", "frame_number": 12040, "timestamp_epoch": "1647909677.138648000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62431, "dst_port": 443, "tcp_stream": 251, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-711e9906e1ee25e71a0ff127", "kind": "tls_client_hello", "frame_number": 12057, "timestamp_epoch": "1647909772.856450000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62432, "dst_port": 443, "tcp_stream": 252, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-a8b5d3ebe3febe7fbb41b47e", "kind": "tls_client_hello", "frame_number": 12105, "timestamp_epoch": "1647910013.207323000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62434, "dst_port": 443, "tcp_stream": 254, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f13b6eb41c6b717a8245fb79", "kind": "tls_client_hello", "frame_number": 12120, "timestamp_epoch": "1647910050.158761000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62435, "dst_port": 443, "tcp_stream": 255, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5f0ce34e325b50b678fb9d75", "kind": "tls_client_hello", "frame_number": 12135, "timestamp_epoch": "1647910086.232238000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62436, "dst_port": 443, "tcp_stream": 256, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5dd47f9793488355b5e3fa07", "kind": "tls_client_hello", "frame_number": 12160, "timestamp_epoch": "1647910124.017703000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62437, "dst_port": 443, "tcp_stream": 257, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-3eef72433d301881a49656a6", "kind": "tls_client_hello", "frame_number": 12178, "timestamp_epoch": "1647910161.140131000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62438, "dst_port": 443, "tcp_stream": 258, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-30d9aac224ccb14bbe8683e6", "kind": "tls_client_hello", "frame_number": 12291, "timestamp_epoch": "1647910198.078443000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62444, "dst_port": 443, "tcp_stream": 264, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-69dbfef2314133620ec36509", "kind": "tls_client_hello", "frame_number": 12315, "timestamp_epoch": "1647910234.134291000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62445, "dst_port": 443, "tcp_stream": 265, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-e084bc2d6ca891ce74ab96db", "kind": "tls_client_hello", "frame_number": 12326, "timestamp_epoch": "1647910270.069393000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62446, "dst_port": 443, "tcp_stream": 266, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5503e5e8d764786f8e326031", "kind": "tls_client_hello", "frame_number": 12348, "timestamp_epoch": "1647910405.103135000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62447, "dst_port": 443, "tcp_stream": 267, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-b41a7dce1903961659044c1f", "kind": "tls_client_hello", "frame_number": 12374, "timestamp_epoch": "1647910606.132287000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62448, "dst_port": 443, "tcp_stream": 268, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d208a78ca4e0ad27c8be7d99", "kind": "tls_client_hello", "frame_number": 12392, "timestamp_epoch": "1647910643.198713000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62449, "dst_port": 443, "tcp_stream": 269, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-95bf98572b94bd34115acdf9", "kind": "tls_client_hello", "frame_number": 12409, "timestamp_epoch": "1647910679.717870000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62450, "dst_port": 443, "tcp_stream": 270, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1293cfdd8a5e9f8137c2318a", "kind": "tls_client_hello", "frame_number": 12429, "timestamp_epoch": "1647910715.005194000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62451, "dst_port": 443, "tcp_stream": 271, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-8d2de6c10e964330a1da9980", "kind": "tls_client_hello", "frame_number": 12451, "timestamp_epoch": "1647910718.245363000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62452, "dst_port": 443, "tcp_stream": 272, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-be26cc84323ec87b2cbd7ee6", "kind": "tls_client_hello", "frame_number": 12488, "timestamp_epoch": "1647910755.078804000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62454, "dst_port": 443, "tcp_stream": 274, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4d00779f87f714fa85384105", "kind": "tls_client_hello", "frame_number": 12518, "timestamp_epoch": "1647910791.114511000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62456, "dst_port": 443, "tcp_stream": 276, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-da16b0a16744e55bd50bf38e", "kind": "tls_client_hello", "frame_number": 12539, "timestamp_epoch": "1647910827.055480000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62457, "dst_port": 443, "tcp_stream": 277, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-12361942c7175ecd9fffd39f", "kind": "tls_client_hello", "frame_number": 12555, "timestamp_epoch": "1647910863.104673000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62458, "dst_port": 443, "tcp_stream": 278, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-fe323ecf3396c490f5867d5c", "kind": "tls_client_hello", "frame_number": 12572, "timestamp_epoch": "1647910985.300345000", "src_ip": "10.0.19.14", "dst_ip": "52.182.143.210", "src_port": 62459, "dst_port": 443, "tcp_stream": 279, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-2483a2ad8f91bac593016fd2", "kind": "tls_client_hello", "frame_number": 12678, "timestamp_epoch": "1647911022.191097000", "src_ip": "10.0.19.14", "dst_ip": "52.137.108.250", "src_port": 62465, "dst_port": 443, "tcp_stream": 285, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-bd76d7299b753ff6f4658ad1", "kind": "tls_client_hello", "frame_number": 12681, "timestamp_epoch": "1647911022.283679000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62466, "dst_port": 443, "tcp_stream": 286, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-c33cf0109117a66aba53c5c7", "kind": "tls_client_hello", "frame_number": 12749, "timestamp_epoch": "1647911022.925677000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62467, "dst_port": 443, "tcp_stream": 287, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-14f0326711030b79e0017620", "kind": "tls_client_hello", "frame_number": 12773, "timestamp_epoch": "1647911025.819022000", "src_ip": "10.0.19.14", "dst_ip": "184.85.64.91", "src_port": 62468, "dst_port": 443, "tcp_stream": 288, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4d6b9cf17f570147e6bae228", "kind": "tls_client_hello", "frame_number": 12800, "timestamp_epoch": "1647911037.611571000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62469, "dst_port": 443, "tcp_stream": 289, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-7e7e09bd42cabdeba0fcd7d8", "kind": "tls_client_hello", "frame_number": 12839, "timestamp_epoch": "1647911199.123882000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62471, "dst_port": 443, "tcp_stream": 291, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c8fc6d051dff784008942139", "kind": "tls_client_hello", "frame_number": 12852, "timestamp_epoch": "1647911236.140285000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62472, "dst_port": 443, "tcp_stream": 292, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4491fd603100f01f2cd09fab", "kind": "tls_client_hello", "frame_number": 12869, "timestamp_epoch": "1647911272.196475000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62473, "dst_port": 443, "tcp_stream": 293, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-dea00a71881f3b9afa078ae2", "kind": "tls_client_hello", "frame_number": 12888, "timestamp_epoch": "1647911308.127897000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62474, "dst_port": 443, "tcp_stream": 294, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-acd2bba028824502fbe094dd", "kind": "tls_client_hello", "frame_number": 12903, "timestamp_epoch": "1647911344.209291000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62475, "dst_port": 443, "tcp_stream": 295, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7c99db82c150772366891f2a", "kind": "tls_client_hello", "frame_number": 12918, "timestamp_epoch": "1647911380.044708000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62476, "dst_port": 443, "tcp_stream": 296, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ccb57729751ac299ce58154b", "kind": "tls_client_hello", "frame_number": 12937, "timestamp_epoch": "1647911416.113782000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62477, "dst_port": 443, "tcp_stream": 297, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b719ad9453757a54851f4999", "kind": "tls_client_hello", "frame_number": 12950, "timestamp_epoch": "1647911452.058493000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62478, "dst_port": 443, "tcp_stream": 298, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ad0f40ec3c385c7a7d0beb96", "kind": "tls_client_hello", "frame_number": 13067, "timestamp_epoch": "1647911670.943355000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62484, "dst_port": 443, "tcp_stream": 304, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-1c2197abc34a661ff416b066", "kind": "tls_client_hello", "frame_number": 13087, "timestamp_epoch": "1647911788.030744000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62485, "dst_port": 443, "tcp_stream": 305, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-abe7aa9f8d9cbf4bd9a503f4", "kind": "tls_client_hello", "frame_number": 13102, "timestamp_epoch": "1647911825.122741000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62486, "dst_port": 443, "tcp_stream": 306, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-426baeec719b2cf32530cf98", "kind": "tls_client_hello", "frame_number": 13117, "timestamp_epoch": "1647911861.108549000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62487, "dst_port": 443, "tcp_stream": 307, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9b85d2895fc360a864de0878", "kind": "tls_client_hello", "frame_number": 13145, "timestamp_epoch": "1647911897.205275000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62488, "dst_port": 443, "tcp_stream": 308, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-8239444e81974f29de3de285", "kind": "tls_client_hello", "frame_number": 13160, "timestamp_epoch": "1647911928.722119000", "src_ip": "10.0.19.14", "dst_ip": "51.105.71.137", "src_port": 62489, "dst_port": 443, "tcp_stream": 309, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-667455396911eefd3239b86a", "kind": "tls_client_hello", "frame_number": 13179, "timestamp_epoch": "1647911933.030895000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62490, "dst_port": 443, "tcp_stream": 310, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-569f3612d7259702d9b0ec11", "kind": "tls_client_hello", "frame_number": 13194, "timestamp_epoch": "1647911969.087528000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62491, "dst_port": 443, "tcp_stream": 311, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6948f6a08d585f008daad193", "kind": "tls_client_hello", "frame_number": 13209, "timestamp_epoch": "1647912005.008852000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62492, "dst_port": 443, "tcp_stream": 312, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-27c340dbde8196302007813f", "kind": "tls_client_hello", "frame_number": 13224, "timestamp_epoch": "1647912041.083556000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62493, "dst_port": 443, "tcp_stream": 313, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-48683516adbf38c63159233b", "kind": "tls_client_hello", "frame_number": 13248, "timestamp_epoch": "1647912303.427846000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62494, "dst_port": 443, "tcp_stream": 314, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-3102aaf63b931028bdd60875", "kind": "tls_client_hello", "frame_number": 13268, "timestamp_epoch": "1647912377.093730000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62495, "dst_port": 443, "tcp_stream": 315, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-73c812dd8db0501eeb015329", "kind": "tls_client_hello", "frame_number": 13286, "timestamp_epoch": "1647912414.124360000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62496, "dst_port": 443, "tcp_stream": 316, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-0e76820cdb8edcd09c9e1a58", "kind": "tls_client_hello", "frame_number": 13303, "timestamp_epoch": "1647912450.193801000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62497, "dst_port": 443, "tcp_stream": 317, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6e0088d7612ec140545958e7", "kind": "tls_client_hello", "frame_number": 13318, "timestamp_epoch": "1647912486.119566000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62498, "dst_port": 443, "tcp_stream": 318, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-327010d55d260718e9bed4b9", "kind": "tls_client_hello", "frame_number": 13338, "timestamp_epoch": "1647912515.932018000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62499, "dst_port": 443, "tcp_stream": 319, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-7641f14a6d93d319ad42ad95", "kind": "tls_client_hello", "frame_number": 13361, "timestamp_epoch": "1647912522.105128000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62500, "dst_port": 443, "tcp_stream": 320, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c806aec7155c0f7cc61b563f", "kind": "tls_client_hello", "frame_number": 13403, "timestamp_epoch": "1647912558.031579000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62502, "dst_port": 443, "tcp_stream": 322, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4c8b98482caafe3c920bf782", "kind": "tls_client_hello", "frame_number": 13418, "timestamp_epoch": "1647912594.090840000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62503, "dst_port": 443, "tcp_stream": 323, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d93cbbb00de58019fdf33fa7", "kind": "tls_client_hello", "frame_number": 13437, "timestamp_epoch": "1647912630.022047000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62504, "dst_port": 443, "tcp_stream": 324, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-456d9108838c1ec336ff086e", "kind": "tls_client_hello", "frame_number": 13458, "timestamp_epoch": "1647912936.857004000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62505, "dst_port": 443, "tcp_stream": 325, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-f63ef581660f4e85054dc5c1", "kind": "tls_client_hello", "frame_number": 13474, "timestamp_epoch": "1647912966.022694000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62506, "dst_port": 443, "tcp_stream": 326, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-15661e0008564c16723b04fa", "kind": "tls_client_hello", "frame_number": 13495, "timestamp_epoch": "1647913003.170369000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62507, "dst_port": 443, "tcp_stream": 327, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ec87e3ce98b064cc468596e5", "kind": "tls_client_hello", "frame_number": 13510, "timestamp_epoch": "1647913039.111166000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62508, "dst_port": 443, "tcp_stream": 328, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5233803ef91ec922f2da142e", "kind": "tls_client_hello", "frame_number": 13525, "timestamp_epoch": "1647913075.158047000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62509, "dst_port": 443, "tcp_stream": 329, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a2f8c735b36824aa8bdeaad5", "kind": "tls_client_hello", "frame_number": 13544, "timestamp_epoch": "1647913111.018686000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62510, "dst_port": 443, "tcp_stream": 330, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5db3538775fd4010eb3b22c0", "kind": "tls_client_hello", "frame_number": 13768, "timestamp_epoch": "1647913147.072444000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62516, "dst_port": 443, "tcp_stream": 336, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b5a7ba96021215fb45af604a", "kind": "tls_client_hello", "frame_number": 13787, "timestamp_epoch": "1647913183.006077000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62517, "dst_port": 443, "tcp_stream": 337, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-009fde1ce27cd93f0d78d1c2", "kind": "tls_client_hello", "frame_number": 13806, "timestamp_epoch": "1647913219.064562000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62518, "dst_port": 443, "tcp_stream": 338, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ebed5bc93dab07e7ed75c24f", "kind": "tls_client_hello", "frame_number": 13871, "timestamp_epoch": "1647913555.137690000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62520, "dst_port": 443, "tcp_stream": 340, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-caa88fb8cb6eaf440ac1a6ff", "kind": "tls_client_hello", "frame_number": 13887, "timestamp_epoch": "1647913569.288873000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62521, "dst_port": 443, "tcp_stream": 341, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-1e16b439b50a68b797e387d9", "kind": "tls_client_hello", "frame_number": 13902, "timestamp_epoch": "1647913592.073912000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62522, "dst_port": 443, "tcp_stream": 342, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-654d403cd899d79ef8e0de40", "kind": "tls_client_hello", "frame_number": 13919, "timestamp_epoch": "1647913628.131103000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62523, "dst_port": 443, "tcp_stream": 343, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2ae397057cf3983c84cdeec6", "kind": "tls_client_hello", "frame_number": 13936, "timestamp_epoch": "1647913664.068831000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62524, "dst_port": 443, "tcp_stream": 344, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d577be6098e96c0268cce1e3", "kind": "tls_client_hello", "frame_number": 13953, "timestamp_epoch": "1647913700.052964000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62525, "dst_port": 443, "tcp_stream": 345, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6fd0e090d5b3e1a79d072aa9", "kind": "tls_client_hello", "frame_number": 13966, "timestamp_epoch": "1647913735.990787000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62526, "dst_port": 443, "tcp_stream": 346, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-37bc8619c95d26a5ccb242a3", "kind": "tls_client_hello", "frame_number": 13981, "timestamp_epoch": "1647913772.060344000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62527, "dst_port": 443, "tcp_stream": 347, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-595b104bcd4889be2822db9b", "kind": "tls_client_hello", "frame_number": 13996, "timestamp_epoch": "1647913807.992228000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62528, "dst_port": 443, "tcp_stream": 348, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-708a06a58d088ee620208427", "kind": "tls_client_hello", "frame_number": 14027, "timestamp_epoch": "1647914144.081009000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62529, "dst_port": 443, "tcp_stream": 349, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6e71e1b6d76b79f24c3ba6b2", "kind": "tls_client_hello", "frame_number": 14048, "timestamp_epoch": "1647914181.137698000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62530, "dst_port": 443, "tcp_stream": 350, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a60495cf9a3b68610fa7bba9", "kind": "tls_client_hello", "frame_number": 14060, "timestamp_epoch": "1647914202.615341000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62531, "dst_port": 443, "tcp_stream": 351, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-1479d7ad98947275942e3b43", "kind": "tls_client_hello", "frame_number": 14077, "timestamp_epoch": "1647914217.058290000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62532, "dst_port": 443, "tcp_stream": 352, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d80f2df0999b3e0e70362f28", "kind": "tls_client_hello", "frame_number": 14115, "timestamp_epoch": "1647914217.211911000", "src_ip": "10.0.19.14", "dst_ip": "52.113.194.132", "src_port": 62533, "dst_port": 443, "tcp_stream": 353, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-cd3a527ad83ef16dfd3b85a4", "kind": "tls_client_hello", "frame_number": 14116, "timestamp_epoch": "1647914217.211985000", "src_ip": "10.0.19.14", "dst_ip": "52.113.194.132", "src_port": 62534, "dst_port": 443, "tcp_stream": 354, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-093a2f2c8e34fba4ad2105cc", "kind": "tls_client_hello", "frame_number": 14233, "timestamp_epoch": "1647914253.174513000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62537, "dst_port": 443, "tcp_stream": 357, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9e2a7a493fc44cff19204b29", "kind": "tls_client_hello", "frame_number": 14248, "timestamp_epoch": "1647914288.989926000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62538, "dst_port": 443, "tcp_stream": 358, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-cb7d7557747038f9c2b21899", "kind": "tls_client_hello", "frame_number": 14265, "timestamp_epoch": "1647914325.056895000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62539, "dst_port": 443, "tcp_stream": 359, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7acf342526ce5cfc3b9f3c1c", "kind": "tls_client_hello", "frame_number": 14304, "timestamp_epoch": "1647914360.982516000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62541, "dst_port": 443, "tcp_stream": 361, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1188aa5710142ae539140f3d", "kind": "tls_client_hello", "frame_number": 14321, "timestamp_epoch": "1647914397.041831000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62542, "dst_port": 443, "tcp_stream": 362, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-2a6e29b58a8771ea094aa569", "kind": "tls_client_hello", "frame_number": 14346, "timestamp_epoch": "1647914585.089270000", "src_ip": "10.0.19.14", "dst_ip": "52.168.117.170", "src_port": 62543, "dst_port": 443, "tcp_stream": 363, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-68fa1fa82fc42f89f9acedd5", "kind": "tls_client_hello", "frame_number": 14408, "timestamp_epoch": "1647914733.105235000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62546, "dst_port": 443, "tcp_stream": 366, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5cc085a28cc9e2564d87d80f", "kind": "tls_client_hello", "frame_number": 14425, "timestamp_epoch": "1647914770.074363000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62547, "dst_port": 443, "tcp_stream": 367, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4230d0fa1baa528c0af7a18e", "kind": "tls_client_hello", "frame_number": 14440, "timestamp_epoch": "1647914806.111289000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62548, "dst_port": 443, "tcp_stream": 368, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-8d80a300094f9e10800c2cfe", "kind": "tls_client_hello", "frame_number": 14454, "timestamp_epoch": "1647914835.980408000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62549, "dst_port": 443, "tcp_stream": 369, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-f7e961926ce34b3744c572c5", "kind": "tls_client_hello", "frame_number": 14469, "timestamp_epoch": "1647914842.056069000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62550, "dst_port": 443, "tcp_stream": 370, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-93cd4f86e8b441031d189262", "kind": "tls_client_hello", "frame_number": 14484, "timestamp_epoch": "1647914878.041318000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62551, "dst_port": 443, "tcp_stream": 371, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-90f2850463817b6222f4813f", "kind": "tls_client_hello", "frame_number": 14501, "timestamp_epoch": "1647914913.972781000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62552, "dst_port": 443, "tcp_stream": 372, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-970c8feaff18ad288c5bb9bf", "kind": "tls_client_hello", "frame_number": 14514, "timestamp_epoch": "1647914950.035397000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62553, "dst_port": 443, "tcp_stream": 373, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c65ddbea66dbecff3e9cc95e", "kind": "tls_client_hello", "frame_number": 14529, "timestamp_epoch": "1647914985.974144000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62554, "dst_port": 443, "tcp_stream": 374, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-19abd9f89f0f7b5457bd5672", "kind": "tls_client_hello", "frame_number": 14659, "timestamp_epoch": "1647915322.036742000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62560, "dst_port": 443, "tcp_stream": 380, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f2da4d462bfeb1c7c231f9e2", "kind": "tls_client_hello", "frame_number": 14676, "timestamp_epoch": "1647915359.122578000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62561, "dst_port": 443, "tcp_stream": 381, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-785bb8675af6b088329eed72", "kind": "tls_client_hello", "frame_number": 14693, "timestamp_epoch": "1647915395.052965000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62562, "dst_port": 443, "tcp_stream": 382, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c3fde4e9dc64d8d09a716f30", "kind": "tls_client_hello", "frame_number": 14707, "timestamp_epoch": "1647915431.094963000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62563, "dst_port": 443, "tcp_stream": 383, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-3fb768e2da0c5df628b9bb9c", "kind": "tls_client_hello", "frame_number": 14722, "timestamp_epoch": "1647915466.972734000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62564, "dst_port": 443, "tcp_stream": 384, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-8e2e7dc4db7a48ae9bcbf267", "kind": "tls_client_hello", "frame_number": 14734, "timestamp_epoch": "1647915468.251647000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62565, "dst_port": 443, "tcp_stream": 385, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-8c76fbdb215b67ce1223543c", "kind": "tls_client_hello", "frame_number": 14755, "timestamp_epoch": "1647915503.017310000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62566, "dst_port": 443, "tcp_stream": 386, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9bf124c567508bc041e3cf45", "kind": "tls_client_hello", "frame_number": 14767, "timestamp_epoch": "1647915526.415124000", "src_ip": "10.0.19.14", "dst_ip": "20.72.205.209", "src_port": 62567, "dst_port": 443, "tcp_stream": 387, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-280604e45fea670a4312f9d0", "kind": "tls_client_hello", "frame_number": 14794, "timestamp_epoch": "1647915538.953814000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62568, "dst_port": 443, "tcp_stream": 388, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-39bd9d331d73a8734a8e0190", "kind": "tls_client_hello", "frame_number": 14809, "timestamp_epoch": "1647915575.031762000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62569, "dst_port": 443, "tcp_stream": 389, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1d6d4aab72232d0a88052bf0", "kind": "tls_client_hello", "frame_number": 14959, "timestamp_epoch": "1647915911.085868000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62577, "dst_port": 443, "tcp_stream": 397, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5822d0593cc1601cf1537d46", "kind": "tls_client_hello", "frame_number": 14976, "timestamp_epoch": "1647915948.028391000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62578, "dst_port": 443, "tcp_stream": 398, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a4e92e5382dfa8a8501c8616", "kind": "tls_client_hello", "frame_number": 14993, "timestamp_epoch": "1647915984.078113000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62579, "dst_port": 443, "tcp_stream": 399, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-5f1d3f564736f15bd2187c75", "kind": "tls_client_hello", "frame_number": 15007, "timestamp_epoch": "1647916020.111575000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62580, "dst_port": 443, "tcp_stream": 400, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9fdb37ec1786487d80db644f", "kind": "tls_client_hello", "frame_number": 15020, "timestamp_epoch": "1647916056.019001000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62581, "dst_port": 443, "tcp_stream": 401, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a13ba800cbd7eb4966c4d06d", "kind": "tls_client_hello", "frame_number": 15031, "timestamp_epoch": "1647916091.958633000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62582, "dst_port": 443, "tcp_stream": 402, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7832f7933f230a782ee4a500", "kind": "tls_client_hello", "frame_number": 15049, "timestamp_epoch": "1647916100.628964000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62583, "dst_port": 443, "tcp_stream": 403, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-4e7152f4b91ede2cdaf7b507", "kind": "tls_client_hello", "frame_number": 15062, "timestamp_epoch": "1647916117.406474000", "src_ip": "10.0.19.14", "dst_ip": "52.185.211.133", "src_port": 62584, "dst_port": 443, "tcp_stream": 404, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-4577b5848cd4dbfb0f680ab0", "kind": "tls_client_hello", "frame_number": 15091, "timestamp_epoch": "1647916128.036643000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62585, "dst_port": 443, "tcp_stream": 405, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-36460eda6ec9f3293e1a560e", "kind": "tls_client_hello", "frame_number": 15137, "timestamp_epoch": "1647916163.943612000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62587, "dst_port": 443, "tcp_stream": 407, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-56f66896abe8f7494c3a8a51", "kind": "tls_client_hello", "frame_number": 15160, "timestamp_epoch": "1647916312.693791000", "src_ip": "10.0.19.14", "dst_ip": "52.109.8.21", "src_port": 62588, "dst_port": 443, "tcp_stream": 408, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-07b9ceec5e6e5e3d5c4b431e", "kind": "tls_client_hello", "frame_number": 15208, "timestamp_epoch": "1647916384.994143000", "src_ip": "10.0.19.14", "dst_ip": "20.42.65.89", "src_port": 62589, "dst_port": 443, "tcp_stream": 409, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-f5de36f1556d7d2cb32400b3", "kind": "tls_client_hello", "frame_number": 15240, "timestamp_epoch": "1647916500.007671000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62590, "dst_port": 443, "tcp_stream": 410, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1ed3e978da57b0ad2be286dc", "kind": "tls_client_hello", "frame_number": 15257, "timestamp_epoch": "1647916537.084994000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62591, "dst_port": 443, "tcp_stream": 411, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-0ff1d68b120a9982700eaf46", "kind": "tls_client_hello", "frame_number": 15272, "timestamp_epoch": "1647916573.018956000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62592, "dst_port": 443, "tcp_stream": 412, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-99edc46b16414d17b2a51d43", "kind": "tls_client_hello", "frame_number": 15289, "timestamp_epoch": "1647916609.090770000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62593, "dst_port": 443, "tcp_stream": 413, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-c670f1121e30f6e17a792cc2", "kind": "tls_client_hello", "frame_number": 15302, "timestamp_epoch": "1647916644.952409000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62594, "dst_port": 443, "tcp_stream": 414, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4bb69e3ebe169d023b8635cd", "kind": "tls_client_hello", "frame_number": 15313, "timestamp_epoch": "1647916681.015582000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62595, "dst_port": 443, "tcp_stream": 415, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b1236349a6a1ec35b97e1a7b", "kind": "tls_client_hello", "frame_number": 15330, "timestamp_epoch": "1647916716.939881000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62596, "dst_port": 443, "tcp_stream": 416, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-ef9746269dbb8b1def64f082", "kind": "tls_client_hello", "frame_number": 15344, "timestamp_epoch": "1647916732.921177000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62597, "dst_port": 443, "tcp_stream": 417, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-46ba15682f802b8574fa03d3", "kind": "tls_client_hello", "frame_number": 15355, "timestamp_epoch": "1647916752.996353000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62598, "dst_port": 443, "tcp_stream": 418, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-0a73eed374154713905afb97", "kind": "tls_client_hello", "frame_number": 15443, "timestamp_epoch": "1647917089.055937000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62602, "dst_port": 443, "tcp_stream": 422, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-029bd197ea49468b9000facf", "kind": "tls_client_hello", "frame_number": 15456, "timestamp_epoch": "1647917125.991212000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62603, "dst_port": 443, "tcp_stream": 423, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1088005374de8b841dc5f0a3", "kind": "tls_client_hello", "frame_number": 15473, "timestamp_epoch": "1647917162.070046000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62604, "dst_port": 443, "tcp_stream": 424, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-9f176228721cc13808799121", "kind": "tls_client_hello", "frame_number": 15490, "timestamp_epoch": "1647917198.005102000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62605, "dst_port": 443, "tcp_stream": 425, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-cb97f0a26c971524c1e1e1d0", "kind": "tls_client_hello", "frame_number": 15501, "timestamp_epoch": "1647917233.982219000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62606, "dst_port": 443, "tcp_stream": 426, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-e5139b88b90d37b20d036384", "kind": "tls_client_hello", "frame_number": 15512, "timestamp_epoch": "1647917269.916693000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62607, "dst_port": 443, "tcp_stream": 427, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-49e0032717d56c110cb9dccc", "kind": "tls_client_hello", "frame_number": 15532, "timestamp_epoch": "1647917305.973182000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62608, "dst_port": 443, "tcp_stream": 428, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-979afb5856f0200eea102ec8", "kind": "tls_client_hello", "frame_number": 15545, "timestamp_epoch": "1647917341.915813000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62609, "dst_port": 443, "tcp_stream": 429, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-04da7196872dc74516af1ddf", "kind": "tls_client_hello", "frame_number": 15561, "timestamp_epoch": "1647917365.255264000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62610, "dst_port": 443, "tcp_stream": 430, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-ef870f59068a8edec010a09a", "kind": "tls_client_hello", "frame_number": 15595, "timestamp_epoch": "1647917677.961172000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62611, "dst_port": 443, "tcp_stream": 431, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-985b2e45dd41b05c1c3a72f9", "kind": "tls_client_hello", "frame_number": 15610, "timestamp_epoch": "1647917715.032438000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62612, "dst_port": 443, "tcp_stream": 432, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-1c5011ee3c8c00bafe55beeb", "kind": "tls_client_hello", "frame_number": 15627, "timestamp_epoch": "1647917750.991175000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62613, "dst_port": 443, "tcp_stream": 433, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-7341cb8a67e2cf6837d8e5c2", "kind": "tls_client_hello", "frame_number": 15644, "timestamp_epoch": "1647917787.039561000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62614, "dst_port": 443, "tcp_stream": 434, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-edde006e5656352b54ba690a", "kind": "tls_client_hello", "frame_number": 15655, "timestamp_epoch": "1647917822.909168000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62615, "dst_port": 443, "tcp_stream": 435, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-27483640cb870c1dd86f7114", "kind": "tls_client_hello", "frame_number": 15666, "timestamp_epoch": "1647917859.206681000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62616, "dst_port": 443, "tcp_stream": 436, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-fddca8d2acf5da9bf6700991", "kind": "tls_client_hello", "frame_number": 15677, "timestamp_epoch": "1647917894.916411000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62617, "dst_port": 443, "tcp_stream": 437, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-a8075d7fd7e09b79bfc8a1fb", "kind": "tls_client_hello", "frame_number": 15695, "timestamp_epoch": "1647917918.053968000", "src_ip": "10.0.19.14", "dst_ip": "52.183.220.149", "src_port": 62618, "dst_port": 443, "tcp_stream": 438, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-42a15a992d258fa2900695c1", "kind": "tls_client_hello", "frame_number": 15720, "timestamp_epoch": "1647917930.950583000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62619, "dst_port": 443, "tcp_stream": 439, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-09343216237e1f8265bbc0d8", "kind": "tls_client_hello", "frame_number": 15777, "timestamp_epoch": "1647917997.627631000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62622, "dst_port": 443, "tcp_stream": 442, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-458fa2cfb80b8fee6a98cb66", "kind": "tls_client_hello", "frame_number": 15801, "timestamp_epoch": "1647918184.876342000", "src_ip": "10.0.19.14", "dst_ip": "52.182.143.208", "src_port": 62623, "dst_port": 443, "tcp_stream": 443, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-aa29d793e139c2d174917ffd", "kind": "tls_client_hello", "frame_number": 15828, "timestamp_epoch": "1647918266.368049000", "src_ip": "10.0.19.14", "dst_ip": "52.113.194.132", "src_port": 62624, "dst_port": 443, "tcp_stream": 444, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4" } }, { "event_id": "evt-13eaa5a99930978ea32f8dff", "kind": "tls_client_hello", "frame_number": 15886, "timestamp_epoch": "1647918267.039426000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62625, "dst_port": 443, "tcp_stream": 445, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d7da5b226bdb10a65477fe62", "kind": "tls_client_hello", "frame_number": 15900, "timestamp_epoch": "1647918303.958784000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62626, "dst_port": 443, "tcp_stream": 446, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-4ed20632b4b7e117f155f460", "kind": "tls_client_hello", "frame_number": 15915, "timestamp_epoch": "1647918340.050515000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62627, "dst_port": 443, "tcp_stream": 447, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-3ff86e4f1e644f8b670e73e8", "kind": "tls_client_hello", "frame_number": 15930, "timestamp_epoch": "1647918375.967594000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62628, "dst_port": 443, "tcp_stream": 448, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-da8d12fedc9d88a0d5ecd5ad", "kind": "tls_client_hello", "frame_number": 15947, "timestamp_epoch": "1647918411.954831000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62629, "dst_port": 443, "tcp_stream": 449, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-d9619cd4f8374fe627550c13", "kind": "tls_client_hello", "frame_number": 15958, "timestamp_epoch": "1647918447.924536000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62630, "dst_port": 443, "tcp_stream": 450, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-b091553e46488b6c3856a3c7", "kind": "tls_client_hello", "frame_number": 15969, "timestamp_epoch": "1647918483.951053000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62631, "dst_port": 443, "tcp_stream": 451, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-cc0b985a0d9da79aa474e600", "kind": "tls_client_hello", "frame_number": 15986, "timestamp_epoch": "1647918519.876373000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62632, "dst_port": 443, "tcp_stream": 452, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-893c919cc2ad76c7873ad68c", "kind": "tls_client_hello", "frame_number": 16015, "timestamp_epoch": "1647918629.907299000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62633, "dst_port": 443, "tcp_stream": 453, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e" } }, { "event_id": "evt-a18bb544e239ae14eef157de", "kind": "tls_client_hello", "frame_number": 16215, "timestamp_epoch": "1647918855.959894000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62648, "dst_port": 443, "tcp_stream": 465, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-f07e099b2f1dff83cedd696d", "kind": "tls_client_hello", "frame_number": 16230, "timestamp_epoch": "1647918893.030216000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62649, "dst_port": 443, "tcp_stream": 466, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-147bf3eed9e0358b7deb907d", "kind": "tls_client_hello", "frame_number": 16245, "timestamp_epoch": "1647918928.982963000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62650, "dst_port": 443, "tcp_stream": 467, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "antnosience.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-6b1672d4c4d55b8d8f70c6f4", "kind": "tls_client_hello", "frame_number": 16263, "timestamp_epoch": "1647918965.017079000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62651, "dst_port": 443, "tcp_stream": 468, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "seaskysafe.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-42447789a8503bf5cec04b49", "kind": "tls_client_hello", "frame_number": 16278, "timestamp_epoch": "1647919000.883944000", "src_ip": "10.0.19.14", "dst_ip": "157.245.142.66", "src_port": 62652, "dst_port": 443, "tcp_stream": 469, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "otectagain.top", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } }, { "event_id": "evt-058c4384f32beda63665971d", "kind": "tls_client_hello", "frame_number": 16290, "timestamp_epoch": "1647919036.944271000", "src_ip": "10.0.19.14", "dst_ip": "91.193.16.181", "src_port": 62653, "dst_port": 443, "tcp_stream": 470, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dilimoretast.com", "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1" } } ], "dhcp": [ { "event_id": "evt-eed467c66fe5c71abc082211", "kind": "dhcp", "frame_number": 3771, "timestamp_epoch": "1647898110.838235000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 30, "fields": { "dhcp.hw.mac_addr": "00:60:52:b7:33:0f,00:60:52:b7:33:0f", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "1", "dhcp.option.hostname": "DESKTOP-5QS3D5D", "dhcp.option.requested_ip_address": "10.0.19.14", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8204e61a8a9be1e949a3b85a", "kind": "dhcp", "frame_number": 3772, "timestamp_epoch": "1647898110.843518000", "src_ip": "10.0.19.1", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "dhcp.hw.mac_addr": "00:60:52:b7:33:0f", "dhcp.ip.your": "10.0.19.14", "dhcp.option.dhcp": "2", "eth.src": "2c:54:2d:2f:13:5c" } }, { "event_id": "evt-38dfa2dd2633dcb9a9c1a7f5", "kind": "dhcp", "frame_number": 3773, "timestamp_epoch": "1647898110.843938000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 30, "fields": { "dhcp.hw.mac_addr": "00:60:52:b7:33:0f,00:60:52:b7:33:0f", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-5QS3D5D", "dhcp.option.requested_ip_address": "10.0.19.14", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-637bff14c38c9aa5aed17b41", "kind": "dhcp", "frame_number": 3774, "timestamp_epoch": "1647898110.847846000", "src_ip": "10.0.19.1", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "dhcp.hw.mac_addr": "00:60:52:b7:33:0f", "dhcp.ip.your": "10.0.19.14", "dhcp.option.dhcp": "5", "eth.src": "2c:54:2d:2f:13:5c" } } ], "identity": [ { "event_id": "evt-9a460fcc6fb334789a2d0c9c", "kind": "identity", "frame_number": 727, "timestamp_epoch": "1647896380.931112000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bdd73e4aa5c6eb1a2d91f007", "kind": "identity", "frame_number": 728, "timestamp_epoch": "1647896380.931112000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1b>" } }, { "event_id": "evt-d233bc6f206671fe4a8f28e9", "kind": "identity", "frame_number": 729, "timestamp_epoch": "1647896380.931476000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE<1b> (Domain Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-f57d4be15d54e961e101aa2c", "kind": "identity", "frame_number": 730, "timestamp_epoch": "1647896380.931672000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-42836f4413c88c59272a7df2", "kind": "identity", "frame_number": 731, "timestamp_epoch": "1647896380.931716000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-f218d0fa9039f3753adf22f0", "kind": "identity", "frame_number": 732, "timestamp_epoch": "1647896380.931887000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4a5f4567139bf22f7be0d603", "kind": "identity", "frame_number": 733, "timestamp_epoch": "1647896380.931960000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-38693f3e2a1cfabea3312b9f", "kind": "identity", "frame_number": 734, "timestamp_epoch": "1647896380.933100000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE-DC<20>" } }, { "event_id": "evt-de841af0f583d3223f77674e", "kind": "identity", "frame_number": 735, "timestamp_epoch": "1647896380.933303000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-0dc54b576ced0af9989fa9f2", "kind": "identity", "frame_number": 742, "timestamp_epoch": "1647896380.934894000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-47eefcd902a3a26611ef9e1c", "kind": "identity", "frame_number": 743, "timestamp_epoch": "1647896380.935536000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7ba540b5675c6ca2a5288d2f", "kind": "identity", "frame_number": 744, "timestamp_epoch": "1647896380.935810000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-5QS3D5D", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-f5654929d01b829831b9c9ff", "kind": "identity", "frame_number": 750, "timestamp_epoch": "1647896380.938855000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-968aed5c69b44382c6a3dcef", "kind": "identity", "frame_number": 751, "timestamp_epoch": "1647896380.938925000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9601217d68726e3654d9814d", "kind": "identity", "frame_number": 752, "timestamp_epoch": "1647896380.939085000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-856c223ef9e358fe9b83bd5a", "kind": "identity", "frame_number": 753, "timestamp_epoch": "1647896380.939201000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4806878c403167e2da566ca3", "kind": "identity", "frame_number": 756, "timestamp_epoch": "1647896380.940105000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eff5e7e438bc6c1f63cdfef8", "kind": "identity", "frame_number": 757, "timestamp_epoch": "1647896380.940124000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4d45496d20e72bd7c46fc451", "kind": "identity", "frame_number": 758, "timestamp_epoch": "1647896380.940282000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-880680ae52f009e7ecb16173", "kind": "identity", "frame_number": 759, "timestamp_epoch": "1647896380.940391000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cb373ff07f89143e51893e4a", "kind": "identity", "frame_number": 766, "timestamp_epoch": "1647896380.957973000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-567bdd99981ef5889df4b665", "kind": "identity", "frame_number": 767, "timestamp_epoch": "1647896380.957995000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ec5dac6f0da5ad40964ae794", "kind": "identity", "frame_number": 768, "timestamp_epoch": "1647896380.958251000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5cb59fb41b8b32c0b1c9684a", "kind": "identity", "frame_number": 769, "timestamp_epoch": "1647896380.958281000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a39616347e686efb45e15395", "kind": "identity", "frame_number": 774, "timestamp_epoch": "1647896380.959016000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ba3275c9efe06d4aab23dee2", "kind": "identity", "frame_number": 775, "timestamp_epoch": "1647896380.959038000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d69afcb401fd6b03157c48df", "kind": "identity", "frame_number": 776, "timestamp_epoch": "1647896380.959243000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-68757c3412b488f02bf1c3f6", "kind": "identity", "frame_number": 777, "timestamp_epoch": "1647896380.959273000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-275fa21cc64826aed54e20b6", "kind": "identity", "frame_number": 795, "timestamp_epoch": "1647896381.088075000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-49ffc3bb13736d885d24d6a2", "kind": "identity", "frame_number": 796, "timestamp_epoch": "1647896381.088383000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-93fa58cbe683d0055b4bae17", "kind": "identity", "frame_number": 797, "timestamp_epoch": "1647896381.088599000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f361ad9ce82c22d89988bea1", "kind": "identity", "frame_number": 800, "timestamp_epoch": "1647896381.091043000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-fdbe7aba73691d1ad3a7395d", "kind": "identity", "frame_number": 802, "timestamp_epoch": "1647896381.092054000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c1e64b65305b5fc5063e6d9e", "kind": "identity", "frame_number": 803, "timestamp_epoch": "1647896381.092897000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e4b9a6c65581d2aa96c23ee7", "kind": "identity", "frame_number": 804, "timestamp_epoch": "1647896381.093158000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-83442126a4ae646bf33547f5", "kind": "identity", "frame_number": 805, "timestamp_epoch": "1647896381.093552000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d988dd66f1d91ba425092204", "kind": "identity", "frame_number": 806, "timestamp_epoch": "1647896381.093639000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f56661dd24331839f6248069", "kind": "identity", "frame_number": 807, "timestamp_epoch": "1647896381.093657000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e79c4de78ad52ddab8371e58", "kind": "identity", "frame_number": 808, "timestamp_epoch": "1647896381.093807000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d487059bdfe35c36482860d7", "kind": "identity", "frame_number": 810, "timestamp_epoch": "1647896381.094201000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cb0fae19e1f411aeb7de14c0", "kind": "identity", "frame_number": 811, "timestamp_epoch": "1647896381.094386000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-be5917cd196be2429d98972b", "kind": "identity", "frame_number": 812, "timestamp_epoch": "1647896381.094742000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-63ff04eb999bdeacc9bb8dbc", "kind": "identity", "frame_number": 813, "timestamp_epoch": "1647896381.094892000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9d40a0d81113e3c2bb0fea78", "kind": "identity", "frame_number": 814, "timestamp_epoch": "1647896381.095187000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ad5c43723ab6b95f384c492f", "kind": "identity", "frame_number": 815, "timestamp_epoch": "1647896381.095306000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-bd93e3c8c6b122759107ef24", "kind": "identity", "frame_number": 816, "timestamp_epoch": "1647896381.095711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b6c99d2b44a5ba66ffac55ad", "kind": "identity", "frame_number": 817, "timestamp_epoch": "1647896381.096044000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-76997f127d40c809a23a8f48", "kind": "identity", "frame_number": 818, "timestamp_epoch": "1647896381.096261000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2ccde234bc72f75e03433d22", "kind": "identity", "frame_number": 819, "timestamp_epoch": "1647896381.096521000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5f5f922143b4c2c6caf774c1", "kind": "identity", "frame_number": 820, "timestamp_epoch": "1647896381.096678000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-916f3d6725396e18568c5f39", "kind": "identity", "frame_number": 821, "timestamp_epoch": "1647896381.096926000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fa7a14461acd4a110fa55117", "kind": "identity", "frame_number": 822, "timestamp_epoch": "1647896381.097074000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-51ed1f35fecc229adb3441c6", "kind": "identity", "frame_number": 823, "timestamp_epoch": "1647896381.097325000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7cf56757002948379fbecbb8", "kind": "identity", "frame_number": 824, "timestamp_epoch": "1647896381.097515000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b07bed639db6fd0f6ff7f2a1", "kind": "identity", "frame_number": 825, "timestamp_epoch": "1647896381.097809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-350ca6411217996482f1f87d", "kind": "identity", "frame_number": 826, "timestamp_epoch": "1647896381.097970000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e6809a7905d7fd3e44f3a4d9", "kind": "identity", "frame_number": 827, "timestamp_epoch": "1647896381.098306000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cd85e648c7beb66c98f8b670", "kind": "identity", "frame_number": 828, "timestamp_epoch": "1647896381.098472000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f724648144c73161ba89c417", "kind": "identity", "frame_number": 829, "timestamp_epoch": "1647896381.098696000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f464c8ef3a397a23330a4514", "kind": "identity", "frame_number": 830, "timestamp_epoch": "1647896381.098861000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d42166d777b7bc541a9d3eea", "kind": "identity", "frame_number": 831, "timestamp_epoch": "1647896381.099041000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f1f14420589921e8967a68c9", "kind": "identity", "frame_number": 832, "timestamp_epoch": "1647896381.099183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d59060e510f8049d1e6bd1d8", "kind": "identity", "frame_number": 833, "timestamp_epoch": "1647896381.099367000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e60bb76d61361d0d943de14c", "kind": "identity", "frame_number": 834, "timestamp_epoch": "1647896381.099575000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-840a429c9ca841f2be3e6e5a", "kind": "identity", "frame_number": 835, "timestamp_epoch": "1647896381.099713000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fafe04d12493d5235336586b", "kind": "identity", "frame_number": 836, "timestamp_epoch": "1647896381.099911000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f6f8ea662fafd1ef07eb365d", "kind": "identity", "frame_number": 837, "timestamp_epoch": "1647896381.100008000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0478ff417c0e57cf62293f33", "kind": "identity", "frame_number": 838, "timestamp_epoch": "1647896381.100754000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-989822d6a5b6c39fb4afae58", "kind": "identity", "frame_number": 839, "timestamp_epoch": "1647896381.101073000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6ffaa0c163d10c432ef9dd08", "kind": "identity", "frame_number": 840, "timestamp_epoch": "1647896381.101223000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1ecfedca29a6da057546afc5", "kind": "identity", "frame_number": 841, "timestamp_epoch": "1647896381.101267000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cc9959f334cb16be086e8a45", "kind": "identity", "frame_number": 842, "timestamp_epoch": "1647896381.101459000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0119d38ccc347aab1fe4f9cd", "kind": "identity", "frame_number": 843, "timestamp_epoch": "1647896381.101518000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-960078936eaa6954c3781c81", "kind": "identity", "frame_number": 844, "timestamp_epoch": "1647896381.101619000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2d81d1ce955e5591c73fdcd9", "kind": "identity", "frame_number": 845, "timestamp_epoch": "1647896381.101729000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-694b83360d44e6ffe6bf03cd", "kind": "identity", "frame_number": 846, "timestamp_epoch": "1647896381.101875000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a11ac87ad5175d0b3f1c50e4", "kind": "identity", "frame_number": 847, "timestamp_epoch": "1647896381.102111000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6363a4fe88eb1742e7086e9b", "kind": "identity", "frame_number": 848, "timestamp_epoch": "1647896381.102276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-309ffd9a682275c7a6944840", "kind": "identity", "frame_number": 849, "timestamp_epoch": "1647896381.102499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f30c0d29d2e2bf3a4369d1f8", "kind": "identity", "frame_number": 850, "timestamp_epoch": "1647896381.102669000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d651baf6fd7132f28d1f26a3", "kind": "identity", "frame_number": 851, "timestamp_epoch": "1647896381.102814000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-44e2697c8b5dc9239b4213ca", "kind": "identity", "frame_number": 852, "timestamp_epoch": "1647896381.102982000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8d00f15fe75dc6cfcc164292", "kind": "identity", "frame_number": 853, "timestamp_epoch": "1647896381.103174000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-da859ba8eb63ee9df6f0b8b9", "kind": "identity", "frame_number": 854, "timestamp_epoch": "1647896381.103307000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-549e499cf235815a40eca7dd", "kind": "identity", "frame_number": 855, "timestamp_epoch": "1647896381.103576000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1faf2663ae1164545c699deb", "kind": "identity", "frame_number": 856, "timestamp_epoch": "1647896381.103795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e7e8564f7f5008ea417a05a5", "kind": "identity", "frame_number": 857, "timestamp_epoch": "1647896381.104034000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-49cb9479d6925e8e83ad2697", "kind": "identity", "frame_number": 858, "timestamp_epoch": "1647896381.104259000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-141b0595db79d41b2eb67fec", "kind": "identity", "frame_number": 859, "timestamp_epoch": "1647896381.104481000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4e456e91f40b972ff85f96d6", "kind": "identity", "frame_number": 860, "timestamp_epoch": "1647896381.104696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-df2b0a3137c539742f721dea", "kind": "identity", "frame_number": 861, "timestamp_epoch": "1647896381.104879000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8278bad7bc015810c0813e03", "kind": "identity", "frame_number": 862, "timestamp_epoch": "1647896381.105037000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ba8529d22ba355d784b90d75", "kind": "identity", "frame_number": 863, "timestamp_epoch": "1647896381.105216000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a90932bfa9015fb150d5223e", "kind": "identity", "frame_number": 864, "timestamp_epoch": "1647896381.105372000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7d422d5f89a427b5a43a06f5", "kind": "identity", "frame_number": 865, "timestamp_epoch": "1647896381.105502000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3592d194bde54d9efc2f2566", "kind": "identity", "frame_number": 866, "timestamp_epoch": "1647896381.105662000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-08b844589dd4098c742062d9", "kind": "identity", "frame_number": 867, "timestamp_epoch": "1647896381.105800000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-46e78ac58379e5f4e1b08c38", "kind": "identity", "frame_number": 868, "timestamp_epoch": "1647896381.105947000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8564391f96e0029530f88afb", "kind": "identity", "frame_number": 869, "timestamp_epoch": "1647896381.106002000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a9c59826cd2db5670e24e41a", "kind": "identity", "frame_number": 1835, "timestamp_epoch": "1647896391.646387000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c112768921667570be3598d2", "kind": "identity", "frame_number": 1838, "timestamp_epoch": "1647896391.646961000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2be574e4ae1baa73d119f414", "kind": "identity", "frame_number": 1839, "timestamp_epoch": "1647896391.647165000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-80732c9f67f9e650a2d51e85", "kind": "identity", "frame_number": 1840, "timestamp_epoch": "1647896391.647336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7e45fcbbaa7d28624d640d03", "kind": "identity", "frame_number": 3241, "timestamp_epoch": "1647896486.782059000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a447a49c78600b73e7686e6d", "kind": "identity", "frame_number": 3354, "timestamp_epoch": "1647897044.217654000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-81f6ceef9a740d7f103bd39f", "kind": "identity", "frame_number": 3355, "timestamp_epoch": "1647897044.217949000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1d89aeafcc5f5d1ec78eb34b", "kind": "identity", "frame_number": 3356, "timestamp_epoch": "1647897044.218404000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d98281c16b44697eedd91201", "kind": "identity", "frame_number": 3359, "timestamp_epoch": "1647897044.221087000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-b0ef68c3a5a53ff36398a3e5", "kind": "identity", "frame_number": 3361, "timestamp_epoch": "1647897044.223068000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-6bb69477942110ecf0b60253", "kind": "identity", "frame_number": 3362, "timestamp_epoch": "1647897044.223901000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-91bcb60b4d5e7a1632d3fec3", "kind": "identity", "frame_number": 3363, "timestamp_epoch": "1647897044.224124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-47f5d282561a34edcdc319c1", "kind": "identity", "frame_number": 3364, "timestamp_epoch": "1647897044.224499000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-870fc51b398e8bc20c3ec1dd", "kind": "identity", "frame_number": 3365, "timestamp_epoch": "1647897044.224652000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4186c33c1b5255b546ab9824", "kind": "identity", "frame_number": 3366, "timestamp_epoch": "1647897044.224740000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6fc7d6bc5ac6e4e1e9903b88", "kind": "identity", "frame_number": 3367, "timestamp_epoch": "1647897044.225029000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6ab245ce3d6c4999c458f0fb", "kind": "identity", "frame_number": 3371, "timestamp_epoch": "1647897054.936276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f15e1b09013e0604d33fb987", "kind": "identity", "frame_number": 3372, "timestamp_epoch": "1647897054.936503000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-80131ff7b76b85cdba48a3d7", "kind": "identity", "frame_number": 3373, "timestamp_epoch": "1647897054.936808000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3b1edeec6f08795dae15de17", "kind": "identity", "frame_number": 3374, "timestamp_epoch": "1647897054.936887000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-83fbc111cc94aded721868bc", "kind": "identity", "frame_number": 3445, "timestamp_epoch": "1647897130.326136000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-3bd7708ebfafdedde6d3566a", "kind": "identity", "frame_number": 3447, "timestamp_epoch": "1647897130.327408000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-57d4440fe805cdcfb57c1c60", "kind": "identity", "frame_number": 3448, "timestamp_epoch": "1647897130.327733000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-333a8a0da8d027476a45303d", "kind": "identity", "frame_number": 3478, "timestamp_epoch": "1647897130.446665000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-1ba0e4c73ae55db33c77416e", "kind": "identity", "frame_number": 3480, "timestamp_epoch": "1647897130.447415000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-3dad7cc8ca1d252b11900f74", "kind": "identity", "frame_number": 3491, "timestamp_epoch": "1647897130.456341000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-8a5616a4eb34e3a3596e6bf3", "kind": "identity", "frame_number": 3493, "timestamp_epoch": "1647897130.457079000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-0718f0ee9f0facd9328e7cd6", "kind": "identity", "frame_number": 3513, "timestamp_epoch": "1647897206.969096000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a7244235dd5cdbbabca4c24f", "kind": "identity", "frame_number": 3659, "timestamp_epoch": "1647897816.606147000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-97654c2e4c59253360e6db6d", "kind": "identity", "frame_number": 3660, "timestamp_epoch": "1647897816.606206000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e22c9a48682a2a0b91f8721a", "kind": "identity", "frame_number": 3661, "timestamp_epoch": "1647897816.606771000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a0fc3497d7ca74ca9c9093d2", "kind": "identity", "frame_number": 3664, "timestamp_epoch": "1647897816.607724000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-45c2d8ab6cad830e87e729cd", "kind": "identity", "frame_number": 3666, "timestamp_epoch": "1647897816.609781000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-98012cbe2c6c4f8028f89422", "kind": "identity", "frame_number": 3667, "timestamp_epoch": "1647897816.609995000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ef7890ee1d974fa424f9b193", "kind": "identity", "frame_number": 3668, "timestamp_epoch": "1647897816.610123000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8b417dc21bd5d4e687dda107", "kind": "identity", "frame_number": 3669, "timestamp_epoch": "1647897816.610212000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-63382d23fa9a76c98881cd95", "kind": "identity", "frame_number": 3670, "timestamp_epoch": "1647897816.610277000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7f1b849a22c1f64530780877", "kind": "identity", "frame_number": 3672, "timestamp_epoch": "1647897816.610439000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-af370f4d28aeed948b80e797", "kind": "identity", "frame_number": 3673, "timestamp_epoch": "1647897816.610628000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9142966e3366bbacdb40d979", "kind": "identity", "frame_number": 3675, "timestamp_epoch": "1647897816.610683000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9c2f9fc997e560ae3a71adcb", "kind": "identity", "frame_number": 3676, "timestamp_epoch": "1647897816.610798000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-86888e3e8d121897818f26f7", "kind": "identity", "frame_number": 3677, "timestamp_epoch": "1647897816.610938000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-480269790ec7fc48beaa6b6b", "kind": "identity", "frame_number": 3678, "timestamp_epoch": "1647897816.611083000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-50a4d5454ac3653b6f7fb8c4", "kind": "identity", "frame_number": 3679, "timestamp_epoch": "1647897816.611175000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d349f85e15a857aa7b803500", "kind": "identity", "frame_number": 3680, "timestamp_epoch": "1647897816.611374000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-68272da23c3cec7fde0bdc76", "kind": "identity", "frame_number": 3681, "timestamp_epoch": "1647897816.611458000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-35222201ccc5fcecdae0edbf", "kind": "identity", "frame_number": 3682, "timestamp_epoch": "1647897816.612077000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-01eea13405bd9cb052c02445", "kind": "identity", "frame_number": 3683, "timestamp_epoch": "1647897816.612142000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-058049e97599e23b80ec6471", "kind": "identity", "frame_number": 3684, "timestamp_epoch": "1647897816.612601000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fa878604cc610c61e0621fa1", "kind": "identity", "frame_number": 3685, "timestamp_epoch": "1647897816.612669000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8353877ac176d683f11f4008", "kind": "identity", "frame_number": 3686, "timestamp_epoch": "1647897816.613032000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-942bef9220e37e702315a2bb", "kind": "identity", "frame_number": 3687, "timestamp_epoch": "1647897816.613135000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7fbce14c0cf2abf932d7dec1", "kind": "identity", "frame_number": 3688, "timestamp_epoch": "1647897816.613753000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-de26ef3dba794162712d1f76", "kind": "identity", "frame_number": 3689, "timestamp_epoch": "1647897816.613810000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c273d01441774776059b59d0", "kind": "identity", "frame_number": 3690, "timestamp_epoch": "1647897816.614360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e99d1288a9a7d3c75bb6290f", "kind": "identity", "frame_number": 3691, "timestamp_epoch": "1647897816.614434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d25da276bf4b63aa0ae70d98", "kind": "identity", "frame_number": 3692, "timestamp_epoch": "1647897816.615084000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-28fc61ed1fc22eb37f825401", "kind": "identity", "frame_number": 3693, "timestamp_epoch": "1647897816.615140000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1e1f1f2d62b5ef74b26ac258", "kind": "identity", "frame_number": 3694, "timestamp_epoch": "1647897816.616039000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b7a2570a7d84369481483586", "kind": "identity", "frame_number": 3695, "timestamp_epoch": "1647897816.616146000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cf6d7c847d8e5fbe37694c7f", "kind": "identity", "frame_number": 3696, "timestamp_epoch": "1647897816.616993000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "samr.samr_UserInfo21.account_name": "patrick.zimmerman", "samr.samr_UserInfo21.full_name": "Patrick Zimmerman" } }, { "event_id": "evt-daa5c9ad387cc2c9c90a1c30", "kind": "identity", "frame_number": 3697, "timestamp_epoch": "1647897816.617090000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bd94d1a233d50af547d2e8b1", "kind": "identity", "frame_number": 3698, "timestamp_epoch": "1647897816.617777000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3a3ee6ad8e4e6efcee87a0e5", "kind": "identity", "frame_number": 3699, "timestamp_epoch": "1647897816.617874000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4fed46f3395fb7ca35d70d7e", "kind": "identity", "frame_number": 3700, "timestamp_epoch": "1647897816.618281000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4f6827fa8277724127b1fb5a", "kind": "identity", "frame_number": 3701, "timestamp_epoch": "1647897816.618400000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aae612d158d0d7572f4fc732", "kind": "identity", "frame_number": 3702, "timestamp_epoch": "1647897816.618775000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2fcf094929b373caf4ba05da", "kind": "identity", "frame_number": 3703, "timestamp_epoch": "1647897816.618923000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-75b51d50fa5e7c1e57f153be", "kind": "identity", "frame_number": 3704, "timestamp_epoch": "1647897816.619241000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c4047a37c0635b8d15b88d30", "kind": "identity", "frame_number": 3705, "timestamp_epoch": "1647897816.619345000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-19a49ef725f7ff5d460ea134", "kind": "identity", "frame_number": 3706, "timestamp_epoch": "1647897816.619754000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3b0bdda57d87cbf2284781c6", "kind": "identity", "frame_number": 3707, "timestamp_epoch": "1647897816.619815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b71154cafba8cc9c1a512a6b", "kind": "identity", "frame_number": 3708, "timestamp_epoch": "1647897816.620196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7df4deddbeebfc6ff072a9db", "kind": "identity", "frame_number": 3709, "timestamp_epoch": "1647897816.620282000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fd9d9a493bc69aada10f8cd9", "kind": "identity", "frame_number": 3710, "timestamp_epoch": "1647897816.620689000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-bae8e05e142e1bd6a9d49314", "kind": "identity", "frame_number": 3711, "timestamp_epoch": "1647897816.620821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e5147edecc5b375f67d77ce0", "kind": "identity", "frame_number": 3712, "timestamp_epoch": "1647897816.620923000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-19e23a453303f08485f7bf75", "kind": "identity", "frame_number": 3719, "timestamp_epoch": "1647898089.387901000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8fa13c0649f3148ad16346b9", "kind": "identity", "frame_number": 3720, "timestamp_epoch": "1647898089.388067000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 24, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bb619b3665c1c1c8d97df402", "kind": "identity", "frame_number": 3721, "timestamp_epoch": "1647898089.388266000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-83f725c753a0ca0ff2fdf7ef", "kind": "identity", "frame_number": 3723, "timestamp_epoch": "1647898089.463553000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-448e287de40d4791ad313019", "kind": "identity", "frame_number": 3724, "timestamp_epoch": "1647898089.463705000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-cc1a2986830664d558a4d39b", "kind": "identity", "frame_number": 3725, "timestamp_epoch": "1647898089.463705000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e5ae6f5f5ab7b63ddca7a478", "kind": "identity", "frame_number": 3727, "timestamp_epoch": "1647898090.213290000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b3c373c4277b73098b240166", "kind": "identity", "frame_number": 3728, "timestamp_epoch": "1647898090.213449000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-0ee29242f1fc783d8f2d3fae", "kind": "identity", "frame_number": 3729, "timestamp_epoch": "1647898090.213449000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-fd9af162da68aa3481befaff", "kind": "identity", "frame_number": 3731, "timestamp_epoch": "1647898090.994480000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-4bb0fccf940da349fd618c42", "kind": "identity", "frame_number": 3732, "timestamp_epoch": "1647898090.994651000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-ae423e55bf0982aca1c3eb5f", "kind": "identity", "frame_number": 3733, "timestamp_epoch": "1647898090.994651000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-533356ae940c42c5f601e178", "kind": "identity", "frame_number": 3734, "timestamp_epoch": "1647898091.744584000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-ce58077ab30686e3e835e11b", "kind": "identity", "frame_number": 3735, "timestamp_epoch": "1647898091.744698000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-9fdf0ead24f6011b5019d634", "kind": "identity", "frame_number": 3736, "timestamp_epoch": "1647898091.744698000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-f1a33bbbd671673c6b11ed5c", "kind": "identity", "frame_number": 3737, "timestamp_epoch": "1647898092.557145000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-c79303b80b5f39bf2cf09c5a", "kind": "identity", "frame_number": 3738, "timestamp_epoch": "1647898093.322841000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-406bf798328ec5af107ac639", "kind": "identity", "frame_number": 3740, "timestamp_epoch": "1647898094.088809000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-83f3330f49f284ddcd3284cd", "kind": "identity", "frame_number": 3741, "timestamp_epoch": "1647898094.854186000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-32c30c213eb8735b3a40bfd9", "kind": "identity", "frame_number": 3743, "timestamp_epoch": "1647898095.636081000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.response_computer_name": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0a1e3dc959cd839e5ca80baa", "kind": "identity", "frame_number": 3744, "timestamp_epoch": "1647898095.639796000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-16bfda9b6dd729aecdeb11eb", "kind": "identity", "frame_number": 3746, "timestamp_epoch": "1647898097.135990000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.response_computer_name": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ab0cba4b316abe3ec975ee68", "kind": "identity", "frame_number": 3748, "timestamp_epoch": "1647898098.636150000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.response_computer_name": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1523f71cf7c145cf4e1c3697", "kind": "identity", "frame_number": 3750, "timestamp_epoch": "1647898100.136185000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.response_computer_name": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8101279f533ac453caeb1106", "kind": "identity", "frame_number": 3751, "timestamp_epoch": "1647898101.636244000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e22a21b63b72e8e468a72f79", "kind": "identity", "frame_number": 3753, "timestamp_epoch": "1647898102.636332000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-344d91cd447484d86c2636fa", "kind": "identity", "frame_number": 3754, "timestamp_epoch": "1647898103.636279000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8ceef54d4717d3859d7009f7", "kind": "identity", "frame_number": 3755, "timestamp_epoch": "1647898104.651817000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 28, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cd9f46b406d3a4a3527799d7", "kind": "identity", "frame_number": 3758, "timestamp_epoch": "1647898104.840784000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-43492ba7a8ace0cdee150756", "kind": "identity", "frame_number": 3759, "timestamp_epoch": "1647898104.840912000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 24, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f0cd91387af20fb3f6dc97c9", "kind": "identity", "frame_number": 3760, "timestamp_epoch": "1647898104.840951000", "src_ip": "169.254.179.89", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-684e10d56fdcf7ef7b6b0773", "kind": "identity", "frame_number": 3763, "timestamp_epoch": "1647898105.665651000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c5593b4c6a0375b6848893d1", "kind": "identity", "frame_number": 3764, "timestamp_epoch": "1647898106.415606000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-42370242151f880b46320372", "kind": "identity", "frame_number": 3765, "timestamp_epoch": "1647898107.165747000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-dc28b3e094ea541d619b81fc", "kind": "identity", "frame_number": 3766, "timestamp_epoch": "1647898107.931579000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e99147e5c05266f00e013b84", "kind": "identity", "frame_number": 3768, "timestamp_epoch": "1647898108.728283000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "<01><02>__MSBROWSE__<02><01>,<01><02>__MSBROWSE__<02><01> (Browser)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-9c2efa595441116cd3c09756", "kind": "identity", "frame_number": 3769, "timestamp_epoch": "1647898109.493938000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "<01><02>__MSBROWSE__<02><01>,<01><02>__MSBROWSE__<02><01> (Browser)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-dc1f167f7ddfa39fba23f8c6", "kind": "identity", "frame_number": 3770, "timestamp_epoch": "1647898110.243883000", "src_ip": "169.254.179.89", "dst_ip": "169.254.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 26, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "<01><02>__MSBROWSE__<02><01>,<01><02>__MSBROWSE__<02><01> (Browser)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-d7ec2b5a471d41a058a31bb8", "kind": "identity", "frame_number": 3789, "timestamp_epoch": "1647898110.856043000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7723f16f6d63a8852b8ceeb8", "kind": "identity", "frame_number": 3799, "timestamp_epoch": "1647898110.916364000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-ae9359335485505dae5bdef1", "kind": "identity", "frame_number": 3809, "timestamp_epoch": "1647898110.966086000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-8cb5d5c9abd140ab9f3f30dc", "kind": "identity", "frame_number": 3811, "timestamp_epoch": "1647898110.966963000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-91cd38917ac1106167a1d5de", "kind": "identity", "frame_number": 3816, "timestamp_epoch": "1647898111.009475000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "<01><02>__MSBROWSE__<02><01>,<01><02>__MSBROWSE__<02><01> (Browser)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-6c6b233a64881dde647e2485", "kind": "identity", "frame_number": 3821, "timestamp_epoch": "1647898111.275148000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-49d32b45d2a470e1017fc5d3", "kind": "identity", "frame_number": 3829, "timestamp_epoch": "1647898111.666012000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-e4bafa6d5fd6813a7064d8d3", "kind": "identity", "frame_number": 3839, "timestamp_epoch": "1647898111.838100000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-412ff1292adf53ce84650d39", "kind": "identity", "frame_number": 3840, "timestamp_epoch": "1647898111.838130000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5dfd5237aec0c326264fb59d", "kind": "identity", "frame_number": 3846, "timestamp_epoch": "1647898111.854034000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-af24b63ce77dd83405798d87", "kind": "identity", "frame_number": 3847, "timestamp_epoch": "1647898111.854092000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 41, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b73b0b7202907b60b9d646f5", "kind": "identity", "frame_number": 3848, "timestamp_epoch": "1647898111.854176000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3872d9d4bbd96f18148dd6ff", "kind": "identity", "frame_number": 3905, "timestamp_epoch": "1647898112.431460000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-5891ce8ff8f6793c7d7d542b", "kind": "identity", "frame_number": 3908, "timestamp_epoch": "1647898112.603273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-7dcc6fb8a8d0d869934ec584", "kind": "identity", "frame_number": 3909, "timestamp_epoch": "1647898112.603273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-d433773eaadcedb99f687ddd", "kind": "identity", "frame_number": 3912, "timestamp_epoch": "1647898113.181422000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<20>,DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-97e01440ee4fd0d9f9b31904", "kind": "identity", "frame_number": 3913, "timestamp_epoch": "1647898113.353272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-1946c2588beecc1c7b92ae06", "kind": "identity", "frame_number": 3914, "timestamp_epoch": "1647898113.353272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-115a6e8c271f029467bcd836", "kind": "identity", "frame_number": 3920, "timestamp_epoch": "1647898113.963345000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-36174ca982ad21ed5cdc26a0", "kind": "identity", "frame_number": 3922, "timestamp_epoch": "1647898114.119089000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<00>,BURNINCANDLE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-e064f2f726f4cb6156c0e57c", "kind": "identity", "frame_number": 3923, "timestamp_epoch": "1647898114.119089000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-5QS3D5D<00>,DESKTOP-5QS3D5D<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b5651dc3f312a5b3c6982df0", "kind": "identity", "frame_number": 3926, "timestamp_epoch": "1647898114.712700000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-58569f09c5a13652ec9f6574", "kind": "identity", "frame_number": 3928, "timestamp_epoch": "1647898115.478242000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-c7478b86f8a97aa6b3fbdb80", "kind": "identity", "frame_number": 3930, "timestamp_epoch": "1647898116.228516000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5543ba2df3b0cd5d374c8aca", "kind": "identity", "frame_number": 3933, "timestamp_epoch": "1647898117.056425000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-f1442b6bce5ee80a61582c3b", "kind": "identity", "frame_number": 3934, "timestamp_epoch": "1647898117.056623000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "5", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-069be9d02e0b08e69872b71d", "kind": "identity", "frame_number": 3935, "timestamp_epoch": "1647898117.057084000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "<01><02>__MSBROWSE__<02><01>" } }, { "event_id": "evt-6f955d81f777f976df4880b1", "kind": "identity", "frame_number": 3936, "timestamp_epoch": "1647898117.057220000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "<01><02>__MSBROWSE__<02><01> (Browser)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-d8db1acdeb5d889c2c74d0ef", "kind": "identity", "frame_number": 3937, "timestamp_epoch": "1647898117.057486000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "BURNINCANDLE", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-603f2b0e432dbadd7fb0d5ed", "kind": "identity", "frame_number": 3938, "timestamp_epoch": "1647898117.057620000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "browser.server": "BURNINCANDLE", "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4fe0196efcf5e36098f6cced", "kind": "identity", "frame_number": 3941, "timestamp_epoch": "1647898117.166144000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE-DC<00>" } }, { "event_id": "evt-0858af2e073d263eb524b5eb", "kind": "identity", "frame_number": 3942, "timestamp_epoch": "1647898117.166289000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE-DC<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-de3666315465620b77ea36a3", "kind": "identity", "frame_number": 3943, "timestamp_epoch": "1647898117.166510000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3ee66ad9ccbba7c686e54626", "kind": "identity", "frame_number": 3944, "timestamp_epoch": "1647898117.167777000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE-DC<20>" } }, { "event_id": "evt-adbf710df24ce6f87cd95ff9", "kind": "identity", "frame_number": 3945, "timestamp_epoch": "1647898117.167928000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c20fe1e9bc8bb1228d54ce82", "kind": "identity", "frame_number": 3952, "timestamp_epoch": "1647898117.169584000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6784e0b93f5a1d01810baf0d", "kind": "identity", "frame_number": 3953, "timestamp_epoch": "1647898117.170439000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cf101e5dd00b5e8c0a4063bc", "kind": "identity", "frame_number": 3954, "timestamp_epoch": "1647898117.170737000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "DESKTOP-5QS3D5D<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-9953e15c460999a8b29f5a09", "kind": "identity", "frame_number": 3955, "timestamp_epoch": "1647898117.170858000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 33, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-5QS3D5D", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-cc569e8917e64e25adcb883b", "kind": "identity", "frame_number": 3960, "timestamp_epoch": "1647898117.172807000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-013cadf47d64ba2745b7a671", "kind": "identity", "frame_number": 3961, "timestamp_epoch": "1647898117.173338000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.qry.name": "DESKTOP-5QS3D5D", "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-468a06d2811770d415590b25", "kind": "identity", "frame_number": 3965, "timestamp_epoch": "1647898117.175200000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1d>,BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-950758fe64f78f65bd99cbb7", "kind": "identity", "frame_number": 3966, "timestamp_epoch": "1647898117.175384000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "5", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE<1d> (Local Master Browser)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-991376a4bf4f38a4d7f292ad", "kind": "identity", "frame_number": 3967, "timestamp_epoch": "1647898117.176212000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>" } }, { "event_id": "evt-b9f1f7662c0fa685f8f5a3aa", "kind": "identity", "frame_number": 3968, "timestamp_epoch": "1647898117.176345000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-701df562cbf5da8794e943bd", "kind": "identity", "frame_number": 3969, "timestamp_epoch": "1647898117.176385000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fc7958c9dac4d570fa758c2f", "kind": "identity", "frame_number": 3970, "timestamp_epoch": "1647898117.176459000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-60ea36e4ec44585723f9d81d", "kind": "identity", "frame_number": 3971, "timestamp_epoch": "1647898117.176561000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5d93c3331f9b8b93b9ab1c5b", "kind": "identity", "frame_number": 3978, "timestamp_epoch": "1647898117.179712000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a5d17c78e05ccb94783d34de", "kind": "identity", "frame_number": 3979, "timestamp_epoch": "1647898117.180065000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c309fceffc66c709be2a9a20", "kind": "identity", "frame_number": 3980, "timestamp_epoch": "1647898117.180785000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "BURNINCANDLE-DC", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-65c38e052f0076a37fb96730", "kind": "identity", "frame_number": 3991, "timestamp_epoch": "1647898117.915697000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-efad466666157e163224af49", "kind": "identity", "frame_number": 3994, "timestamp_epoch": "1647898118.668493000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-56d8a9ec8be33d97d8e35e49", "kind": "identity", "frame_number": 3995, "timestamp_epoch": "1647898119.418463000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BURNINCANDLE<1e>,BURNINCANDLE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-90af26da8fd41d7782f9ecd2", "kind": "identity", "frame_number": 3996, "timestamp_epoch": "1647898120.231504000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.response_computer_name": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-36cb480e71674bf13a961b16", "kind": "identity", "frame_number": 3997, "timestamp_epoch": "1647898120.234817000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dc6393b57aa46a331f36d0f0", "kind": "identity", "frame_number": 4023, "timestamp_epoch": "1647898139.727975000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2832e44d9fe54a607cb4267f", "kind": "identity", "frame_number": 4024, "timestamp_epoch": "1647898139.728161000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-526c7ef88c8415578a7d808d", "kind": "identity", "frame_number": 4025, "timestamp_epoch": "1647898139.728686000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f15e529991686012a2efd00c", "kind": "identity", "frame_number": 4028, "timestamp_epoch": "1647898139.729830000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-1789412c575931ae9ac92c24", "kind": "identity", "frame_number": 4030, "timestamp_epoch": "1647898139.731829000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-25b4f584010149fd0a1c6c1a", "kind": "identity", "frame_number": 4031, "timestamp_epoch": "1647898139.732162000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c83787c3fe216b5d6f6933b0", "kind": "identity", "frame_number": 4032, "timestamp_epoch": "1647898139.732423000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f749205c61555e5df92ecac7", "kind": "identity", "frame_number": 4033, "timestamp_epoch": "1647898139.732649000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3a82fe283b24550d7f830732", "kind": "identity", "frame_number": 4034, "timestamp_epoch": "1647898139.732788000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-83342f6ec9755d04086f4bfc", "kind": "identity", "frame_number": 4036, "timestamp_epoch": "1647898139.732938000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3514f168c85b90448dc10871", "kind": "identity", "frame_number": 4037, "timestamp_epoch": "1647898139.733152000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0b3cc2ddacbc9baae6fbc046", "kind": "identity", "frame_number": 4064, "timestamp_epoch": "1647898150.508350000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a69ee102b745eaaf19322add", "kind": "identity", "frame_number": 4065, "timestamp_epoch": "1647898150.508548000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-09a472ef24f7f08b214b1a9d", "kind": "identity", "frame_number": 4066, "timestamp_epoch": "1647898150.508753000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ca41f2d6476071d5ccda231b", "kind": "identity", "frame_number": 4067, "timestamp_epoch": "1647898150.508891000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0778919fb4d0e23d9b1c2799", "kind": "identity", "frame_number": 4126, "timestamp_epoch": "1647898843.133416000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-02b0a2f78482867bafce719c", "kind": "identity", "frame_number": 4137, "timestamp_epoch": "1647899008.770218000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-39016f4c4279dee203a9994d", "kind": "identity", "frame_number": 4138, "timestamp_epoch": "1647899008.770326000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7792c8daa6864af497b0a818", "kind": "identity", "frame_number": 4139, "timestamp_epoch": "1647899008.770935000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-bbab3156ca9ea9ad0592d8b2", "kind": "identity", "frame_number": 4150, "timestamp_epoch": "1647899008.771958000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-e1b070966f0cf6704738eb57", "kind": "identity", "frame_number": 4156, "timestamp_epoch": "1647899008.772979000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-776bae34087972f2b58d9bce", "kind": "identity", "frame_number": 4162, "timestamp_epoch": "1647899008.773229000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-b556d9c742097a3a8a9a300b", "kind": "identity", "frame_number": 4164, "timestamp_epoch": "1647899008.774133000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-31d138288d00756e73e10ed5", "kind": "identity", "frame_number": 4171, "timestamp_epoch": "1647899008.778106000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-c63983c562ca1db4166705a8", "kind": "identity", "frame_number": 4173, "timestamp_epoch": "1647899008.779758000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "11" } }, { "event_id": "evt-46cb598566f0d1d8aea8a89e", "kind": "identity", "frame_number": 4181, "timestamp_epoch": "1647899008.782862000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-f8f8f29da2770f48d0267d05", "kind": "identity", "frame_number": 4183, "timestamp_epoch": "1647899008.784427000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "11" } }, { "event_id": "evt-42002ed2a5dd62bdde277376", "kind": "identity", "frame_number": 4192, "timestamp_epoch": "1647899008.785269000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-86edb104cd6e7029e8a55d39", "kind": "identity", "frame_number": 4195, "timestamp_epoch": "1647899008.787474000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-d3a031c28cd8289f77c012b1", "kind": "identity", "frame_number": 4201, "timestamp_epoch": "1647899008.787952000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-bd8212e904d96379283f0d29", "kind": "identity", "frame_number": 4203, "timestamp_epoch": "1647899008.789116000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-25104727b1390c45665d713b", "kind": "identity", "frame_number": 4204, "timestamp_epoch": "1647899008.789235000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-7ae0458a09b5e280c264546c", "kind": "identity", "frame_number": 4220, "timestamp_epoch": "1647899008.795290000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-0eaacbf05b97edadae06c04f", "kind": "identity", "frame_number": 4235, "timestamp_epoch": "1647899008.798204000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-a7f66b036c5f17a1e943ffba", "kind": "identity", "frame_number": 4245, "timestamp_epoch": "1647899008.798900000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-a6aa98dae4cf534e310919b1", "kind": "identity", "frame_number": 4253, "timestamp_epoch": "1647899008.799509000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-5777b36a0bf7e68774f3d80d", "kind": "identity", "frame_number": 4255, "timestamp_epoch": "1647899008.800293000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-b0b453ff52215f6dc1976fd9", "kind": "identity", "frame_number": 4259, "timestamp_epoch": "1647899008.800494000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-ddce4db5dc8b4e72aaa01b5f", "kind": "identity", "frame_number": 4265, "timestamp_epoch": "1647899008.800985000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-a1537ac3dcb6aedabe2dda88", "kind": "identity", "frame_number": 4272, "timestamp_epoch": "1647899008.801918000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-ab554abd9628ebcf7083507b", "kind": "identity", "frame_number": 4273, "timestamp_epoch": "1647899008.802149000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e6dc1f7c9c164dd5adad33fc", "kind": "identity", "frame_number": 4275, "timestamp_epoch": "1647899008.802405000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-60eff49e00577e3348042461", "kind": "identity", "frame_number": 4276, "timestamp_epoch": "1647899008.802481000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-53182d5991ca5bbbad663853", "kind": "identity", "frame_number": 4277, "timestamp_epoch": "1647899008.802618000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7071fccd71a1c0b1d074a828", "kind": "identity", "frame_number": 4278, "timestamp_epoch": "1647899008.802707000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f0f7564df6fafbecefbec246", "kind": "identity", "frame_number": 4279, "timestamp_epoch": "1647899008.802918000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9a82122bd97359d1ac0cd192", "kind": "identity", "frame_number": 4280, "timestamp_epoch": "1647899008.802991000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-03258d739128251fb24ef076", "kind": "identity", "frame_number": 4281, "timestamp_epoch": "1647899008.803185000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-84ff281e561fc3a3b3409a51", "kind": "identity", "frame_number": 4282, "timestamp_epoch": "1647899008.803349000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-771652f5cec5bb989c8a09f3", "kind": "identity", "frame_number": 4283, "timestamp_epoch": "1647899008.803489000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-342016cbac71f532c6d15a6e", "kind": "identity", "frame_number": 4284, "timestamp_epoch": "1647899008.803558000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-881aaed6af339ce79501fc68", "kind": "identity", "frame_number": 4285, "timestamp_epoch": "1647899008.803661000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-389f7d3908e9ae0d21f8f0ca", "kind": "identity", "frame_number": 4286, "timestamp_epoch": "1647899008.803809000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1f5e8a7dd6a10611503a33b3", "kind": "identity", "frame_number": 4287, "timestamp_epoch": "1647899008.804112000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4aa82c8435f542a65a3684e5", "kind": "identity", "frame_number": 4288, "timestamp_epoch": "1647899008.804203000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-df65e2be030b5a75e1b499a0", "kind": "identity", "frame_number": 4289, "timestamp_epoch": "1647899008.804461000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1b493c64173bb4d0f77e3c54", "kind": "identity", "frame_number": 4290, "timestamp_epoch": "1647899008.804548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5566c39292c2fd39ff58c6ed", "kind": "identity", "frame_number": 4291, "timestamp_epoch": "1647899008.804796000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8c15f002caf22c11e15edd93", "kind": "identity", "frame_number": 4292, "timestamp_epoch": "1647899008.804874000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-37c75313fb176588a03dc3c6", "kind": "identity", "frame_number": 4293, "timestamp_epoch": "1647899008.805122000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-40212a8bb55537e11831db74", "kind": "identity", "frame_number": 4294, "timestamp_epoch": "1647899008.805311000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-370962f783cd8c5b2cfa95e2", "kind": "identity", "frame_number": 4295, "timestamp_epoch": "1647899008.805561000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-120d2a9e7ded304e3abcc6e8", "kind": "identity", "frame_number": 4296, "timestamp_epoch": "1647899008.805736000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b20a98f14ff4e4161c88aa71", "kind": "identity", "frame_number": 4300, "timestamp_epoch": "1647899008.806011000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 51, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "10" } }, { "event_id": "evt-f03dfb60c5de5ce80ae26c0a", "kind": "identity", "frame_number": 4301, "timestamp_epoch": "1647899008.806089000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b3173ae0e9c7014c6bd8c46f", "kind": "identity", "frame_number": 4303, "timestamp_epoch": "1647899008.806272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7a45a18dab4e9ae5a55a5ed3", "kind": "identity", "frame_number": 4306, "timestamp_epoch": "1647899008.806952000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 51, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "11" } }, { "event_id": "evt-d6d40b8292bc7470266275ff", "kind": "identity", "frame_number": 4307, "timestamp_epoch": "1647899008.806952000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6b49a98917787b631f1c7428", "kind": "identity", "frame_number": 4311, "timestamp_epoch": "1647899008.807109000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-422283cf6c3437b7adbf61ad", "kind": "identity", "frame_number": 4316, "timestamp_epoch": "1647899008.807660000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-f8db45fe0c6966759c1f62e1", "kind": "identity", "frame_number": 4317, "timestamp_epoch": "1647899008.807692000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "samr.samr_UserInfo21.account_name": "patrick.zimmerman", "samr.samr_UserInfo21.full_name": "Patrick Zimmerman" } }, { "event_id": "evt-6b922475b83986fffb627512", "kind": "identity", "frame_number": 4319, "timestamp_epoch": "1647899008.807815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d93ed240e1eb48efcc51625a", "kind": "identity", "frame_number": 4320, "timestamp_epoch": "1647899008.808242000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1d202628928838562dbc0e23", "kind": "identity", "frame_number": 4321, "timestamp_epoch": "1647899008.808319000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ee545fbbda3610022aa4b7ca", "kind": "identity", "frame_number": 4323, "timestamp_epoch": "1647899008.808757000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-bf7f4a05492c77ab926c63db", "kind": "identity", "frame_number": 4324, "timestamp_epoch": "1647899008.808757000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-dc2cb27abd2f15e96a74ce6c", "kind": "identity", "frame_number": 4329, "timestamp_epoch": "1647899008.808946000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-71e69cb24b8ed00d4419ffb7", "kind": "identity", "frame_number": 4330, "timestamp_epoch": "1647899008.809201000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7a2d0245fdf11f2c0ecb3947", "kind": "identity", "frame_number": 4331, "timestamp_epoch": "1647899008.809305000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-06b33311f9fd99ba6b10670c", "kind": "identity", "frame_number": 4332, "timestamp_epoch": "1647899008.809495000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1fadeacd2bc855a95b89437f", "kind": "identity", "frame_number": 4333, "timestamp_epoch": "1647899008.809642000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4c25eefebbfb31c6ccbd91d0", "kind": "identity", "frame_number": 4334, "timestamp_epoch": "1647899008.809881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-25af9077b6e734ec3701b14f", "kind": "identity", "frame_number": 4335, "timestamp_epoch": "1647899008.809986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6de2339205139e50ec97d791", "kind": "identity", "frame_number": 4336, "timestamp_epoch": "1647899008.810217000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-72b14911c940f59a7207e794", "kind": "identity", "frame_number": 4337, "timestamp_epoch": "1647899008.810323000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1a763c596b08892b9157f075", "kind": "identity", "frame_number": 4338, "timestamp_epoch": "1647899008.810629000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7280e1855c7eaeea0fd337a7", "kind": "identity", "frame_number": 4339, "timestamp_epoch": "1647899008.810707000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6748f5534e43e808edf94e9f", "kind": "identity", "frame_number": 4340, "timestamp_epoch": "1647899008.810816000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3366352bac98757075ece796", "kind": "identity", "frame_number": 4350, "timestamp_epoch": "1647899008.900486000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0017bc05d2358a6f93e044a6", "kind": "identity", "frame_number": 4351, "timestamp_epoch": "1647899008.900902000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c6439c56eab1eeeb3d02dcdc", "kind": "identity", "frame_number": 4356, "timestamp_epoch": "1647899008.901710000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-4d374dbeda171378d591b453", "kind": "identity", "frame_number": 4359, "timestamp_epoch": "1647899008.902878000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-d8d7767a3287259bc3831349", "kind": "identity", "frame_number": 4366, "timestamp_epoch": "1647899008.903548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-6e4bf70ee00d4dc2b83bbcd8", "kind": "identity", "frame_number": 4368, "timestamp_epoch": "1647899008.904397000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-a582a97b261e95f006b9d35d", "kind": "identity", "frame_number": 4369, "timestamp_epoch": "1647899008.904672000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a152448255d44917d857eb82", "kind": "identity", "frame_number": 4370, "timestamp_epoch": "1647899008.904849000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3af46e8067c7cf3a1b28415d", "kind": "identity", "frame_number": 4371, "timestamp_epoch": "1647899008.904947000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-44b9118f033e5818f33d5255", "kind": "identity", "frame_number": 4372, "timestamp_epoch": "1647899008.905067000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-926a2cbeadf29093a4093b81", "kind": "identity", "frame_number": 4383, "timestamp_epoch": "1647899009.109732000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-d2edc7e78a270c72faa96d40", "kind": "identity", "frame_number": 4385, "timestamp_epoch": "1647899009.111125000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-972f0996704604263bfed416", "kind": "identity", "frame_number": 4392, "timestamp_epoch": "1647899009.119228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f412fa3e325e2a2bedafca4f", "kind": "identity", "frame_number": 4394, "timestamp_epoch": "1647899009.120599000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-500989540d4ad505770f87aa", "kind": "identity", "frame_number": 4709, "timestamp_epoch": "1647899019.478295000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-025450708cc948f9ae43e695", "kind": "identity", "frame_number": 4710, "timestamp_epoch": "1647899019.478448000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c88ac0c9376e5c220ee6f1ce", "kind": "identity", "frame_number": 4711, "timestamp_epoch": "1647899019.478747000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7cd44001b2e66c7f120821ca", "kind": "identity", "frame_number": 4712, "timestamp_epoch": "1647899019.478844000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-efa7bd326163c208db7a3ce9", "kind": "identity", "frame_number": 4769, "timestamp_epoch": "1647899039.674066000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-08facd852fb4dfec81fe890d", "kind": "identity", "frame_number": 4770, "timestamp_epoch": "1647899039.674241000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3eefe2640e0a6975e9aa29f3", "kind": "identity", "frame_number": 4771, "timestamp_epoch": "1647899039.674774000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f897c172f670643b4f4f8b73", "kind": "identity", "frame_number": 4774, "timestamp_epoch": "1647899039.675898000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-700d9cb24794e5543c04a06f", "kind": "identity", "frame_number": 4776, "timestamp_epoch": "1647899039.677899000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e85086ff7865cff602425077", "kind": "identity", "frame_number": 4777, "timestamp_epoch": "1647899039.678220000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6851164407e2f2f22e245c3b", "kind": "identity", "frame_number": 4778, "timestamp_epoch": "1647899039.678508000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f9c98978c5e16e5f4c9def5f", "kind": "identity", "frame_number": 4779, "timestamp_epoch": "1647899039.678695000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-99140c631bf9c0a3ff8a453e", "kind": "identity", "frame_number": 4780, "timestamp_epoch": "1647899039.678894000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0bd64a46a5add5ae4492f106", "kind": "identity", "frame_number": 4781, "timestamp_epoch": "1647899039.678894000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-856286652e67269a9f3e88a0", "kind": "identity", "frame_number": 4782, "timestamp_epoch": "1647899039.679124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-39117a86878f2957308c638b", "kind": "identity", "frame_number": 4816, "timestamp_epoch": "1647899050.399835000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-83f2c8346f04496533d99f7f", "kind": "identity", "frame_number": 4817, "timestamp_epoch": "1647899050.400014000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-25349be5200e7390d56a2c39", "kind": "identity", "frame_number": 4818, "timestamp_epoch": "1647899050.400259000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3a2424ae341786e5a5607b4f", "kind": "identity", "frame_number": 4819, "timestamp_epoch": "1647899050.400576000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e417e0eb558770c20162f638", "kind": "identity", "frame_number": 4838, "timestamp_epoch": "1647899069.645025000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-ce1a23a16da886ed8a3bf644", "kind": "identity", "frame_number": 4840, "timestamp_epoch": "1647899069.646233000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-2de5d8cae5541255527a620b", "kind": "identity", "frame_number": 4841, "timestamp_epoch": "1647899069.646453000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-d7adc01496de0db51b2a86df", "kind": "identity", "frame_number": 4865, "timestamp_epoch": "1647899069.654943000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-d57855e3cdddbc5a8826e745", "kind": "identity", "frame_number": 4867, "timestamp_epoch": "1647899069.656347000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-858bfa2c6ecceb37fbe2f9e7", "kind": "identity", "frame_number": 4878, "timestamp_epoch": "1647899069.660236000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-944f0fb018669861a3733f3e", "kind": "identity", "frame_number": 4880, "timestamp_epoch": "1647899069.661690000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-bc5a914bb38d81449083f369", "kind": "identity", "frame_number": 4977, "timestamp_epoch": "1647899289.107228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8eadd6f22a93804e543f6612", "kind": "identity", "frame_number": 4978, "timestamp_epoch": "1647899289.107478000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-661a3d53ff8c68664726d4a8", "kind": "identity", "frame_number": 5048, "timestamp_epoch": "1647899561.040414000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-63ebbf83f0025d4d9277877e", "kind": "identity", "frame_number": 5785, "timestamp_epoch": "1647899730.288870000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "WPAD<00>" } }, { "event_id": "evt-4481c00b540d3155c382167e", "kind": "identity", "frame_number": 5786, "timestamp_epoch": "1647899730.288922000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.qry.name": "wpad.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-58fbc603d2988cec3acb2387", "kind": "identity", "frame_number": 5787, "timestamp_epoch": "1647899730.289101000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.qry.name": "wpad", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-62ed7403bcf28cdace8c8953", "kind": "identity", "frame_number": 5788, "timestamp_epoch": "1647899730.698141000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.qry.name": "wpad", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-278c7f1ea46481ae0954c738", "kind": "identity", "frame_number": 5789, "timestamp_epoch": "1647899731.075614000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "WPAD<00>" } }, { "event_id": "evt-3ec9b0529d42c8cc7659f5ac", "kind": "identity", "frame_number": 5790, "timestamp_epoch": "1647899731.286924000", "src_ip": "10.0.19.14", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.qry.name": "wpad.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-18b6413c11347ef606b22796", "kind": "identity", "frame_number": 5791, "timestamp_epoch": "1647899731.849224000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "WPAD<00>" } }, { "event_id": "evt-3ce32a349e340f8d03a4910a", "kind": "identity", "frame_number": 5913, "timestamp_epoch": "1647899889.422795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-61e643774c644acc020fc363", "kind": "identity", "frame_number": 5914, "timestamp_epoch": "1647899889.423196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1e27ef515a743457f4adafed", "kind": "identity", "frame_number": 6008, "timestamp_epoch": "1647899939.641112000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-37269c8da52c80411d140006", "kind": "identity", "frame_number": 6009, "timestamp_epoch": "1647899939.641323000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c914e43e1b8047e508c68595", "kind": "identity", "frame_number": 6010, "timestamp_epoch": "1647899939.641897000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0f7384e30fe9455f8ac6ea1d", "kind": "identity", "frame_number": 6013, "timestamp_epoch": "1647899939.644420000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-8684ee19b87348b7910b7eac", "kind": "identity", "frame_number": 6015, "timestamp_epoch": "1647899939.646530000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-b0efa8a0303aa615efcf6f76", "kind": "identity", "frame_number": 6016, "timestamp_epoch": "1647899939.647381000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-77d572bd123d28eec73a8a7b", "kind": "identity", "frame_number": 6017, "timestamp_epoch": "1647899939.647627000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cd829cbb3295b0a106d650ed", "kind": "identity", "frame_number": 6018, "timestamp_epoch": "1647899939.648031000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e739e89acb66b05df005bd61", "kind": "identity", "frame_number": 6019, "timestamp_epoch": "1647899939.648167000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7c178cfa1bcdd42fd053a575", "kind": "identity", "frame_number": 6020, "timestamp_epoch": "1647899939.648199000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6e935b5999bd5c189fff42d5", "kind": "identity", "frame_number": 6021, "timestamp_epoch": "1647899939.648506000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a10310e437daca37efd3f58b", "kind": "identity", "frame_number": 6036, "timestamp_epoch": "1647899950.332336000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-190f53d06985b3ee6820cb32", "kind": "identity", "frame_number": 6037, "timestamp_epoch": "1647899950.332543000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a222d8245ba6fa3dd2415494", "kind": "identity", "frame_number": 6038, "timestamp_epoch": "1647899950.332745000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2046ab660dce2233aa009a6d", "kind": "identity", "frame_number": 6039, "timestamp_epoch": "1647899950.332920000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 89, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2fc9056f0637520087200610", "kind": "identity", "frame_number": 6317, "timestamp_epoch": "1647900283.235767000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bfbd31299c02625caa544df6", "kind": "identity", "frame_number": 7002, "timestamp_epoch": "1647900354.451058000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-39b7120b7e38fc1437ae137f", "kind": "identity", "frame_number": 7005, "timestamp_epoch": "1647900354.453638000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "patrick.zimmerman", "kerberos.msg_type": "13" } }, { "event_id": "evt-a17eed941c00ed8f2fb1a9d7", "kind": "identity", "frame_number": 7011, "timestamp_epoch": "1647900354.454129000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-39d9779bb3e289b8c83ca489", "kind": "identity", "frame_number": 7013, "timestamp_epoch": "1647900354.455609000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-67e0c76bf63c424a06f7246a", "kind": "identity", "frame_number": 7027, "timestamp_epoch": "1647900354.461285000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-caf31442ee7ef5b4fc863cb3", "kind": "identity", "frame_number": 7029, "timestamp_epoch": "1647900354.462709000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-d8b4f16418d473730c3429c6", "kind": "identity", "frame_number": 7383, "timestamp_epoch": "1647900354.649520000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-816cb6e6bd7dcb34de11a13d", "kind": "identity", "frame_number": 7384, "timestamp_epoch": "1647900354.649724000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-afa0b3c2c9d66410fc5bf86c", "kind": "identity", "frame_number": 7385, "timestamp_epoch": "1647900354.649936000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d945d46ebfc3c3234e09757d", "kind": "identity", "frame_number": 7388, "timestamp_epoch": "1647900354.651002000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-015cea9937c7d6d028d84546", "kind": "identity", "frame_number": 7390, "timestamp_epoch": "1647900354.652049000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-50d8ca3aeffa5297a5f7710d", "kind": "identity", "frame_number": 7391, "timestamp_epoch": "1647900354.652269000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4ed54231d7b22adf4c589da6", "kind": "identity", "frame_number": 7392, "timestamp_epoch": "1647900354.652424000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-43efe135b5ec9dc72d469d8c", "kind": "identity", "frame_number": 7393, "timestamp_epoch": "1647900354.652519000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eff74f344899efad9886af8c", "kind": "identity", "frame_number": 7394, "timestamp_epoch": "1647900354.652582000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-37f33c81739bb15285697334", "kind": "identity", "frame_number": 7395, "timestamp_epoch": "1647900354.652646000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-72c28b378f59a1634245ce93", "kind": "identity", "frame_number": 7396, "timestamp_epoch": "1647900354.652760000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e25ca71db695a28f7ff327cd", "kind": "identity", "frame_number": 7398, "timestamp_epoch": "1647900354.652898000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-76c58171e06941bbe790ea52", "kind": "identity", "frame_number": 7399, "timestamp_epoch": "1647900354.652939000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-194fb029d666d9070b78755b", "kind": "identity", "frame_number": 7400, "timestamp_epoch": "1647900354.653071000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c26da8ce8e4a7019ae9c910c", "kind": "identity", "frame_number": 7401, "timestamp_epoch": "1647900354.653162000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b90a7c22a97922dd0eca9f00", "kind": "identity", "frame_number": 7402, "timestamp_epoch": "1647900354.653278000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c59aaa40d3abf76376249969", "kind": "identity", "frame_number": 7403, "timestamp_epoch": "1647900354.653384000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f801b4aeb2dd0d9ab5ca1ac8", "kind": "identity", "frame_number": 7404, "timestamp_epoch": "1647900354.653536000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0b54fa910ea633c4a930f7c0", "kind": "identity", "frame_number": 7405, "timestamp_epoch": "1647900354.653621000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4df7c56b0e75ac19cf4509d3", "kind": "identity", "frame_number": 7406, "timestamp_epoch": "1647900354.653783000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ecabccd60e3dcfeeda2eb13f", "kind": "identity", "frame_number": 7407, "timestamp_epoch": "1647900354.653967000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ffe2c018d4f5bd263b7174d8", "kind": "identity", "frame_number": 7408, "timestamp_epoch": "1647900354.654077000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-67862b5277e4838e8eb589f4", "kind": "identity", "frame_number": 7409, "timestamp_epoch": "1647900354.654170000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6a59566565a9777f6eeff99f", "kind": "identity", "frame_number": 7410, "timestamp_epoch": "1647900354.664118000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-98df55042fb32228adaa3d93", "kind": "identity", "frame_number": 7411, "timestamp_epoch": "1647900354.664308000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0406b5d1edf053a235c9c3e9", "kind": "identity", "frame_number": 7412, "timestamp_epoch": "1647900354.664539000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-84c9b640e31bc0582da67619", "kind": "identity", "frame_number": 7413, "timestamp_epoch": "1647900354.664674000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e817230744fe5866050ef97a", "kind": "identity", "frame_number": 7414, "timestamp_epoch": "1647900354.676872000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d2eddd972612e3ebb5b8174c", "kind": "identity", "frame_number": 7415, "timestamp_epoch": "1647900354.680639000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c61e7a899e7b9f93552566a6", "kind": "identity", "frame_number": 7417, "timestamp_epoch": "1647900354.776937000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-40fc0f650a8880f4c435dbb3", "kind": "identity", "frame_number": 7418, "timestamp_epoch": "1647900354.777539000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fffe5626fbc07070238348ad", "kind": "identity", "frame_number": 7419, "timestamp_epoch": "1647900354.777831000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-af0f3f8e5e352114b54d6d24", "kind": "identity", "frame_number": 7420, "timestamp_epoch": "1647900354.778410000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8d9d5544b91b39b7136fc8b3", "kind": "identity", "frame_number": 7421, "timestamp_epoch": "1647900354.778724000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0e38d8a8448d5c0ed464e492", "kind": "identity", "frame_number": 7422, "timestamp_epoch": "1647900354.786063000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f890129ff6c8f9d22d7f3862", "kind": "identity", "frame_number": 7423, "timestamp_epoch": "1647900354.786627000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e92cd01009aa29edbe88048f", "kind": "identity", "frame_number": 7424, "timestamp_epoch": "1647900354.787209000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3d7f6224bd5c798d17c514ef", "kind": "identity", "frame_number": 7425, "timestamp_epoch": "1647900354.787621000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ca1065d5354bb6d02d65078a", "kind": "identity", "frame_number": 7426, "timestamp_epoch": "1647900354.788272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9d3290259606a17de946215c", "kind": "identity", "frame_number": 7427, "timestamp_epoch": "1647900354.788706000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-865c8120968b899d07eec7c0", "kind": "identity", "frame_number": 7428, "timestamp_epoch": "1647900354.789048000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-577f825ad0d8552bf65a01c3", "kind": "identity", "frame_number": 7429, "timestamp_epoch": "1647900354.789269000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0cfbeaeaa092b82ecda1c0ad", "kind": "identity", "frame_number": 7430, "timestamp_epoch": "1647900354.789550000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-500f39b2bee5fc72878e551c", "kind": "identity", "frame_number": 7431, "timestamp_epoch": "1647900354.789795000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2e588ef13167af0754a7dcf3", "kind": "identity", "frame_number": 7432, "timestamp_epoch": "1647900354.817711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-339cb6670d77802f0ddc87db", "kind": "identity", "frame_number": 7433, "timestamp_epoch": "1647900354.821259000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f869fb185ae3fd1b044621fe", "kind": "identity", "frame_number": 7435, "timestamp_epoch": "1647900354.917093000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-574abe2c4633de023f084e8f", "kind": "identity", "frame_number": 7436, "timestamp_epoch": "1647900354.917739000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0cbcd36c6ef4de2c6c0b7c84", "kind": "identity", "frame_number": 7437, "timestamp_epoch": "1647900354.918043000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c499b72a5ac9f3847b433b94", "kind": "identity", "frame_number": 7438, "timestamp_epoch": "1647900354.918884000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aa3d9beb785ad4945463f73e", "kind": "identity", "frame_number": 7439, "timestamp_epoch": "1647900354.919329000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9b473e2d8f942a69ca1c4292", "kind": "identity", "frame_number": 7440, "timestamp_epoch": "1647900354.920819000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f99f24de4a92aa549e4e01d1", "kind": "identity", "frame_number": 7441, "timestamp_epoch": "1647900354.921741000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a34f600dc3b44f8dfbce96cc", "kind": "identity", "frame_number": 7442, "timestamp_epoch": "1647900354.924463000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a2a71676d0f0c45e1fdbc5d7", "kind": "identity", "frame_number": 7443, "timestamp_epoch": "1647900354.925030000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f916dd88650b2374e6a15f07", "kind": "identity", "frame_number": 7444, "timestamp_epoch": "1647900354.925612000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ff6ff245be0b3411a07ebebb", "kind": "identity", "frame_number": 7445, "timestamp_epoch": "1647900354.926013000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fce5bd383f79231197722a45", "kind": "identity", "frame_number": 7446, "timestamp_epoch": "1647900354.926603000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-df2c497d0cce710d5162a1b5", "kind": "identity", "frame_number": 7447, "timestamp_epoch": "1647900354.927009000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0c2db17cebcb4c42070e973a", "kind": "identity", "frame_number": 7448, "timestamp_epoch": "1647900354.927336000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7fbd18027c1a8cefd4e7e6ed", "kind": "identity", "frame_number": 7449, "timestamp_epoch": "1647900354.927462000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c52bba863b9a13f23d0e4a56", "kind": "identity", "frame_number": 7450, "timestamp_epoch": "1647900354.927814000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c3c6b5ea4a7323b16d9b788a", "kind": "identity", "frame_number": 7451, "timestamp_epoch": "1647900354.928038000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2611fad143959be827ce8fae", "kind": "identity", "frame_number": 7558, "timestamp_epoch": "1647900365.408169000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8689af1458b40d9793dc0295", "kind": "identity", "frame_number": 7559, "timestamp_epoch": "1647900365.408438000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b779c6e1c21b911f95d58c2b", "kind": "identity", "frame_number": 7876, "timestamp_epoch": "1647900469.574877000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ffa77262d510d7c567443562", "kind": "identity", "frame_number": 7877, "timestamp_epoch": "1647900469.575354000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9a343f25dbf0626540bc73e9", "kind": "identity", "frame_number": 7878, "timestamp_epoch": "1647900469.576383000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f26e4ddb7d5de805fbb1592f", "kind": "identity", "frame_number": 7879, "timestamp_epoch": "1647900469.576784000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-08e890ca044a5b3cc9efc52a", "kind": "identity", "frame_number": 7882, "timestamp_epoch": "1647900470.075414000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bec259dbc0c42f2e81788292", "kind": "identity", "frame_number": 7883, "timestamp_epoch": "1647900470.075802000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-54678a9cb966f06de548015e", "kind": "identity", "frame_number": 7884, "timestamp_epoch": "1647900470.076435000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2559940fedbfc0558ab0c056", "kind": "identity", "frame_number": 7885, "timestamp_epoch": "1647900470.076717000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-01bbeed9a3e503a7aa4a4568", "kind": "identity", "frame_number": 7892, "timestamp_epoch": "1647900489.749442000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ccf3c42f6a7cd07dd1977cbe", "kind": "identity", "frame_number": 7893, "timestamp_epoch": "1647900489.749442000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b42df98360636c3274079f33", "kind": "identity", "frame_number": 7894, "timestamp_epoch": "1647900489.749748000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ea23883eed7f8419a1699b13", "kind": "identity", "frame_number": 7895, "timestamp_epoch": "1647900489.749822000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c099985d989917d240171c72", "kind": "identity", "frame_number": 7911, "timestamp_epoch": "1647900526.499164000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-decdc00eaca336364422220f", "kind": "identity", "frame_number": 7912, "timestamp_epoch": "1647900526.499505000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-52ccf4b03132a094f9d99b58", "kind": "identity", "frame_number": 7913, "timestamp_epoch": "1647900526.499860000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-98582c90db156c5465dae1e6", "kind": "identity", "frame_number": 7914, "timestamp_epoch": "1647900526.500040000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-46247d9969a17b319444d272", "kind": "identity", "frame_number": 7915, "timestamp_epoch": "1647900526.500387000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-42ea60629f265644d87cab2b", "kind": "identity", "frame_number": 7916, "timestamp_epoch": "1647900526.500557000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f9b0a8e0e896f24ba86b75a2", "kind": "identity", "frame_number": 7918, "timestamp_epoch": "1647900537.270216000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7b2300c452986cb4d0959939", "kind": "identity", "frame_number": 7919, "timestamp_epoch": "1647900537.270216000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aeced642c805929b59e23e5f", "kind": "identity", "frame_number": 7921, "timestamp_epoch": "1647900537.270322000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-187ca27794fa657286e9fb0d", "kind": "identity", "frame_number": 7922, "timestamp_epoch": "1647900537.270493000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e0400dc1bc434e7a70eec781", "kind": "identity", "frame_number": 7923, "timestamp_epoch": "1647900537.270493000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-dd566e8c5e3b787620cd8071", "kind": "identity", "frame_number": 7925, "timestamp_epoch": "1647900537.270715000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7d27e38beb6377162f067e71", "kind": "identity", "frame_number": 7926, "timestamp_epoch": "1647900537.270796000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1d8f33a0d4f37811d2ee24c5", "kind": "identity", "frame_number": 8016, "timestamp_epoch": "1647900730.227853000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-fe0e6cbc5fd9c3389d55f823", "kind": "identity", "frame_number": 8018, "timestamp_epoch": "1647900730.229126000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c69070f03cd3e2b48a38b712", "kind": "identity", "frame_number": 8019, "timestamp_epoch": "1647900730.229653000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-11b0a17cdd848091161b155c", "kind": "identity", "frame_number": 8043, "timestamp_epoch": "1647900730.241525000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-0594d75a460c4dbb03e03fd1", "kind": "identity", "frame_number": 8045, "timestamp_epoch": "1647900730.242950000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e4315d921616e23332511204", "kind": "identity", "frame_number": 8056, "timestamp_epoch": "1647900730.246986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-576fd14fb447ead4568f8ab2", "kind": "identity", "frame_number": 8058, "timestamp_epoch": "1647900730.248438000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-1111dc6b6d839a44a12ae488", "kind": "identity", "frame_number": 8093, "timestamp_epoch": "1647900774.083093000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-494daaa453e1fdbb38438e4e", "kind": "identity", "frame_number": 8095, "timestamp_epoch": "1647900774.084307000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c1286f51783e208b3f3cb39c", "kind": "identity", "frame_number": 8096, "timestamp_epoch": "1647900774.084476000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-db8f5e9e348ae103e7f1d325", "kind": "identity", "frame_number": 8116, "timestamp_epoch": "1647900774.398700000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-0aa09b960fbc2506f2c64eaa", "kind": "identity", "frame_number": 8118, "timestamp_epoch": "1647900774.400149000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e3fd64f20e50159bbb3fa020", "kind": "identity", "frame_number": 8125, "timestamp_epoch": "1647900774.409200000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-840b042d7cddcf8f4df0b20b", "kind": "identity", "frame_number": 8127, "timestamp_epoch": "1647900774.410661000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-6e20993fcd41753f1d28f7a3", "kind": "identity", "frame_number": 8142, "timestamp_epoch": "1647900774.728383000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b8e8c4a85e737ac6ba371637", "kind": "identity", "frame_number": 8143, "timestamp_epoch": "1647900774.728588000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9bb21a05132fd1ad9b45a42b", "kind": "identity", "frame_number": 8144, "timestamp_epoch": "1647900774.729098000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4a0fcb022775f386c17fc279", "kind": "identity", "frame_number": 8147, "timestamp_epoch": "1647900774.731462000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-c3436ebbf00fd6b949e58d92", "kind": "identity", "frame_number": 8149, "timestamp_epoch": "1647900774.733514000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-4e95445ef66a04818d9ebc58", "kind": "identity", "frame_number": 8150, "timestamp_epoch": "1647900774.734369000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7e1a69dd046314a0cdca3ced", "kind": "identity", "frame_number": 8151, "timestamp_epoch": "1647900774.734753000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d5f1821c430c45d91f639ac3", "kind": "identity", "frame_number": 8152, "timestamp_epoch": "1647900774.735094000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7352dfa46ed502c467512d87", "kind": "identity", "frame_number": 8153, "timestamp_epoch": "1647900774.735341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0ec104468e972d0b41a52508", "kind": "identity", "frame_number": 8154, "timestamp_epoch": "1647900774.735505000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-259f2ac731be7145985d1e12", "kind": "identity", "frame_number": 8155, "timestamp_epoch": "1647900774.736082000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a476bfb52c7c6c4c2a80743c", "kind": "identity", "frame_number": 8157, "timestamp_epoch": "1647900774.736466000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6e66c1434c57476b109af7af", "kind": "identity", "frame_number": 8158, "timestamp_epoch": "1647900774.736654000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a0d01823c2d04681f21b0b1a", "kind": "identity", "frame_number": 8159, "timestamp_epoch": "1647900774.736959000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3bb946cd832e439bd254a621", "kind": "identity", "frame_number": 8160, "timestamp_epoch": "1647900774.737118000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3e8a0c968c9f1e814e62b338", "kind": "identity", "frame_number": 8161, "timestamp_epoch": "1647900774.737520000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c57fd7904da715f4dcebc728", "kind": "identity", "frame_number": 8162, "timestamp_epoch": "1647900774.737765000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ae2d9ad8dac781a4b4faf09f", "kind": "identity", "frame_number": 8163, "timestamp_epoch": "1647900774.743694000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bcd3ed9be5756f0693d714ef", "kind": "identity", "frame_number": 8164, "timestamp_epoch": "1647900774.744241000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a9c555540ef57057a6882877", "kind": "identity", "frame_number": 8165, "timestamp_epoch": "1647900774.744627000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4c66564520b8ce8c555a3046", "kind": "identity", "frame_number": 8166, "timestamp_epoch": "1647900774.744742000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ccb143753b8dc40b9e8b8f06", "kind": "identity", "frame_number": 8167, "timestamp_epoch": "1647900774.745102000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b7929474e5a880f72826c23c", "kind": "identity", "frame_number": 8168, "timestamp_epoch": "1647900774.745464000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ea3eb13c43207792e9da4c98", "kind": "identity", "frame_number": 8169, "timestamp_epoch": "1647900774.747323000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-56492b9d9cda66cde261fbef", "kind": "identity", "frame_number": 8170, "timestamp_epoch": "1647900774.747872000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-753a0ea32b19fbd89d5e109f", "kind": "identity", "frame_number": 8171, "timestamp_epoch": "1647900774.748274000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-203b0d830589ae4968039bdb", "kind": "identity", "frame_number": 8172, "timestamp_epoch": "1647900774.748398000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-827114fe9dba80830c7d9f37", "kind": "identity", "frame_number": 8173, "timestamp_epoch": "1647900774.748804000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c60aea78bcbc75100aadd8ac", "kind": "identity", "frame_number": 8174, "timestamp_epoch": "1647900774.749083000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b8a5206f0d53adf81eb9ca37", "kind": "identity", "frame_number": 8175, "timestamp_epoch": "1647900774.751148000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-427f2627723e4ac4678f030d", "kind": "identity", "frame_number": 8176, "timestamp_epoch": "1647900774.751703000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c1ed1c77ad33fcbe8ec4d455", "kind": "identity", "frame_number": 8177, "timestamp_epoch": "1647900774.752096000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-51bdee1ee5cef22ff34fee00", "kind": "identity", "frame_number": 8178, "timestamp_epoch": "1647900774.752269000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-faba70eecdeadf67025ffd38", "kind": "identity", "frame_number": 8179, "timestamp_epoch": "1647900774.752672000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5f80146440ecb85fb3dc5cea", "kind": "identity", "frame_number": 8180, "timestamp_epoch": "1647900774.752943000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8ab7ae585b18f75e1c26b1e6", "kind": "identity", "frame_number": 8181, "timestamp_epoch": "1647900774.755298000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-48c5e0189d7c5c9601e1ad49", "kind": "identity", "frame_number": 8182, "timestamp_epoch": "1647900774.755800000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8f45559f124ffec76e8231b7", "kind": "identity", "frame_number": 8183, "timestamp_epoch": "1647900774.756194000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9a6b0c9880ca33d5fbc676f7", "kind": "identity", "frame_number": 8184, "timestamp_epoch": "1647900774.756385000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d4265e1e5a97091bfced7f53", "kind": "identity", "frame_number": 8185, "timestamp_epoch": "1647900774.756745000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6f2f2b21eaca6921e16850ec", "kind": "identity", "frame_number": 8186, "timestamp_epoch": "1647900774.757064000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ee98def15db88d2ec0e2d755", "kind": "identity", "frame_number": 8187, "timestamp_epoch": "1647900774.757813000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-61566405b4b3e16c98859684", "kind": "identity", "frame_number": 8188, "timestamp_epoch": "1647900774.758394000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-dc72e938cab6e83f04c0e109", "kind": "identity", "frame_number": 8189, "timestamp_epoch": "1647900774.758742000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9719fea140304a488c7cac07", "kind": "identity", "frame_number": 8190, "timestamp_epoch": "1647900774.758921000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8ce451d581c26858398ec189", "kind": "identity", "frame_number": 8191, "timestamp_epoch": "1647900774.759267000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-90aa58145561224a9ce8c140", "kind": "identity", "frame_number": 8192, "timestamp_epoch": "1647900774.759467000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8e877bf7cd6a026ac4b5ce97", "kind": "identity", "frame_number": 8193, "timestamp_epoch": "1647900774.759741000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-edabaf688ab461607bc8238a", "kind": "identity", "frame_number": 8194, "timestamp_epoch": "1647900774.759944000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4451597fd8450c517ddd649f", "kind": "identity", "frame_number": 8195, "timestamp_epoch": "1647900774.760951000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5626a17ac95b3e0b88cc7f9a", "kind": "identity", "frame_number": 8196, "timestamp_epoch": "1647900774.761449000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-bc0a2c71334da495ab6a6f01", "kind": "identity", "frame_number": 8197, "timestamp_epoch": "1647900774.761761000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dd32b60104d200109bb3efe9", "kind": "identity", "frame_number": 8198, "timestamp_epoch": "1647900774.761920000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1fa7d78a238a0e10750bcb2a", "kind": "identity", "frame_number": 8199, "timestamp_epoch": "1647900774.762215000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f7d22c896ef2cdb91125175f", "kind": "identity", "frame_number": 8200, "timestamp_epoch": "1647900774.762410000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d45c108f354ee83ec3243b98", "kind": "identity", "frame_number": 8201, "timestamp_epoch": "1647900774.762676000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d8a87a49726eff4a6bd38548", "kind": "identity", "frame_number": 8202, "timestamp_epoch": "1647900774.762889000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e2cb3ef0ba7dd7091ca0e77a", "kind": "identity", "frame_number": 8203, "timestamp_epoch": "1647900774.763134000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d82e5108a7c08d166c22bb4a", "kind": "identity", "frame_number": 8204, "timestamp_epoch": "1647900774.763361000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9741cac7403bebe7f4dbb619", "kind": "identity", "frame_number": 8205, "timestamp_epoch": "1647900774.763601000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c1ab5a699e0fa4e73c89ed26", "kind": "identity", "frame_number": 8206, "timestamp_epoch": "1647900774.763729000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e6ea41cc5dab20409251ab15", "kind": "identity", "frame_number": 8207, "timestamp_epoch": "1647900774.765739000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dfc1be16a8abcb2b01f5609a", "kind": "identity", "frame_number": 8208, "timestamp_epoch": "1647900774.766095000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b9a850733538936ee8a2253d", "kind": "identity", "frame_number": 8209, "timestamp_epoch": "1647900774.767357000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0add0942ddecf2b87821aba0", "kind": "identity", "frame_number": 8210, "timestamp_epoch": "1647900774.767632000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-71d8cb0e66782c0bfb75c250", "kind": "identity", "frame_number": 8211, "timestamp_epoch": "1647900774.768227000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-45c28bf37fe26c4f3b0e7703", "kind": "identity", "frame_number": 8212, "timestamp_epoch": "1647900774.768711000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5f2e1224decca9cbc5389499", "kind": "identity", "frame_number": 8213, "timestamp_epoch": "1647900774.769500000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-abb4dae7431df2511ccb31f0", "kind": "identity", "frame_number": 8214, "timestamp_epoch": "1647900774.769799000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2895b33767ed3d0e5b7884e9", "kind": "identity", "frame_number": 8215, "timestamp_epoch": "1647900774.770550000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0d116fa712b5a1ff822c63c2", "kind": "identity", "frame_number": 8216, "timestamp_epoch": "1647900774.771164000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7749b7bfc136ebd378057dd8", "kind": "identity", "frame_number": 8217, "timestamp_epoch": "1647900774.771467000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fd57224b6d56230c3969239f", "kind": "identity", "frame_number": 8218, "timestamp_epoch": "1647900774.771662000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b6705e4a874578b69532a19e", "kind": "identity", "frame_number": 8219, "timestamp_epoch": "1647900774.771921000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3ba5c24307af11821c9261d4", "kind": "identity", "frame_number": 8220, "timestamp_epoch": "1647900774.772128000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-86181e0acee191eaf740d1ff", "kind": "identity", "frame_number": 8221, "timestamp_epoch": "1647900774.772351000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b6c206fe6c0c92c8cf7e5cc5", "kind": "identity", "frame_number": 8222, "timestamp_epoch": "1647900774.772498000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a9f0fb0412927fd957070b53", "kind": "identity", "frame_number": 8223, "timestamp_epoch": "1647900774.772845000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a9b305834f4f4448c1adec96", "kind": "identity", "frame_number": 8224, "timestamp_epoch": "1647900774.773202000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e9bb3f61e25e47c0579c4a48", "kind": "identity", "frame_number": 8225, "timestamp_epoch": "1647900774.773475000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b09aec2edf2de394c0664ebc", "kind": "identity", "frame_number": 8226, "timestamp_epoch": "1647900774.773739000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0361d2df1919a111445b819b", "kind": "identity", "frame_number": 8227, "timestamp_epoch": "1647900774.773945000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3e55380ce1edbb403a7dcfdf", "kind": "identity", "frame_number": 8228, "timestamp_epoch": "1647900774.774168000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d34b828dd40a24ba43ad5144", "kind": "identity", "frame_number": 8229, "timestamp_epoch": "1647900774.774371000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-afb60a4664715554443007ba", "kind": "identity", "frame_number": 8230, "timestamp_epoch": "1647900774.774559000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-240fe6f6255049fb3ac36503", "kind": "identity", "frame_number": 8231, "timestamp_epoch": "1647900774.774814000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aa839b9edb27ff6e5c502ada", "kind": "identity", "frame_number": 8232, "timestamp_epoch": "1647900774.775008000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9ed00554d2a20b4afd6ab4d2", "kind": "identity", "frame_number": 8233, "timestamp_epoch": "1647900774.775321000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1e17640d3b66bf69908c7dd8", "kind": "identity", "frame_number": 8234, "timestamp_epoch": "1647900774.775407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-35496c7e8d143870e5a2558a", "kind": "identity", "frame_number": 8235, "timestamp_epoch": "1647900774.776479000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-97286b8ad49d6855e6c945a2", "kind": "identity", "frame_number": 8236, "timestamp_epoch": "1647900774.776653000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-956f8909002a9072777c08d4", "kind": "identity", "frame_number": 8237, "timestamp_epoch": "1647900774.777196000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ca2511d3b207fa1c40481beb", "kind": "identity", "frame_number": 8239, "timestamp_epoch": "1647900774.777760000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-aba43191dadae9db55513b19", "kind": "identity", "frame_number": 8241, "timestamp_epoch": "1647900774.778478000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ab9dbaed02bc0b72effa0f6f", "kind": "identity", "frame_number": 8242, "timestamp_epoch": "1647900774.778719000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-753a808eaf92bf067af75051", "kind": "identity", "frame_number": 8243, "timestamp_epoch": "1647900774.779421000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-64f35550172666b7512c774d", "kind": "identity", "frame_number": 8244, "timestamp_epoch": "1647900774.779840000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d62b4a7113c93f8d6e1cba82", "kind": "identity", "frame_number": 8245, "timestamp_epoch": "1647900774.780207000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c037eac8ea32e93cfa2e61b5", "kind": "identity", "frame_number": 8246, "timestamp_epoch": "1647900774.780383000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3ddbc44014b2a9361db4bff9", "kind": "identity", "frame_number": 8247, "timestamp_epoch": "1647900774.780700000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aaa34455b31f5b77ff87160c", "kind": "identity", "frame_number": 8248, "timestamp_epoch": "1647900774.780799000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f7a1fe8f3868e1c34b959945", "kind": "identity", "frame_number": 8249, "timestamp_epoch": "1647900774.781162000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f56175429b861cbc213cc0c2", "kind": "identity", "frame_number": 8250, "timestamp_epoch": "1647900774.781258000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d33a922d1f80180180707b75", "kind": "identity", "frame_number": 8251, "timestamp_epoch": "1647900774.781623000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-20f598836d32e4e892b67ea5", "kind": "identity", "frame_number": 8252, "timestamp_epoch": "1647900774.781788000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a0c3341db7264c663650abd3", "kind": "identity", "frame_number": 8253, "timestamp_epoch": "1647900774.782157000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-12a56e134c4ca3277f7052ac", "kind": "identity", "frame_number": 8254, "timestamp_epoch": "1647900774.782496000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-34b02265c33ab98a20be1dad", "kind": "identity", "frame_number": 8255, "timestamp_epoch": "1647900774.782862000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7825ef4785e56d4659be2878", "kind": "identity", "frame_number": 8256, "timestamp_epoch": "1647900774.783031000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b6ffdb459eeb072751b4a453", "kind": "identity", "frame_number": 8257, "timestamp_epoch": "1647900774.783332000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-81b3a7ba22255f0704dbf666", "kind": "identity", "frame_number": 8258, "timestamp_epoch": "1647900774.783435000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-363bc9c60a02b17cc371aa6c", "kind": "identity", "frame_number": 8259, "timestamp_epoch": "1647900774.783783000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c663d3c11efbd96adeeda8b9", "kind": "identity", "frame_number": 8260, "timestamp_epoch": "1647900774.783919000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-34d43e2922c3ff7fafaf92bf", "kind": "identity", "frame_number": 8261, "timestamp_epoch": "1647900774.784183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3017e28572e661fed5b70bc8", "kind": "identity", "frame_number": 8262, "timestamp_epoch": "1647900774.784329000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c520a8950757ccba03209a5b", "kind": "identity", "frame_number": 8263, "timestamp_epoch": "1647900774.784616000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6659fe475787441d60ef55d2", "kind": "identity", "frame_number": 8264, "timestamp_epoch": "1647900774.784715000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9ba4fd5b6087ea2f1bc618c7", "kind": "identity", "frame_number": 8265, "timestamp_epoch": "1647900774.785129000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4ac14e35b595f1da411a2937", "kind": "identity", "frame_number": 8266, "timestamp_epoch": "1647900774.785215000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-78f9831123ae97542842326b", "kind": "identity", "frame_number": 8267, "timestamp_epoch": "1647900774.785473000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a1240fb5b07013df918de0cd", "kind": "identity", "frame_number": 8268, "timestamp_epoch": "1647900774.785574000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cef762c7d195e2fdd0526497", "kind": "identity", "frame_number": 8269, "timestamp_epoch": "1647900774.785890000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fbef5b682347f066fd2ee25f", "kind": "identity", "frame_number": 8270, "timestamp_epoch": "1647900774.786112000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b6397284ea301cd090bd4588", "kind": "identity", "frame_number": 8301, "timestamp_epoch": "1647900839.592637000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f46d4a336d1051a6984ec01c", "kind": "identity", "frame_number": 8303, "timestamp_epoch": "1647900839.594892000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-f5235f8eb63e7632c1999cd0", "kind": "identity", "frame_number": 8304, "timestamp_epoch": "1647900839.595805000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d19927cccc1dd463feb3cb51", "kind": "identity", "frame_number": 8305, "timestamp_epoch": "1647900839.596066000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-edfb3df6a1702cf129702f49", "kind": "identity", "frame_number": 8306, "timestamp_epoch": "1647900839.596555000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b705a3f4b867191a6ffb55ba", "kind": "identity", "frame_number": 8307, "timestamp_epoch": "1647900839.596947000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a27b04750108259e2a82b45e", "kind": "identity", "frame_number": 8312, "timestamp_epoch": "1647900849.923377000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-53c61d30faffdc2838dcac5d", "kind": "identity", "frame_number": 8313, "timestamp_epoch": "1647900849.923581000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b4c2e0c4e244e398b7d35894", "kind": "identity", "frame_number": 8314, "timestamp_epoch": "1647900849.923889000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-37821d8cfe291ae3c42ba55e", "kind": "identity", "frame_number": 8315, "timestamp_epoch": "1647900849.924031000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4be293b525d38628a4a47c47", "kind": "identity", "frame_number": 8358, "timestamp_epoch": "1647900946.625955000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7958edc985a42e1577a980bb", "kind": "identity", "frame_number": 8359, "timestamp_epoch": "1647900946.626294000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1907aca2ae4c5bf650894a36", "kind": "identity", "frame_number": 8360, "timestamp_epoch": "1647900946.626613000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f3bb57d792ef834b039f2634", "kind": "identity", "frame_number": 8361, "timestamp_epoch": "1647900946.626896000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9d6ee77b67049c639b1837c3", "kind": "identity", "frame_number": 8362, "timestamp_epoch": "1647900946.627162000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c0dcb806594a658a55036311", "kind": "identity", "frame_number": 8363, "timestamp_epoch": "1647900946.627479000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-515da2d87dc83c1be9960c06", "kind": "identity", "frame_number": 8364, "timestamp_epoch": "1647900946.627746000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-16077d6f0a46d1b009812128", "kind": "identity", "frame_number": 8365, "timestamp_epoch": "1647900946.627993000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-05a24b54136ffdc746483d33", "kind": "identity", "frame_number": 8368, "timestamp_epoch": "1647900957.353257000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f7a288b4b243ccec24439caf", "kind": "identity", "frame_number": 8369, "timestamp_epoch": "1647900957.353403000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-216d6afa4e4a7660c725bd44", "kind": "identity", "frame_number": 8370, "timestamp_epoch": "1647900957.353650000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d18e0abf6eca6c64133eb563", "kind": "identity", "frame_number": 8371, "timestamp_epoch": "1647900957.353865000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c3e33736ffb39f4911cb6c54", "kind": "identity", "frame_number": 8379, "timestamp_epoch": "1647901003.830612000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a430ecd281fb66ddc20b64e4", "kind": "identity", "frame_number": 8390, "timestamp_epoch": "1647901090.082069000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fe4715fe5e07eea145f11651", "kind": "identity", "frame_number": 8391, "timestamp_epoch": "1647901090.082310000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c91b1f2de1c3add42a321ab3", "kind": "identity", "frame_number": 8532, "timestamp_epoch": "1647901690.448853000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eec7b287d84d9f245de90fdc", "kind": "identity", "frame_number": 8533, "timestamp_epoch": "1647901690.449187000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6ce953d7e3f70bca6ebbfd0c", "kind": "identity", "frame_number": 8566, "timestamp_epoch": "1647901724.905961000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2f24f5a8d5da0e67278d00f1", "kind": "identity", "frame_number": 8599, "timestamp_epoch": "1647901739.551703000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-932e95094913e21eb107f013", "kind": "identity", "frame_number": 8600, "timestamp_epoch": "1647901739.551914000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ccf62de0ab25495fe182af9f", "kind": "identity", "frame_number": 8601, "timestamp_epoch": "1647901739.552473000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-983e62ab1d2bd69c80089d28", "kind": "identity", "frame_number": 8604, "timestamp_epoch": "1647901739.554967000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-3e2a5c9c59a1544ebb3b19d1", "kind": "identity", "frame_number": 8606, "timestamp_epoch": "1647901739.557039000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-5adbfca6456d37f6a13e8344", "kind": "identity", "frame_number": 8607, "timestamp_epoch": "1647901739.557909000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c183104bd59289edd6796d85", "kind": "identity", "frame_number": 8608, "timestamp_epoch": "1647901739.558122000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ed35f1202b05dc787f9fec59", "kind": "identity", "frame_number": 8609, "timestamp_epoch": "1647901739.558501000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0e468fcab0bb4b04241ed600", "kind": "identity", "frame_number": 8610, "timestamp_epoch": "1647901739.558695000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c3e9369e2ee76f8a72f34b02", "kind": "identity", "frame_number": 8611, "timestamp_epoch": "1647901739.558764000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c645170760470f06703a986b", "kind": "identity", "frame_number": 8612, "timestamp_epoch": "1647901739.558995000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ed643861fc4f2181fdabb456", "kind": "identity", "frame_number": 8614, "timestamp_epoch": "1647901750.338345000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-519c8ff6a15e08e6d76e7caf", "kind": "identity", "frame_number": 8615, "timestamp_epoch": "1647901750.338556000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2a4db58c110d12f07a3e185c", "kind": "identity", "frame_number": 8616, "timestamp_epoch": "1647901750.338812000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aea110539812843410fc2b25", "kind": "identity", "frame_number": 8617, "timestamp_epoch": "1647901750.339000000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ed2b4a254f667841f606e238", "kind": "identity", "frame_number": 8781, "timestamp_epoch": "1647902290.758483000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0df72a1723184389d59ef5e6", "kind": "identity", "frame_number": 8782, "timestamp_epoch": "1647902290.758857000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cf4ceb6111aebe24b8c927ba", "kind": "identity", "frame_number": 8825, "timestamp_epoch": "1647902443.984774000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fbc9e4cb2de221876f279276", "kind": "identity", "frame_number": 8933, "timestamp_epoch": "1647902639.513146000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-787cc1dc9883f008265c9fc6", "kind": "identity", "frame_number": 8934, "timestamp_epoch": "1647902639.513401000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9979c1038f280d5ca882a757", "kind": "identity", "frame_number": 8935, "timestamp_epoch": "1647902639.513930000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b704d8db7f2fd7bc1f470c87", "kind": "identity", "frame_number": 8938, "timestamp_epoch": "1647902639.516228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e775277fcf8dc689a7820671", "kind": "identity", "frame_number": 8940, "timestamp_epoch": "1647902639.518270000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-a21715146a53b48459684049", "kind": "identity", "frame_number": 8941, "timestamp_epoch": "1647902639.519103000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-788c36bc02996e20cc9584a0", "kind": "identity", "frame_number": 8942, "timestamp_epoch": "1647902639.519366000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-35429fc09ab7b8cb7643b6f9", "kind": "identity", "frame_number": 8943, "timestamp_epoch": "1647902639.519738000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bba48c47580ec07f7028212c", "kind": "identity", "frame_number": 8944, "timestamp_epoch": "1647902639.519859000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0393b6a34acc24119639e837", "kind": "identity", "frame_number": 8945, "timestamp_epoch": "1647902639.519935000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3d8d93451c742b08382c43a2", "kind": "identity", "frame_number": 8946, "timestamp_epoch": "1647902639.520139000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c92769d78dfee5bd739a1538", "kind": "identity", "frame_number": 8948, "timestamp_epoch": "1647902650.219659000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9af0376d693b074aa3b97b84", "kind": "identity", "frame_number": 8949, "timestamp_epoch": "1647902650.219810000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c486756926843da975757b8d", "kind": "identity", "frame_number": 8950, "timestamp_epoch": "1647902650.220057000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-21146dd02ea12594871b340e", "kind": "identity", "frame_number": 8951, "timestamp_epoch": "1647902650.220186000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3037612b7f36b903b2e244b1", "kind": "identity", "frame_number": 9002, "timestamp_epoch": "1647902891.094711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-78738e94f74ccf4694a1c110", "kind": "identity", "frame_number": 9003, "timestamp_epoch": "1647902891.095008000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d057f5929a673dc747eef803", "kind": "identity", "frame_number": 9067, "timestamp_epoch": "1647903166.432817000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e02682d6b496f4862733e61b", "kind": "identity", "frame_number": 9138, "timestamp_epoch": "1647903491.421449000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f3d9ea99ed62faeaa6f496c5", "kind": "identity", "frame_number": 9139, "timestamp_epoch": "1647903491.421727000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-027e0695503aef266bcd6f8d", "kind": "identity", "frame_number": 9156, "timestamp_epoch": "1647903539.478448000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b122129e85fb73b9e2045f7a", "kind": "identity", "frame_number": 9157, "timestamp_epoch": "1647903539.478693000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a05c6f041662c0700411151a", "kind": "identity", "frame_number": 9158, "timestamp_epoch": "1647903539.479209000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0c36c8d8ffe09cfb51cb3e4c", "kind": "identity", "frame_number": 9161, "timestamp_epoch": "1647903539.481597000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-a39ba3937a60f493e19c5a7a", "kind": "identity", "frame_number": 9163, "timestamp_epoch": "1647903539.483776000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-4db6c579409fe6509548a1da", "kind": "identity", "frame_number": 9164, "timestamp_epoch": "1647903539.484619000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-97d02bc040b33738f13f5c9e", "kind": "identity", "frame_number": 9165, "timestamp_epoch": "1647903539.484880000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ea4573ef959e3f7fb70098dd", "kind": "identity", "frame_number": 9166, "timestamp_epoch": "1647903539.485255000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7fe258581f48aa788efd43de", "kind": "identity", "frame_number": 9167, "timestamp_epoch": "1647903539.485391000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f4d92325e41e7fc9433ace6b", "kind": "identity", "frame_number": 9168, "timestamp_epoch": "1647903539.485465000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-97b2332ff7f71a1c21523a78", "kind": "identity", "frame_number": 9169, "timestamp_epoch": "1647903539.485707000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-65270c1764d79f9c745f9043", "kind": "identity", "frame_number": 9171, "timestamp_epoch": "1647903550.203353000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2ee9e42b7575df8d7927abac", "kind": "identity", "frame_number": 9172, "timestamp_epoch": "1647903550.203595000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-274ff95a36b61d33445c1e52", "kind": "identity", "frame_number": 9173, "timestamp_epoch": "1647903550.203797000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1a2d5cb6d7d1fa5b425711e2", "kind": "identity", "frame_number": 9174, "timestamp_epoch": "1647903550.203936000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 151, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1f21ff1ce7f36f2668b2794b", "kind": "identity", "frame_number": 9289, "timestamp_epoch": "1647903884.645639000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-62edb6344579d3bd00f5eda9", "kind": "identity", "frame_number": 9349, "timestamp_epoch": "1647904091.746046000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-26b4bdc434ca5fd4a4174786", "kind": "identity", "frame_number": 9350, "timestamp_epoch": "1647904091.746394000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6fa741aaa77ddef980a923c5", "kind": "identity", "frame_number": 9433, "timestamp_epoch": "1647904330.055452000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-b990a83db6efe3a255249578", "kind": "identity", "frame_number": 9435, "timestamp_epoch": "1647904330.056750000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e059df2362227ee95c988874", "kind": "identity", "frame_number": 9436, "timestamp_epoch": "1647904330.056972000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-ba8722d6f55b4ebeb080789e", "kind": "identity", "frame_number": 9466, "timestamp_epoch": "1647904330.173540000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-070dafa089f531e3efac8bb1", "kind": "identity", "frame_number": 9468, "timestamp_epoch": "1647904330.174261000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c40e3063315b69cc73dbf8af", "kind": "identity", "frame_number": 9479, "timestamp_epoch": "1647904330.183723000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-08a11709d08c01b42c98d860", "kind": "identity", "frame_number": 9481, "timestamp_epoch": "1647904330.184486000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-67e40d7ec3336ece4fd2673c", "kind": "identity", "frame_number": 9511, "timestamp_epoch": "1647904439.447591000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-179ddc744dd4c6e2ba24e4c9", "kind": "identity", "frame_number": 9512, "timestamp_epoch": "1647904439.447844000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e0cdeeabb740f9bf14fbfca8", "kind": "identity", "frame_number": 9513, "timestamp_epoch": "1647904439.448318000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8afb04e3fc65135e61b02cdf", "kind": "identity", "frame_number": 9516, "timestamp_epoch": "1647904439.450712000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f55569a5fb725da018d0bd88", "kind": "identity", "frame_number": 9518, "timestamp_epoch": "1647904439.452800000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-2b95c7fd8b40a3c87d8278ca", "kind": "identity", "frame_number": 9519, "timestamp_epoch": "1647904439.453629000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bb7c8f703c93abaab641d166", "kind": "identity", "frame_number": 9520, "timestamp_epoch": "1647904439.453883000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-50a7e7313f9545f43c84dc01", "kind": "identity", "frame_number": 9521, "timestamp_epoch": "1647904439.454215000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c7f88a71c03b48b599592769", "kind": "identity", "frame_number": 9522, "timestamp_epoch": "1647904439.454417000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-268ea6eede692529e9d445d4", "kind": "identity", "frame_number": 9523, "timestamp_epoch": "1647904439.454438000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cf607f5d7f5d6df6bbad4ac9", "kind": "identity", "frame_number": 9524, "timestamp_epoch": "1647904439.454770000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5ed685b0dee9ad0d8fda2c42", "kind": "identity", "frame_number": 9528, "timestamp_epoch": "1647904450.194049000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c6e6f355d360e330d27f7223", "kind": "identity", "frame_number": 9529, "timestamp_epoch": "1647904450.194228000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1fb1bc845e35612898771e52", "kind": "identity", "frame_number": 9530, "timestamp_epoch": "1647904450.194489000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c4e1a3c407b9ac2b2ad42d34", "kind": "identity", "frame_number": 9531, "timestamp_epoch": "1647904450.194767000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 162, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4d23f3dc7bbde4a6eb09e1e9", "kind": "identity", "frame_number": 9585, "timestamp_epoch": "1647904588.484590000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-ed4e6de690f2f399a17affd6", "kind": "identity", "frame_number": 9587, "timestamp_epoch": "1647904588.485886000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-baecdeb5c9ca333ba843122e", "kind": "identity", "frame_number": 9588, "timestamp_epoch": "1647904588.486127000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-bd440f4adb82ee0052af2e84", "kind": "identity", "frame_number": 9623, "timestamp_epoch": "1647904588.929938000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-60eec357527f901cd7429878", "kind": "identity", "frame_number": 9625, "timestamp_epoch": "1647904588.931407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-7fc82f5789c9dee277f8c856", "kind": "identity", "frame_number": 9632, "timestamp_epoch": "1647904588.938139000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-aa2289d60bcbb740905ea5ae", "kind": "identity", "frame_number": 9634, "timestamp_epoch": "1647904588.939622000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-2ac0d2ca86949a49daffe6b3", "kind": "identity", "frame_number": 9661, "timestamp_epoch": "1647904606.809815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-813d886c5e44a8b9356fdf46", "kind": "identity", "frame_number": 9680, "timestamp_epoch": "1647904692.057084000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-201f0b4c9841f6a18c8eb701", "kind": "identity", "frame_number": 9681, "timestamp_epoch": "1647904692.057322000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-de22e20488a4a43953e4aebb", "kind": "identity", "frame_number": 9875, "timestamp_epoch": "1647905292.396922000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c3d7e449ab5c7addde2d2ac6", "kind": "identity", "frame_number": 9876, "timestamp_epoch": "1647905292.397224000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8286c74e4a24e3b3db88d7c8", "kind": "identity", "frame_number": 9911, "timestamp_epoch": "1647905325.767418000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-92e8518a0528bc0719f2d65b", "kind": "identity", "frame_number": 9920, "timestamp_epoch": "1647905339.411714000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-154cf45bde09ac13bbd9fdfb", "kind": "identity", "frame_number": 9921, "timestamp_epoch": "1647905339.411975000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-18c8c6b9667a39db762832c7", "kind": "identity", "frame_number": 9922, "timestamp_epoch": "1647905339.412602000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-858a5b9d45faf1f4f7136622", "kind": "identity", "frame_number": 9925, "timestamp_epoch": "1647905339.414931000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-a80299ee11998d38ccb0f63b", "kind": "identity", "frame_number": 9927, "timestamp_epoch": "1647905339.417103000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-0815c1dcd06656a584eb8b00", "kind": "identity", "frame_number": 9928, "timestamp_epoch": "1647905339.417997000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-72ccbb64bafea53a43732a06", "kind": "identity", "frame_number": 9929, "timestamp_epoch": "1647905339.418259000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-67b7f6cdc69cd6b0e90dceb3", "kind": "identity", "frame_number": 9930, "timestamp_epoch": "1647905339.418621000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eca069f319b6d8665fb85d6e", "kind": "identity", "frame_number": 9931, "timestamp_epoch": "1647905339.418762000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6951530bbf3c3409a69ba5fd", "kind": "identity", "frame_number": 9932, "timestamp_epoch": "1647905339.418856000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f70cfb747898b2822f8c706e", "kind": "identity", "frame_number": 9933, "timestamp_epoch": "1647905339.419097000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-bb0894361376793de1c65004", "kind": "identity", "frame_number": 9939, "timestamp_epoch": "1647905350.150308000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4c2c1245f9e41b11dccd1e19", "kind": "identity", "frame_number": 9940, "timestamp_epoch": "1647905350.150510000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b45182e71e9b49c313d51e26", "kind": "identity", "frame_number": 9941, "timestamp_epoch": "1647905350.150812000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-31de9229766702a87f0acebd", "kind": "identity", "frame_number": 9942, "timestamp_epoch": "1647905350.150960000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 175, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5094aa5f90b317bf7afd45cb", "kind": "identity", "frame_number": 10138, "timestamp_epoch": "1647905892.725176000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f420b151db06ddc25f7fec9a", "kind": "identity", "frame_number": 10139, "timestamp_epoch": "1647905892.725476000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-583df49847f83366c599b45f", "kind": "identity", "frame_number": 10184, "timestamp_epoch": "1647906048.049652000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-de18406d4874ea1ce145308c", "kind": "identity", "frame_number": 10244, "timestamp_epoch": "1647906239.374205000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e7f9c6a2f5b0e82683e08305", "kind": "identity", "frame_number": 10245, "timestamp_epoch": "1647906239.374463000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-459cfc12a2b7aa009c4d1c42", "kind": "identity", "frame_number": 10246, "timestamp_epoch": "1647906239.375052000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-aa63434f403c1293ca8b335b", "kind": "identity", "frame_number": 10249, "timestamp_epoch": "1647906239.377446000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-b6f432af6d8f02d37448bfd3", "kind": "identity", "frame_number": 10251, "timestamp_epoch": "1647906239.379502000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c2b9fc39bc60e8814e3ad53f", "kind": "identity", "frame_number": 10252, "timestamp_epoch": "1647906239.380339000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5d9465d516ae53d57d44817e", "kind": "identity", "frame_number": 10253, "timestamp_epoch": "1647906239.380591000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c4ea6bad0f38cff76c5fed8e", "kind": "identity", "frame_number": 10254, "timestamp_epoch": "1647906239.380935000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ab20e76e9d6dabf36ec32475", "kind": "identity", "frame_number": 10255, "timestamp_epoch": "1647906239.381080000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-09a21dc36ef8daf6e3667fcd", "kind": "identity", "frame_number": 10256, "timestamp_epoch": "1647906239.381150000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-467368dbb75511e2bbe37539", "kind": "identity", "frame_number": 10257, "timestamp_epoch": "1647906239.381387000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-49ccd6e9f8156da65cbd22e3", "kind": "identity", "frame_number": 10263, "timestamp_epoch": "1647906250.098318000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fc066555f96a766510379c34", "kind": "identity", "frame_number": 10264, "timestamp_epoch": "1647906250.098529000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f9881da9d797868daba90275", "kind": "identity", "frame_number": 10265, "timestamp_epoch": "1647906250.098830000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e5278401bf7384fb4e41cbbb", "kind": "identity", "frame_number": 10266, "timestamp_epoch": "1647906250.098921000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 182, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6eb16a5460ad240a64128846", "kind": "identity", "frame_number": 10336, "timestamp_epoch": "1647906493.076899000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cf292777a106c24b6282cb4e", "kind": "identity", "frame_number": 10337, "timestamp_epoch": "1647906493.077153000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fe554ffee799d75ab12e4bd8", "kind": "identity", "frame_number": 10401, "timestamp_epoch": "1647906765.381604000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-94297fef747d7273936c04bc", "kind": "identity", "frame_number": 10455, "timestamp_epoch": "1647906954.853896000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-7cd79968d87efb4fb4786e15", "kind": "identity", "frame_number": 10457, "timestamp_epoch": "1647906954.855187000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e756bcc01b6c0adc0a1bfa43", "kind": "identity", "frame_number": 10458, "timestamp_epoch": "1647906954.855640000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-bf5297e801a689ff812497f1", "kind": "identity", "frame_number": 10478, "timestamp_epoch": "1647906955.062253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-6884e6465a935aaaf67b83aa", "kind": "identity", "frame_number": 10480, "timestamp_epoch": "1647906955.063721000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-431e82db502523c805eaf368", "kind": "identity", "frame_number": 10491, "timestamp_epoch": "1647906955.179897000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e78d443f63169fc5463453a0", "kind": "identity", "frame_number": 10493, "timestamp_epoch": "1647906955.181313000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-6580dcf477ba7bc366031152", "kind": "identity", "frame_number": 10508, "timestamp_epoch": "1647906955.501004000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e05ec80310e4105c1afb3ba4", "kind": "identity", "frame_number": 10509, "timestamp_epoch": "1647906955.501261000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-441b86267cbead355b254f98", "kind": "identity", "frame_number": 10510, "timestamp_epoch": "1647906955.501708000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5591d2956f9f0ae64eb792ef", "kind": "identity", "frame_number": 10513, "timestamp_epoch": "1647906955.504036000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-bb69670a6461678dddcb8d93", "kind": "identity", "frame_number": 10515, "timestamp_epoch": "1647906955.506022000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-6b5c5cb688de8241e45440c9", "kind": "identity", "frame_number": 10516, "timestamp_epoch": "1647906955.506849000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-55569fdc8c22eb1c349b23ad", "kind": "identity", "frame_number": 10517, "timestamp_epoch": "1647906955.507296000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1be16773f05508350482780e", "kind": "identity", "frame_number": 10518, "timestamp_epoch": "1647906955.507721000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3843d8724a65e697a671b286", "kind": "identity", "frame_number": 10519, "timestamp_epoch": "1647906955.507871000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9f70c5c53fa35d8f38792183", "kind": "identity", "frame_number": 10520, "timestamp_epoch": "1647906955.508008000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-abeeaad28c4a68de6d3cd50c", "kind": "identity", "frame_number": 10521, "timestamp_epoch": "1647906955.508632000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d400346cab7dee3a8652a29c", "kind": "identity", "frame_number": 10523, "timestamp_epoch": "1647906955.509001000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-332035da9dd70e03013eaec5", "kind": "identity", "frame_number": 10524, "timestamp_epoch": "1647906955.509196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-574393e72e30a11ac8eabc40", "kind": "identity", "frame_number": 10525, "timestamp_epoch": "1647906955.509551000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-074431b6f2455af824366b98", "kind": "identity", "frame_number": 10526, "timestamp_epoch": "1647906955.509741000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-68ced75ffdccd57918e06964", "kind": "identity", "frame_number": 10527, "timestamp_epoch": "1647906955.510085000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6b7f4e63664b6d172a808639", "kind": "identity", "frame_number": 10528, "timestamp_epoch": "1647906955.510404000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b228fb9b1b7737e52cbc2684", "kind": "identity", "frame_number": 10529, "timestamp_epoch": "1647906955.514071000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-272b234b5dc6bea8d2d6e02c", "kind": "identity", "frame_number": 10530, "timestamp_epoch": "1647906955.514662000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cde940024b49430f4e76ee42", "kind": "identity", "frame_number": 10531, "timestamp_epoch": "1647906955.515003000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9a1dae654235aadc6a58bec6", "kind": "identity", "frame_number": 10532, "timestamp_epoch": "1647906955.515172000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-95d869f170f531a3127110b0", "kind": "identity", "frame_number": 10533, "timestamp_epoch": "1647906955.515504000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3554e7c30d99cf34c6d56c43", "kind": "identity", "frame_number": 10534, "timestamp_epoch": "1647906955.515977000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-21ff650cc877b00072a23a89", "kind": "identity", "frame_number": 10535, "timestamp_epoch": "1647906955.517177000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-31550b5d25cc4921b541ac9a", "kind": "identity", "frame_number": 10536, "timestamp_epoch": "1647906955.517783000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cdf7aa36d621add9f445a9ef", "kind": "identity", "frame_number": 10537, "timestamp_epoch": "1647906955.518194000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4b4c36250f23bf2bee4f9311", "kind": "identity", "frame_number": 10538, "timestamp_epoch": "1647906955.518318000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d91b30b3561b4dc47309dae6", "kind": "identity", "frame_number": 10539, "timestamp_epoch": "1647906955.518680000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-774ae1dfd9a9b6bdfef72481", "kind": "identity", "frame_number": 10540, "timestamp_epoch": "1647906955.519031000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ebed2b41d97b03a940b5c16c", "kind": "identity", "frame_number": 10541, "timestamp_epoch": "1647906955.520379000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-721076e12c07339197776c72", "kind": "identity", "frame_number": 10542, "timestamp_epoch": "1647906955.520985000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f29b59750d5506fdc1a1276c", "kind": "identity", "frame_number": 10543, "timestamp_epoch": "1647906955.521377000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b01bb3633fa78bd7d15a986c", "kind": "identity", "frame_number": 10544, "timestamp_epoch": "1647906955.521520000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5945b2f88b9771e37de6cc7a", "kind": "identity", "frame_number": 10545, "timestamp_epoch": "1647906955.521960000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-15e630205791c89dbf4117b6", "kind": "identity", "frame_number": 10546, "timestamp_epoch": "1647906955.522251000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-57d47c4050a7de2b2ecb3dc2", "kind": "identity", "frame_number": 10547, "timestamp_epoch": "1647906955.523622000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-79eea1e8d72d95e2c644de7e", "kind": "identity", "frame_number": 10548, "timestamp_epoch": "1647906955.524224000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-929330dba11697e8f6987623", "kind": "identity", "frame_number": 10549, "timestamp_epoch": "1647906955.524624000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b9e181cd72ebc08622c9dbe2", "kind": "identity", "frame_number": 10550, "timestamp_epoch": "1647906955.524766000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-733fe747e3406ebad6990aa4", "kind": "identity", "frame_number": 10551, "timestamp_epoch": "1647906955.525170000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5d41e8fc5c6ad2e28201ae97", "kind": "identity", "frame_number": 10552, "timestamp_epoch": "1647906955.525496000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b3eba7b0d9ce92248f91f41e", "kind": "identity", "frame_number": 10553, "timestamp_epoch": "1647906955.526209000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-49b82477e0c602726f8f9e61", "kind": "identity", "frame_number": 10554, "timestamp_epoch": "1647906955.526826000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e5debf41a40f8a59ce838a01", "kind": "identity", "frame_number": 10555, "timestamp_epoch": "1647906955.527187000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5e9865adaa66dbb2615ad647", "kind": "identity", "frame_number": 10556, "timestamp_epoch": "1647906955.527481000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-36327a94676618f15aeb99a2", "kind": "identity", "frame_number": 10557, "timestamp_epoch": "1647906955.527875000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-99f14ff3662dd90217f8c6aa", "kind": "identity", "frame_number": 10558, "timestamp_epoch": "1647906955.527981000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-272cb11a9be09c0746e5bdc9", "kind": "identity", "frame_number": 10559, "timestamp_epoch": "1647906955.528355000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a8c591f69284c7b56df0849f", "kind": "identity", "frame_number": 10560, "timestamp_epoch": "1647906955.528452000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-742b88508a7bf1449cd6e66f", "kind": "identity", "frame_number": 10561, "timestamp_epoch": "1647906955.528919000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ca711098f82da98051440101", "kind": "identity", "frame_number": 10562, "timestamp_epoch": "1647906955.529237000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-634d5438d5c9aa430bb83927", "kind": "identity", "frame_number": 10563, "timestamp_epoch": "1647906955.529599000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-59ff62e409e5ede4e68f2611", "kind": "identity", "frame_number": 10564, "timestamp_epoch": "1647906955.529775000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-93400dbaff50bb0134ee0d28", "kind": "identity", "frame_number": 10565, "timestamp_epoch": "1647906955.530117000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bd8f1d92a8f4213b162a3301", "kind": "identity", "frame_number": 10566, "timestamp_epoch": "1647906955.530276000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c26a02d8b68d706a4e9887a1", "kind": "identity", "frame_number": 10567, "timestamp_epoch": "1647906955.530645000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c932e1945bc3f2947f2092e3", "kind": "identity", "frame_number": 10568, "timestamp_epoch": "1647906955.530762000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a297ebc590de76041d0936fd", "kind": "identity", "frame_number": 10569, "timestamp_epoch": "1647906955.531101000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9be46a4f9b98e3f2afe7cb3e", "kind": "identity", "frame_number": 10570, "timestamp_epoch": "1647906955.531187000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3addbe7b8cd21cf0c510fdf5", "kind": "identity", "frame_number": 10571, "timestamp_epoch": "1647906955.531520000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1e6849f5a600f4991140ad69", "kind": "identity", "frame_number": 10572, "timestamp_epoch": "1647906955.531669000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-062ce2a677ab22fe550cd1a6", "kind": "identity", "frame_number": 10573, "timestamp_epoch": "1647906955.533023000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-96e7a6b6b6a4f1f27fe7212a", "kind": "identity", "frame_number": 10574, "timestamp_epoch": "1647906955.533294000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d74154e422c1be0d5699ca9d", "kind": "identity", "frame_number": 10575, "timestamp_epoch": "1647906955.534625000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eb3072463d8598ca55c88f43", "kind": "identity", "frame_number": 10576, "timestamp_epoch": "1647906955.534899000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-349fce5a5aa1df155ccc0a75", "kind": "identity", "frame_number": 10577, "timestamp_epoch": "1647906955.535515000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c23f2a5a808166e6300b530a", "kind": "identity", "frame_number": 10578, "timestamp_epoch": "1647906955.536040000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7fe911c96d56e9f887244e6b", "kind": "identity", "frame_number": 10579, "timestamp_epoch": "1647906955.536799000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-06a7fb2793ba6489e31ffa09", "kind": "identity", "frame_number": 10580, "timestamp_epoch": "1647906955.537092000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5b5634f563ec533fc444a801", "kind": "identity", "frame_number": 10581, "timestamp_epoch": "1647906955.537866000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-886c93ac0eb9ee5b5e95f789", "kind": "identity", "frame_number": 10582, "timestamp_epoch": "1647906955.538481000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0602ea1e4f081c940827e97f", "kind": "identity", "frame_number": 10583, "timestamp_epoch": "1647906955.538827000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-999acf29f620ec2fb1fb77ce", "kind": "identity", "frame_number": 10584, "timestamp_epoch": "1647906955.539071000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ab13986b7aab4c00c8c40e3e", "kind": "identity", "frame_number": 10585, "timestamp_epoch": "1647906955.539373000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-109b0bc7c903e849d8aa55b2", "kind": "identity", "frame_number": 10586, "timestamp_epoch": "1647906955.539526000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7f86714395dcef709217fd28", "kind": "identity", "frame_number": 10587, "timestamp_epoch": "1647906955.539845000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f9d43a7139823aab9aac31b5", "kind": "identity", "frame_number": 10588, "timestamp_epoch": "1647906955.540044000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1ba3b5189389bf78d16fdad6", "kind": "identity", "frame_number": 10589, "timestamp_epoch": "1647906955.540368000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5c7048deb10c41fcfef5cf2f", "kind": "identity", "frame_number": 10590, "timestamp_epoch": "1647906955.540728000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cd3fe19fa695653aca4da08c", "kind": "identity", "frame_number": 10591, "timestamp_epoch": "1647906955.541005000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-203c8a61a3c92f5753a01f48", "kind": "identity", "frame_number": 10592, "timestamp_epoch": "1647906955.541196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-686b12c035baee3911006ff6", "kind": "identity", "frame_number": 10593, "timestamp_epoch": "1647906955.541430000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7efc3546b5259a223331e73e", "kind": "identity", "frame_number": 10594, "timestamp_epoch": "1647906955.541580000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-76f709aefdfa9edc89d7b301", "kind": "identity", "frame_number": 10595, "timestamp_epoch": "1647906955.541835000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-60048d080491f4ec6dd86c1a", "kind": "identity", "frame_number": 10596, "timestamp_epoch": "1647906955.542026000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-084198d16ff775d50e79ff6f", "kind": "identity", "frame_number": 10597, "timestamp_epoch": "1647906955.542229000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4d044004bb90ed13617e3c80", "kind": "identity", "frame_number": 10598, "timestamp_epoch": "1647906955.542411000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-355e7ce9ad0de3ea9341921d", "kind": "identity", "frame_number": 10599, "timestamp_epoch": "1647906955.542625000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f486f91dafc35b1da1274c0f", "kind": "identity", "frame_number": 10600, "timestamp_epoch": "1647906955.542809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a80c25f67be377c2f3163895", "kind": "identity", "frame_number": 10601, "timestamp_epoch": "1647906955.543623000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8084798a6ebd0fedb2e1f848", "kind": "identity", "frame_number": 10602, "timestamp_epoch": "1647906955.543686000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9098ae84b37fac8a7068f1ef", "kind": "identity", "frame_number": 10603, "timestamp_epoch": "1647906955.544226000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d89a410623994600f086a002", "kind": "identity", "frame_number": 10605, "timestamp_epoch": "1647906955.544939000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3f5ef2d85ea4514272396515", "kind": "identity", "frame_number": 10607, "timestamp_epoch": "1647906955.545636000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-59dc0b800f7def340f2dff8b", "kind": "identity", "frame_number": 10608, "timestamp_epoch": "1647906955.545813000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-aaafb223041f9edf40b139c8", "kind": "identity", "frame_number": 10609, "timestamp_epoch": "1647906955.546413000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a8433c8fdd8f15cd2d00943e", "kind": "identity", "frame_number": 10610, "timestamp_epoch": "1647906955.546754000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-523931ed321e2c1fa3d2ff90", "kind": "identity", "frame_number": 10611, "timestamp_epoch": "1647906955.547075000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b2024a37bf4f9af084e1e819", "kind": "identity", "frame_number": 10612, "timestamp_epoch": "1647906955.547232000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d3540e8a7138f69925ecf5ec", "kind": "identity", "frame_number": 10613, "timestamp_epoch": "1647906955.547461000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-37d5b28a673562165639c68c", "kind": "identity", "frame_number": 10614, "timestamp_epoch": "1647906955.547607000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-63c635cbbf2f2af86d66fe16", "kind": "identity", "frame_number": 10615, "timestamp_epoch": "1647906955.547838000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2937c0b6997fbc49923b31cb", "kind": "identity", "frame_number": 10616, "timestamp_epoch": "1647906955.547980000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3fdb43694432dddfd06c948b", "kind": "identity", "frame_number": 10617, "timestamp_epoch": "1647906955.548242000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5f5e340a014e68a60be112fd", "kind": "identity", "frame_number": 10618, "timestamp_epoch": "1647906955.548364000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4e1fa2e06ce0b8c6ffcc7523", "kind": "identity", "frame_number": 10619, "timestamp_epoch": "1647906955.548778000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0b0179d8571fe87fc00c15b0", "kind": "identity", "frame_number": 10620, "timestamp_epoch": "1647906955.549022000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1f2e650be02d7ad2ebd22a35", "kind": "identity", "frame_number": 10621, "timestamp_epoch": "1647906955.549303000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-720f882fb1e73ff0c0c03378", "kind": "identity", "frame_number": 10622, "timestamp_epoch": "1647906955.549656000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c2bbc8399d5ee555d973dc34", "kind": "identity", "frame_number": 10623, "timestamp_epoch": "1647906955.549769000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3c3a528228c9761d3b884c7e", "kind": "identity", "frame_number": 10624, "timestamp_epoch": "1647906955.549915000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6bfd4a5e33a517bd86afbfd8", "kind": "identity", "frame_number": 10625, "timestamp_epoch": "1647906955.549972000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-96f49bd6cfc0354209e4e46d", "kind": "identity", "frame_number": 10626, "timestamp_epoch": "1647906955.550070000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-20f085dcd661295f70cb475c", "kind": "identity", "frame_number": 10627, "timestamp_epoch": "1647906955.550176000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-80d5861dd04e77ed00815bce", "kind": "identity", "frame_number": 10628, "timestamp_epoch": "1647906955.550267000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6a3c241f87568445b955094f", "kind": "identity", "frame_number": 10629, "timestamp_epoch": "1647906955.550374000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9b1e885df02f4dc6e0fb49c3", "kind": "identity", "frame_number": 10630, "timestamp_epoch": "1647906955.550459000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-538d99726a2b24c527a8d01f", "kind": "identity", "frame_number": 10631, "timestamp_epoch": "1647906955.550665000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-03ed81c82dadabeda72d5ae9", "kind": "identity", "frame_number": 10632, "timestamp_epoch": "1647906955.550761000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cea6483eabe814a56f589800", "kind": "identity", "frame_number": 10633, "timestamp_epoch": "1647906955.550953000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3dd7fecc7d0c306ee4901f9c", "kind": "identity", "frame_number": 10634, "timestamp_epoch": "1647906955.551078000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2e09a789b3480b6b90289b99", "kind": "identity", "frame_number": 10635, "timestamp_epoch": "1647906955.551488000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c5bf11acd6098df5760df10e", "kind": "identity", "frame_number": 10636, "timestamp_epoch": "1647906955.551827000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-976e0dec661b11ebd3e3e9e5", "kind": "identity", "frame_number": 10694, "timestamp_epoch": "1647907093.412924000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0f6e0e88d9a4b72d1c370a67", "kind": "identity", "frame_number": 10695, "timestamp_epoch": "1647907093.412963000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-14e4f8dc4ffbfc20b0e14ec7", "kind": "identity", "frame_number": 10696, "timestamp_epoch": "1647907093.413169000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-eeb40dd0cb22efe5cb0e38ef", "kind": "identity", "frame_number": 10697, "timestamp_epoch": "1647907093.413286000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7107c4171803bdbe12659521", "kind": "identity", "frame_number": 10706, "timestamp_epoch": "1647907127.358716000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e2bb1173f18fc76f1e9efbad", "kind": "identity", "frame_number": 10707, "timestamp_epoch": "1647907127.359012000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5009a4d1b2eeab1facc577ed", "kind": "identity", "frame_number": 10708, "timestamp_epoch": "1647907127.359379000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d4d040c0ef50bf877a436775", "kind": "identity", "frame_number": 10709, "timestamp_epoch": "1647907127.359568000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d3b5e206899e50103a3c118e", "kind": "identity", "frame_number": 10710, "timestamp_epoch": "1647907127.359926000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3b4f82f448091ddbf77db148", "kind": "identity", "frame_number": 10711, "timestamp_epoch": "1647907127.360082000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d2c805198a2050cbdf4e50b7", "kind": "identity", "frame_number": 10712, "timestamp_epoch": "1647907127.360397000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-35592c0a14b880fd6693799a", "kind": "identity", "frame_number": 10713, "timestamp_epoch": "1647907127.360606000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b7649e5015030557496e8355", "kind": "identity", "frame_number": 10716, "timestamp_epoch": "1647907138.070238000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ecdf4375ee083d365d4f4753", "kind": "identity", "frame_number": 10717, "timestamp_epoch": "1647907138.070532000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-18249e131f0c516b8dc2cc87", "kind": "identity", "frame_number": 10718, "timestamp_epoch": "1647907138.070740000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-512d58cdb84cf28bec9764bf", "kind": "identity", "frame_number": 10719, "timestamp_epoch": "1647907138.070936000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 191, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f87f8d76b9fbee59f21f2749", "kind": "identity", "frame_number": 10725, "timestamp_epoch": "1647907139.344196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-96c85e33a2392c0ce4c6d9e6", "kind": "identity", "frame_number": 10726, "timestamp_epoch": "1647907139.344406000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6dac9708089ae2b1c4094362", "kind": "identity", "frame_number": 10727, "timestamp_epoch": "1647907139.344925000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e2fb70bb69cc0e281b0449e4", "kind": "identity", "frame_number": 10730, "timestamp_epoch": "1647907139.347259000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-1c7f9cd7061fec6a550d8495", "kind": "identity", "frame_number": 10732, "timestamp_epoch": "1647907139.349265000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-eeeaae43048df151933e2a0c", "kind": "identity", "frame_number": 10733, "timestamp_epoch": "1647907139.350094000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8dfe63cc03250faa71c9346a", "kind": "identity", "frame_number": 10734, "timestamp_epoch": "1647907139.350301000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4e91be3f110a4834a32db0ba", "kind": "identity", "frame_number": 10735, "timestamp_epoch": "1647907139.350685000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-680182c058855e3ed8cad98e", "kind": "identity", "frame_number": 10736, "timestamp_epoch": "1647907139.350811000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2735de39d36a757a9ee71eac", "kind": "identity", "frame_number": 10737, "timestamp_epoch": "1647907139.350926000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e86cc4bc4db5e37596da50ef", "kind": "identity", "frame_number": 10738, "timestamp_epoch": "1647907139.351186000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-db34964aaa14a111a0d77ceb", "kind": "identity", "frame_number": 10744, "timestamp_epoch": "1647907150.049116000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3b7ffdeb726a1df0ee11113f", "kind": "identity", "frame_number": 10745, "timestamp_epoch": "1647907150.049270000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b045d7a77f1bf451e5f839c9", "kind": "identity", "frame_number": 10746, "timestamp_epoch": "1647907150.049577000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8212e0ce290fc7bd77b27a8c", "kind": "identity", "frame_number": 10747, "timestamp_epoch": "1647907150.049657000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 192, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-10743ac99619416c3147a783", "kind": "identity", "frame_number": 10846, "timestamp_epoch": "1647907484.936771000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b5efa4a08239c6adfe754958", "kind": "identity", "frame_number": 10894, "timestamp_epoch": "1647907693.763821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-40815b80a4c2302280b24055", "kind": "identity", "frame_number": 10895, "timestamp_epoch": "1647907693.764074000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1800f2014bf602cad6edf727", "kind": "identity", "frame_number": 10964, "timestamp_epoch": "1647907930.107326000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-7a781c93d71a7d12db39ddb9", "kind": "identity", "frame_number": 10966, "timestamp_epoch": "1647907930.108499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e4534a7d4d5b2e19ab8220c6", "kind": "identity", "frame_number": 10967, "timestamp_epoch": "1647907930.108693000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-4c181a4d3dba83d202cea4c4", "kind": "identity", "frame_number": 10991, "timestamp_epoch": "1647907930.116627000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e285d594ecfca6a6c541232a", "kind": "identity", "frame_number": 10993, "timestamp_epoch": "1647907930.117506000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-866ea197990fe20f2997068e", "kind": "identity", "frame_number": 11004, "timestamp_epoch": "1647907930.120660000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-14b22972eda720759e7300cf", "kind": "identity", "frame_number": 11006, "timestamp_epoch": "1647907930.121390000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-cf556063d5af24005c604540", "kind": "identity", "frame_number": 11042, "timestamp_epoch": "1647908039.312432000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e85d857929396f3d80667828", "kind": "identity", "frame_number": 11043, "timestamp_epoch": "1647908039.312655000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a30157182ad3f761f5465f82", "kind": "identity", "frame_number": 11044, "timestamp_epoch": "1647908039.313215000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cc4719b17bd9e5111ec661b6", "kind": "identity", "frame_number": 11047, "timestamp_epoch": "1647908039.315569000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-c554ddc183bae413698dd877", "kind": "identity", "frame_number": 11049, "timestamp_epoch": "1647908039.317593000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-417ce7f9b3bd3f68e2fd1f46", "kind": "identity", "frame_number": 11050, "timestamp_epoch": "1647908039.318434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6c74506d8af28f821313847d", "kind": "identity", "frame_number": 11051, "timestamp_epoch": "1647908039.318693000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-48432ffcacdfb60ca1b26bdb", "kind": "identity", "frame_number": 11052, "timestamp_epoch": "1647908039.318967000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0a382bfdea9899056c284fa1", "kind": "identity", "frame_number": 11053, "timestamp_epoch": "1647908039.319187000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d482186e8c48e176f56ce66a", "kind": "identity", "frame_number": 11054, "timestamp_epoch": "1647908039.319234000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9502dfc13ac0685f9de45892", "kind": "identity", "frame_number": 11055, "timestamp_epoch": "1647908039.319531000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-887a9f36425080d8069b6a8c", "kind": "identity", "frame_number": 11057, "timestamp_epoch": "1647908050.012782000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b8526fe31bd16ba43d75f745", "kind": "identity", "frame_number": 11058, "timestamp_epoch": "1647908050.012941000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6b9afeff9be06dcf7e456001", "kind": "identity", "frame_number": 11059, "timestamp_epoch": "1647908050.013241000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ccddb54bd3ece6465318ffcb", "kind": "identity", "frame_number": 11060, "timestamp_epoch": "1647908050.013377000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 201, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0c051b64d9549394b325e820", "kind": "identity", "frame_number": 11105, "timestamp_epoch": "1647908207.440648000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-db52ddae7077550656132ed2", "kind": "identity", "frame_number": 11114, "timestamp_epoch": "1647908294.078755000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9117d05adb1ac26350776d5c", "kind": "identity", "frame_number": 11115, "timestamp_epoch": "1647908294.079107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e76b0925f8c35c15db83d30e", "kind": "identity", "frame_number": 11467, "timestamp_epoch": "1647908840.694361000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-b6fc5c4bae4fe0837b48de9e", "kind": "identity", "frame_number": 11469, "timestamp_epoch": "1647908840.695531000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-3276e8f26cda859e04ec1e7b", "kind": "identity", "frame_number": 11470, "timestamp_epoch": "1647908840.695707000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-ab52b480164c1280776516e5", "kind": "identity", "frame_number": 11489, "timestamp_epoch": "1647908840.698709000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-56871af6d705ecfbd73047a3", "kind": "identity", "frame_number": 11493, "timestamp_epoch": "1647908840.699772000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-36e2fb5211836c2eb384c84c", "kind": "identity", "frame_number": 11494, "timestamp_epoch": "1647908840.699962000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-c4e03a04097f471f1a78740b", "kind": "identity", "frame_number": 11542, "timestamp_epoch": "1647908840.812578000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-8aea6a317453759bd13dbe97", "kind": "identity", "frame_number": 11544, "timestamp_epoch": "1647908840.813200000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-03d01638e82a0b525495bee0", "kind": "identity", "frame_number": 11555, "timestamp_epoch": "1647908840.817696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-93b184882ca19ac79744be99", "kind": "identity", "frame_number": 11557, "timestamp_epoch": "1647908840.818465000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-76b41b7efddd62d4e7bfcb10", "kind": "identity", "frame_number": 11663, "timestamp_epoch": "1647908894.395490000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e594752bd894fbc0d100a96e", "kind": "identity", "frame_number": 11664, "timestamp_epoch": "1647908894.395783000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f20306e5150199d403cee9ec", "kind": "identity", "frame_number": 11707, "timestamp_epoch": "1647908926.108834000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f11aafb03c57cdb3b0794c3f", "kind": "identity", "frame_number": 11715, "timestamp_epoch": "1647908939.275021000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-44bdc9858011ae5386db67f3", "kind": "identity", "frame_number": 11716, "timestamp_epoch": "1647908939.275279000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-67dea427c293869ac495923a", "kind": "identity", "frame_number": 11717, "timestamp_epoch": "1647908939.275749000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-38ad756812febed454a65232", "kind": "identity", "frame_number": 11720, "timestamp_epoch": "1647908939.278166000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-688ba1892c92feac804120e9", "kind": "identity", "frame_number": 11722, "timestamp_epoch": "1647908939.280170000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-57ae56b06a35d800117dc6ca", "kind": "identity", "frame_number": 11723, "timestamp_epoch": "1647908939.280999000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1557907f959eef095294d798", "kind": "identity", "frame_number": 11724, "timestamp_epoch": "1647908939.281211000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4578c46d3dd8e33a5b8971b3", "kind": "identity", "frame_number": 11725, "timestamp_epoch": "1647908939.281604000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0dbf1411c2746c01a78bcb3d", "kind": "identity", "frame_number": 11726, "timestamp_epoch": "1647908939.281748000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5f9057fd857e9cf91f0640cf", "kind": "identity", "frame_number": 11727, "timestamp_epoch": "1647908939.281881000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-93662be1a9654f19884c6e69", "kind": "identity", "frame_number": 11728, "timestamp_epoch": "1647908939.282126000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2cc1ffddfcd98cb1940f35e7", "kind": "identity", "frame_number": 11745, "timestamp_epoch": "1647908949.983287000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4ac550745aed4500a64394e5", "kind": "identity", "frame_number": 11746, "timestamp_epoch": "1647908949.983443000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-03c873b8162173b8c85ccde2", "kind": "identity", "frame_number": 11747, "timestamp_epoch": "1647908949.983697000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c6a856b6eb8e2bdbe3d9f27f", "kind": "identity", "frame_number": 11748, "timestamp_epoch": "1647908949.983939000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 233, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b156909c05a6fd0d13cd385f", "kind": "identity", "frame_number": 11957, "timestamp_epoch": "1647909494.749413000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-970a88e49576f6f6c1c4b6d2", "kind": "identity", "frame_number": 11958, "timestamp_epoch": "1647909494.749749000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ec76b96f10b950ede397c9ac", "kind": "identity", "frame_number": 12035, "timestamp_epoch": "1647909644.815873000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-16dd750356568fb1ee2ec316", "kind": "identity", "frame_number": 12074, "timestamp_epoch": "1647909839.243857000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-536028e9444856ccec27a489", "kind": "identity", "frame_number": 12075, "timestamp_epoch": "1647909839.244111000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1edc8cadb272df7b7ad3262b", "kind": "identity", "frame_number": 12076, "timestamp_epoch": "1647909839.244697000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-593113a4bb846a1abf01046e", "kind": "identity", "frame_number": 12079, "timestamp_epoch": "1647909839.247030000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f19dc9a5c161566bf5333084", "kind": "identity", "frame_number": 12081, "timestamp_epoch": "1647909839.249058000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-8f1f92ae95cd68e431ccfeed", "kind": "identity", "frame_number": 12082, "timestamp_epoch": "1647909839.249882000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-30c4805a410313e7f2aa604d", "kind": "identity", "frame_number": 12083, "timestamp_epoch": "1647909839.250190000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-700eaa2fcccf66bf8323ff51", "kind": "identity", "frame_number": 12084, "timestamp_epoch": "1647909839.250493000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b6b69d938044fb0a8d58d2f3", "kind": "identity", "frame_number": 12085, "timestamp_epoch": "1647909839.250694000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-55944482431008b43feb1671", "kind": "identity", "frame_number": 12086, "timestamp_epoch": "1647909839.250694000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5efee2fc81642940e371d03e", "kind": "identity", "frame_number": 12087, "timestamp_epoch": "1647909839.251015000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a9ac092e78d299f2be96e42b", "kind": "identity", "frame_number": 12089, "timestamp_epoch": "1647909849.980876000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1f62711d480b26b33cfb0860", "kind": "identity", "frame_number": 12090, "timestamp_epoch": "1647909849.981030000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-261b20c36c45208500ed3cbf", "kind": "identity", "frame_number": 12091, "timestamp_epoch": "1647909849.981279000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8e473acbdeb35aa86796f82f", "kind": "identity", "frame_number": 12092, "timestamp_epoch": "1647909849.981407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 253, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-feed781a06c83917cda5bac5", "kind": "identity", "frame_number": 12149, "timestamp_epoch": "1647910095.085107000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6d16e32a19c0a3305a30d911", "kind": "identity", "frame_number": 12150, "timestamp_epoch": "1647910095.085417000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b0104dcc16495625a7f92f73", "kind": "identity", "frame_number": 12215, "timestamp_epoch": "1647910170.409573000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-7915fd78514b6ddcf50ccdca", "kind": "identity", "frame_number": 12217, "timestamp_epoch": "1647910170.410964000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-8893951ced79f884d31a84ab", "kind": "identity", "frame_number": 12218, "timestamp_epoch": "1647910170.411406000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-a0fcfda8cd2b5a4b126fa2e0", "kind": "identity", "frame_number": 12238, "timestamp_epoch": "1647910170.635226000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-42c32c8a2f7221580371539f", "kind": "identity", "frame_number": 12240, "timestamp_epoch": "1647910170.636624000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-652441744744929cc2e6af80", "kind": "identity", "frame_number": 12247, "timestamp_epoch": "1647910170.655880000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f347f9b157b7c504d4a4030a", "kind": "identity", "frame_number": 12249, "timestamp_epoch": "1647910170.657336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-abf964db24cc6de265725a6f", "kind": "identity", "frame_number": 12338, "timestamp_epoch": "1647910366.157821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-362eb52695ea610280e246f2", "kind": "identity", "frame_number": 12418, "timestamp_epoch": "1647910695.399763000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b9aa1ea15b67411400601298", "kind": "identity", "frame_number": 12419, "timestamp_epoch": "1647910695.400054000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8d9092ab87509097325f8016", "kind": "identity", "frame_number": 12464, "timestamp_epoch": "1647910739.210446000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-22ff559c71ebb770550397e8", "kind": "identity", "frame_number": 12465, "timestamp_epoch": "1647910739.210654000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-83453c5ba300f953476cfee5", "kind": "identity", "frame_number": 12466, "timestamp_epoch": "1647910739.211220000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f47e04997a764f51115da573", "kind": "identity", "frame_number": 12469, "timestamp_epoch": "1647910739.213535000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-0f2de50267359f610bed299e", "kind": "identity", "frame_number": 12471, "timestamp_epoch": "1647910739.215672000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-f5c83e6126e1cc87fe14a4f5", "kind": "identity", "frame_number": 12472, "timestamp_epoch": "1647910739.216496000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-41e30b632f5f70c6f9738673", "kind": "identity", "frame_number": 12473, "timestamp_epoch": "1647910739.216705000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-27473716e8c2ee90b7522bf5", "kind": "identity", "frame_number": 12474, "timestamp_epoch": "1647910739.217080000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e324e0069237fac68125c75a", "kind": "identity", "frame_number": 12475, "timestamp_epoch": "1647910739.217204000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bd960eb99396b3b79eb7c2cb", "kind": "identity", "frame_number": 12476, "timestamp_epoch": "1647910739.217279000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-494a4ce10f50eb13009c71c5", "kind": "identity", "frame_number": 12477, "timestamp_epoch": "1647910739.217568000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-30f76259634bc076518a9ab2", "kind": "identity", "frame_number": 12480, "timestamp_epoch": "1647910749.929312000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-16ac7e32c013cffa0ac2f742", "kind": "identity", "frame_number": 12481, "timestamp_epoch": "1647910749.929558000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-768f1e1a6a9ca9846be2ec12", "kind": "identity", "frame_number": 12482, "timestamp_epoch": "1647910749.929765000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f2c98879177687fdabbc8a12", "kind": "identity", "frame_number": 12483, "timestamp_epoch": "1647910749.929948000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 273, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-506b167dfcba832d3b72892d", "kind": "identity", "frame_number": 12600, "timestamp_epoch": "1647911020.565463000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-2b5add8d862143a738acbe7a", "kind": "identity", "frame_number": 12602, "timestamp_epoch": "1647911020.566898000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-2ae58d804ff49ab8fc9c7023", "kind": "identity", "frame_number": 12621, "timestamp_epoch": "1647911020.694171000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e4e9a870b58370234806d7b4", "kind": "identity", "frame_number": 12623, "timestamp_epoch": "1647911020.694963000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-b33dc59ebb43d591a53f9eaa", "kind": "identity", "frame_number": 12633, "timestamp_epoch": "1647911020.809733000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 282, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "10" } }, { "event_id": "evt-ef22b4698e085337c90cbec1", "kind": "identity", "frame_number": 12634, "timestamp_epoch": "1647911020.810660000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 282, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-3aa8376978a71983a3dde9e1", "kind": "identity", "frame_number": 12641, "timestamp_epoch": "1647911020.825241000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 283, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "10" } }, { "event_id": "evt-e02f4cc65887dca2ccaad507", "kind": "identity", "frame_number": 12643, "timestamp_epoch": "1647911020.826922000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 283, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "11" } }, { "event_id": "evt-ff3e6c9df35e46b2bd59ae4b", "kind": "identity", "frame_number": 12652, "timestamp_epoch": "1647911020.827921000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 284, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-57b33fe56ea5e2ea23312999", "kind": "identity", "frame_number": 12655, "timestamp_epoch": "1647911020.830086000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 284, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "13" } }, { "event_id": "evt-d3d777108ef0ec386780e529", "kind": "identity", "frame_number": 12822, "timestamp_epoch": "1647911085.563133000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0a5997e1c8808a9aa3a204ee", "kind": "identity", "frame_number": 12878, "timestamp_epoch": "1647911295.720410000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7c6afb758b0268f1a0294ef5", "kind": "identity", "frame_number": 12879, "timestamp_epoch": "1647911295.720807000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b6e57a3039a9f110dd860027", "kind": "identity", "frame_number": 12973, "timestamp_epoch": "1647911530.000258000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e981d0fdd08088d75211b13d", "kind": "identity", "frame_number": 12975, "timestamp_epoch": "1647911530.001497000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-50beb88d60bc30fb1f1a110b", "kind": "identity", "frame_number": 12976, "timestamp_epoch": "1647911530.001710000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-8158d1d5c97343a0a89bcd51", "kind": "identity", "frame_number": 13000, "timestamp_epoch": "1647911530.010172000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-e1b7cd1c943b7f21bd24714d", "kind": "identity", "frame_number": 13002, "timestamp_epoch": "1647911530.011598000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-eb06fc28845c4f6cbab6a3f1", "kind": "identity", "frame_number": 13013, "timestamp_epoch": "1647911530.015067000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-2aa7c118952ea6c40491b11e", "kind": "identity", "frame_number": 13015, "timestamp_epoch": "1647911530.016499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-0dbb3c4d2c0fd273c70be7ea", "kind": "identity", "frame_number": 13039, "timestamp_epoch": "1647911639.168300000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4905e7ddef7fedb6603bc84d", "kind": "identity", "frame_number": 13040, "timestamp_epoch": "1647911639.168565000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1ecce196ef4d383cae4f640b", "kind": "identity", "frame_number": 13041, "timestamp_epoch": "1647911639.169109000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5aac4f1f3e239598d8e5215f", "kind": "identity", "frame_number": 13044, "timestamp_epoch": "1647911639.171511000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-5cf1fcfad56e6c3a04eb4d49", "kind": "identity", "frame_number": 13046, "timestamp_epoch": "1647911639.173585000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-e651e8dd1c4b7e703c6fc7f3", "kind": "identity", "frame_number": 13047, "timestamp_epoch": "1647911639.174416000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9eb71551f65ae8d9c8498db4", "kind": "identity", "frame_number": 13048, "timestamp_epoch": "1647911639.174728000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-75668720d11033dee372750a", "kind": "identity", "frame_number": 13049, "timestamp_epoch": "1647911639.175015000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0ee901516ea4813e72cce1ed", "kind": "identity", "frame_number": 13050, "timestamp_epoch": "1647911639.175172000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fe72f6d2357c9ede0c64f114", "kind": "identity", "frame_number": 13051, "timestamp_epoch": "1647911639.175209000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-61706d235c972061184a34d4", "kind": "identity", "frame_number": 13052, "timestamp_epoch": "1647911639.175515000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ff9b9b80c5feeba1643d1cca", "kind": "identity", "frame_number": 13054, "timestamp_epoch": "1647911649.890281000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-57afad5e5e191ed9333c3d4d", "kind": "identity", "frame_number": 13055, "timestamp_epoch": "1647911649.890560000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fb08be492ca73faad26f7b75", "kind": "identity", "frame_number": 13056, "timestamp_epoch": "1647911649.890767000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-141b036a80369d6190a9e0c9", "kind": "identity", "frame_number": 13057, "timestamp_epoch": "1647911649.890948000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 303, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3b61a1ea486e3e982925245c", "kind": "identity", "frame_number": 13094, "timestamp_epoch": "1647911807.126548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0eb39ea6941e606297802f83", "kind": "identity", "frame_number": 13136, "timestamp_epoch": "1647911896.041665000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8e02efbbf16f34d1a0aea104", "kind": "identity", "frame_number": 13137, "timestamp_epoch": "1647911896.041956000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6310d0e72ce1bf0438daeac8", "kind": "identity", "frame_number": 13329, "timestamp_epoch": "1647912496.366816000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6ac6af3bb7a755728ab01856", "kind": "identity", "frame_number": 13330, "timestamp_epoch": "1647912496.367045000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0ffe4a1610b61417fab943a8", "kind": "identity", "frame_number": 13370, "timestamp_epoch": "1647912529.329228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-018567876ba05c31f33f75a1", "kind": "identity", "frame_number": 13377, "timestamp_epoch": "1647912539.136592000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-765f8050253c861bd15e4bd7", "kind": "identity", "frame_number": 13378, "timestamp_epoch": "1647912539.136801000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-426b786c60ca58cf0b81a29c", "kind": "identity", "frame_number": 13379, "timestamp_epoch": "1647912539.137319000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7e0e64570034e51c52e87705", "kind": "identity", "frame_number": 13382, "timestamp_epoch": "1647912539.139738000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-ff470c8e456d9e6e5d865b2b", "kind": "identity", "frame_number": 13384, "timestamp_epoch": "1647912539.141780000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-9e561bfd3404bc8f4af24c97", "kind": "identity", "frame_number": 13385, "timestamp_epoch": "1647912539.142602000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5c81b37c17f6ce6ef988c217", "kind": "identity", "frame_number": 13386, "timestamp_epoch": "1647912539.142796000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9c6d8634477ea20718d5a676", "kind": "identity", "frame_number": 13387, "timestamp_epoch": "1647912539.143179000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f4f59d25566b9357d04aadea", "kind": "identity", "frame_number": 13388, "timestamp_epoch": "1647912539.143358000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-10297634097af24df58f6725", "kind": "identity", "frame_number": 13389, "timestamp_epoch": "1647912539.143434000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b778c6146281d0599f5542a1", "kind": "identity", "frame_number": 13390, "timestamp_epoch": "1647912539.143645000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-26c2c09041cde3353d814a18", "kind": "identity", "frame_number": 13392, "timestamp_epoch": "1647912549.867105000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d31c157b1f010eac2a5c8049", "kind": "identity", "frame_number": 13393, "timestamp_epoch": "1647912549.867297000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5a80ad13100d524250979343", "kind": "identity", "frame_number": 13394, "timestamp_epoch": "1647912549.867545000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d37012dcd4a78541db7d3463", "kind": "identity", "frame_number": 13395, "timestamp_epoch": "1647912549.867667000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 321, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fa59f20560dca6a4c590582b", "kind": "identity", "frame_number": 13536, "timestamp_epoch": "1647913096.706488000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8aa7ae931534058d31438218", "kind": "identity", "frame_number": 13537, "timestamp_epoch": "1647913096.706706000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6b08c5811d5677e93d120cbe", "kind": "identity", "frame_number": 13564, "timestamp_epoch": "1647913134.466565000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-26c8e6047db92145fe066e86", "kind": "identity", "frame_number": 13566, "timestamp_epoch": "1647913134.467715000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-1dac57cb847b6e402be8112b", "kind": "identity", "frame_number": 13567, "timestamp_epoch": "1647913134.467839000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-7d4af15084e0d67acdd1e8d5", "kind": "identity", "frame_number": 13587, "timestamp_epoch": "1647913134.785889000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-1e1e06594a461b85eb0e8b8a", "kind": "identity", "frame_number": 13589, "timestamp_epoch": "1647913134.787336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-a56956e9691ce4edf9c24991", "kind": "identity", "frame_number": 13604, "timestamp_epoch": "1647913135.028507000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-79affd2a076b5fb1387bb80f", "kind": "identity", "frame_number": 13606, "timestamp_epoch": "1647913135.029973000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-47673c115655272166eb4bbc", "kind": "identity", "frame_number": 13621, "timestamp_epoch": "1647913135.349174000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-22436c36045bdbccca2460f7", "kind": "identity", "frame_number": 13622, "timestamp_epoch": "1647913135.349441000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-18624b8e7e77f8094fb78f46", "kind": "identity", "frame_number": 13623, "timestamp_epoch": "1647913135.349909000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-23ee572fc861740f44b71dc3", "kind": "identity", "frame_number": 13626, "timestamp_epoch": "1647913135.352201000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-7cb1b4220ab9db3471c4eafc", "kind": "identity", "frame_number": 13628, "timestamp_epoch": "1647913135.354191000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-61945f474def6ddf8f9fc0ca", "kind": "identity", "frame_number": 13629, "timestamp_epoch": "1647913135.355014000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b1a1f2d8a31a4c4bbe0adb02", "kind": "identity", "frame_number": 13630, "timestamp_epoch": "1647913135.355396000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-45c6b5c3308fea293da056ee", "kind": "identity", "frame_number": 13631, "timestamp_epoch": "1647913135.355784000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c30eee2bce50921964a945e0", "kind": "identity", "frame_number": 13632, "timestamp_epoch": "1647913135.355968000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c3b43a7fe64538c0ce8bf5ff", "kind": "identity", "frame_number": 13633, "timestamp_epoch": "1647913135.356056000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5ff570316cdb2b93da547997", "kind": "identity", "frame_number": 13634, "timestamp_epoch": "1647913135.356666000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a62022053f66cd3d73eddef1", "kind": "identity", "frame_number": 13636, "timestamp_epoch": "1647913135.357042000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1890ec9cd459a110c1041ce1", "kind": "identity", "frame_number": 13637, "timestamp_epoch": "1647913135.357231000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b91f1c043db7e39469d17705", "kind": "identity", "frame_number": 13638, "timestamp_epoch": "1647913135.357576000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dcf8277a8fd0ea799ccda7cc", "kind": "identity", "frame_number": 13639, "timestamp_epoch": "1647913135.357787000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0aa3be1e3199c1a11f1d7006", "kind": "identity", "frame_number": 13640, "timestamp_epoch": "1647913135.358128000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a823255284e628c2d094431a", "kind": "identity", "frame_number": 13641, "timestamp_epoch": "1647913135.358317000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-33065db14d2a69fef5e9fb9c", "kind": "identity", "frame_number": 13642, "timestamp_epoch": "1647913135.362013000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-43c45cf9a0b7a8fc5c3f0541", "kind": "identity", "frame_number": 13643, "timestamp_epoch": "1647913135.362603000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a4ed42c787c7eda5016927e5", "kind": "identity", "frame_number": 13644, "timestamp_epoch": "1647913135.362998000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-874c14bb74dc349342728e08", "kind": "identity", "frame_number": 13645, "timestamp_epoch": "1647913135.363119000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-685b7197489a9827b45c7831", "kind": "identity", "frame_number": 13646, "timestamp_epoch": "1647913135.363546000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-18b105b8a4e7486a3ba81adb", "kind": "identity", "frame_number": 13647, "timestamp_epoch": "1647913135.363844000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8c1d95bfce4244ecb42e8184", "kind": "identity", "frame_number": 13648, "timestamp_epoch": "1647913135.365091000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9c32ce1dee0bc2c174cf1138", "kind": "identity", "frame_number": 13649, "timestamp_epoch": "1647913135.365641000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7b4cc9932b89a79ef79e7ff9", "kind": "identity", "frame_number": 13650, "timestamp_epoch": "1647913135.366035000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7906a43263fd01ccf0334f5d", "kind": "identity", "frame_number": 13651, "timestamp_epoch": "1647913135.366156000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-891599f2ebc4f176d7b7aff0", "kind": "identity", "frame_number": 13652, "timestamp_epoch": "1647913135.366560000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0434be92df29faf46eb2e9ad", "kind": "identity", "frame_number": 13653, "timestamp_epoch": "1647913135.366831000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-35d5167b5fcd2c42ec4fc5b6", "kind": "identity", "frame_number": 13654, "timestamp_epoch": "1647913135.368131000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-eabb19972803089604243c54", "kind": "identity", "frame_number": 13655, "timestamp_epoch": "1647913135.368625000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b6ba95427ac6aa6a343acf00", "kind": "identity", "frame_number": 13656, "timestamp_epoch": "1647913135.369007000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2db6c8662259aad9edcccba2", "kind": "identity", "frame_number": 13657, "timestamp_epoch": "1647913135.369175000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-40b065660cc8182abe44b420", "kind": "identity", "frame_number": 13658, "timestamp_epoch": "1647913135.369539000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-26ebed0117cc298d9686af20", "kind": "identity", "frame_number": 13659, "timestamp_epoch": "1647913135.369852000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fa4a699671ba51a07e570c60", "kind": "identity", "frame_number": 13660, "timestamp_epoch": "1647913135.371271000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-183da1d717005d657ebfceb7", "kind": "identity", "frame_number": 13661, "timestamp_epoch": "1647913135.371815000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b297fb4ea2dfd1ab1847bcfb", "kind": "identity", "frame_number": 13662, "timestamp_epoch": "1647913135.372216000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-59942a330091395b8ed54f83", "kind": "identity", "frame_number": 13663, "timestamp_epoch": "1647913135.372345000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2079d8a1c76e6e03358ff46a", "kind": "identity", "frame_number": 13664, "timestamp_epoch": "1647913135.372732000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d0b4523e8c289958f1b2d3e8", "kind": "identity", "frame_number": 13665, "timestamp_epoch": "1647913135.373054000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-188c729b2aae2d0cb8a398d9", "kind": "identity", "frame_number": 13666, "timestamp_epoch": "1647913135.373767000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b5d25c613ffe57b711ea391f", "kind": "identity", "frame_number": 13667, "timestamp_epoch": "1647913135.374338000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6cee991b3e362b490c1191dd", "kind": "identity", "frame_number": 13668, "timestamp_epoch": "1647913135.374739000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b72486cfb4d782f00d5a52e5", "kind": "identity", "frame_number": 13669, "timestamp_epoch": "1647913135.374913000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-137c0847dcabd16f92ce9ff4", "kind": "identity", "frame_number": 13670, "timestamp_epoch": "1647913135.375323000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c20a79cca045176dd370a731", "kind": "identity", "frame_number": 13671, "timestamp_epoch": "1647913135.375415000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3dcdfc7921734fac83a00e43", "kind": "identity", "frame_number": 13672, "timestamp_epoch": "1647913135.375737000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ae0ce2edf85bf7e9933bcbb8", "kind": "identity", "frame_number": 13673, "timestamp_epoch": "1647913135.375874000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f82c94268c8a4c3a04fd3e63", "kind": "identity", "frame_number": 13674, "timestamp_epoch": "1647913135.376289000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e1168d2ba6f0b9d62cdd1bf4", "kind": "identity", "frame_number": 13675, "timestamp_epoch": "1647913135.376638000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6a03fbb90a021d665a2fbcec", "kind": "identity", "frame_number": 13676, "timestamp_epoch": "1647913135.376995000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6769cb613ab26d10aec8f8fc", "kind": "identity", "frame_number": 13677, "timestamp_epoch": "1647913135.377142000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b7189658da332b13f14e996c", "kind": "identity", "frame_number": 13678, "timestamp_epoch": "1647913135.377468000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-38876fd820052168ff4f3703", "kind": "identity", "frame_number": 13679, "timestamp_epoch": "1647913135.377562000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-12e18f1e585122bfc97af91f", "kind": "identity", "frame_number": 13680, "timestamp_epoch": "1647913135.377885000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c6613cd4744ef3fe656b51bc", "kind": "identity", "frame_number": 13681, "timestamp_epoch": "1647913135.378039000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7f4a5651100dfc6fb2578ac7", "kind": "identity", "frame_number": 13682, "timestamp_epoch": "1647913135.378350000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ed77e08dd8c5ea7ba9f7f717", "kind": "identity", "frame_number": 13683, "timestamp_epoch": "1647913135.378433000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ef51458d836afbbcd9ff974e", "kind": "identity", "frame_number": 13684, "timestamp_epoch": "1647913135.378695000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3a37660409ca665d21afb9af", "kind": "identity", "frame_number": 13685, "timestamp_epoch": "1647913135.378826000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0773c4e294ce4f304fc04a17", "kind": "identity", "frame_number": 13686, "timestamp_epoch": "1647913135.380150000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-35d2085cc188618fea3ba897", "kind": "identity", "frame_number": 13687, "timestamp_epoch": "1647913135.380289000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cd6bdb985f0ca3479e032d90", "kind": "identity", "frame_number": 13688, "timestamp_epoch": "1647913135.381626000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-34d08e89b1de68b8f576d456", "kind": "identity", "frame_number": 13689, "timestamp_epoch": "1647913135.381802000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-73d63aa577fc1e6a15e2cee5", "kind": "identity", "frame_number": 13690, "timestamp_epoch": "1647913135.382405000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3c4d607bafaabeee5d5af0a8", "kind": "identity", "frame_number": 13691, "timestamp_epoch": "1647913135.382903000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2ee75d4a429a3560eb3c8cc6", "kind": "identity", "frame_number": 13692, "timestamp_epoch": "1647913135.383656000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4a74e4ffc086ce3880d9688a", "kind": "identity", "frame_number": 13693, "timestamp_epoch": "1647913135.383936000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-54936b7e55ffa3d94b58eb6d", "kind": "identity", "frame_number": 13694, "timestamp_epoch": "1647913135.384735000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1676b61259d8395d568ca6f3", "kind": "identity", "frame_number": 13695, "timestamp_epoch": "1647913135.385137000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-daad71aa0b1a32e6d3cae3c9", "kind": "identity", "frame_number": 13696, "timestamp_epoch": "1647913135.385663000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0e5b1ee8a98eb71ecf8f27b7", "kind": "identity", "frame_number": 13697, "timestamp_epoch": "1647913135.385914000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fbf4ece1a88d31388ba47edb", "kind": "identity", "frame_number": 13698, "timestamp_epoch": "1647913135.386289000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-044adda614050f4790a67d8f", "kind": "identity", "frame_number": 13699, "timestamp_epoch": "1647913135.386329000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-214bfd9d673d2f48e1ab34cb", "kind": "identity", "frame_number": 13700, "timestamp_epoch": "1647913135.386599000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9882c90837158ccdef82ff16", "kind": "identity", "frame_number": 13701, "timestamp_epoch": "1647913135.386706000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9289709b40a351260d0d2a56", "kind": "identity", "frame_number": 13702, "timestamp_epoch": "1647913135.387105000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f26a7d1b4b4e38994cce486a", "kind": "identity", "frame_number": 13703, "timestamp_epoch": "1647913135.387257000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fd442e4c6f9e13c91b91b8f0", "kind": "identity", "frame_number": 13704, "timestamp_epoch": "1647913135.387623000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-78689a89567cb5a16c7e6eb6", "kind": "identity", "frame_number": 13705, "timestamp_epoch": "1647913135.387673000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e45f6b8b40ecb4cb83b5a187", "kind": "identity", "frame_number": 13706, "timestamp_epoch": "1647913135.387971000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-769926101f49a593044f47a9", "kind": "identity", "frame_number": 13707, "timestamp_epoch": "1647913135.388020000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-9f1d4dc415414d7eefbb198a", "kind": "identity", "frame_number": 13708, "timestamp_epoch": "1647913135.388277000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8ff0234bfd42874de5e3e9c5", "kind": "identity", "frame_number": 13709, "timestamp_epoch": "1647913135.388383000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b868b4c6a6978411951422c3", "kind": "identity", "frame_number": 13710, "timestamp_epoch": "1647913135.388680000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e650a9778ea4102c0836c462", "kind": "identity", "frame_number": 13711, "timestamp_epoch": "1647913135.388729000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a7078e15a3c01d04476c9c7f", "kind": "identity", "frame_number": 13712, "timestamp_epoch": "1647913135.389063000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c26d0afe4afee858e304f6ea", "kind": "identity", "frame_number": 13713, "timestamp_epoch": "1647913135.389107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d6acf15342790288dfcd2267", "kind": "identity", "frame_number": 13714, "timestamp_epoch": "1647913135.389472000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dddc910b1838fabf2de16d24", "kind": "identity", "frame_number": 13715, "timestamp_epoch": "1647913135.389517000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4b545828f6651076027a77c1", "kind": "identity", "frame_number": 13716, "timestamp_epoch": "1647913135.389667000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3011112f79b01096da376705", "kind": "identity", "frame_number": 13718, "timestamp_epoch": "1647913135.390150000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c554d2b995995a291aae4860", "kind": "identity", "frame_number": 13720, "timestamp_epoch": "1647913135.390428000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-59a18474183d92a2c62b2adf", "kind": "identity", "frame_number": 13721, "timestamp_epoch": "1647913135.390534000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8fb660af351265aa432bd4ce", "kind": "identity", "frame_number": 13722, "timestamp_epoch": "1647913135.390757000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5fd413feb2463ee1ed8a67cb", "kind": "identity", "frame_number": 13723, "timestamp_epoch": "1647913135.390960000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f13bf9c4bb3d37b457ed02eb", "kind": "identity", "frame_number": 13724, "timestamp_epoch": "1647913135.391129000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-642537ceacbfbd48ea7ed5d9", "kind": "identity", "frame_number": 13725, "timestamp_epoch": "1647913135.391242000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b49e1cd4fb43d4458e24eba8", "kind": "identity", "frame_number": 13726, "timestamp_epoch": "1647913135.391360000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-16ed5912075bd2e0b6684580", "kind": "identity", "frame_number": 13727, "timestamp_epoch": "1647913135.391446000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ff247b99929344e740b3056b", "kind": "identity", "frame_number": 13728, "timestamp_epoch": "1647913135.391610000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b50be25dbfecda35a5472e3b", "kind": "identity", "frame_number": 13729, "timestamp_epoch": "1647913135.391659000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5fade9d6d5620383325d8808", "kind": "identity", "frame_number": 13730, "timestamp_epoch": "1647913135.391778000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-dabd9ebc06a8705488a2220f", "kind": "identity", "frame_number": 13731, "timestamp_epoch": "1647913135.391870000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-dd6aed6e4dbac2213e5c73bf", "kind": "identity", "frame_number": 13732, "timestamp_epoch": "1647913135.392036000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d00ac447575f79be9ff9bf08", "kind": "identity", "frame_number": 13733, "timestamp_epoch": "1647913135.392274000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-84b93540347b49317bfbb261", "kind": "identity", "frame_number": 13734, "timestamp_epoch": "1647913135.392374000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-7d81a76290bdfa6d7e3ac28f", "kind": "identity", "frame_number": 13735, "timestamp_epoch": "1647913135.392479000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a45a9c8577a88623444ffd11", "kind": "identity", "frame_number": 13736, "timestamp_epoch": "1647913135.392629000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-066e492c76a48b42702c26c2", "kind": "identity", "frame_number": 13737, "timestamp_epoch": "1647913135.392678000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e5da8ee229f026c45bdce6b6", "kind": "identity", "frame_number": 13738, "timestamp_epoch": "1647913135.392786000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3c954e402172bd05d4d13bdd", "kind": "identity", "frame_number": 13739, "timestamp_epoch": "1647913135.392880000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-34c797af0127939c212f51ac", "kind": "identity", "frame_number": 13740, "timestamp_epoch": "1647913135.392992000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0fd387b232b46da4daad25cd", "kind": "identity", "frame_number": 13741, "timestamp_epoch": "1647913135.393137000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e12e083294c78eb3f6367c44", "kind": "identity", "frame_number": 13742, "timestamp_epoch": "1647913135.393192000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6f1948d0657d0c38e719b224", "kind": "identity", "frame_number": 13743, "timestamp_epoch": "1647913135.393274000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fa6d241bcd09822bbfb52291", "kind": "identity", "frame_number": 13744, "timestamp_epoch": "1647913135.393486000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-37cf7e507e1fcb3bb807f86f", "kind": "identity", "frame_number": 13745, "timestamp_epoch": "1647913135.393583000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-40c240f519bb70e00bc6b118", "kind": "identity", "frame_number": 13746, "timestamp_epoch": "1647913135.393766000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5a7efd9e8cc1401b3c68fde0", "kind": "identity", "frame_number": 13747, "timestamp_epoch": "1647913135.393858000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7d1897ccf742a67e3aed48e5", "kind": "identity", "frame_number": 13748, "timestamp_epoch": "1647913135.394216000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-779e7a4bbe395e7e8f281daf", "kind": "identity", "frame_number": 13749, "timestamp_epoch": "1647913135.394460000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1f98f0569deee2ee85dae61f", "kind": "identity", "frame_number": 13815, "timestamp_epoch": "1647913248.641903000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6ba16f4d8726b50e4b94b624", "kind": "identity", "frame_number": 13823, "timestamp_epoch": "1647913307.315443000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d8dfa261c7c0d2a5384e5112", "kind": "identity", "frame_number": 13824, "timestamp_epoch": "1647913307.315776000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3a06707b2a1629358dbb60ab", "kind": "identity", "frame_number": 13825, "timestamp_epoch": "1647913307.316096000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f3166babea200673eb0bd8ab", "kind": "identity", "frame_number": 13826, "timestamp_epoch": "1647913307.316303000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-dfd9fd22f002ade97396b59a", "kind": "identity", "frame_number": 13827, "timestamp_epoch": "1647913307.316653000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ca909b896f055c63510a8fd6", "kind": "identity", "frame_number": 13828, "timestamp_epoch": "1647913307.316793000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-df5f2fbc9fc67c936e97be25", "kind": "identity", "frame_number": 13829, "timestamp_epoch": "1647913307.317163000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-afb119b60fff18037eecdd09", "kind": "identity", "frame_number": 13830, "timestamp_epoch": "1647913307.317318000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7df41ee3a4e0ba5242668ffb", "kind": "identity", "frame_number": 13833, "timestamp_epoch": "1647913318.058518000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4faf9333f4875eab81546ea2", "kind": "identity", "frame_number": 13834, "timestamp_epoch": "1647913318.058714000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-98d8becf89ea89a72443939b", "kind": "identity", "frame_number": 13835, "timestamp_epoch": "1647913318.059007000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-cbbadbdd78e24a1e3cad46f9", "kind": "identity", "frame_number": 13836, "timestamp_epoch": "1647913318.059104000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 335, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8a756b1b6a2d2fbf0eaa8900", "kind": "identity", "frame_number": 13844, "timestamp_epoch": "1647913439.106439000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-01d16642542c7c40010fb158", "kind": "identity", "frame_number": 13845, "timestamp_epoch": "1647913439.106694000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-8c22f99443ea36e5860ded7a", "kind": "identity", "frame_number": 13846, "timestamp_epoch": "1647913439.107271000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-657d54e25ec7f1ba0a1e3c53", "kind": "identity", "frame_number": 13849, "timestamp_epoch": "1647913439.109614000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f94821fc8f25bfaf616ebad1", "kind": "identity", "frame_number": 13851, "timestamp_epoch": "1647913439.111615000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-b6e1fcdf83d9df9382c5ba09", "kind": "identity", "frame_number": 13852, "timestamp_epoch": "1647913439.112434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bf8a84dd8c1fdbd5702ce093", "kind": "identity", "frame_number": 13853, "timestamp_epoch": "1647913439.112744000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ed60fe25c49130bd0342de9c", "kind": "identity", "frame_number": 13854, "timestamp_epoch": "1647913439.113025000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-445ce19503152bae148a790c", "kind": "identity", "frame_number": 13855, "timestamp_epoch": "1647913439.113246000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aa9aa4303c7eef2c39bffafc", "kind": "identity", "frame_number": 13856, "timestamp_epoch": "1647913439.113246000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-08e970bbedfa0962ebdf4156", "kind": "identity", "frame_number": 13857, "timestamp_epoch": "1647913439.113493000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-55bea4332ff245f12962e896", "kind": "identity", "frame_number": 13859, "timestamp_epoch": "1647913449.867908000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5b1a0691429a7cc804b69aba", "kind": "identity", "frame_number": 13860, "timestamp_epoch": "1647913449.868130000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-4fef6934c5bbf96a627780ea", "kind": "identity", "frame_number": 13861, "timestamp_epoch": "1647913449.868420000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3f0f4cf8f800c14e82bcb877", "kind": "identity", "frame_number": 13862, "timestamp_epoch": "1647913449.868513000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 339, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-22fadf1062686e6316411a19", "kind": "identity", "frame_number": 13946, "timestamp_epoch": "1647913697.035618000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-4bc8013f63eb84338a725035", "kind": "identity", "frame_number": 13947, "timestamp_epoch": "1647913697.035916000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0da88200aac9c61f5d308383", "kind": "identity", "frame_number": 14012, "timestamp_epoch": "1647913969.569806000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5f63f7c8497ab52cf82dc483", "kind": "identity", "frame_number": 14093, "timestamp_epoch": "1647914217.146102000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-08354a00f072aed1c964682b", "kind": "identity", "frame_number": 14095, "timestamp_epoch": "1647914217.147318000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-6048a3829c45761a233bd5ce", "kind": "identity", "frame_number": 14096, "timestamp_epoch": "1647914217.147461000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-fbf9c8a479c927ac2c80f5d7", "kind": "identity", "frame_number": 14257, "timestamp_epoch": "1647914297.371194000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c5472fe963a0850245ffe21a", "kind": "identity", "frame_number": 14258, "timestamp_epoch": "1647914297.371494000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-be91e7cefd83525062e42abf", "kind": "identity", "frame_number": 14278, "timestamp_epoch": "1647914339.068713000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-26d2620d615cbf4a747a9370", "kind": "identity", "frame_number": 14279, "timestamp_epoch": "1647914339.068927000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6a22995b51c8d13084f0954e", "kind": "identity", "frame_number": 14280, "timestamp_epoch": "1647914339.069491000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-19cd96ccac0ba667099d8772", "kind": "identity", "frame_number": 14283, "timestamp_epoch": "1647914339.071843000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-afd12fcc3d6ebd2c43fe1df5", "kind": "identity", "frame_number": 14285, "timestamp_epoch": "1647914339.073910000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-db587ed68a7b929949861f2f", "kind": "identity", "frame_number": 14286, "timestamp_epoch": "1647914339.074843000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-bd48079e358daf90347b5901", "kind": "identity", "frame_number": 14287, "timestamp_epoch": "1647914339.075149000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e903aa93e014819e637dd72f", "kind": "identity", "frame_number": 14288, "timestamp_epoch": "1647914339.075434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-514b69ad3b6ab9f967e28dd2", "kind": "identity", "frame_number": 14289, "timestamp_epoch": "1647914339.075668000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d53bf6f3e73d4317b92bd0d0", "kind": "identity", "frame_number": 14290, "timestamp_epoch": "1647914339.075711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0be435ef33ee060c3b9b88fa", "kind": "identity", "frame_number": 14291, "timestamp_epoch": "1647914339.075987000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2150af37f2176d123038c704", "kind": "identity", "frame_number": 14293, "timestamp_epoch": "1647914349.817051000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aff39ad15c96abc9adc6fc43", "kind": "identity", "frame_number": 14294, "timestamp_epoch": "1647914349.817294000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2c91f69f74e56a8c8d7bdaf8", "kind": "identity", "frame_number": 14295, "timestamp_epoch": "1647914349.817503000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-86ad9109f66761be76545a46", "kind": "identity", "frame_number": 14296, "timestamp_epoch": "1647914349.817619000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 360, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f1ed4c883bb19982be2b6211", "kind": "identity", "frame_number": 14393, "timestamp_epoch": "1647914691.804176000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ecd8317688e996dde952e42c", "kind": "identity", "frame_number": 14493, "timestamp_epoch": "1647914897.723935000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-b6c66915b3329371aec0231a", "kind": "identity", "frame_number": 14494, "timestamp_epoch": "1647914897.724315000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c084419749ba625554e1b2eb", "kind": "identity", "frame_number": 14560, "timestamp_epoch": "1647915129.853948000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-65b8a003d3a55f03613d0fd6", "kind": "identity", "frame_number": 14562, "timestamp_epoch": "1647915129.855173000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-171d7feb526cb3b915553199", "kind": "identity", "frame_number": 14563, "timestamp_epoch": "1647915129.855329000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-7f0329b4bb5624f66bd04c5b", "kind": "identity", "frame_number": 14593, "timestamp_epoch": "1647915129.970034000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-5ca462ad63ee7c59c2307917", "kind": "identity", "frame_number": 14595, "timestamp_epoch": "1647915129.970767000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-900fa892e944b64aac4a4f5e", "kind": "identity", "frame_number": 14606, "timestamp_epoch": "1647915129.974631000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-765110ddea7c50a9df47dbe9", "kind": "identity", "frame_number": 14608, "timestamp_epoch": "1647915129.975394000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-383e4627ff12418d35636e07", "kind": "identity", "frame_number": 14632, "timestamp_epoch": "1647915239.026751000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-b5e10249dd76dcda510a2d0c", "kind": "identity", "frame_number": 14633, "timestamp_epoch": "1647915239.027016000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-01ce816149c894cdfe7ac13f", "kind": "identity", "frame_number": 14634, "timestamp_epoch": "1647915239.027644000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-fbccb1218c8b59bcf292f13b", "kind": "identity", "frame_number": 14637, "timestamp_epoch": "1647915239.030118000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-2d55fb54857576519e505bf4", "kind": "identity", "frame_number": 14639, "timestamp_epoch": "1647915239.032146000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-31eb995a2e13e2071bf9d029", "kind": "identity", "frame_number": 14640, "timestamp_epoch": "1647915239.032961000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-46b12bd7bbb7eff8ec71eec9", "kind": "identity", "frame_number": 14641, "timestamp_epoch": "1647915239.033230000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d71f0766e656312e1c8371c2", "kind": "identity", "frame_number": 14642, "timestamp_epoch": "1647915239.033555000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-ec8db011556fc2a87becf06e", "kind": "identity", "frame_number": 14643, "timestamp_epoch": "1647915239.033785000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-2ef9049cb3585d7ac2ef0ebb", "kind": "identity", "frame_number": 14644, "timestamp_epoch": "1647915239.033785000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-39ab7f9c814c64debf785078", "kind": "identity", "frame_number": 14645, "timestamp_epoch": "1647915239.034107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a978e604f6273614ab741a17", "kind": "identity", "frame_number": 14647, "timestamp_epoch": "1647915249.753237000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1ac763ebd264069d1ec904bc", "kind": "identity", "frame_number": 14648, "timestamp_epoch": "1647915249.753404000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8877265b4d0453be40e51616", "kind": "identity", "frame_number": 14649, "timestamp_epoch": "1647915249.753698000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-0b44008115711ee6eee3571c", "kind": "identity", "frame_number": 14650, "timestamp_epoch": "1647915249.753837000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 379, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-e38b72428efde3423134d076", "kind": "identity", "frame_number": 14700, "timestamp_epoch": "1647915409.807328000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-262ebcbee33c1b92873ca224", "kind": "identity", "frame_number": 14744, "timestamp_epoch": "1647915498.045887000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6e5d8dd95bf954e5e7974d43", "kind": "identity", "frame_number": 14745, "timestamp_epoch": "1647915498.046161000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c1f3ac6bed5bf3ee68f1b965", "kind": "identity", "frame_number": 14868, "timestamp_epoch": "1647915749.941183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-0c5bcc2763fb1502038e3151", "kind": "identity", "frame_number": 14872, "timestamp_epoch": "1647915749.942519000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-4f9b56f84f77eb6b4078cc7f", "kind": "identity", "frame_number": 14873, "timestamp_epoch": "1647915749.942768000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-6506f7cd3ca43c0065582fe1", "kind": "identity", "frame_number": 14900, "timestamp_epoch": "1647915750.260253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-1ec6acc94d189c976309f1ef", "kind": "identity", "frame_number": 14902, "timestamp_epoch": "1647915750.261722000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-f07c7157e98a159649ef75e8", "kind": "identity", "frame_number": 14913, "timestamp_epoch": "1647915750.383470000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-f4f900988749f1861659629b", "kind": "identity", "frame_number": 14915, "timestamp_epoch": "1647915750.384935000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-bb6005ca68c09b842343a9cc", "kind": "identity", "frame_number": 15040, "timestamp_epoch": "1647916098.382836000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-66adb34c45fa455e4d9af9eb", "kind": "identity", "frame_number": 15041, "timestamp_epoch": "1647916098.383146000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f01a901ac19cf9e9a0573180", "kind": "identity", "frame_number": 15100, "timestamp_epoch": "1647916132.068010000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-284a4b666d27329156898341", "kind": "identity", "frame_number": 15111, "timestamp_epoch": "1647916139.000543000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-688a38c0ad0700058c356751", "kind": "identity", "frame_number": 15112, "timestamp_epoch": "1647916139.000757000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f65c5938be775f5a8e8f3b7c", "kind": "identity", "frame_number": 15113, "timestamp_epoch": "1647916139.001305000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-a60e4c75379d0e986493e675", "kind": "identity", "frame_number": 15116, "timestamp_epoch": "1647916139.003696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-9f44e0763df97289bbecab0d", "kind": "identity", "frame_number": 15118, "timestamp_epoch": "1647916139.005772000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-d1dec72a96515e36c9d3bc8d", "kind": "identity", "frame_number": 15119, "timestamp_epoch": "1647916139.006603000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-779922340d8831cb67db69af", "kind": "identity", "frame_number": 15120, "timestamp_epoch": "1647916139.006863000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1ec33630f949ad78daa4c963", "kind": "identity", "frame_number": 15121, "timestamp_epoch": "1647916139.007248000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-06e66e44a4791f62c4487fb6", "kind": "identity", "frame_number": 15122, "timestamp_epoch": "1647916139.007376000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cb17a39db1a8fdd54a6ea9c7", "kind": "identity", "frame_number": 15123, "timestamp_epoch": "1647916139.007479000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-f1fba991f810b02cf9cad304", "kind": "identity", "frame_number": 15124, "timestamp_epoch": "1647916139.007739000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0f8021a665495390cfbd39e3", "kind": "identity", "frame_number": 15126, "timestamp_epoch": "1647916149.709408000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-44185350953fa3e063adcba6", "kind": "identity", "frame_number": 15127, "timestamp_epoch": "1647916149.709619000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-1da7b0210947fb463851e8a4", "kind": "identity", "frame_number": 15128, "timestamp_epoch": "1647916149.709882000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d060c7a72e1df9a383da1f64", "kind": "identity", "frame_number": 15129, "timestamp_epoch": "1647916149.710126000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 406, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-26e103214fc7e68d779349c9", "kind": "identity", "frame_number": 15322, "timestamp_epoch": "1647916698.730217000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6faf2cd50566644da08afa0c", "kind": "identity", "frame_number": 15323, "timestamp_epoch": "1647916698.730583000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-6961988254246da849a3c926", "kind": "identity", "frame_number": 15379, "timestamp_epoch": "1647916849.837871000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-88fea42a61f275d287d07838", "kind": "identity", "frame_number": 15388, "timestamp_epoch": "1647917038.965038000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-62a52df1775b618b8df89d7c", "kind": "identity", "frame_number": 15389, "timestamp_epoch": "1647917038.965251000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-79fdc06aab287c503e8728e6", "kind": "identity", "frame_number": 15390, "timestamp_epoch": "1647917038.965740000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-7ce80f5c1fc864a9afc24165", "kind": "identity", "frame_number": 15399, "timestamp_epoch": "1647917039.076828000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 420, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-ef318cd5d791562db4b35d2b", "kind": "identity", "frame_number": 15402, "timestamp_epoch": "1647917039.078464000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 420, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "13" } }, { "event_id": "evt-72218860833be4c88d4ab446", "kind": "identity", "frame_number": 15411, "timestamp_epoch": "1647917039.080089000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 421, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3aa045d5ada96adbb985eccf", "kind": "identity", "frame_number": 15414, "timestamp_epoch": "1647917039.081571000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 421, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "13" } }, { "event_id": "evt-081d976195a8fd4b505e97cc", "kind": "identity", "frame_number": 15421, "timestamp_epoch": "1647917039.082799000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-60005afdc16170d1c8b3cd1e", "kind": "identity", "frame_number": 15423, "timestamp_epoch": "1647917039.084640000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-c43f182dcdbdd3a8f7198cd3", "kind": "identity", "frame_number": 15424, "timestamp_epoch": "1647917039.085478000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-76168e621cb7a170c620a016", "kind": "identity", "frame_number": 15425, "timestamp_epoch": "1647917039.085748000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d58c19a2843a74c35172859e", "kind": "identity", "frame_number": 15426, "timestamp_epoch": "1647917039.086034000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-c3c5b596bbb80dde5c6ebc7b", "kind": "identity", "frame_number": 15427, "timestamp_epoch": "1647917039.086213000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-5dadcb8f303a30ba83ba9b64", "kind": "identity", "frame_number": 15428, "timestamp_epoch": "1647917039.086239000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-283e2e87c996c6f291f6432b", "kind": "identity", "frame_number": 15429, "timestamp_epoch": "1647917039.086437000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-622ba81ee413d84285dc7c9e", "kind": "identity", "frame_number": 15431, "timestamp_epoch": "1647917049.732852000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e430eff66954be3e4ede67ff", "kind": "identity", "frame_number": 15432, "timestamp_epoch": "1647917049.733060000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-f63a25de4c399ea4de47abe4", "kind": "identity", "frame_number": 15433, "timestamp_epoch": "1647917049.733268000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-590595e1af0cfa7e6fba0b46", "kind": "identity", "frame_number": 15434, "timestamp_epoch": "1647917049.733459000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 419, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-27b5ad16f7a06676c11e7e8e", "kind": "identity", "frame_number": 15524, "timestamp_epoch": "1647917299.055166000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a2fe3de5344c7e11d20df82f", "kind": "identity", "frame_number": 15525, "timestamp_epoch": "1647917299.055518000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-d903496acb79dad8c6b41e47", "kind": "identity", "frame_number": 15585, "timestamp_epoch": "1647917568.104634000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-fdc2220e4411a19efcb7c7b3", "kind": "identity", "frame_number": 15686, "timestamp_epoch": "1647917899.393892000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-01f93bcdd132e680de6eca91", "kind": "identity", "frame_number": 15687, "timestamp_epoch": "1647917899.394222000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-743c2d55715d0aa08bae4aed", "kind": "identity", "frame_number": 15731, "timestamp_epoch": "1647917939.043176000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-86f9ca503f905bcbd80eec5b", "kind": "identity", "frame_number": 15732, "timestamp_epoch": "1647917939.043341000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-2319320ad8dd2d09eb2bbe6c", "kind": "identity", "frame_number": 15733, "timestamp_epoch": "1647917939.043881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-533d4613a94b0103fb366fc6", "kind": "identity", "frame_number": 15738, "timestamp_epoch": "1647917939.045065000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 441, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-c3e03b18502ff1c595a114f0", "kind": "identity", "frame_number": 15741, "timestamp_epoch": "1647917939.047983000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 441, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "13" } }, { "event_id": "evt-9264f3f03443530ff0dae2b0", "kind": "identity", "frame_number": 15748, "timestamp_epoch": "1647917939.048670000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-bc0784c599b77c62637244c7", "kind": "identity", "frame_number": 15750, "timestamp_epoch": "1647917939.050745000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-7b02986ebc51cf0df1b10e9c", "kind": "identity", "frame_number": 15751, "timestamp_epoch": "1647917939.051082000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-3a26e264ef0e476d7bfbee57", "kind": "identity", "frame_number": 15752, "timestamp_epoch": "1647917939.051200000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c2d64db2a14faa8673104975", "kind": "identity", "frame_number": 15753, "timestamp_epoch": "1647917939.051484000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-725d69585f7a497eedf72b25", "kind": "identity", "frame_number": 15754, "timestamp_epoch": "1647917939.051585000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-d6fb7c188f661d86b2f3afcc", "kind": "identity", "frame_number": 15755, "timestamp_epoch": "1647917939.051661000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-3f46780eb68859a20cfeea85", "kind": "identity", "frame_number": 15756, "timestamp_epoch": "1647917939.051864000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-26e993da6a3ba0e4d856a9a1", "kind": "identity", "frame_number": 15758, "timestamp_epoch": "1647917949.794013000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e8731582f1675ed6115e6514", "kind": "identity", "frame_number": 15759, "timestamp_epoch": "1647917949.794198000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-cb030c7e113bac6f7b152554", "kind": "identity", "frame_number": 15760, "timestamp_epoch": "1647917949.794497000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-e6ec96c04443d0913dfd7a02", "kind": "identity", "frame_number": 15761, "timestamp_epoch": "1647917949.794585000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 440, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-ae87dc9d541a49a976b8b155", "kind": "identity", "frame_number": 15893, "timestamp_epoch": "1647918291.069231000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-35a6b2b68a13208066578c2e", "kind": "identity", "frame_number": 15978, "timestamp_epoch": "1647918499.739120000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-011c9b24efe8a23568ec786a", "kind": "identity", "frame_number": 15979, "timestamp_epoch": "1647918499.739323000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-86da72fc47f2938ec0f571a0", "kind": "identity", "frame_number": 16044, "timestamp_epoch": "1647918729.756590000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 456, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-11884bf760ef422efd509542", "kind": "identity", "frame_number": 16046, "timestamp_epoch": "1647918729.756903000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 456, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-2aca1c960175368e2655d077", "kind": "identity", "frame_number": 16053, "timestamp_epoch": "1647918729.757812000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 457, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "desktop-5qs3d5d$", "kerberos.msg_type": "10" } }, { "event_id": "evt-d3c53cc8b33f2a201723f28c", "kind": "identity", "frame_number": 16054, "timestamp_epoch": "1647918729.758702000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 457, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "30" } }, { "event_id": "evt-37da2bc1815e454d9bcca289", "kind": "identity", "frame_number": 16061, "timestamp_epoch": "1647918729.779634000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 458, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.CNameString": "desktop-5qs3d5d$", "kerberos.msg_type": "10" } }, { "event_id": "evt-8b77bba15802e05c8b2f2bc2", "kind": "identity", "frame_number": 16063, "timestamp_epoch": "1647918729.781341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 458, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "11" } }, { "event_id": "evt-a892f21102899c76a3964e4c", "kind": "identity", "frame_number": 16072, "timestamp_epoch": "1647918729.782271000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 459, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-ba1e3453b3e7220e310b1285", "kind": "identity", "frame_number": 16077, "timestamp_epoch": "1647918729.784514000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 459, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.CNameString": "DESKTOP-5QS3D5D$", "kerberos.msg_type": "13" } }, { "event_id": "evt-6bcb9725e586ff53123a4b86", "kind": "identity", "frame_number": 16083, "timestamp_epoch": "1647918729.785162000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-2b2838e215df14cc22721f18", "kind": "identity", "frame_number": 16085, "timestamp_epoch": "1647918729.786359000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-4e7e2992670319a0b494cc2e", "kind": "identity", "frame_number": 16086, "timestamp_epoch": "1647918729.786628000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "15" } }, { "event_id": "evt-46173791185a4d637cc5bfac", "kind": "identity", "frame_number": 16116, "timestamp_epoch": "1647918729.903484000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-50a28c7b4cfc91893407a142", "kind": "identity", "frame_number": 16118, "timestamp_epoch": "1647918729.904197000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-2b8af4ab1355d1911d3e53ed", "kind": "identity", "frame_number": 16129, "timestamp_epoch": "1647918729.913565000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-ae1d706916b4bed366c81e3d", "kind": "identity", "frame_number": 16131, "timestamp_epoch": "1647918729.914308000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-d83ff575b00bf4a4f1c97e9b", "kind": "identity", "frame_number": 16190, "timestamp_epoch": "1647918839.015374000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-0faecd7f46705cf319714850", "kind": "identity", "frame_number": 16191, "timestamp_epoch": "1647918839.015588000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-9c5697a32f37ea08824d2df7", "kind": "identity", "frame_number": 16192, "timestamp_epoch": "1647918839.016170000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-91fcd91e674201ea60f8cef7", "kind": "identity", "frame_number": 16195, "timestamp_epoch": "1647918839.018554000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f", "kerberos.msg_type": "14" } }, { "event_id": "evt-35dc077daabc88baa28238a3", "kind": "identity", "frame_number": 16197, "timestamp_epoch": "1647918839.020634000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19", "kerberos.msg_type": "15" } }, { "event_id": "evt-9fdbee58a5cdc7b30bf45572", "kind": "identity", "frame_number": 16198, "timestamp_epoch": "1647918839.021458000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-6f4f49bc1f3d7474245a6fca", "kind": "identity", "frame_number": 16199, "timestamp_epoch": "1647918839.021718000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-972c5950a59556bfaacb6848", "kind": "identity", "frame_number": 16200, "timestamp_epoch": "1647918839.022063000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-90c5f81d83c3422be0a0e211", "kind": "identity", "frame_number": 16201, "timestamp_epoch": "1647918839.022260000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-5e835ffd8cf2a7116e6e0d60", "kind": "identity", "frame_number": 16202, "timestamp_epoch": "1647918839.022281000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-aedc5c09bd0f5eece5917151", "kind": "identity", "frame_number": 16203, "timestamp_epoch": "1647918839.022577000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-42f6a026e79c78d5a07e3328", "kind": "identity", "frame_number": 16205, "timestamp_epoch": "1647918849.760471000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-a00a8dd7395816d37e1fbe62", "kind": "identity", "frame_number": 16206, "timestamp_epoch": "1647918849.760699000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-c2ed06d1ace50936ace3f307", "kind": "identity", "frame_number": 16207, "timestamp_epoch": "1647918849.761007000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:c0:4f:f8:48:19", "eth.src": "00:60:52:b7:33:0f" } }, { "event_id": "evt-1a37486aa4983a24dc5f809b", "kind": "identity", "frame_number": 16208, "timestamp_epoch": "1647918849.761099000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 464, "udp_stream": null, "fields": { "eth.dst": "00:60:52:b7:33:0f", "eth.src": "00:c0:4f:f8:48:19" } }, { "event_id": "evt-8b678addeac3dc69bfdb965d", "kind": "identity", "frame_number": 16285, "timestamp_epoch": "1647919010.588600000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 5, "fields": { "browser.server": "DESKTOP-5QS3D5D", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:60:52:b7:33:0f" } } ], "directory_service": [ { "event_id": "evt-c9f05d484158e32126942874", "kind": "directory_service", "frame_number": 816, "timestamp_epoch": "1647896381.095711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-a194e04af99ff27765c6706b", "kind": "directory_service", "frame_number": 817, "timestamp_epoch": "1647896381.096044000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-310c232963a74d99dcc9a701", "kind": "directory_service", "frame_number": 818, "timestamp_epoch": "1647896381.096261000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-5e3f77b39374e31172756bf0", "kind": "directory_service", "frame_number": 819, "timestamp_epoch": "1647896381.096521000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-bab64f3004c8b8ba618518d3", "kind": "directory_service", "frame_number": 820, "timestamp_epoch": "1647896381.096678000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-f8c326cfbd0161eee7cba7ba", "kind": "directory_service", "frame_number": 821, "timestamp_epoch": "1647896381.096926000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-9ea75c740ea4f5976c4037e6", "kind": "directory_service", "frame_number": 822, "timestamp_epoch": "1647896381.097074000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-86314b0d9935d5c390bd75bc", "kind": "directory_service", "frame_number": 823, "timestamp_epoch": "1647896381.097325000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-0b64a973052ed6c613c80282", "kind": "directory_service", "frame_number": 824, "timestamp_epoch": "1647896381.097515000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-af18569705e837233c64f3c0", "kind": "directory_service", "frame_number": 825, "timestamp_epoch": "1647896381.097809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-106b324d6ef5154f2e0e3cc4", "kind": "directory_service", "frame_number": 826, "timestamp_epoch": "1647896381.097970000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-6a8e2957995f586e8a468c3e", "kind": "directory_service", "frame_number": 827, "timestamp_epoch": "1647896381.098306000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-472f094d224f2f7dd962f0a1", "kind": "directory_service", "frame_number": 828, "timestamp_epoch": "1647896381.098472000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-4ac1803a63dff9701fe77bf3", "kind": "directory_service", "frame_number": 829, "timestamp_epoch": "1647896381.098696000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "20" } }, { "event_id": "evt-e6e49e55888b656992020c99", "kind": "directory_service", "frame_number": 830, "timestamp_epoch": "1647896381.098861000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-0c6d61af64aab1cadf4cb912", "kind": "directory_service", "frame_number": 831, "timestamp_epoch": "1647896381.099041000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-cc507fdf1dd66a93663b06e0", "kind": "directory_service", "frame_number": 832, "timestamp_epoch": "1647896381.099183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1564cecbdceb1223b288a34d", "kind": "directory_service", "frame_number": 833, "timestamp_epoch": "1647896381.099367000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9d38ad81eb7837a15f9b0c9f", "kind": "directory_service", "frame_number": 834, "timestamp_epoch": "1647896381.099575000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-37d004593df6c8a3861f8e28", "kind": "directory_service", "frame_number": 835, "timestamp_epoch": "1647896381.099713000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-154941ad007bb097833abfd8", "kind": "directory_service", "frame_number": 846, "timestamp_epoch": "1647896381.101875000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-37f9c307fdf87430a423ff45", "kind": "directory_service", "frame_number": 847, "timestamp_epoch": "1647896381.102111000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-92aa377250a871aa1636ae56", "kind": "directory_service", "frame_number": 848, "timestamp_epoch": "1647896381.102276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-1141a7a9800aaa0f62f68819", "kind": "directory_service", "frame_number": 849, "timestamp_epoch": "1647896381.102499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-7286f4d313edb625dada5490", "kind": "directory_service", "frame_number": 850, "timestamp_epoch": "1647896381.102669000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-80b5e501a8d3a048383490aa", "kind": "directory_service", "frame_number": 851, "timestamp_epoch": "1647896381.102814000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-953f01e9f60874e9b1a2d846", "kind": "directory_service", "frame_number": 852, "timestamp_epoch": "1647896381.102982000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-a1f2d3979aee9446f99cda52", "kind": "directory_service", "frame_number": 853, "timestamp_epoch": "1647896381.103174000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-eb8d0ce23debca5438e79928", "kind": "directory_service", "frame_number": 854, "timestamp_epoch": "1647896381.103307000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-c04d44eaa9c90eafc8e733d1", "kind": "directory_service", "frame_number": 855, "timestamp_epoch": "1647896381.103576000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-c88996c17a8fc98dd969279a", "kind": "directory_service", "frame_number": 856, "timestamp_epoch": "1647896381.103795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-19194f6da15a0dcca25d94e5", "kind": "directory_service", "frame_number": 857, "timestamp_epoch": "1647896381.104034000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "19" } }, { "event_id": "evt-7144e103fd5b8e3aab3eebf3", "kind": "directory_service", "frame_number": 858, "timestamp_epoch": "1647896381.104259000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-6566e4bbf3725e11c2fccea4", "kind": "directory_service", "frame_number": 859, "timestamp_epoch": "1647896381.104481000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "25" } }, { "event_id": "evt-625ef9a38514a315a06110a4", "kind": "directory_service", "frame_number": 860, "timestamp_epoch": "1647896381.104696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-64ccd706ebe97ef8fab5992b", "kind": "directory_service", "frame_number": 861, "timestamp_epoch": "1647896381.104879000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "18" } }, { "event_id": "evt-858139881bbf79f7b138666f", "kind": "directory_service", "frame_number": 862, "timestamp_epoch": "1647896381.105037000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-683ced900f21154d66c2d26e", "kind": "directory_service", "frame_number": 863, "timestamp_epoch": "1647896381.105216000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-a27db0c4c1ab89368ccdce6b", "kind": "directory_service", "frame_number": 864, "timestamp_epoch": "1647896381.105372000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-b34d90bcc2735b924c4dc0b7", "kind": "directory_service", "frame_number": 865, "timestamp_epoch": "1647896381.105502000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f3671c0e530c63c5b5d3f524", "kind": "directory_service", "frame_number": 866, "timestamp_epoch": "1647896381.105662000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-24e63582025661891b43f0c9", "kind": "directory_service", "frame_number": 867, "timestamp_epoch": "1647896381.105800000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-0627d2c3d41d10c1f42bed7a", "kind": "directory_service", "frame_number": 3450, "timestamp_epoch": "1647897130.329916000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-92a8cf3f7118256cb60ca805", "kind": "directory_service", "frame_number": 3451, "timestamp_epoch": "1647897130.330464000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-cc39b67326bc942ea1e5a1c7", "kind": "directory_service", "frame_number": 3452, "timestamp_epoch": "1647897130.330833000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-51ff0befe0384f5781ab677b", "kind": "directory_service", "frame_number": 3453, "timestamp_epoch": "1647897130.331478000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-29a5da58922eb8030b48b758", "kind": "directory_service", "frame_number": 3454, "timestamp_epoch": "1647897130.331661000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-043c9f76eb07f855570cb88b", "kind": "directory_service", "frame_number": 3455, "timestamp_epoch": "1647897130.331868000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8428242395c33b60b99d20f7", "kind": "directory_service", "frame_number": 3458, "timestamp_epoch": "1647897130.333439000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3b2f046a3aba5bfaa0835140", "kind": "directory_service", "frame_number": 3459, "timestamp_epoch": "1647897130.333787000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-83ee532c435f74d88471b842", "kind": "directory_service", "frame_number": 3460, "timestamp_epoch": "1647897130.333988000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9857a036f328f7c696e2c454", "kind": "directory_service", "frame_number": 3461, "timestamp_epoch": "1647897130.334601000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-df13760a955d537cc0b010d7", "kind": "directory_service", "frame_number": 3462, "timestamp_epoch": "1647897130.334759000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c56fccd0899a2a9f9f9ecaba", "kind": "directory_service", "frame_number": 3463, "timestamp_epoch": "1647897130.334959000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-79322ec254195d518c7f1212", "kind": "directory_service", "frame_number": 3473, "timestamp_epoch": "1647897130.443849000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-83c0b7dda0fc88eea8d1fd71", "kind": "directory_service", "frame_number": 3475, "timestamp_epoch": "1647897130.444539000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1dd83932ca65acde71a37246", "kind": "directory_service", "frame_number": 3478, "timestamp_epoch": "1647897130.446665000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f1aafad56407eb8a089235a4", "kind": "directory_service", "frame_number": 3480, "timestamp_epoch": "1647897130.447415000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-0f680ad60879314cce92fda5", "kind": "directory_service", "frame_number": 3481, "timestamp_epoch": "1647897130.448276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a7f62e253d920dd9ee8a2117", "kind": "directory_service", "frame_number": 3482, "timestamp_epoch": "1647897130.448652000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f3664e35447c0bcd9b3cf936", "kind": "directory_service", "frame_number": 3483, "timestamp_epoch": "1647897130.449057000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-021b3da30d1f2f5a27a0127c", "kind": "directory_service", "frame_number": 3484, "timestamp_epoch": "1647897130.449446000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bac7360b44527328f282194a", "kind": "directory_service", "frame_number": 3485, "timestamp_epoch": "1647897130.449815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6e52f592502ec1be727b2bea", "kind": "directory_service", "frame_number": 3486, "timestamp_epoch": "1647897130.449967000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f2a2a3b566e1978ac254a7c7", "kind": "directory_service", "frame_number": 3491, "timestamp_epoch": "1647897130.456341000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-1a6da89fb3f5b9c1d7a99053", "kind": "directory_service", "frame_number": 3493, "timestamp_epoch": "1647897130.457079000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-cd043246facc6e96b6e7e27e", "kind": "directory_service", "frame_number": 3494, "timestamp_epoch": "1647897130.457863000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-bd82d5932b8746a22a5b6bf7", "kind": "directory_service", "frame_number": 3497, "timestamp_epoch": "1647897130.458656000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-04f9012a954bc522a119079f", "kind": "directory_service", "frame_number": 3499, "timestamp_epoch": "1647897130.459238000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f49cda414cf5dca26236724e", "kind": "directory_service", "frame_number": 3500, "timestamp_epoch": "1647897130.459447000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-cebb440edbdaa427dc1e0a09", "kind": "directory_service", "frame_number": 3501, "timestamp_epoch": "1647897130.459792000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-fdc2be1741d78598c14fdb17", "kind": "directory_service", "frame_number": 3503, "timestamp_epoch": "1647897130.460220000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-c9b74b52081e05261828efb0", "kind": "directory_service", "frame_number": 3681, "timestamp_epoch": "1647897816.611458000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-7ed6b5dfdec748f82c582dc7", "kind": "directory_service", "frame_number": 3682, "timestamp_epoch": "1647897816.612077000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-9bc931ef5b9a6f046efe5122", "kind": "directory_service", "frame_number": 3683, "timestamp_epoch": "1647897816.612142000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-d504cc1816d054b450bdd188", "kind": "directory_service", "frame_number": 3684, "timestamp_epoch": "1647897816.612601000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-60289ccb9621acb7a0211b85", "kind": "directory_service", "frame_number": 3685, "timestamp_epoch": "1647897816.612669000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-c2ed5550478982b09431d9f5", "kind": "directory_service", "frame_number": 3686, "timestamp_epoch": "1647897816.613032000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-47e61e69f2760b4eeb197936", "kind": "directory_service", "frame_number": 3687, "timestamp_epoch": "1647897816.613135000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-c87fbf7c517f9aff5647d03f", "kind": "directory_service", "frame_number": 3688, "timestamp_epoch": "1647897816.613753000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-fcf67c6bbac0cfcb41c97621", "kind": "directory_service", "frame_number": 3689, "timestamp_epoch": "1647897816.613810000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-634e157d5125a2833c173870", "kind": "directory_service", "frame_number": 3690, "timestamp_epoch": "1647897816.614360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-f62844e45496d51e34d7806f", "kind": "directory_service", "frame_number": 3691, "timestamp_epoch": "1647897816.614434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-0f3db23002d3d3b8b74ebf26", "kind": "directory_service", "frame_number": 3692, "timestamp_epoch": "1647897816.615084000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-7cde4f5096ffba76f896bd33", "kind": "directory_service", "frame_number": 3693, "timestamp_epoch": "1647897816.615140000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-8b8739cd15a906a96fbececd", "kind": "directory_service", "frame_number": 3694, "timestamp_epoch": "1647897816.616039000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-878a0b51a13fbac90c2a17f2", "kind": "directory_service", "frame_number": 3695, "timestamp_epoch": "1647897816.616146000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-93fbb36837cafbb9659e21bd", "kind": "directory_service", "frame_number": 3696, "timestamp_epoch": "1647897816.616993000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "patrick.zimmerman", "samr.samr_UserInfo21.full_name": "Patrick Zimmerman" } }, { "event_id": "evt-43d1b7446284a4ec051838b4", "kind": "directory_service", "frame_number": 3697, "timestamp_epoch": "1647897816.617090000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-82eca2c77247ce5502d2ca5b", "kind": "directory_service", "frame_number": 3698, "timestamp_epoch": "1647897816.617777000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-fdba941592fdc73e7c3eb17f", "kind": "directory_service", "frame_number": 3699, "timestamp_epoch": "1647897816.617874000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-7d6502c99989eada4a71bd02", "kind": "directory_service", "frame_number": 3700, "timestamp_epoch": "1647897816.618281000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-d18862caa6e4a534bc8a2273", "kind": "directory_service", "frame_number": 3701, "timestamp_epoch": "1647897816.618400000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-24f275d19773fd07b6cda96d", "kind": "directory_service", "frame_number": 3702, "timestamp_epoch": "1647897816.618775000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-1f42a50b7cc5fcad2e53ee83", "kind": "directory_service", "frame_number": 3703, "timestamp_epoch": "1647897816.618923000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-cfe3161d5c21216518510b15", "kind": "directory_service", "frame_number": 3704, "timestamp_epoch": "1647897816.619241000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-2eca6f877f901a645395be6b", "kind": "directory_service", "frame_number": 3705, "timestamp_epoch": "1647897816.619345000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-96ddc6dd95c002a1307af615", "kind": "directory_service", "frame_number": 3706, "timestamp_epoch": "1647897816.619754000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1dde0e3be0277a197e0d78ed", "kind": "directory_service", "frame_number": 3707, "timestamp_epoch": "1647897816.619815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-7ddad21578b60ac4b90147d8", "kind": "directory_service", "frame_number": 3708, "timestamp_epoch": "1647897816.620196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f7dff6e20f46cd9014809257", "kind": "directory_service", "frame_number": 3709, "timestamp_epoch": "1647897816.620282000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-8735c226811e67bb6cb415a6", "kind": "directory_service", "frame_number": 3710, "timestamp_epoch": "1647897816.620689000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-cdc832e83c03c99900bb4445", "kind": "directory_service", "frame_number": 3804, "timestamp_epoch": "1647898110.964639000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e61e5b937b7bd19fec7965b4", "kind": "directory_service", "frame_number": 3806, "timestamp_epoch": "1647898110.965251000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ada82b9b204dafd0c9f0cc97", "kind": "directory_service", "frame_number": 3809, "timestamp_epoch": "1647898110.966086000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-fa6eef4982f7ad23b1a64d51", "kind": "directory_service", "frame_number": 3811, "timestamp_epoch": "1647898110.966963000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b3de42c4add8a9f776e5aef9", "kind": "directory_service", "frame_number": 3812, "timestamp_epoch": "1647898110.967231000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-ffd6de27f6b0f04343ec7dfe", "kind": "directory_service", "frame_number": 4206, "timestamp_epoch": "1647899008.789886000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6209aab6b33028992f776d30", "kind": "directory_service", "frame_number": 4207, "timestamp_epoch": "1647899008.790196000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4aa4897b4a5be7d37033eb6b", "kind": "directory_service", "frame_number": 4208, "timestamp_epoch": "1647899008.790396000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4dd8f93425cd9331b27fd935", "kind": "directory_service", "frame_number": 4209, "timestamp_epoch": "1647899008.791040000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-36e166465f239d2f6b6f8349", "kind": "directory_service", "frame_number": 4210, "timestamp_epoch": "1647899008.791156000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-cba74738b716eaaabb0e72b1", "kind": "directory_service", "frame_number": 4211, "timestamp_epoch": "1647899008.791690000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-542ee60273c3e8593fe4af62", "kind": "directory_service", "frame_number": 4212, "timestamp_epoch": "1647899008.791779000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5582894b11ebe101fb55426f", "kind": "directory_service", "frame_number": 4213, "timestamp_epoch": "1647899008.792028000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6a75b7e958749570d4b2a141", "kind": "directory_service", "frame_number": 4286, "timestamp_epoch": "1647899008.803809000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-51e17921fd9d57445b62672a", "kind": "directory_service", "frame_number": 4287, "timestamp_epoch": "1647899008.804112000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-6293dc6ff3126ca59a1b0f5b", "kind": "directory_service", "frame_number": 4288, "timestamp_epoch": "1647899008.804203000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-f08cb8df233db858291a0631", "kind": "directory_service", "frame_number": 4289, "timestamp_epoch": "1647899008.804461000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-892fbc7f588db5ab54f774b2", "kind": "directory_service", "frame_number": 4290, "timestamp_epoch": "1647899008.804548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-9db59134235732649dae922e", "kind": "directory_service", "frame_number": 4291, "timestamp_epoch": "1647899008.804796000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-4a379eec8060ff6b5796acfd", "kind": "directory_service", "frame_number": 4292, "timestamp_epoch": "1647899008.804874000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-682fbe21a21acd04077dab27", "kind": "directory_service", "frame_number": 4293, "timestamp_epoch": "1647899008.805122000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-e2bc3b15ef8e953d98616641", "kind": "directory_service", "frame_number": 4294, "timestamp_epoch": "1647899008.805311000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-ab1cefadf2f262e9044ec0b5", "kind": "directory_service", "frame_number": 4295, "timestamp_epoch": "1647899008.805561000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-581fd616c4d9a32cfc9415e4", "kind": "directory_service", "frame_number": 4296, "timestamp_epoch": "1647899008.805736000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-a31634ed1b9dd2e522160011", "kind": "directory_service", "frame_number": 4301, "timestamp_epoch": "1647899008.806089000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-dc4a37f1617c1ee4f751e402", "kind": "directory_service", "frame_number": 4303, "timestamp_epoch": "1647899008.806272000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-ec4698afda893e9cf1f1779c", "kind": "directory_service", "frame_number": 4307, "timestamp_epoch": "1647899008.806952000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-5ebef9810a4652fb0e702624", "kind": "directory_service", "frame_number": 4311, "timestamp_epoch": "1647899008.807109000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-b7491f1ff13065ec5038b41f", "kind": "directory_service", "frame_number": 4317, "timestamp_epoch": "1647899008.807692000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "patrick.zimmerman", "samr.samr_UserInfo21.full_name": "Patrick Zimmerman" } }, { "event_id": "evt-31afd8ba5b7753769fd6e85e", "kind": "directory_service", "frame_number": 4319, "timestamp_epoch": "1647899008.807815000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-7ed9290ee104a8adc6aa1f80", "kind": "directory_service", "frame_number": 4320, "timestamp_epoch": "1647899008.808242000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-4cca40f198d08a2cef605932", "kind": "directory_service", "frame_number": 4321, "timestamp_epoch": "1647899008.808319000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-221e2a499db6287ec9d09a85", "kind": "directory_service", "frame_number": 4324, "timestamp_epoch": "1647899008.808757000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-ced6670388116cfc6f5b0c81", "kind": "directory_service", "frame_number": 4329, "timestamp_epoch": "1647899008.808946000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-745f326d9863c788786e3757", "kind": "directory_service", "frame_number": 4330, "timestamp_epoch": "1647899008.809201000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-820278224eb96bd134b204a7", "kind": "directory_service", "frame_number": 4331, "timestamp_epoch": "1647899008.809305000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-b445dacb1e5788cb7b330586", "kind": "directory_service", "frame_number": 4332, "timestamp_epoch": "1647899008.809495000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-e5bc8c5c36f4af7f205ab7d2", "kind": "directory_service", "frame_number": 4333, "timestamp_epoch": "1647899008.809642000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-2c859cf71ea83937b08d14f0", "kind": "directory_service", "frame_number": 4334, "timestamp_epoch": "1647899008.809881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-57487af751fada2f56fdca14", "kind": "directory_service", "frame_number": 4335, "timestamp_epoch": "1647899008.809986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-21a7657a81b5dc6babfe8b17", "kind": "directory_service", "frame_number": 4336, "timestamp_epoch": "1647899008.810217000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-d5489bb59c20c0cb7f214755", "kind": "directory_service", "frame_number": 4337, "timestamp_epoch": "1647899008.810323000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-d4a102443598d9b30d005d3d", "kind": "directory_service", "frame_number": 4338, "timestamp_epoch": "1647899008.810629000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-830a72393cfb41667e7c17f3", "kind": "directory_service", "frame_number": 4378, "timestamp_epoch": "1647899009.107932000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-12bb4acecbc0ea533c7c4877", "kind": "directory_service", "frame_number": 4380, "timestamp_epoch": "1647899009.108807000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-09060c3586b6bf70e975eb31", "kind": "directory_service", "frame_number": 4383, "timestamp_epoch": "1647899009.109732000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-af3b46f89185dc2ab2e0b589", "kind": "directory_service", "frame_number": 4385, "timestamp_epoch": "1647899009.111125000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8e66412650bf2b82f690bfd8", "kind": "directory_service", "frame_number": 4386, "timestamp_epoch": "1647899009.116568000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-5cf803148995e6a7cd361574", "kind": "directory_service", "frame_number": 4387, "timestamp_epoch": "1647899009.117212000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-e74604dc61dd834d8d6f24d0", "kind": "directory_service", "frame_number": 4392, "timestamp_epoch": "1647899009.119228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-0b042d12ef936931138f428e", "kind": "directory_service", "frame_number": 4394, "timestamp_epoch": "1647899009.120599000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-6842ea72dd3556725bfd3c39", "kind": "directory_service", "frame_number": 4395, "timestamp_epoch": "1647899009.120885000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ad7d1be453e6323d69fdc3ce", "kind": "directory_service", "frame_number": 4396, "timestamp_epoch": "1647899009.121107000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-cbda671a5debd84cf2184577", "kind": "directory_service", "frame_number": 4397, "timestamp_epoch": "1647899009.121276000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-d3ab7f70ecba841d63e41322", "kind": "directory_service", "frame_number": 4398, "timestamp_epoch": "1647899009.121530000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-559d26a6560c2322f6a9c233", "kind": "directory_service", "frame_number": 4399, "timestamp_epoch": "1647899009.122580000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-bd23d19343fd3c6d089eaaa0", "kind": "directory_service", "frame_number": 4400, "timestamp_epoch": "1647899009.123168000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-a8f5aeaa4b178fdd89708a59", "kind": "directory_service", "frame_number": 4406, "timestamp_epoch": "1647899009.435538000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-29db817f1db74e7880928c39", "kind": "directory_service", "frame_number": 4410, "timestamp_epoch": "1647899009.437661000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-54b902945da462cfcf2ad7ba", "kind": "directory_service", "frame_number": 4843, "timestamp_epoch": "1647899069.647910000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-99d6f35774fbbbabad839306", "kind": "directory_service", "frame_number": 4844, "timestamp_epoch": "1647899069.648413000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-def72d82d003e48574aaf651", "kind": "directory_service", "frame_number": 4845, "timestamp_epoch": "1647899069.648662000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-521298ed9072b882249b74a9", "kind": "directory_service", "frame_number": 4846, "timestamp_epoch": "1647899069.649388000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c8e68b828cae6ce8e44fbcc7", "kind": "directory_service", "frame_number": 4847, "timestamp_epoch": "1647899069.649532000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-e77c10a9cec4684b262a6a19", "kind": "directory_service", "frame_number": 4848, "timestamp_epoch": "1647899069.649830000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-2679c0b151754544646033d9", "kind": "directory_service", "frame_number": 4851, "timestamp_epoch": "1647899069.650809000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-d59b17f52a48c89399ad718d", "kind": "directory_service", "frame_number": 4852, "timestamp_epoch": "1647899069.651114000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1ca0930ce5f82e6e9f7880d7", "kind": "directory_service", "frame_number": 4853, "timestamp_epoch": "1647899069.651273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-dd23733b8388ceff68cad213", "kind": "directory_service", "frame_number": 4854, "timestamp_epoch": "1647899069.651939000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6d78e0ca28df0e4f56a21698", "kind": "directory_service", "frame_number": 4855, "timestamp_epoch": "1647899069.652082000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d95d7d3da84e11bed37f23bd", "kind": "directory_service", "frame_number": 4856, "timestamp_epoch": "1647899069.652331000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-18dd3ea59886f75b2c9a156c", "kind": "directory_service", "frame_number": 4860, "timestamp_epoch": "1647899069.653574000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-d3fb37bebedb5c58e0e9fc34", "kind": "directory_service", "frame_number": 4862, "timestamp_epoch": "1647899069.654272000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a67952de108943e84ec45d35", "kind": "directory_service", "frame_number": 4865, "timestamp_epoch": "1647899069.654943000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6309b64b4475d34fcc5fd213", "kind": "directory_service", "frame_number": 4867, "timestamp_epoch": "1647899069.656347000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-37f049de07a06f474a379a0b", "kind": "directory_service", "frame_number": 4868, "timestamp_epoch": "1647899069.656581000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-333e5f9bc981e1fc655b8b26", "kind": "directory_service", "frame_number": 4869, "timestamp_epoch": "1647899069.657116000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-81a0475c31c4e699a7ec65b8", "kind": "directory_service", "frame_number": 4870, "timestamp_epoch": "1647899069.657280000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-75d978788995e6608b6d8081", "kind": "directory_service", "frame_number": 4871, "timestamp_epoch": "1647899069.657633000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1cdb679d6044da2b7da91545", "kind": "directory_service", "frame_number": 4872, "timestamp_epoch": "1647899069.657888000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1e61cf23629d0243508d402e", "kind": "directory_service", "frame_number": 4873, "timestamp_epoch": "1647899069.658294000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1ff5ed6075f1313a7d011712", "kind": "directory_service", "frame_number": 4878, "timestamp_epoch": "1647899069.660236000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f02f6cf09e34dd23391595e8", "kind": "directory_service", "frame_number": 4880, "timestamp_epoch": "1647899069.661690000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-73e753a00c07698490078823", "kind": "directory_service", "frame_number": 4881, "timestamp_epoch": "1647899069.661912000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f5ac1e160e491172dfec112a", "kind": "directory_service", "frame_number": 4884, "timestamp_epoch": "1647899069.662733000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-73d96ff53e8c95a20a8cee20", "kind": "directory_service", "frame_number": 4886, "timestamp_epoch": "1647899069.662851000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-eb6a615be554d14884d8511a", "kind": "directory_service", "frame_number": 4887, "timestamp_epoch": "1647899069.663368000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-a1abed9f609f26b3a5781b58", "kind": "directory_service", "frame_number": 4888, "timestamp_epoch": "1647899069.663504000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-147f042fbb653aaed9db9d13", "kind": "directory_service", "frame_number": 4890, "timestamp_epoch": "1647899069.663604000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 73, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-2ce4b80df522036ec8033bd2", "kind": "directory_service", "frame_number": 6994, "timestamp_epoch": "1647900354.449183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6f9926158602a842da3095f3", "kind": "directory_service", "frame_number": 6996, "timestamp_epoch": "1647900354.450032000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-cf7656308aa712c2319039c9", "kind": "directory_service", "frame_number": 7011, "timestamp_epoch": "1647900354.454129000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-71a75f620d7def75047a401d", "kind": "directory_service", "frame_number": 7013, "timestamp_epoch": "1647900354.455609000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c2b102fd3e795bab45bf0a20", "kind": "directory_service", "frame_number": 7014, "timestamp_epoch": "1647900354.458460000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-4af5bf51cb6a1375289b332c", "kind": "directory_service", "frame_number": 7017, "timestamp_epoch": "1647900354.459404000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9c41809d80fdad40b635bae6", "kind": "directory_service", "frame_number": 7019, "timestamp_epoch": "1647900354.459585000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 104, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-03ddf5f41f87271156997680", "kind": "directory_service", "frame_number": 7027, "timestamp_epoch": "1647900354.461285000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-41188e8f3e2206f7704c8641", "kind": "directory_service", "frame_number": 7029, "timestamp_epoch": "1647900354.462709000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-cd3c4d7375a5ca6275f40b97", "kind": "directory_service", "frame_number": 7030, "timestamp_epoch": "1647900354.462864000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-38c6ea671b6df5f98b3422f0", "kind": "directory_service", "frame_number": 7031, "timestamp_epoch": "1647900354.463138000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4aa792361d1290b7c6994842", "kind": "directory_service", "frame_number": 7032, "timestamp_epoch": "1647900354.463895000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-68931e44747ced51ae545272", "kind": "directory_service", "frame_number": 7033, "timestamp_epoch": "1647900354.464508000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-51cdf33fe8ffec6414d9d160", "kind": "directory_service", "frame_number": 7034, "timestamp_epoch": "1647900354.464614000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8d21bfa9b81d9705a4376dfa", "kind": "directory_service", "frame_number": 7040, "timestamp_epoch": "1647900354.466354000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4c7e5510a225ef2cb720c673", "kind": "directory_service", "frame_number": 7042, "timestamp_epoch": "1647900354.466502000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c20804d138e2dbc8792fe97a", "kind": "directory_service", "frame_number": 7043, "timestamp_epoch": "1647900354.466963000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e50e97da09a8eb7227fd9b3f", "kind": "directory_service", "frame_number": 7044, "timestamp_epoch": "1647900354.467062000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Schema,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-dc36c3f13a5af59fea5c79af", "kind": "directory_service", "frame_number": 7045, "timestamp_epoch": "1647900354.467490000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-845d18c5a06f708dbc4d015d", "kind": "directory_service", "frame_number": 7046, "timestamp_epoch": "1647900354.467536000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Schema,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-6921e9d6c757359e69b0fe1b", "kind": "directory_service", "frame_number": 7047, "timestamp_epoch": "1647900354.467881000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bb83500170ea5c139f879bc7", "kind": "directory_service", "frame_number": 7048, "timestamp_epoch": "1647900354.470742000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-fd261fa768cc43a4123d7ef5", "kind": "directory_service", "frame_number": 7362, "timestamp_epoch": "1647900354.506596000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-7562202bcddc678d539cd3d4", "kind": "directory_service", "frame_number": 7364, "timestamp_epoch": "1647900354.547930000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-58548d40a77636141a8d0524", "kind": "directory_service", "frame_number": 7365, "timestamp_epoch": "1647900354.548251000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-77c7043c8f6193dc8d2c72ff", "kind": "directory_service", "frame_number": 7366, "timestamp_epoch": "1647900354.551729000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-e93678ff5778e9e508ecdb8e", "kind": "directory_service", "frame_number": 7372, "timestamp_epoch": "1647900354.553730000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4,4,4,5" } }, { "event_id": "evt-a904e07625c0396d9bb7c3f6", "kind": "directory_service", "frame_number": 8021, "timestamp_epoch": "1647900730.232183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a6cbd102c3fe26b970392e1e", "kind": "directory_service", "frame_number": 8022, "timestamp_epoch": "1647900730.232641000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-67d6c7b61bcef0ab2682cd35", "kind": "directory_service", "frame_number": 8023, "timestamp_epoch": "1647900730.233113000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c6957e4269fdea4a19f12115", "kind": "directory_service", "frame_number": 8024, "timestamp_epoch": "1647900730.233793000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-364949f31179bd8b00df1c19", "kind": "directory_service", "frame_number": 8025, "timestamp_epoch": "1647900730.234054000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9b8eb9e785616a125ed35ec1", "kind": "directory_service", "frame_number": 8026, "timestamp_epoch": "1647900730.234210000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8b277a5eab88690432870f11", "kind": "directory_service", "frame_number": 8029, "timestamp_epoch": "1647900730.236009000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3676e3807ea31e6b434208eb", "kind": "directory_service", "frame_number": 8030, "timestamp_epoch": "1647900730.236260000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1dbc5ed9927a6d3eabb82470", "kind": "directory_service", "frame_number": 8031, "timestamp_epoch": "1647900730.236528000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-28b7e4590dc804da616d97aa", "kind": "directory_service", "frame_number": 8032, "timestamp_epoch": "1647900730.237141000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-70591401d5983eec364a812b", "kind": "directory_service", "frame_number": 8033, "timestamp_epoch": "1647900730.237364000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-b591c47b134a9a35f952e8cd", "kind": "directory_service", "frame_number": 8034, "timestamp_epoch": "1647900730.237519000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-4a981cf64b36738421ec2026", "kind": "directory_service", "frame_number": 8038, "timestamp_epoch": "1647900730.239879000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a0dbd151a28de1264556aad5", "kind": "directory_service", "frame_number": 8040, "timestamp_epoch": "1647900730.240537000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f4253195071bef84f8e1625a", "kind": "directory_service", "frame_number": 8043, "timestamp_epoch": "1647900730.241525000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c642075649dea8bfbdd6fc76", "kind": "directory_service", "frame_number": 8045, "timestamp_epoch": "1647900730.242950000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-e40bec87563cebab57355e88", "kind": "directory_service", "frame_number": 8046, "timestamp_epoch": "1647900730.243268000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ac333203639d7d011a4f31ee", "kind": "directory_service", "frame_number": 8047, "timestamp_epoch": "1647900730.243600000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5a0b37e96f689ab92e95ab2d", "kind": "directory_service", "frame_number": 8048, "timestamp_epoch": "1647900730.243842000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-70c5dee62ef231961a903541", "kind": "directory_service", "frame_number": 8049, "timestamp_epoch": "1647900730.244212000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-c88b91e4b6f380ddf558c3fa", "kind": "directory_service", "frame_number": 8050, "timestamp_epoch": "1647900730.244387000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2cef8e03db2044eeadd248f6", "kind": "directory_service", "frame_number": 8051, "timestamp_epoch": "1647900730.244712000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-335c4b938a23edfbd60c6d53", "kind": "directory_service", "frame_number": 8056, "timestamp_epoch": "1647900730.246986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-70dc568a2733e00f83bb9373", "kind": "directory_service", "frame_number": 8058, "timestamp_epoch": "1647900730.248438000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-508c972f5ba7b9c124f7d282", "kind": "directory_service", "frame_number": 8059, "timestamp_epoch": "1647900730.248658000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-60025cb9a6e2333a850d833d", "kind": "directory_service", "frame_number": 8062, "timestamp_epoch": "1647900730.249442000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ed3a98a47cbbb82564ac946b", "kind": "directory_service", "frame_number": 8064, "timestamp_epoch": "1647900730.249607000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e5debdbfc477f06153cf0cff", "kind": "directory_service", "frame_number": 8065, "timestamp_epoch": "1647900730.250043000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-1316140ec4b3756a754162aa", "kind": "directory_service", "frame_number": 8066, "timestamp_epoch": "1647900730.250180000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 128, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-a2b0d486761505aadecc47af", "kind": "directory_service", "frame_number": 8068, "timestamp_epoch": "1647900730.250278000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 127, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-f42326b4acc425d2b3dfb077", "kind": "directory_service", "frame_number": 8098, "timestamp_epoch": "1647900774.085161000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b700b46a44d08a7c9a4b0643", "kind": "directory_service", "frame_number": 8099, "timestamp_epoch": "1647900774.085535000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-110199ea6c154f7c528db884", "kind": "directory_service", "frame_number": 8100, "timestamp_epoch": "1647900774.085821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-995d71b732947adba845015e", "kind": "directory_service", "frame_number": 8101, "timestamp_epoch": "1647900774.086435000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-556ce5786606397ead938561", "kind": "directory_service", "frame_number": 8102, "timestamp_epoch": "1647900774.086655000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6113ed16e0424401f4a49b64", "kind": "directory_service", "frame_number": 8103, "timestamp_epoch": "1647900774.086815000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-80ea20f5d628d1c88d84411a", "kind": "directory_service", "frame_number": 8111, "timestamp_epoch": "1647900774.396959000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-7a4fb93045a90be7b3e60f53", "kind": "directory_service", "frame_number": 8113, "timestamp_epoch": "1647900774.397637000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-55a3c956cf6089a2a069e234", "kind": "directory_service", "frame_number": 8116, "timestamp_epoch": "1647900774.398700000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-aa86035b667e48b05c0f0ca3", "kind": "directory_service", "frame_number": 8118, "timestamp_epoch": "1647900774.400149000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-ad0629b3d133b11318c4f7c9", "kind": "directory_service", "frame_number": 8119, "timestamp_epoch": "1647900774.406542000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-5d58ca8a7d5eab4213fa1859", "kind": "directory_service", "frame_number": 8120, "timestamp_epoch": "1647900774.407213000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-87bfcf6c94c3b144a9581b17", "kind": "directory_service", "frame_number": 8125, "timestamp_epoch": "1647900774.409200000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-ba3dda7283bac61e67577450", "kind": "directory_service", "frame_number": 8127, "timestamp_epoch": "1647900774.410661000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a06770a6f710e61a55242a85", "kind": "directory_service", "frame_number": 8128, "timestamp_epoch": "1647900774.410956000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-322ba1e0dd047315d86e1518", "kind": "directory_service", "frame_number": 8129, "timestamp_epoch": "1647900774.411124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-42c174ea5da5497226a9d7bb", "kind": "directory_service", "frame_number": 8130, "timestamp_epoch": "1647900774.411273000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-83d9fe2705208fd1075c451b", "kind": "directory_service", "frame_number": 8131, "timestamp_epoch": "1647900774.411575000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-8419ce9175f5091a959651c2", "kind": "directory_service", "frame_number": 8132, "timestamp_epoch": "1647900774.412115000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-238b4e94dc04bb32271b1af7", "kind": "directory_service", "frame_number": 8133, "timestamp_epoch": "1647900774.413002000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4b8fa64d5fc590127a7c5184", "kind": "directory_service", "frame_number": 8271, "timestamp_epoch": "1647900774.787829000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-32468d817a1851b6c9424c9c", "kind": "directory_service", "frame_number": 8275, "timestamp_epoch": "1647900774.792853000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-07d6921108a24b6e16ae4258", "kind": "directory_service", "frame_number": 9438, "timestamp_epoch": "1647904330.058457000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-45edc4f537442e21ad2df447", "kind": "directory_service", "frame_number": 9439, "timestamp_epoch": "1647904330.058917000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7bae70d9bf20c731666ef97a", "kind": "directory_service", "frame_number": 9440, "timestamp_epoch": "1647904330.059151000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6335db931b0420318a48046f", "kind": "directory_service", "frame_number": 9441, "timestamp_epoch": "1647904330.060052000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-469b5ddbe148f0eb6ab020b6", "kind": "directory_service", "frame_number": 9442, "timestamp_epoch": "1647904330.060195000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-859cf9cd3b7139354e9424b8", "kind": "directory_service", "frame_number": 9443, "timestamp_epoch": "1647904330.060448000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-2b45d615706358352c0ab4f7", "kind": "directory_service", "frame_number": 9446, "timestamp_epoch": "1647904330.061393000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6fe2ad8082332819a6d3c17e", "kind": "directory_service", "frame_number": 9447, "timestamp_epoch": "1647904330.061712000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-e5ee7b5984c6ab645f19ceb9", "kind": "directory_service", "frame_number": 9448, "timestamp_epoch": "1647904330.061881000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-21482c2fa9c580e8343086f9", "kind": "directory_service", "frame_number": 9449, "timestamp_epoch": "1647904330.062522000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-132d1c96888c2eb8e27c1254", "kind": "directory_service", "frame_number": 9450, "timestamp_epoch": "1647904330.062663000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a8173dca6a9397ce972e7e4b", "kind": "directory_service", "frame_number": 9451, "timestamp_epoch": "1647904330.062912000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 159, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-f724ccb3cc3f7f14ed94c55f", "kind": "directory_service", "frame_number": 9461, "timestamp_epoch": "1647904330.170760000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c4f7101e70964dc1fa8091fd", "kind": "directory_service", "frame_number": 9463, "timestamp_epoch": "1647904330.171499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1626251575d5e40319c75646", "kind": "directory_service", "frame_number": 9466, "timestamp_epoch": "1647904330.173540000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-69fb14ec3beb6e50451fca25", "kind": "directory_service", "frame_number": 9468, "timestamp_epoch": "1647904330.174261000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-e28dffd25b2ab8062da774ea", "kind": "directory_service", "frame_number": 9469, "timestamp_epoch": "1647904330.175091000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-69b1b2ec08affe6589d8d214", "kind": "directory_service", "frame_number": 9470, "timestamp_epoch": "1647904330.175513000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b8dac91db702770637ff3749", "kind": "directory_service", "frame_number": 9471, "timestamp_epoch": "1647904330.175929000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3469a507cd2ac80d1a203de5", "kind": "directory_service", "frame_number": 9472, "timestamp_epoch": "1647904330.176339000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a1e99b7cebca2a2332164553", "kind": "directory_service", "frame_number": 9473, "timestamp_epoch": "1647904330.176753000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-582135e469b4eabb609a4442", "kind": "directory_service", "frame_number": 9474, "timestamp_epoch": "1647904330.177144000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4873875afda3de9620441458", "kind": "directory_service", "frame_number": 9479, "timestamp_epoch": "1647904330.183723000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d4c5cd73a05287f3652dd01d", "kind": "directory_service", "frame_number": 9481, "timestamp_epoch": "1647904330.184486000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-5c47d8ef48ec7981719a90f9", "kind": "directory_service", "frame_number": 9482, "timestamp_epoch": "1647904330.185261000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e5dbb74e89d6601d1aab68e3", "kind": "directory_service", "frame_number": 9485, "timestamp_epoch": "1647904330.186013000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-717e83121d2938d1be1f0b4b", "kind": "directory_service", "frame_number": 9487, "timestamp_epoch": "1647904330.186488000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-9270508311918368df597d6a", "kind": "directory_service", "frame_number": 9488, "timestamp_epoch": "1647904330.186717000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-49a18b8d8ae8541dde4eb484", "kind": "directory_service", "frame_number": 9489, "timestamp_epoch": "1647904330.187120000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 161, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e31c3e18453d1eb22a68bf18", "kind": "directory_service", "frame_number": 9491, "timestamp_epoch": "1647904330.187616000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 160, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-64c0fd71ad3adbb9d8bfdc69", "kind": "directory_service", "frame_number": 9590, "timestamp_epoch": "1647904588.486786000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1e235756756c566af38f345b", "kind": "directory_service", "frame_number": 9591, "timestamp_epoch": "1647904588.487085000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a4d69b738b94e3f672d21772", "kind": "directory_service", "frame_number": 9592, "timestamp_epoch": "1647904588.487394000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-015c02d0c93d1e3d5b52709a", "kind": "directory_service", "frame_number": 9593, "timestamp_epoch": "1647904588.487713000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c707c2212449554499240af1", "kind": "directory_service", "frame_number": 9594, "timestamp_epoch": "1647904588.487966000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-f7694744f3807236009b1ae3", "kind": "directory_service", "frame_number": 9595, "timestamp_epoch": "1647904588.488042000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 165, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c277964746488246d84f10f6", "kind": "directory_service", "frame_number": 9618, "timestamp_epoch": "1647904588.928065000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0d72df0677ec50c1e8e95852", "kind": "directory_service", "frame_number": 9620, "timestamp_epoch": "1647904588.928829000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-73a5d453f9a34bd502da5736", "kind": "directory_service", "frame_number": 9623, "timestamp_epoch": "1647904588.929938000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-8598682e4a7007e599e9fa1a", "kind": "directory_service", "frame_number": 9625, "timestamp_epoch": "1647904588.931407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8a5bb239db7556dbef477786", "kind": "directory_service", "frame_number": 9626, "timestamp_epoch": "1647904588.935196000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-10189463f06aaac7605f4032", "kind": "directory_service", "frame_number": 9627, "timestamp_epoch": "1647904588.935824000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-a13b7c2e205d5c3b51a14ead", "kind": "directory_service", "frame_number": 9632, "timestamp_epoch": "1647904588.938139000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-9b76c95257217107fa48e931", "kind": "directory_service", "frame_number": 9634, "timestamp_epoch": "1647904588.939622000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1fd59822bde6bb53b22d34c4", "kind": "directory_service", "frame_number": 9635, "timestamp_epoch": "1647904588.939972000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6c41edac067b8e7d1d16564a", "kind": "directory_service", "frame_number": 9636, "timestamp_epoch": "1647904588.940139000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-79b86ff43c283f494b0aeff0", "kind": "directory_service", "frame_number": 9637, "timestamp_epoch": "1647904588.940374000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e7429c9fe568af4bc766b47c", "kind": "directory_service", "frame_number": 9638, "timestamp_epoch": "1647904588.940679000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-7c652161cb5690ec9c8b4961", "kind": "directory_service", "frame_number": 9639, "timestamp_epoch": "1647904588.941217000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-24db909341f6a5f9d8b01b4b", "kind": "directory_service", "frame_number": 9640, "timestamp_epoch": "1647904588.941779000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-6de83e465219ec10bdad08b4", "kind": "directory_service", "frame_number": 9645, "timestamp_epoch": "1647904589.255267000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 168, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-d068df33c1fcf2ac88b75f41", "kind": "directory_service", "frame_number": 9649, "timestamp_epoch": "1647904589.257630000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 167, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1c70af4996482800829847fa", "kind": "directory_service", "frame_number": 10460, "timestamp_epoch": "1647906954.856669000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1af3ad20554fb0249ea049cb", "kind": "directory_service", "frame_number": 10461, "timestamp_epoch": "1647906954.857096000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-368e268619a3c1598ccb02bd", "kind": "directory_service", "frame_number": 10462, "timestamp_epoch": "1647906954.857548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-5f849954dfa120114ba40c39", "kind": "directory_service", "frame_number": 10463, "timestamp_epoch": "1647906954.858287000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c641fd364ae2e400b00e3652", "kind": "directory_service", "frame_number": 10464, "timestamp_epoch": "1647906954.858600000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-e56af091b62b6a0205fed91f", "kind": "directory_service", "frame_number": 10465, "timestamp_epoch": "1647906954.858873000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 188, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5488417eb5790cc9632e9ede", "kind": "directory_service", "frame_number": 10473, "timestamp_epoch": "1647906955.060541000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2df0c9262f303c35ef5934e4", "kind": "directory_service", "frame_number": 10475, "timestamp_epoch": "1647906955.061243000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-871a23f2851639d357f34fa0", "kind": "directory_service", "frame_number": 10478, "timestamp_epoch": "1647906955.062253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a23a2ff11959a9337e7a21bf", "kind": "directory_service", "frame_number": 10480, "timestamp_epoch": "1647906955.063721000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c072dc9ccc1f69598d8b2623", "kind": "directory_service", "frame_number": 10481, "timestamp_epoch": "1647906955.068834000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-feba15314660060470219200", "kind": "directory_service", "frame_number": 10482, "timestamp_epoch": "1647906955.069495000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-f42abee855efbbb63d775e38", "kind": "directory_service", "frame_number": 10491, "timestamp_epoch": "1647906955.179897000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-ddb7d0cf8e146aace43b8ebf", "kind": "directory_service", "frame_number": 10493, "timestamp_epoch": "1647906955.181313000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-889780504e7107e472658d8a", "kind": "directory_service", "frame_number": 10494, "timestamp_epoch": "1647906955.182116000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-767a27c8b8deb7e3cfa50d30", "kind": "directory_service", "frame_number": 10495, "timestamp_epoch": "1647906955.182467000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-db0cb531a24d428fe74151a0", "kind": "directory_service", "frame_number": 10496, "timestamp_epoch": "1647906955.182881000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ed2e3ec1f86af5c4d62c78d4", "kind": "directory_service", "frame_number": 10497, "timestamp_epoch": "1647906955.183225000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-193716bf1c462ce135cfc134", "kind": "directory_service", "frame_number": 10498, "timestamp_epoch": "1647906955.184570000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-f5cab72c8345ba5ffb5785b8", "kind": "directory_service", "frame_number": 10499, "timestamp_epoch": "1647906955.185548000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-c84404b228e100a6eccfa23b", "kind": "directory_service", "frame_number": 10637, "timestamp_epoch": "1647906955.553261000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 190, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-225d5a992dd77ec5dcb732b1", "kind": "directory_service", "frame_number": 10641, "timestamp_epoch": "1647906955.556880000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 189, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1eed83be020e90b5b8a5f2ee", "kind": "directory_service", "frame_number": 10969, "timestamp_epoch": "1647907930.110233000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a738cae4470cf015ce1decdc", "kind": "directory_service", "frame_number": 10970, "timestamp_epoch": "1647907930.110749000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7b42db6500fef3b2a0f187b9", "kind": "directory_service", "frame_number": 10971, "timestamp_epoch": "1647907930.110995000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f3aae004ebfcb8cd6c4c30f0", "kind": "directory_service", "frame_number": 10972, "timestamp_epoch": "1647907930.111583000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-07e0fed128646cd8f150c991", "kind": "directory_service", "frame_number": 10973, "timestamp_epoch": "1647907930.111776000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3e8e457d38f851502548ed96", "kind": "directory_service", "frame_number": 10974, "timestamp_epoch": "1647907930.112026000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5d2cbf1b1614355b81b9c1ab", "kind": "directory_service", "frame_number": 10977, "timestamp_epoch": "1647907930.112974000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-54650ada366fed971a68dec6", "kind": "directory_service", "frame_number": 10978, "timestamp_epoch": "1647907930.113346000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-fa83776963929a69efc703df", "kind": "directory_service", "frame_number": 10979, "timestamp_epoch": "1647907930.113518000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-09b69eb5ff86bd87d4fcb4e3", "kind": "directory_service", "frame_number": 10980, "timestamp_epoch": "1647907930.113766000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d337838acc6501f5b638dc20", "kind": "directory_service", "frame_number": 10981, "timestamp_epoch": "1647907930.113942000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-db4349703f29966b1b3074ee", "kind": "directory_service", "frame_number": 10982, "timestamp_epoch": "1647907930.114099000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 198, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7e14c9d56872164184a73d49", "kind": "directory_service", "frame_number": 10986, "timestamp_epoch": "1647907930.115333000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0303ac68feabff25c328a0e7", "kind": "directory_service", "frame_number": 10988, "timestamp_epoch": "1647907930.115919000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b2c3860743d345a2f6d6fdf5", "kind": "directory_service", "frame_number": 10991, "timestamp_epoch": "1647907930.116627000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-16d46db209833b2571208421", "kind": "directory_service", "frame_number": 10993, "timestamp_epoch": "1647907930.117506000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-3deca7e9e05f4f9bd1485eb7", "kind": "directory_service", "frame_number": 10994, "timestamp_epoch": "1647907930.117789000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3ccf7e3b1f3b661f840edb46", "kind": "directory_service", "frame_number": 10995, "timestamp_epoch": "1647907930.117911000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-c4c63f3fb8d21c4167e8fe41", "kind": "directory_service", "frame_number": 10996, "timestamp_epoch": "1647907930.118054000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f596071ba3966f3fb4854fdc", "kind": "directory_service", "frame_number": 10997, "timestamp_epoch": "1647907930.118191000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e2091b5c9bf353da3c0b4f8d", "kind": "directory_service", "frame_number": 10998, "timestamp_epoch": "1647907930.118326000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-011dfa70e9b133a8430cd6f3", "kind": "directory_service", "frame_number": 10999, "timestamp_epoch": "1647907930.118489000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bd901131d2d329d5e321752e", "kind": "directory_service", "frame_number": 11004, "timestamp_epoch": "1647907930.120660000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-5f5d1551b0eb75f4bcb67b6e", "kind": "directory_service", "frame_number": 11006, "timestamp_epoch": "1647907930.121390000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-050991dd4432a81fd5e7ec2f", "kind": "directory_service", "frame_number": 11007, "timestamp_epoch": "1647907930.121650000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-bf3bcdb9827ca720b829d211", "kind": "directory_service", "frame_number": 11010, "timestamp_epoch": "1647907930.122292000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5e4ea5632dff39d88f2eb523", "kind": "directory_service", "frame_number": 11012, "timestamp_epoch": "1647907930.122392000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2c947a694ea338e67cc28b51", "kind": "directory_service", "frame_number": 11013, "timestamp_epoch": "1647907930.122703000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-41c1590725cf6c8ea7064d9c", "kind": "directory_service", "frame_number": 11014, "timestamp_epoch": "1647907930.122823000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 200, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-7a4e4cb509d805a1be38a517", "kind": "directory_service", "frame_number": 11017, "timestamp_epoch": "1647907930.122986000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 199, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-4a6bc9e0e3cfcb2b0f6a0572", "kind": "directory_service", "frame_number": 11475, "timestamp_epoch": "1647908840.696407000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ffba07d9755f676393a6d96d", "kind": "directory_service", "frame_number": 11479, "timestamp_epoch": "1647908840.696826000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-2ec13cb402311fc47ad2bbdd", "kind": "directory_service", "frame_number": 11480, "timestamp_epoch": "1647908840.696950000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b3f6b2a08e0809aea21505c1", "kind": "directory_service", "frame_number": 11482, "timestamp_epoch": "1647908840.697765000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-845621a4f9890dede2b26808", "kind": "directory_service", "frame_number": 11483, "timestamp_epoch": "1647908840.697862000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-32e9ce9ac2a6a76688a9d3e2", "kind": "directory_service", "frame_number": 11485, "timestamp_epoch": "1647908840.698022000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 223, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-725f7d95936965ed447c80d1", "kind": "directory_service", "frame_number": 11497, "timestamp_epoch": "1647908840.701487000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-11b1b46fecdb2104c9a64aca", "kind": "directory_service", "frame_number": 11498, "timestamp_epoch": "1647908840.701869000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-13017c3a49a43ac00728f735", "kind": "directory_service", "frame_number": 11499, "timestamp_epoch": "1647908840.702094000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-5b64fad429b174bea2c8aad3", "kind": "directory_service", "frame_number": 11500, "timestamp_epoch": "1647908840.702783000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-175145adc19034f446b1cac3", "kind": "directory_service", "frame_number": 11501, "timestamp_epoch": "1647908840.702969000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-8fdb720bb8e59f9e0cece8f1", "kind": "directory_service", "frame_number": 11502, "timestamp_epoch": "1647908840.703170000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-be91679d8e96ed3e2ca0f17b", "kind": "directory_service", "frame_number": 11505, "timestamp_epoch": "1647908840.704548000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-fa0bea30987de5e84e156147", "kind": "directory_service", "frame_number": 11506, "timestamp_epoch": "1647908840.704658000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8738e57629c27557d605f652", "kind": "directory_service", "frame_number": 11507, "timestamp_epoch": "1647908840.704817000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-7acce77e80f256be0ddf90f6", "kind": "directory_service", "frame_number": 11508, "timestamp_epoch": "1647908840.705128000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e5ac63b1c21c587c5c85e7f0", "kind": "directory_service", "frame_number": 11509, "timestamp_epoch": "1647908840.705354000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-b53d3e41d3c18a481dad37aa", "kind": "directory_service", "frame_number": 11510, "timestamp_epoch": "1647908840.705419000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 225, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-75d0f4a5a27c0abaa31a926d", "kind": "directory_service", "frame_number": 11537, "timestamp_epoch": "1647908840.811134000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1a1fc0a02893c887547cf8bc", "kind": "directory_service", "frame_number": 11539, "timestamp_epoch": "1647908840.811717000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-fb812a34c86b370cde4a80b8", "kind": "directory_service", "frame_number": 11542, "timestamp_epoch": "1647908840.812578000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c072ac1f2a695fbdfa174af2", "kind": "directory_service", "frame_number": 11544, "timestamp_epoch": "1647908840.813200000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-cc692c40ee5172cf7b7e1cec", "kind": "directory_service", "frame_number": 11545, "timestamp_epoch": "1647908840.813543000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ed9b4f5ba75b0a148aa3fe9f", "kind": "directory_service", "frame_number": 11546, "timestamp_epoch": "1647908840.813822000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4a78bbdf934c727bb892107c", "kind": "directory_service", "frame_number": 11547, "timestamp_epoch": "1647908840.814002000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-092a925bd8f2172c03f0f16c", "kind": "directory_service", "frame_number": 11548, "timestamp_epoch": "1647908840.814228000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-57d69bc5c60b9cff97112994", "kind": "directory_service", "frame_number": 11549, "timestamp_epoch": "1647908840.814343000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-05fc16841580cf5f3ec0c896", "kind": "directory_service", "frame_number": 11550, "timestamp_epoch": "1647908840.814573000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-015fd3a13d43ec69980b0ea0", "kind": "directory_service", "frame_number": 11555, "timestamp_epoch": "1647908840.817696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-820cc0983318aa2dc4120071", "kind": "directory_service", "frame_number": 11557, "timestamp_epoch": "1647908840.818465000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-71b7161fe582dc692e078d9b", "kind": "directory_service", "frame_number": 11558, "timestamp_epoch": "1647908840.818720000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e453aa72fe8218bf0983b4dc", "kind": "directory_service", "frame_number": 11561, "timestamp_epoch": "1647908840.819302000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b5926de1937e8da0221067f6", "kind": "directory_service", "frame_number": 11563, "timestamp_epoch": "1647908840.819479000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0c6111548d2f8c501f138550", "kind": "directory_service", "frame_number": 11564, "timestamp_epoch": "1647908840.819798000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-539dff3df65b8a958db2ff8a", "kind": "directory_service", "frame_number": 11565, "timestamp_epoch": "1647908840.819871000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 227, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-ddc6eff92ae2e3161c86ec31", "kind": "directory_service", "frame_number": 11568, "timestamp_epoch": "1647908840.820007000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 226, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e448bf48db517b1cd71158f6", "kind": "directory_service", "frame_number": 12220, "timestamp_epoch": "1647910170.412565000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c6b2cab2b02e66f8fd926810", "kind": "directory_service", "frame_number": 12221, "timestamp_epoch": "1647910170.412890000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b79dd1b4b266a6dcd69db16f", "kind": "directory_service", "frame_number": 12222, "timestamp_epoch": "1647910170.413416000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8ca9ba038dd2b0d87d494bd3", "kind": "directory_service", "frame_number": 12223, "timestamp_epoch": "1647910170.413997000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a7fd5a87460a282080e10647", "kind": "directory_service", "frame_number": 12224, "timestamp_epoch": "1647910170.414352000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d8fc3a54b441fd903f430eba", "kind": "directory_service", "frame_number": 12225, "timestamp_epoch": "1647910170.414508000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 261, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-381215578b67f12cdbc3a200", "kind": "directory_service", "frame_number": 12233, "timestamp_epoch": "1647910170.633453000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-66082fde84976617d976474f", "kind": "directory_service", "frame_number": 12235, "timestamp_epoch": "1647910170.634213000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-715963497cd3fd879174c39c", "kind": "directory_service", "frame_number": 12238, "timestamp_epoch": "1647910170.635226000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6bca6c8973d238a2902e1736", "kind": "directory_service", "frame_number": 12240, "timestamp_epoch": "1647910170.636624000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-698bbd9b616752ba52380212", "kind": "directory_service", "frame_number": 12241, "timestamp_epoch": "1647910170.650509000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-7a6a28ae0b3d7018f0b9cdea", "kind": "directory_service", "frame_number": 12242, "timestamp_epoch": "1647910170.651132000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-9bae2429d2882e8827bfbe57", "kind": "directory_service", "frame_number": 12247, "timestamp_epoch": "1647910170.655880000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-62196dd0701d6f569c741658", "kind": "directory_service", "frame_number": 12249, "timestamp_epoch": "1647910170.657336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8279fe0b9bc011cdc8a4ae66", "kind": "directory_service", "frame_number": 12250, "timestamp_epoch": "1647910170.657797000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3119238e290bfa129aaad45d", "kind": "directory_service", "frame_number": 12251, "timestamp_epoch": "1647910170.658123000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-41231760b35a9b71dae2ac9d", "kind": "directory_service", "frame_number": 12252, "timestamp_epoch": "1647910170.658384000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-41a6856f630556ee836a8f4f", "kind": "directory_service", "frame_number": 12253, "timestamp_epoch": "1647910170.658740000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5cb910a8e98ac9777eed8f88", "kind": "directory_service", "frame_number": 12254, "timestamp_epoch": "1647910170.659573000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-4709ad058f2427f2e4770262", "kind": "directory_service", "frame_number": 12255, "timestamp_epoch": "1647910170.660209000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-ab15b22bd7d459c6eb4f72fe", "kind": "directory_service", "frame_number": 12260, "timestamp_epoch": "1647910170.976469000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 263, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-91dd195886a27d89dbd845c2", "kind": "directory_service", "frame_number": 12264, "timestamp_epoch": "1647910170.978613000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 262, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-c62d08aeb9aca9f6323169cf", "kind": "directory_service", "frame_number": 12595, "timestamp_epoch": "1647911020.563949000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-17698e0ebbc17554c1fff9b9", "kind": "directory_service", "frame_number": 12597, "timestamp_epoch": "1647911020.564721000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ad4065a93b58650d19c2abfe", "kind": "directory_service", "frame_number": 12600, "timestamp_epoch": "1647911020.565463000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-4464c007bd6a572711064cb5", "kind": "directory_service", "frame_number": 12602, "timestamp_epoch": "1647911020.566898000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-ad334b86499dcbd1826321a8", "kind": "directory_service", "frame_number": 12603, "timestamp_epoch": "1647911020.567987000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3181a7af739952fa385411af", "kind": "directory_service", "frame_number": 12604, "timestamp_epoch": "1647911020.568291000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-8b44ca919ebf16fb603a89a1", "kind": "directory_service", "frame_number": 12605, "timestamp_epoch": "1647911020.568479000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8e56a711dd0b9b8e0c28a8f2", "kind": "directory_service", "frame_number": 12606, "timestamp_epoch": "1647911020.568689000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4ed44af5d05c952b43c8fe68", "kind": "directory_service", "frame_number": 12607, "timestamp_epoch": "1647911020.568876000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.baseObject": "CN=NTDS Settings,CN=BURNINCANDLE-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0924703cc7ac02fd0ef1ca33", "kind": "directory_service", "frame_number": 12608, "timestamp_epoch": "1647911020.569183000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a25eac7196c52c4a92a28e1a", "kind": "directory_service", "frame_number": 12609, "timestamp_epoch": "1647911020.569372000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-a7e9ad2508eddc1c57ce3ca4", "kind": "directory_service", "frame_number": 12610, "timestamp_epoch": "1647911020.569691000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-383adca0e47bea975cec76d5", "kind": "directory_service", "frame_number": 12611, "timestamp_epoch": "1647911020.569858000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5e3da4d1ea9186ff0640777a", "kind": "directory_service", "frame_number": 12612, "timestamp_epoch": "1647911020.570248000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-24a9f82f8b71796f22fec59c", "kind": "directory_service", "frame_number": 12621, "timestamp_epoch": "1647911020.694171000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-33dfa06a0c35631489375408", "kind": "directory_service", "frame_number": 12623, "timestamp_epoch": "1647911020.694963000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-08a765d986c642e9e9f007c4", "kind": "directory_service", "frame_number": 12624, "timestamp_epoch": "1647911020.696550000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-8fe02398c67ef044c3224fcd", "kind": "directory_service", "frame_number": 12625, "timestamp_epoch": "1647911020.696823000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-3cc3251cfdc3246f728b50e1", "kind": "directory_service", "frame_number": 12660, "timestamp_epoch": "1647911020.831886000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-4c9bcd440fc1e37a037270ef", "kind": "directory_service", "frame_number": 12661, "timestamp_epoch": "1647911020.832493000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-bce8a506bc303f0ce1264d06", "kind": "directory_service", "frame_number": 12662, "timestamp_epoch": "1647911020.833314000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 281, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-d74b38ab4b0fed30d4d48967", "kind": "directory_service", "frame_number": 12665, "timestamp_epoch": "1647911020.833554000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 280, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-8db87a436cce7b0e6566ae2e", "kind": "directory_service", "frame_number": 12978, "timestamp_epoch": "1647911530.003178000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4afd35641065ce1c89e22946", "kind": "directory_service", "frame_number": 12979, "timestamp_epoch": "1647911530.003637000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-784c3f97a47df4f42ceb68f5", "kind": "directory_service", "frame_number": 12980, "timestamp_epoch": "1647911530.003944000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-3ddbb2a164c88ce9fdb14c4a", "kind": "directory_service", "frame_number": 12981, "timestamp_epoch": "1647911530.004663000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d6347904399c846265675123", "kind": "directory_service", "frame_number": 12982, "timestamp_epoch": "1647911530.004826000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-bfca2b2bfa7385d47d007d3a", "kind": "directory_service", "frame_number": 12983, "timestamp_epoch": "1647911530.005078000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-0cd5ff332e3b5fb4f5b4a90d", "kind": "directory_service", "frame_number": 12986, "timestamp_epoch": "1647911530.006063000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ae855c17fa2b86f67bbacf84", "kind": "directory_service", "frame_number": 12987, "timestamp_epoch": "1647911530.006336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-636c1eb51ffc334cd41b1a40", "kind": "directory_service", "frame_number": 12988, "timestamp_epoch": "1647911530.006552000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-06f9bda528dbb6d0850ef917", "kind": "directory_service", "frame_number": 12989, "timestamp_epoch": "1647911530.007117000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-1c45f56710d69e71d976b85f", "kind": "directory_service", "frame_number": 12990, "timestamp_epoch": "1647911530.007251000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3b2b01a8d9b8fd1752912c56", "kind": "directory_service", "frame_number": 12991, "timestamp_epoch": "1647911530.007501000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 300, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6039c1bfee0a080ee07e74e6", "kind": "directory_service", "frame_number": 12995, "timestamp_epoch": "1647911530.008728000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-16be2337c04f93eff8e2c9f8", "kind": "directory_service", "frame_number": 12997, "timestamp_epoch": "1647911530.009423000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-377c74f8662666618e962000", "kind": "directory_service", "frame_number": 13000, "timestamp_epoch": "1647911530.010172000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-938e58ee2d5ba7728064526d", "kind": "directory_service", "frame_number": 13002, "timestamp_epoch": "1647911530.011598000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-6469fbcd063acbb1022f8a74", "kind": "directory_service", "frame_number": 13003, "timestamp_epoch": "1647911530.011821000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-550700822f75a0d5ab97077f", "kind": "directory_service", "frame_number": 13004, "timestamp_epoch": "1647911530.012159000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bf3d464ebb5674d9e694be32", "kind": "directory_service", "frame_number": 13005, "timestamp_epoch": "1647911530.012365000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-c215c6a7c709efac19751721", "kind": "directory_service", "frame_number": 13006, "timestamp_epoch": "1647911530.012678000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-053aeb6742692075bb084bf4", "kind": "directory_service", "frame_number": 13007, "timestamp_epoch": "1647911530.012795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5b9e897c59523b54330df6c7", "kind": "directory_service", "frame_number": 13008, "timestamp_epoch": "1647911530.013087000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f28c6443013e69c546a0d68d", "kind": "directory_service", "frame_number": 13013, "timestamp_epoch": "1647911530.015067000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-09515b308f9eeecef747f948", "kind": "directory_service", "frame_number": 13015, "timestamp_epoch": "1647911530.016499000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1788f0abcd7d5304090fff2f", "kind": "directory_service", "frame_number": 13016, "timestamp_epoch": "1647911530.016756000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-357604d1951f853919b65c2d", "kind": "directory_service", "frame_number": 13019, "timestamp_epoch": "1647911530.017529000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-eb5f220bc422528f2be6a8b1", "kind": "directory_service", "frame_number": 13021, "timestamp_epoch": "1647911530.017644000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-effe2191eb464addb8e26ad8", "kind": "directory_service", "frame_number": 13022, "timestamp_epoch": "1647911530.018037000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-b295b6cd08bf02993072ae51", "kind": "directory_service", "frame_number": 13023, "timestamp_epoch": "1647911530.018208000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 302, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e60fd5c5cfe7ce4f4150871a", "kind": "directory_service", "frame_number": 13025, "timestamp_epoch": "1647911530.018356000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 301, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-4406e263b46f393178882a14", "kind": "directory_service", "frame_number": 13569, "timestamp_epoch": "1647913134.468590000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-9b5d53e0ce91c029f402f767", "kind": "directory_service", "frame_number": 13570, "timestamp_epoch": "1647913134.468953000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f8f7c2754d71e55b2101e5f0", "kind": "directory_service", "frame_number": 13571, "timestamp_epoch": "1647913134.469202000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4c751aee000b45e7e9a21139", "kind": "directory_service", "frame_number": 13572, "timestamp_epoch": "1647913134.469962000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8497ba6b9131d8adc1ef422b", "kind": "directory_service", "frame_number": 13573, "timestamp_epoch": "1647913134.470106000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-adf58401d2101ac4d76ef8e3", "kind": "directory_service", "frame_number": 13574, "timestamp_epoch": "1647913134.470412000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 332, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-aba6e94e460c0e04737c71f1", "kind": "directory_service", "frame_number": 13582, "timestamp_epoch": "1647913134.784106000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-272627f7e424cdc32badd663", "kind": "directory_service", "frame_number": 13584, "timestamp_epoch": "1647913134.784793000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0e2c8fa8447988aa6045fd2f", "kind": "directory_service", "frame_number": 13587, "timestamp_epoch": "1647913134.785889000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a58721da075ef559403f7a65", "kind": "directory_service", "frame_number": 13589, "timestamp_epoch": "1647913134.787336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-895ca9a55432c44b4d5586d3", "kind": "directory_service", "frame_number": 13594, "timestamp_epoch": "1647913134.905855000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-2e74069af14218be0ba7d5c2", "kind": "directory_service", "frame_number": 13595, "timestamp_epoch": "1647913134.906490000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-85ebddfe17737d706fdfbda8", "kind": "directory_service", "frame_number": 13604, "timestamp_epoch": "1647913135.028507000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c041a5c6c02b46084be424c4", "kind": "directory_service", "frame_number": 13606, "timestamp_epoch": "1647913135.029973000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-2cc91c422afc960f1e26be12", "kind": "directory_service", "frame_number": 13607, "timestamp_epoch": "1647913135.030775000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-77f1ce747dff6306ce96d2ba", "kind": "directory_service", "frame_number": 13608, "timestamp_epoch": "1647913135.031027000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-8eee335e0122dec9318c828d", "kind": "directory_service", "frame_number": 13609, "timestamp_epoch": "1647913135.031496000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-62ef0dc2a8c56138f68056c9", "kind": "directory_service", "frame_number": 13610, "timestamp_epoch": "1647913135.031906000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5d74cfaf901585ced2287526", "kind": "directory_service", "frame_number": 13611, "timestamp_epoch": "1647913135.033277000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-16deacf00a4bf99e208c77f0", "kind": "directory_service", "frame_number": 13612, "timestamp_epoch": "1647913135.034242000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-06ec0a41be25fd6823be5483", "kind": "directory_service", "frame_number": 13750, "timestamp_epoch": "1647913135.395710000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 334, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-fa6df80b08eca7c1ee590f8e", "kind": "directory_service", "frame_number": 13754, "timestamp_epoch": "1647913135.399113000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 333, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-4afb51d775d8c533ea9fac19", "kind": "directory_service", "frame_number": 14098, "timestamp_epoch": "1647914217.148203000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-d80c138b215134312e21f945", "kind": "directory_service", "frame_number": 14099, "timestamp_epoch": "1647914217.148610000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-27cae463409bab17f89433a3", "kind": "directory_service", "frame_number": 14100, "timestamp_epoch": "1647914217.148795000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-64d7f88eec70967f56070a96", "kind": "directory_service", "frame_number": 14101, "timestamp_epoch": "1647914217.149233000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ce6f61649316671cf7d0ff39", "kind": "directory_service", "frame_number": 14102, "timestamp_epoch": "1647914217.149362000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-74b47b8e2113ce1084def832", "kind": "directory_service", "frame_number": 14103, "timestamp_epoch": "1647914217.149525000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 356, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-b513a6ff6a0b33f13afbef01", "kind": "directory_service", "frame_number": 14565, "timestamp_epoch": "1647915129.856757000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-56261c1709e9ea1892c5c533", "kind": "directory_service", "frame_number": 14566, "timestamp_epoch": "1647915129.857261000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5798b656b987b87e1ea54997", "kind": "directory_service", "frame_number": 14567, "timestamp_epoch": "1647915129.857508000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6c2363b8c34a959a146c165a", "kind": "directory_service", "frame_number": 14568, "timestamp_epoch": "1647915129.858163000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b1ef395b9f8be67c4aa912f4", "kind": "directory_service", "frame_number": 14569, "timestamp_epoch": "1647915129.858309000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7f1edf77dea6509e30474297", "kind": "directory_service", "frame_number": 14570, "timestamp_epoch": "1647915129.858619000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3a8e67274c0efe029c8de4de", "kind": "directory_service", "frame_number": 14573, "timestamp_epoch": "1647915129.859628000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7e4d194a141e292800697ba7", "kind": "directory_service", "frame_number": 14574, "timestamp_epoch": "1647915129.859941000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6ba05ba4daffad3f3da371cb", "kind": "directory_service", "frame_number": 14575, "timestamp_epoch": "1647915129.860112000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-fadc1b72b63b7510d064e89c", "kind": "directory_service", "frame_number": 14576, "timestamp_epoch": "1647915129.860677000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f26d657008cf332ebd2f5fea", "kind": "directory_service", "frame_number": 14577, "timestamp_epoch": "1647915129.860818000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d9e0448aa49221fe9ee9b161", "kind": "directory_service", "frame_number": 14578, "timestamp_epoch": "1647915129.861069000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 376, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-2313c14553e8bcf6f3cf1973", "kind": "directory_service", "frame_number": 14588, "timestamp_epoch": "1647915129.967228000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3ade88889882f2b770da8a91", "kind": "directory_service", "frame_number": 14590, "timestamp_epoch": "1647915129.967892000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6d5d28089215a24447a0200e", "kind": "directory_service", "frame_number": 14593, "timestamp_epoch": "1647915129.970034000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-931bc670469102ec2f9e77c6", "kind": "directory_service", "frame_number": 14595, "timestamp_epoch": "1647915129.970767000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-3bd225bac0777c2f1fa52c56", "kind": "directory_service", "frame_number": 14596, "timestamp_epoch": "1647915129.971514000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-764f20535b809020ba8c6a1c", "kind": "directory_service", "frame_number": 14597, "timestamp_epoch": "1647915129.971912000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-21fa48076849b5b4cc820a59", "kind": "directory_service", "frame_number": 14598, "timestamp_epoch": "1647915129.972061000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-24d7e5c78ffcaddad3b91fe7", "kind": "directory_service", "frame_number": 14599, "timestamp_epoch": "1647915129.972200000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-d6f298612e45580e0776dceb", "kind": "directory_service", "frame_number": 14600, "timestamp_epoch": "1647915129.972339000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-39abcdb3065446206d6bc405", "kind": "directory_service", "frame_number": 14601, "timestamp_epoch": "1647915129.972537000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9a6d7e21310fbaacf23dc4ce", "kind": "directory_service", "frame_number": 14606, "timestamp_epoch": "1647915129.974631000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-470bd78534e88e6f5de6255c", "kind": "directory_service", "frame_number": 14608, "timestamp_epoch": "1647915129.975394000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-248fe033417a61112bb950f9", "kind": "directory_service", "frame_number": 14609, "timestamp_epoch": "1647915129.975541000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-6e9ec9ed9b620ee14fcd8aee", "kind": "directory_service", "frame_number": 14612, "timestamp_epoch": "1647915129.976172000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-d9f703ff21d7dc31285c3fad", "kind": "directory_service", "frame_number": 14614, "timestamp_epoch": "1647915129.976308000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-86c6072f5ecc31346cc9de4f", "kind": "directory_service", "frame_number": 14615, "timestamp_epoch": "1647915129.976518000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-1c6f3a9140db7602956028bc", "kind": "directory_service", "frame_number": 14616, "timestamp_epoch": "1647915129.976641000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 378, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-49a333f69690fa796e7e58ca", "kind": "directory_service", "frame_number": 14619, "timestamp_epoch": "1647915129.976790000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 377, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-0ba43f3143fbcfb0f203c6dc", "kind": "directory_service", "frame_number": 14876, "timestamp_epoch": "1647915749.943400000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3ef754f5b05dd2be3e03855a", "kind": "directory_service", "frame_number": 14877, "timestamp_epoch": "1647915749.943809000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-aba4825ba57cabae2eb29587", "kind": "directory_service", "frame_number": 14878, "timestamp_epoch": "1647915749.943940000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-507ddf3dc1ae08d225c43dc4", "kind": "directory_service", "frame_number": 14879, "timestamp_epoch": "1647915749.944573000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-be15e81bd3ef19f7b44e58a6", "kind": "directory_service", "frame_number": 14880, "timestamp_epoch": "1647915749.944642000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-13cdc47c031689d001522cc9", "kind": "directory_service", "frame_number": 14881, "timestamp_epoch": "1647915749.944882000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 393, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-33de35b017c0394e430fa833", "kind": "directory_service", "frame_number": 14895, "timestamp_epoch": "1647915750.258454000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-17bce4211f7d6c5bf1115a94", "kind": "directory_service", "frame_number": 14897, "timestamp_epoch": "1647915750.259166000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-264f7f3275c9e89509cbc469", "kind": "directory_service", "frame_number": 14900, "timestamp_epoch": "1647915750.260253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-cb31860988cb83b866ea6874", "kind": "directory_service", "frame_number": 14902, "timestamp_epoch": "1647915750.261722000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c83278928ce2bca38c940ef2", "kind": "directory_service", "frame_number": 14907, "timestamp_epoch": "1647915750.376470000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.baseObject": "DC=burnincandle,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-d0abdc37d95f139331415514", "kind": "directory_service", "frame_number": 14908, "timestamp_epoch": "1647915750.377139000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-f838ed90dcf4ab3bbffb5cba", "kind": "directory_service", "frame_number": 14913, "timestamp_epoch": "1647915750.383470000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-bdd9a34e33719244dc85371d", "kind": "directory_service", "frame_number": 14915, "timestamp_epoch": "1647915750.384935000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-5ebfc22272993978b1b8c4db", "kind": "directory_service", "frame_number": 14916, "timestamp_epoch": "1647915750.385709000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f4057382ebc0d3e254290a23", "kind": "directory_service", "frame_number": 14917, "timestamp_epoch": "1647915750.386058000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9bcf0cf41d8204546ff9e71d", "kind": "directory_service", "frame_number": 14918, "timestamp_epoch": "1647915750.386530000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a39e3bd36ab7082d0d324f1f", "kind": "directory_service", "frame_number": 14919, "timestamp_epoch": "1647915750.386891000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-7580affdbf2dba0971e7dd24", "kind": "directory_service", "frame_number": 14920, "timestamp_epoch": "1647915750.388292000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=burnincandle,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-fa2ed0e965f2f08452e9609e", "kind": "directory_service", "frame_number": 14921, "timestamp_epoch": "1647915750.388999000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-b57c7e0bdcb5da32c5f43590", "kind": "directory_service", "frame_number": 14926, "timestamp_epoch": "1647915750.694566000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 396, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-38bc5a73aaa579cf5e2b46ec", "kind": "directory_service", "frame_number": 14930, "timestamp_epoch": "1647915750.696726000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 395, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1e288616999cfdd71f863434", "kind": "directory_service", "frame_number": 16088, "timestamp_epoch": "1647918729.788121000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-891c852df0af8f0d9f46cb1a", "kind": "directory_service", "frame_number": 16089, "timestamp_epoch": "1647918729.788462000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3f92926b7c23226d0359c515", "kind": "directory_service", "frame_number": 16090, "timestamp_epoch": "1647918729.788791000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-fd0c00ab2ea9351d6c5fb8d0", "kind": "directory_service", "frame_number": 16091, "timestamp_epoch": "1647918729.789463000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-cca45390f8c81c70acb61dcd", "kind": "directory_service", "frame_number": 16092, "timestamp_epoch": "1647918729.789657000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-be1fd644e25c76a092b0b850", "kind": "directory_service", "frame_number": 16093, "timestamp_epoch": "1647918729.789814000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6d9cb9ee76db4d2983bceb4c", "kind": "directory_service", "frame_number": 16096, "timestamp_epoch": "1647918729.790856000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6f706a96121b3dc148ce3add", "kind": "directory_service", "frame_number": 16097, "timestamp_epoch": "1647918729.791089000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a2914d3205b6d185d0373ad0", "kind": "directory_service", "frame_number": 16098, "timestamp_epoch": "1647918729.791316000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-5bd3186d7385b39d19698315", "kind": "directory_service", "frame_number": 16099, "timestamp_epoch": "1647918729.791931000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-43ada188516e4a3359f10f3f", "kind": "directory_service", "frame_number": 16100, "timestamp_epoch": "1647918729.792122000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9cb762f3ccd070b0454ac379", "kind": "directory_service", "frame_number": 16101, "timestamp_epoch": "1647918729.792269000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 455, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-623535bd55fff26340c16005", "kind": "directory_service", "frame_number": 16111, "timestamp_epoch": "1647918729.900734000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-b29cc113c2f4704ba90c1afe", "kind": "directory_service", "frame_number": 16113, "timestamp_epoch": "1647918729.901398000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b34574ec21a95b2ed4ab6e76", "kind": "directory_service", "frame_number": 16116, "timestamp_epoch": "1647918729.903484000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-80201f10b86e202a9d43d256", "kind": "directory_service", "frame_number": 16118, "timestamp_epoch": "1647918729.904197000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-29e3499fd7ac31954bd97140", "kind": "directory_service", "frame_number": 16119, "timestamp_epoch": "1647918729.905021000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-9b7b023581b97379ecd4fb4e", "kind": "directory_service", "frame_number": 16120, "timestamp_epoch": "1647918729.905375000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5fbdfbff5582dca2a75f5d03", "kind": "directory_service", "frame_number": 16121, "timestamp_epoch": "1647918729.905885000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5403828d25a0a8db94b44b76", "kind": "directory_service", "frame_number": 16122, "timestamp_epoch": "1647918729.906204000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0c68bb9713a2e4c8546d873d", "kind": "directory_service", "frame_number": 16123, "timestamp_epoch": "1647918729.906661000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.baseObject": "CN=DESKTOP-5QS3D5D,CN=Computers,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a068a85c1b7357159cee6fcf", "kind": "directory_service", "frame_number": 16124, "timestamp_epoch": "1647918729.907011000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-cff771671adb8546ce1d16c6", "kind": "directory_service", "frame_number": 16129, "timestamp_epoch": "1647918729.913565000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d761fc8694584e49213a2ff6", "kind": "directory_service", "frame_number": 16131, "timestamp_epoch": "1647918729.914308000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-d9777e2445674472979764da", "kind": "directory_service", "frame_number": 16132, "timestamp_epoch": "1647918729.915041000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-fc1a09d04b18ce06680009ab", "kind": "directory_service", "frame_number": 16135, "timestamp_epoch": "1647918729.915879000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-15b384354867b1fe1b732f2e", "kind": "directory_service", "frame_number": 16137, "timestamp_epoch": "1647918729.916352000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=burnincandle,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-69c4c1e1048ba7378aa2b808", "kind": "directory_service", "frame_number": 16138, "timestamp_epoch": "1647918729.916543000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-03339c86fe8896861843b639", "kind": "directory_service", "frame_number": 16139, "timestamp_epoch": "1647918729.916989000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 461, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-b4ad3ceefd4d243049cd9324", "kind": "directory_service", "frame_number": 16143, "timestamp_epoch": "1647918729.917417000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": null, "dst_port": null, "tcp_stream": 460, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-f5d42063ff089596f92afdbe", "kind": "unclassified_tcp", "frame_number": 880, "timestamp_epoch": "1647896381.184591000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "755a4f473bea732b2a535cb89d58ab4da663d524fc8c9b0077757824ac54b54bc831a5ed96751da01d0722955f1ce70d5569f712ac97073e3dc28a7dec6cb4024fb9e3604b7fcc6aa897b6f6a01faeeaa831cd01d3391b6cd0b1f201c0838fb1732bdcf21129e6764c0815fe0c3396930348707b70465b28a15e6b13a2fbc904268a38e4e793652f61c94b5393c5fd262249b86d349ae92b8a5e3bd289ed927f0537352e0d42339bd7fbf41449289aa68c75b2e77ea58653757ca76188b543c036852de907d925ff523d2190c7dc5bdc0b1572f495f1aec7eff8170a4dec53aa25f4395e4deeba4b50dfa7ad6db1b3a4c30bf7fea0df3f4bc7bb73647c89c3ef7172d9ac5947419b2ecc645735116d8f7cb099f420eff803578c3bc02a721c8a02037316e56a012c993fdb27f4e5f5d78abc29b00bf055004fd94062f51cfa436956f2dcca7da315d7a8e0820cf93720d044b83a0459539e39618a3f30f23168236ada852ce8d4d9465b7b294742ece20098ed09735893aed233427e3688c2868c3df20a2b7baecb9b59aa740cc04268ca3e6ef2ec5fba487bbf91ff77e06d616448674b63d20ce41aae4b698e555c6ef09b7a29bce191104f8784ca83301e32416b99b178cd928e5d1d679d2249a0eea0a29fc374434a351f256f4b661f47e31797470bbf246be34a08459811359a9e26c8931099e522ff1ae622577a9f94d5c471a514ca13e72958c702951c136a7845c0d004a7554b717d49af8485daec105baa7e98c00144eefb17756eeb4ab57b70401230a9862485fce461309652d65ca51bcca695b67bd65031f34f72bb1d634a5deda3c0ec7e35be1aa02262afd991060583630aed3e38d0bc60c306f164410ae2a1248af63cad2e652c484d89e94091c677a5d11298dfe88f32a299f71a9e189b6ea34bec6148c6ff8f7cfbe44b9f2c1e83d56cdf7031e424a2b1a89562f7fd7c1f2779a4e7f87023a06275a9c86423a63018f267cdceb47a8ffca5a20b1ae416ed28bd38662e8c3992cb7779fb8701c204c1351e6aa43f9abe9236c4259bb05c960daa92097cfb34017678b98f46068dd0127a7f44a77ab54291b17d751b6fce8e2ffa0a145c6856c91dbb5eef43712cd91315f2eee79a83820d4cef030de76f80bd30166841a0961d41a16758bddad26901f24deca7aeb22586423e2d6cff740f083d3d776830284f2fef7ed7155a0bb0a8c84bf7a6efd4dd3eb16dda8fe8acb493529b0032e7bafe624a48011d4dc44fb36d06439a0f680ce37f2dd7139e6a31ed654d820bd19a520eaed3027f6299448e3fe2259f4695fb495e7a6a5ab552a87b23c9a957b398f482bf6844701ebb648e7509f41cfa7f10f1d1431ff6244464732ffa00283c1f2a33fba8411c14cb7958ed35fe0da2a2b6be03524251f27dbbb0c6e61e5e1fadcf0da111e21473d2394691764215c9ccc56542154b155e5239243ebd3e34bf588e17174215e5914c8a16a5b72fb1a9cd5b2a1ff059e27d4a38214f4a9a0ad141e2829dc6cb6597564ed368275e1ebd098231d72de26784ee76eb302a64decab6d8b8071c29e7b54ad3537fd483c0be5a882da53c84f7de691b67399fbeddb3594e9c808647a0deb9134fcfc3ca6ca12c101cdf6a984dce1698521d99ae1b81323a7906c231719ab2d5c2956de8a0f4b93a99cb9f7adcd9eab6c7464fcce4135e590b5e15f3d79ee4d2361729f8680919def221c658512242309768c9ef3c0489e810b1b64bb7cb94e7688b7759f9405f9a7d25be6b0a7db976102c153d60572f1d2e688ad10980136c871676245d05037e61c0a8b522354e625bce2430d273e325971f932e1abe141624eab8a9e53a6b4ccba98516ba71a2fa0778bda31e0c88df7054bf610e7dddebaf6fd3e6660b31525e6f6654371a66cb9ad1e9bebcc0fb549d359344216b55a82948d5cb28de82373b" } }, { "event_id": "evt-60ba8b2403a7bac7fb860888", "kind": "unclassified_tcp", "frame_number": 898, "timestamp_epoch": "1647896381.300363000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "782678478bb82a0b392456ef262d83f56613efb2cea795a3786390e27bf39529051b0a33bed5523d942a56d6a33fd9a59698f1ccc662a7e9649e39f4a5c5f72bc12ec9f0e2ef1861044ccf037567c525b52b78f4b31f803cab4271ac8583fee3995b6b472a5fc558edba866837860e9f4c512338392c6a29bef8bcfe91c534a783509a9fd33e226d9ed475103c9492111851958122ca21f1499f62466b0c954e68a79ee6de251840625f154b13013311c68208b5da95c686223c9f09591d4731267bc45d058181ccd44a2588ad263e229db3ffeed543a4545b9f0baf8c07efbc8574d8a4d262658f2e62ea92236f578d4c9dc55a5e4d7771f4c80bfbba711d0ecefaf657860a0abe651a040fe4b2bcc82b07acbcf241d0a47e094cbc594ba68f49c35e1cfec9ca9eb5e4d7f92040a858c5995df5a817b5f7a37835e2c1af487ee94f6541c2b6c066eb307865aa0a25b07fec7d9125de0386327417f38b4bff1e54181d642604d7645c7dbd468490da707111515a6948799f5625bd15f526bdabb0105c391e87de4ae5a45bd8d9c0935e39e399e07b5fa8ad6855be44f0fb0c86632f3dd00e42e68b6ce0cf53772537d0f57712e590e82dbb7a0c710e9094e486aa59bb14f40b635851e0b4e3d428a85021e11436ba5c3143c64f3382f78242e0dcecff39b9bd6dd644e117cc57ce899cf85509f0359627766d541c4aa7909802c9450e8bcc0cd3ae8b80620d72646f19e00163e77b93aaed8d426459c6f8ed7f925612dc879e95cd8ddf0110e4b55479921040db5053d300c99cb89d7795ff982d7cacd7697fde489ed66054f6834d8810f4eb6002bc8519957b9cf017729de76b9ed2a54f1ffb3b3cf0414ce13d9292484d2a2d8f1afce690fe0d02aeeb6a55d230b2eab0d10da475e6374d3b902d37c06987d7b427c99b26fd6d40bbc513a469be95119f9496ef1b79431cfc09f487895b0a951441a600c9c5f40211b0e7c5adf31d417161195088c0b6c0e60c85059c342fec103d9e203ceddd3ebe831a8ec5160da603a3869c14eed142eb8fec02586333ca48b4f63f6838e7de37dec75d021ee6d37a312badae186d8d7eca17da1b51f030b79ac7cc610b9c760c3421d95b50e93edce9b3500b5695a6f282daf5dfb0263589a903f799e57f865f34097056c5539e193d71855bc9beb66db3a83cad8443be68bbdbccffd4be3bfae501a1d2ec5b8a9faff9e23430362e96b013d1f6e29604dbba93c4c6dee9ce617c5a479b742efeb0991243239e1daef17e3c10eed8d2901c89536b7849773f70475ce3a7075699f6d007324b3d2f8bc0a2fa95e1c711eab57057c9555af9d9a7731671a9541429a62fd4fa32028ecbef067d1c0cc7f528f933dd02dfb5e8567e1c6604b2695b81391a2dee55e13dd370e6ec510feb4a146b5a87c3f1d8b58cb940eabb6b54c6864baf852b1f8a65a6a4035cf1fd2bd9ab3d4cf6c90d21b79c222c18a8c1dddcd3e27144b23c8b6192b8515163c23c38ecff256c0a13d2d92aaa2ab055c529a1556af37b7f6f509c75ef199b5203f1f0f2c316ed94b90ecc3bcf7f3db160536d816aaab0235ec9581f36a2ec6b3a0a925cd0489231ef1763731afd0c8e7c64b67158de130b2970e6d218c44a985ead68397a2492d125132853abed040ef2ac7600ff10f6054bd6adaecbc4532f8a9bf2483752a590f67a6cfd23b5537c4fe34a3f4abb2ba2bfa8049c7ec1286260742c1adce707d0f960f1402628b41f1aa534ffb9d7c479d795faab125512c369d0861e39b57da62e6fb699cd9d2a290fb5341bafa1c370c8510ef662c36260b77d2ce3a15d6827ab3925c058bf829bfec68f2a48d6ba6a834e47c13ddaa00d2701f0dac1f1e773a0df761ac44c785d2de6d01bd2f21f73fead050917df642f156711bd7dca3ad7c02175d031fc910f8f9758e49e395fe1ccd782aa" } }, { "event_id": "evt-0aac074f9b5f1423568aea78", "kind": "unclassified_tcp", "frame_number": 1031, "timestamp_epoch": "1647896383.082568000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "32486d5824159376fefb785951d828df11499d11a546c1bfbd743dbb37c92f50b1e96266dbff76f9869fd53ca50a3f3ad95efb7a37f9b4653a505af88a383d735cc4c9525660ddedc39757272094b566cf2279e6b4af5678e95fe273a5be9b2b38f60525182f7daf0e558d68312a6e460e445c37d26b75239988c79cc103c1dd97ff21b416216bdb4ccc0205d9a0db17f6170f7fffc924b14bdf03766477a7501da77a22d46f2d988770738911c4b2df6c8f727a8b9865b33443e7f1811d917ee8df98b7b9129e2dbfc69fa349adb9963b7fb247b558a13f01d950355198534ae133e4058c5e7981c52c1278fcb686ce1e10656e9dba3805fbde1ad8c4ed7839233410875f45f8ef4efebe15523652f25821eca85db426602e325a6fb03c6a5e7a874afd17b3e1016335ca614e9bf7f58d5d22e98e3f628e4c700951a84c1d57ef1d1559044cbd4689dc6a4dd5226433364366876d070260206a61c9247ee8bde543a6fa412c68c915da1a0e77c98b669d93a1dc4fb8e698869ad24c382bf39737af4aa920be46f6324d417314e03dbdc20624cc0027696b3f31aac3ebeffd8ea4ceb6f630d5c13dc8fdf3f0963116557e8c7e44fe0bbf8baad67a39577ef3933e9e7d5b094cdf60840477d3c84e6e8f99375117ea8e2afd874acf958bcdc89f435da24767d5bcd38c48fca9f14a5b5c5b0a542c93102fb5aec58fee2a733c45b08c1151aea3cee00dabd52cdfd70b06365830729efa5c8372a48cec3fa6c22cda18a7ea528004bb5dbb5232af3dbf3ee75094d9492fd40dd60f49d8ac571229a299a7adb40bc71738a07c7b4eabb90ddda88d1d33d87b5685f63dce7a93f2454f0355fdd5e85d39f5abbc60f0ffe3b3b872ad6db578f4ddc1f282094cfaab3a98ba9fe05cbc8f847464e0bf0495017b3fe529316863bbc2368e3ac3dbc23b1e64365c098648269b198692df96f6d71289411c512989b1fb949e8cbca41228880f76dcc8c8216eb0f0e7addb41b28ed76834c5ba11001cf68feee56f1f63f488366cdabcc58551f90dc79b205261cfe82014097a488a577d5d96d50e7634a98972788456de9bd7ac15ba3b5e1ee10e6b8ff09412d47b0e9bf8a2f3d2c3e415c37ceea4b67e1d92443ba662597b7a64069c672a3198cc2851f60a86a487d7bf22f621871bdb9c8763ef282b121e15d47b38155d1d7cbb120bb7f1209235bfba1d8672544f489c6f47b8ccea46057d488f72bfffc93055af9e46c888633e52960e9707f73cf83b44a4212cf1d45b2c2324daf2a3cb66ded608d9a70dc1be4e7a374bee9769c0b24ff55dbfd17a426195c266f8f97431dc36d2362d028d46ac8d68427582929ecc62b4cc1f570a49c9363ac842f0bb285054b1c8f073bbb9afddc2c8729d99954b52f321f73e8def787f5c43a923e288227e0ac1ab3cb03bc28f2a78fcf52b71f64cfdc1a910cf6401e77c2c6df9a9d07b1604f773af423a9ee2b7bf395420f89f1dca8a25d58f961f0e39a32750a3c3c8c776f39ad172fa73590e2a4d7b18dd1cf1121dcb108576ef5877e30c6b87b77cf74d5441d381dea73df43e1abe9f6f7dc9af49d85eb80e3d19ce2935cdfee006eaacb4f9e8febaad0f4df42407e9f65883210b659e70de9e1d09aad2ba0f5627d1f8b38e99b7871b99093a2e5830e961f7564cb6c6138b769b3f637fea293ce65f732a2d528ad677ae8e30f22b4ac46a981266b3284fd1b375c893e91be159baeea9802be3348e8c004934f37ca5aa98b83f1f6fe20b32e442672a7a2077ae31b34d2357112d6ed75c64cd42856c47000c271ea61a4c020340235aa69f227bac6f37b1c4802cdf373a0341b69cceeaedb7191a8a69b477340addbfc6d4916e9daa5dcc8a0d050ec34f9145264aba241330cb4826f0fad184a26a95f892b8180ed1b0bb79dc4d03ba487e99b1a76b1c13d9e7efbba70d" } }, { "event_id": "evt-4069c7070bfd1a3df52f75d4", "kind": "unclassified_tcp", "frame_number": 1043, "timestamp_epoch": "1647896383.485563000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "3f604e7bb50c1cf50e8ca6b6a1929bc5c28ae0d17107cdeb6c3648be768dbf5a06e673b345f79f84d5eaaba88efeeb886af68015470989a1d5bf296097d52966c3fa71534c29cdf77f78255be57c05f0b028b5991e325481e84d8d2cadc89a88be16ecc343ff3227016491fcbba09170558282622342629ca6b38467532154a539c2de7b3fb7492fc13a8173dd582ad93f452fb4637ca52ec4c22bc52e255f8923dd6b8bd03c2620a07f3695628de7d91672bcd24999feeb5559e16d9d640b60ec9d91fb6e08042de2277448ee2a4a7662172655af3e892882c776ee4cc6b75901fca1421d24f4c5d136048af24f489cfc5df4ace81df3d8046408d5fc6b6833da5d90850c693ba5944be439d46d708a17e087a544b5c9ffc5bc7feee94216d7b3db040f7e18b800528f725518421191b8d77e428a297aefefb695d9900ebcaabcea5f54dde59a016989a423c41edb52db196174692c35f0e6247ebac18d7fe03a21bad17ea07730b6f598c0f113b2969333c042676e3c087c4a14f64f4df904d737e32563ab33d99912227abdff27fb31613cf18031306dd9f159c8746a75c48428cec35a3be5fa708127760381db154c470d22db549ec2d0f47ff97c096eee02fe1954649cafd1302b7aa5341f21b24df8335f132e8e0dd49efa33263ffe48e1018120796a17817b189503e94529bf88b02984f93ebe8046d953f65e39a94985b105f1ff33abd0d62ce3568a937db65b85d6463af56e260a8808db72391c12b8b388c63e210083659348ec5913d405f0e2371aa4e771091964828bd2cee3f54e78a4a92751a2bd9287d1d2fcab39d470fc0b2538a8012e2aba69eb81ea7d85fce50cda66da31d2cecf98f3dfc21bdaf61763c72f2a42d9191d257e4987d8fbf36143668a4811ac73686766caf6802716cae8f3d6c977fc7f0d622ccfb543ffb16f059cac085291b2957be9a20933fae0d2d2878583a1f85f80893e8ad8cfc09359bd965d49e7e0d21374ee6936969b6e6ae73a9fe9f52ec809931066a2c2d383c7348d4c1d6d0d156575710a5e5dfd7eb912f2e68adc0277caebaeaace45b90e29dadab6bafd0b180875f9c39b835f84dd220cf53e08a195f787d17ce5cad46be5f9df820c1062014d17546b800e002e8aa4828c5ab32630e224579a8db56cebfa5f61947c2f337372895c78adc4ab2c0b3eac3cc7122f642cb0b018cb892530db18123e207531c6fa84f1db215f53325cab50289273ea99e5e6b455264081d21e3534044dc98ed53fc85600b8ff45b99e1e73933bc4b339663cb7e50efcfa412c4d285d749b8d5bd4c494fcfeeb3e8944f1c2bc8ed88e7f177fd52aa009d1a9e27ed447c606c28c7b19ca26091f78b71c545556d7e2ccd3d7533834aedef94aecba84cf134ca7f2f2f49836cdc925d334da0cfaecb0300b7c0a155be7b96bb59a543395f5a960d7d8bc8b9a12abcfcf2b78c61b579ab92c468ba5a0128382a231f7244fd4c7534e4ab056990bc9a089b5b74640cbc9212af863a9afc03debac95c1b6fedb258499e14cd284e09a91dbbd7eb042b7b7722cf9997cf4b12728f957fc673839a4013496901c9849566e402f2ceb714a77aba23fd14c1cb5062f9ea085e1d43f661027854403a0ab9dfac8476b3bbb1e2c76e083327595829acb0f07b2c969bbf429d3cb26ba6f29002a6323e2ca0be4bcab3e89733458886cef55932869a845c3a7401c06f48fa94f2d1de94e3adc07d99b515570ad10b7cac9a1d051fe2a4b96ab9935294dcb434c4bf8b43d3c9fb5f562820dd8128ff0e647dc188ee2462bce7daf90dfa14d608d9dd850d5eac6f35426fcc1675a398dc870f15625a53d1ec859143c574ec36ae0a837d0c882f6219c82e6c9a787454b600a5134373e1cec8ff2be44505a8acad5461299f997a84c43b724d9d24e6cf07665da7e525b90600da35c6f9ec7" } }, { "event_id": "evt-82cd34203cdf359d00784ca0", "kind": "unclassified_tcp", "frame_number": 1089, "timestamp_epoch": "1647896384.539538000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "6d4a3634cc73e0188764ef2343cfe6ee207c640a6b8ed47e4f01c4505218bf914f773c6052017974e9a1ddc8ec1fa6b057fddebc421690e20566337e791bc61c75ddc6b93e4472e38bb37a9fac7d395e470304aad1298cd8d19157ec957814d597300c7566e9024aeed775fd83f8eb03a942be15bc2d4c4e6b794b2e5a10c112440429f0df2c621e61853cd974383a23a4814cef6ca6c84fa42643dcad11563c25c9032a68f3abed7905a894993ed856fa54fb03e2781a85f6b18d0ce936276c70a36327be18227e5932b50142693c1d8862f3d740167da5e60ce8169f689ae20ad859684e9515b1373d5ce11f5a43a5badbb2b95e9a70a924d6cdb8860b03279a55f3782715049e957ccad4966a5fa077d510c54d822656598ca617712cad84028038d3f107fe1f1a8735ef37408b4dc99b7ce0a4c7a315ec040db00d03c933a591b77c1edb61b7d77b32d3ab35f9a89fb2c04dbbf0b1d9462a02ef0b81e2598c4d084170f7be5c98b57f37d80f4c510e5c7b8bbe3444430d5aab49d7e42c9cfc7ae7b9d48b8543ed456c31ff49d7cc7587ca54e6bfbbece8545671e87ca458a80b59762a8d6d76f7da85ebadc4d5d19bf6497f5dac64f3d5ff5b75158201c48466d1d677fa209647edae58e326a209aeab71abee74e1119528fdb29159e97cfa59e450597d03592e6371f279622c565816d3d20a0813533766507e29547759d25734838c28c698a5534fb9651ee2e7317cc550c62eba48dc576ef058857738a2fbcba175de93d5d9828551e44b91a61b77acebc10f126857b69f89f5067c3c8261576e05990fbd22095772744541a8e5846d17cbbbe371e6c29e0829c64cb7ca8ebd840028103f912b16db1e7b20d3c43e4ae749a12ab499ad83c3848a95772db0ba0c3999b9b8749e5b608040fb4e17b968a4a91354fe6578ea57cffd48138b3adb2b37c14817f8c3960cec9412941f40b3072fc2ef383326fecdf7358cc4e9da1560ad849e438292e6c70da7b939fed7708142510ba77f4e98e9b1962500ea227e4e01f7eb28bab5ab71e53e865787cab689288b853852c135cd2c6e38a83d1fa0eb70836605699ff06d70ec450f0d1604384108fa877d067ab654a796631aeea827aea1117ee75db69385d5bf2ffc8747e0646bba35216a25d04403d79bc149a00b743616a2343f238361fd7f64168bdb1687055161c68524b13d8cbe07cf20ec9db4aadb3b40bc372b70c9c56c016365a9f59933c4248564e65b3613e373dfbc8200675ff4b64c99977af0007914393af989fcb2a760017f7e75ebe90fe5a479007ae2d1ce2de2d44e24adb658f7a968da7af780963f3be4449c59b5c5366adff9186ca8e2922fafd199363663ef610cffec52cd6ae6488ddc797427ac7dd75d77675df15f7b84baaa3ab86ac52d33417477d01721060f35fa0af7dc54edfe0d3782df637358e77e32510bf32ef7d27097ba9c8174a8bd85d769d63ea07ec3ce55b31cf567077ca1f2c8c4d3c4c5700a4d6a06d0f7b3da01c5c9544423ff2d13e5eca48697b326f32f6a41de19477c250cbc7e6625fea96b655ae6c95c36c4f2393dcdccfca75fa8f30774b62f78ac730a92f44dcd385a3d7533f9cda46a83007ea0d03c6b66858c757ea2cf7f7c2ace40ce54a2b7ddae003b505f753036dd337c7ffc0ea54292417c225de11ffd89a8974ed63bcca904423d30dc19deddff8d4747276cfd89dcca07fa1425651215e59680969f31e3f9641773381c2ffc0fcebbae6b16f3b2e829e9c7fe1c8b8a75e685844d9dbfa0e927e6cebffa16d8d9eef48056a4a1eebe4ba3875deac27dc5f312e2f2c9d51c4713fb7bdc806775198bafe6cd66ff6866b5816b6de7a0ef196b78c916e37573a2ddc9b8fac01304dec136a80e6f9fbbc854e840d6d42b2c45b5674024e8320e1e940082e98139de93fcd13842d08722a748bc" } }, { "event_id": "evt-52f1ea687d0a2b5cd8aac19a", "kind": "unclassified_tcp", "frame_number": 1090, "timestamp_epoch": "1647896384.545558000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "7b263474705e26bb6e4439ebf9a41c75d5d302df4063aec3db45d5920bc931b90410b9233488ff456fc5fc2bc04ff2f98f70edf79778e450f7903a12dd50ebdfc1849254be47817098ab85583911e2bf2ff3aa2d9930de34b408659afc8630325eed38dcf1ea42e4cf950c35899b53a1789135d2c803ffab0e7b6b1126cd84405fca0232c97744ba425c02187d57e53d2d14a7e116da45e6f3302813a1fa8d2281bf2ac915f8b3ddd4048d5ea69c249e0ed49865871a5aa2c5e35f081c556339594c4f42cb4c06cb01b1416398804e832df7fa8b1aa4160c2e33a800f9c4607d15d2c61bc35e1506b56e16ca1ef220bb803f9433cf6c61085181bfba711921a6f2bfe8ba381110bb11825c01e0ac9756ae16481b067325509909784c45320f9c39fd6e50ee2a71babd80f00d29a57bbe5a39e6fbed0aa66c21733b4829a32facda84e3584d9a30b3d9008c99a41e8da5d0ad4e19406d820edb5c5d6cf1620cd9561ff7a063bf45697ea11cefc8c92c7212be9592a3626a4fce349a72f3db0b15e83fe9d30ba9ca7c97ac4a045adb4d8651a52dab53be2c9063ae014f5f399b18a904928a39295292b8a5b4bc3c1ae16d49222809845b97a08d123c4bfd4be520501affd5b4350cabbf02d1d352dd40f759a75433b18ce7b72cc179b9fa7feba061dcfacf20d5615a7c28d6ef2cfad9572fb4105af372f72ccd9df9b207542071e1d90be368144f9a2095112030c6017b5ab21f5f11c7dd60774ae342184f1f9f9020a999589582d033f9a9ec766912467f48955444aed5a7f6cbbfcaa16cd23eb55ac40b72f45cd0dbbc0ff19406516deb3364addad0e5eadbff3e9e889d0e567bc6a522d4b4071d06708ba675b75db78b4b271768ad5419a5940521ffb2bac9fd52fdc77acbcfe0f98aeb2302f21f593568258f175c1a9dbdf7cfe26f4bc7d191d6d0391dfca4cf12200307c8abb6c0ac9a1f8bca0a8b39fecafdb1759a41794b44b55e7fba41419348306e173cfada6c6bf6ba006b084a8a78f97cf0c440344bc6ef71cf6401b108a0c36edd9d3f1db5b1dadb32abd0fa47a90b99efabf121eb374b3bd811e5510415b7bff43d2735f93c333ee4a4b299d8d341ef553cf7cd6d2da6b633ea705b38f71a3ad254a0c92eda5ed5201c7fc8471ddd82cb8cb65aa91cd93f31a17efe26d18eca5aae787f877df4a1cca638214b8ee5b25da22a33736921472864ea5232c4273e76c2d477a64567e4f3ed6536a68958879301622d91acf8ba53c67b574da81ba46b3b47390710681528da666f825f61658dda4e6001491bbd0f6d5d1b0e50ba09b14659ba80b61b283c058de117413a2a626be75f6cd57278ad5f2b5bbdeb63c9a21d64aa74342dc83aaa4ee7bfc51ace9aafa1a7610fad2a5be780ad8ed152cbec02197c08e3569a8fa57ddf74cc616676351008bef782bdf40d62453f06dec66f2c8dc3945f6040b1edde20b1c8bb6d8fc4f84897cdcda574296ed2c966b0c9b3f9cf27ee2141237c94588a001e425ffad6e04003e1195dca835c5e2e62e46ffb8c4bc6baf87a38d2ce7f296fe5fafe3ed7fe72aace889199f0410aab3be6fe8bef3d9dc7ef320000a7c2c9d27a99366b7a5a2a8a4c19f16fa2819d22629d5a0c2c2ecc56479babf9f5c3a7b3df09f0292b5c30e9917f06d4cbff7dd1985dc353910d9c7064870ed2711590ba3de9fd7e1ed14de6e1d5450089f5c2d4762a8fa8e23614ddc8522f105f2727cf64ab110d18314e3f6ee702a71f8c1bae6c15d0d49f0320aa6eb0b1020997146a8007645edce074a14e7195ddc1e902cc34d8c036187a162b4e9116c62e07f0d7bb03afed70092a190b5e12c734ab457458a8066b3d2ba2f77fc3c15deebeb0ebd3a87029ed051080d8747c34bed5392aef6aa7cc3512f6ccdf9df407867c104312aaf81801509474cc364eb9f7e53523950339" } }, { "event_id": "evt-42454beadd18bfb15907e7b7", "kind": "unclassified_tcp", "frame_number": 1408, "timestamp_epoch": "1647896387.622376000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "de164484c7a2ddfa029bfefddb514aed62ed644c44a135cb08b8d84beb9eee899a1d4e479ac0c3bea79533383619706c5d520dde4cec625755c3e874404c20f4cc04a41629ccb3cf9f14fea1a8c967de27704a831d4c231d06781c2d0377e52cea6ca51ef649634db7f8befe8793b2405234c8e7edd84996f4b7616df187c8b58666ab74859436f7f72ff8253ad61263fbca6fe8a3973baf86b118e16bd409e6d6908eafbff51284254777ec92077369109ba1d4c8fde5a3bd4b35b235e767adfa6d2014b3f7c5e1615f12b3d56ac3d1b40471cfa5212e49c02868c29b683e8cdce2465dc0c41ec353456b04f3c57e91b71f399ef438cc3f1a83e667766d79d3c5a41aa79af222ada3ab32da89550ed540d6a6295e1b44fb09cf7f96471e8de609916138188027e615fabc51bc6e057c7c388d9ee20befd06435d3c70dbb5260ef15aafe797e0d375ca7da216fc6a01b02c1a14ef5c98ba8acc21821f838050a23ad3b6eb3840c49c9c0955f5c9ab2b2efd9ef2ca9465a96d3160a17030340182ee6b743221c104fcad65a5ee13cb89091767a1ab110e7a7eb6815562e9b7e53ac527b9d76474d16154e62f6026aff88b1b8e89697dce7144dfc3be065605e087624d1c2b85d8c3f6730bd6bfa322751b1d0543908bd85afc235049b3905f6c002523999c2567e42649d7fc44c44e38f4c6eda270cd442f015f0d89763749cd0e1cf20ec08638b6b15087767eb27b17c5d188872110aa10dd20869d4ce2e6846eca9bb2303cf727c48ea58730ea362c843b05caf8ca7f1cae8e3ac945fa7b315d85b7b971366baed3ad2492042cee9d5ad2125d32b520ce39df600ba8352c1dd16384261f74cb186470673f3e64095cae29387d1c10c21272db6ef59b3f02e7c53cfc997a5dd2bf981e3b3ede8c25dd177f17f62cc10a50a8e2671e64f046f028511a0da50ec5337279aa4665797f37be3a5e82baf23f1cae96aa1875ef592fe7eee4b666516917b376fe00dc1364463ec10bd1d64adbe3c1f81a146f2542e3e7cd3708168b1a45d69b17f99ae03b2d5590876c9606288b41eee302e02fd4c034bc7c14204cefd5f4f77f8b91caee89d898746456a6d6f0b4d07e3206ef3a7c64417058d8fc5c05df029932e3e76783d84ad71b8606ec0b3ed516bd43494ead5a9c6c5a8b204941546e35a79a8adfedf0f50762d3e4e607ee5dca5c9caf9ed9ab626872b47e84cd11de89f6716eeed8475f3257a43d987407fcb0f899013206c311b6e089fe39bb2ea284a7ef909708998d04d68165093fe2f00e9e9ee25f6cc928c90e11b1ea50af900cc75dbf7dda3566153b4de33c84c717528e0ffb7a7f9f6f46d12edd2ca8adc4a20c25f93aa393e14e451526cdfabe1a60e47beaed205be94f54b8f5c16d11e477c76522db7c27f76ef5d97bf11c11eea7691ea4d098f6e28fe7eeea96d408ad7ba6b6b7a0bdd1868c1ceaf96638c92a7491b04fea69a571c4011baf0812259b3d48e88a7d0b300b604d7bbf4286a49f58e9478e545fffed713f50eabf32e16272d4d1e9ab36b5250e2a0941dbfa99a9f07c6c3b280d0f7a7b8afed95d93c4ac716ac0a8967cef6657ef0bcf34d3c9149008489d9ac6416305e27e444e534d53004ea4f389e9e8f19bb0bcbf9ec01f6e7d7876f1671b2f54af1db1ae07dae4bab891904a8ac9ed9e8d9f9435aed6f02698942d93cb210f68a4f72aac4d971bc1d169e46316f85229a033284c0daa1cc187b5cd4603c8fc0905738ff102fb4c2941fd0a0086e91a6871dd24de8cd1efd8eee07808d38d38e85c566bdde952e030add9f0b6a64422674d70e554c92080e524304cf4e7e537cae2a09bddaa6f9942ab136b526215c08bc8f2c96dc717db5f646e98a1b9bf780d4e0f95d93ad03f9c5e5cafe76fa8fc60c74d857c1620d22c8d7370460c1e8eb47839ca0d8ce5f5d84150c" } }, { "event_id": "evt-7fa330490ba889ace6342fd8", "kind": "unclassified_tcp", "frame_number": 1887, "timestamp_epoch": "1647896392.470144000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "3e247739123475c9ea8d8b5eb74ee60266f1b7ae048ff45a73b3b63bdbad79aa35fa9286adc595dcd40e8ebf553fc25b106a486c800850af8a4878ee713428c8477ad0cb5632efd255d6f85362ba430c44f1f0f42827c28d94c4a52cd15057710fda2c2258a2bded44276a30825483f17f413cb60cb264a8e529ab4b5b71be1c510cf6f3560d2dde5b0c0121bf1c3e306bef898c14edf3781735aff97a24610f297a9ff3a1c799d5b2a5d95d84706256be138ee397cbd7ceddf30420e09b7e715ea274fdd16d76422b510f22c1034489884fb66b034d567877947ecbcd4048d0fc82f91c6c55227bfd3fb5434d422efb13887b66664b1b31f53f7a568a0b1038f9ddbe97e10bca0990be5ac3255853da8b1c67a5fc3091fb839e40265e552bb96caf7858b9ea77290bfbbc2ed9fdb3dec0572e1a36bc5823ee6099dc6edba23c8a8f4138dd1a1bc5c1c729dcd8a3a906cd3c8bee0a73850c41024f340cdfeb86326063686b511c5493c620473eeaf3396aba9be6c9b60d579b2ccc3bf6b782b8d26b029f13bf3e4636f26441f5158c6fd10939b349b4eefa59a665c624f1f019f2b5ee172f81cb84be12795c9004de829794df409a02c46584a3e41afef9aa0c9e1a726ebac0ae0a1b8b16c31aa0e1a121d645055f51e6f171102209f3df09b5fe702841468ec88390919bceb0261e547548358658669c50f2845869c521f6a547ab5edbfc6d963d074283f840a0099e641ffd9dfd6c33dbe395604bb477eae7e0540ae1964445048edd85c0f6d64930c7401bf4df3909f0ba11650cf344f8e6d5115b69e53e6b8a00e913f9af2dfc6af5bc3795f4326fc8f0c64cfc5599e7f72ff66017532c987c08416c222f065d2e1d130b6276d22bab7159d1a81944d7e634ea3f9b675364c3c09ba3d860e73115669da6a14207f28fa344e9236ab5e1c7f9ba4e40d2200ec94de03d2237b3394022ebe23bcdbfd7ff8bf695ebae58d329937d7218ecd569469984ba944e244cb7b6417dd29068990022d9e95a8e1c4a71a635b11a76db80c31660c8dccac72008bcfbc9982496f04623aa6d4b7053fd7c355d7b36cb25dcf308252ad40bd918e31d630a414d1ae5e30f80150d8db2a97e799a443e3eb79950c62c18ae38341652debd976467cba3b3aeb967107080d6dde022d3133c5508ceb2201ca3412c5c848064098d73dfc9c939e82fb65e98a8b1248c01ef0aa07d15b872fa72349331fb247be4fbe40b6559b7200a706c7273a0a53a80a2f0f8a8b9dce03affb3ac5b709a8473ea1277bf569ac848ad7a6ba551cc1ef120a2f5f06c28126774ee12390b93d568d3c426501c87c0672ad055145535f215f4d7ed7bf4698a493e2f0aab0b0b98313e6ccde90c325cbbbfbf485ec880c66b2c5252cd4eea00b93d48a61da36a93dc40db18522d71b2339b64914adf28254bcddb046d1310de4cf191543b5fac4671b9cfb61b894d916d99f3e889e4b2153707169a4a45ab9063e1de92cb7ae911bd883e6550a6400de8be640ba0f32213d26d74221f9e4207bc6db8f4e2aea98db9ea01139f82cb53018a162da2d1c5e699d9be803d1928bc6c68421d1d1c4b96aa4b0f50b4867604aebd56a46353903e781663f18d0baaec09cbc60906f99ab62f5f0ac59a21b3f7d044b1155c51c1d7a0bf4b346e8efd0718937338a7d7e2deaec93672a177dca287131d6330d6eeb0044d825927dd06f5249267a9a60a9b81c707fcd0dcad3c5c1839f89204bd0c073e91c1c3625b9a2426d28163ffc8a11cc830991966cf31e805a0150f64c1de4a541c5997455e43407d6b40136e4ecab7f3308bf6ef4b2fe328afa53037bcb104e87de6e67662333ca09a8c73d8d14327d0efbc203f022701ca54821acc3918b208f41d33f2b1c98e7f2f66b6e02b444f33d07f108e08b4af7bbc6ed4c37118d920e6c014f7bd7e20ce70" } }, { "event_id": "evt-173fd03aa6f0db53a3c4f14e", "kind": "unclassified_tcp", "frame_number": 2180, "timestamp_epoch": "1647896397.599815000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "6f6b4727f559d2badad14d13bde3a92ed96af8c20f527202cf26bcc7769d78f385ba1e160b619e4b85bc6a4f0a89351a493543499272860043168329d9b36df8fc8ec0bffd4d01b481caee97a1e9a496b4682919e915717ee43ac8b791b1c39c8d35adbc8fd626effe0ba5c4f1fe6b9007a77cab8b8548ffbd04867b06d670c649775320aaac81fdbb21c0eaf6a704b3e7b1928f148bb8f8d7f616ef6560e90ecc519f9f672204f09af5facef8323c0d7788aa013ce453456eec87f4f11a98d7734ae7310a78b58e9d264db1fe572137dfd30282cf9e9dbeb3012998c2f5c69ab8973052610d2fe02adf3ad6e3f8643efd4309af44ba016f937e87c4f84e58f4938624523f7b7f6fedc90f3d1d08fafdfdd9fadcde7cc714b25f908246b02e1c9fe16745c837945aa75f6e1997b2ba6b5b300ad297cf94b82087057597dee11f0f5b05ab9934952e301f4e6c4b7920a1619ead93b07c0e95cee3839ca9b7bcc1124fd6de367079146c93239f9223fc074e82b158a495c2561b5f03fec00b90194f73d7eccc0170c174f83046aff010d7e41df52e73bc77e489c11f270e7042633386ae1e8dabb1a2aae619570b53aa85e889874f5d91669125e5f49658a3c170efbbfe2bb6f4b9d5055318015267338d247af41ea50dc3863b11d0658ebe1bed0bdb3f944fb14289af36c94aad7895832e2f284356440a12fb65a27cda615b30412ac2ad124ddda901298e7b051c967bea1f07ac92652541fc11693e2f20e5348499858495ecfa38825add7e3407056ed91d81ae64e1068dc8d3870dbae78c4cbe359eb634391c3a348bbc28fee02f313fc86ad0102890ad07bfd2cb4fb881bde5e4684b100b543858eb542fee99bf12434c42035a4563f8b599346447232aa739ea0e7dcc89c93d2148a06888d77fd36b359b16735559dcd14616e6d806d446a221182d5a083ce5e9950280d5954583ba6792ba01f9cd33135415acc65d4b7ecbee77246f30511d7c70c01575c505718d068220cb21eae24c2836fbfeba383b250fca576c53c110915b313927941eb1674110ced60a116d702016a9d22cc0cf918d7afd83f013a8f80c1f0cf7bd215148ec0878798d66db27a3990f9b9dcc709aae932cf5ca7261c6a5009ca444f31e479f7568f1c04df41adf7637a0b89a1df131c4fe501410e19b61deeda7b8d59e05921a1150f428a20962c56011a3b6541e369bb5b2a0d206ddab419e5e120beb4b5f11ce5a9e9efac39f70c85d8db090b65edd178b65fc07b99320b5b0e06252299223b031a31ac336f36979be1d1e8aebc4cabfe9ccff64136c1eeb947f42f4e8d0e9c908a701fb3b8e1b4683cb48eb8ed57eb2e2d075165dac5112ed13c774dfdb31d71002dbe793f6d17605cf196f2a025fe8f3900cc4f1decdb5226faae46dc5cf3044e7fe9f0c56b7feb6383fadba5702cf15dd81a0dad21fd113e693ebbb0cee7f78b0b1b4489a71f983cd7c4ae4395d6584f8268a43afc682369a2bd7c90a01ab6290a8d99ba80c1f88dde317239a4df3bec1c5134e5aff2385489d186e852ed44f43e52b66c555581ced7f1f822982e0792ab2a578ac7ef367724210745d70a60bc6d92b2a7267997ae8fc7ef23b28150b2665bbdd275cfce1a9c88a2c4497fce431a3de4a7a1c6586cb0de64ca7b5a2086b290165b1ec057a7b08cfcee6d6782c434cfac6a512cfb2379757963ef5ebff9a019136d04cda1cf880bb3dfbe824ad3eb7956a06fb9f0c26f421b5b880d08a4a91d6dc3948d7d756eb1ee725af251ce7be0b2d96e5c92de1091d6d89ef0da78a2ccfe183c522d12695a05d3647e2fbdf99deca7e8b883fad6cdbd06865f68f1895e9a3c305558dba8694d3d5309b499f4bc5f06a210f084f009cbc88f14b3efc0e39a3e09443ef848e0912f41f71cd660f9cbcaee3b50c1b054d7ef670df91134f5579ed10f9" } }, { "event_id": "evt-2957b3680335ca1f76046f78", "kind": "unclassified_tcp", "frame_number": 2201, "timestamp_epoch": "1647896398.250812000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "5a6d5e70c65a0e1087e2664caa18bc968f70057ab0174a06053f72156c19ae7eb0930c79dfc2abceeb1295db606792a4c60855e5f582b63c530b62108c359a4047f729fc999c4d138550a32c716fc20a46861f17c6649cd3e346a1675a040c139b1760fc7c88e70400cfec74cd986d55ee51cc313f7a90426381a266199c1b6b86b1972659f491f4dc8c9134ae21cba704887182c466b0bdfb5d2eecc6ca2108c79e891e2775c8d844ac2f70ebc5fb2fac02988dd6b65e6009f35ddae504aedf2ce37a0925959908ac775c425cd5fab4d1361bf55d16c6d4518ee00168b2f425240794b5a06abcf13fd9c5a76d21f273d5630b2cac5257be618faf0d447948f62839468a0d3b78680fee61a974ee7373a91894d85c521b32dbd812c448f8b0a789ba98dc055ce1db9fc537feb747ebc579351eb41223b26dd8db68cc08cd1496dc9779931c09e3de596a9c5872009500cf0cc4bb983647377179af49de550ffd392c055f4dd6c90fac818f04153cab2a5a7195f121d6781d1d44e482f1e7cfcc5323be42bf3374209881e3906292a3b7b843c6f1a63de6320f0f9b238a3c79ec56281a073a95962205d03e926a9bb03f7f78b8cef808783b6fafb089532847c1963a92c9068a04d70a0544d8c9453ea598407da36183fdcdd8356161cb84be415044ef79228cfa27524643a678dc3b00c52b03b117e15b9777bca32a24351ddb586cc14d30b5538c46a82a01a9b16516427afe35e67ad91ed03eced00867c39f1eea196719e5432aa5580ea85db309649db0d8dab712a747e3ea1d5abf0c581d16f54045a50bcfa40df1b614275d54cf093775e232ab5b0610466337daefa0024fe374551a6ca807ce4507be6db2038cc2080e1fdbbea7b09df8fcc8fc9c7ca1e24ed87ba4099df5d77290710ac27647b0e5999f04af5ce40e8b626f6f24db5544280550ac511f25496dab827c125c0cb44f4e5b48d7f3868b962923544a273fb169627f9376272c84a92a909fe005239367aee7a9c398b4858d0c5ae6cdde5f36457380f7ec092354a8f27ae41c8e0f4d1d683ba46bfe7815f5e9f24efa12715937e5ab8e92dad1d9a9ec992f4a5fa86d92d1ef5d9e0cc228851753a38c14f5c56ce046c39294b5c868ee9b9e6e9f2db2e2a751f184c747fdc3c56babc14fdafcf8c7c030b6902f155ae325d2471d70b5a278fc83e1d7df294974e39c643fd9fc665b848ade83f8a1d101884642ba27128d6733aacfd4fae99ae61b60f52b2f0c76d864b3425352f2464236753138d3b7548580f75a64a8b604dfd58ee9f2f6236d8f23c21db78a33f610d7f92120c540bbb9aaa725a285f16e0b7a493dbe5f9fa58e7ecd697fbac1a8429d0f07a1f64ffbd96c59b0ca3e00fda63be3a13a3d6db490d57aa44b2a6cb60a58ad085f0a61dac264a282cc5727a191c1fbe5d524d6aafbfc6a97220064efc1c238f4e4795959c08e79e0f1a815010d716847fce20814f90f23ff303855a61627ce98db986f982e236ac46c4b9525a7dc689ccb6ccc737c4540ee2aa6a49a85837b3638beb745b0dfa5e756256702bcb9a15f3a46ba55776cba2d0b490a09830e54f5938c7611179d229fe65aaafbdac63f0a17c266163c8ebb380fc425224ab40966deffec980a5cc8d5947dea11d46d5673f391a8966f1b63bd3bd8270fd478cf1e21e6fd3cdf0e49898773fed49016cecf13ba06f18ed243483ef9cb03c1327adffe69e750580a3ef4a79877e1fbaa7ce8ae0a8727a7770b0781244649ce4ad641838a077f0abd183d01dec883e9c4431283c4b8e7ae3cde88d1586e0172606800b433e9ea522189572769d835ccd0051c609e4fd658f438aca483e5b5914b279c161c9f8c471c963ad8f3bed908809648cc013fbff10c41e7d9dd9c38f96e6cadeb76801fb80eda21f61dda35d5d1254dd4f3a5c4fefe513393e05fc43c1d" } }, { "event_id": "evt-4b563d997cb5bb5b74f1fa10", "kind": "unclassified_tcp", "frame_number": 2334, "timestamp_epoch": "1647896402.137000000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "2f4c757b31d820846f462137806842cab762e8c935c8cba03f56e2eac18c792a87b54e402889486b0b4d8fab4be7f01289ea57a7675f314c77a2c36041db3afbbe9dd7eac20666a95befd4deace6587b43d28afe6bedc52c452a61d177ba1d39c7c0b62d93f5f23d91a54b01678b261047e93c33aa57e9b77f7ce0664244f768e36f969fd602f7d0557ebe6e8eb5debb1527021be18b639686fc24645ec6e6b21cb692dc6dc25d4bbc0d0f64ceea03afe179d370527058c236e4b473ec6b31cc64fe4697771fce2f93cda549502f87c9a8f8927c4cf0729defdf2f331eae51872f21c75539f7787ebf671f4a089325d4bb7583e42cfb7f1d25b87e6d9f17b7c4398fcab172d9fc300a28a22d922a6d84f29a1312bf47ef6a3c4b8e3bfc0a859dc4464ae0dab5d832cbdaa77aa721d111b3e3598d01f7ba67a99d4d1e024643c5e414f92afa0339551d905d872b99ab70b6bc4d15aab388beb2007741b287efc724317a2c5eea41d04a80d3726be6ef97cf91cd8e7a28309b258043d5d7f15e1566019c4d9e33a8f01ae54c4938135d887a15d2fd032ce4e0d6c0a014f2c9e871feace8064fecef46abd6c917c60851a2d0fd2450d036cc495193c69b4a9e87c38bb102d7ed179149803cce4e6a8273c9bc47fd46dd6c372fc8bc2c070d0247faf26af4f0b5ec4ee59b83a888ff8501beda6715372f6a22f78742d22cb41b09509270bbcb194cf12727298e9e44bf4f74b3da8a3c9b7751c5e860c42ace2ab11e74640abe6a50b305afebf45c32dd45efe69e805ec8e113655948f109d6f2c1a5c12e3367d26e7fcfa3c9c1f6b275e25ca59aa70046b1f500961f818edb888ff7bf073ecc18a1cc8d6fdfdb2326354e31ca5c8017a6359e3a9cf5d2f01792eeb20b36c2cd1be1d59b7049200cdcb12641d10ad67908b92bba41273759c38ce0d9f8f999149f9f8855b812417551d1cc8760968a95d3fa45f7fd8330114ff9b518dddb90ed12bc4e404fc3970663ecb33d8044334c75909e34af747576f0562a92827eb41583c0cdb5bf39c46c1f1802879ce1f26f83e9dcce323a5c6b9dc83558450c8ce7af0323c0280aa29a86964729d2daaf4aa40def527562078c8f60841c15445ce6f470781e6d225f19fb505e9f49047e6602f6fa47906649437b447e301f6304cd0df6a65d37680fbff335da55a374728c82ac74d420c40c7ef51a78998b9812ff09aa65ea1a492d211a5c354179fe162217b474e5114df652a167a78c3acea7acb7155674abc209e558b3b903297fafe86f2dcd5381c1f1846b0a9257c17ebeea4587840b571948ed80bea32bbaba6e4dc59a726b0200753e9ce585e4a5cb5b4d78f8ffde6b51935cb0e281558c7858bf3da237a053beeb36e8559274736b5090b763398c213e104a14c1b1596b452c45ccf397a01e627c45fdb9a1f6d84fead21664e446451fe0b2206c2c9f2f2ff37eeaea6478dd05badce819120a855ecb237877df5e5f815a2c68d82ac6448b8ef2bc7d7262c7f7c2cbbee9237e510621e4ec3c636ec24dfd4724e3b1f2562a91ba5304b5b4ee8153147512cd4f7b5395e89c29b3bf5da4d679ea87bb13ab9518886baf56afdfc6e0bdb75750fe958a5c1114557fe9c4ba8222eda60a03f9ce91d2d1400f8330f54d72a68aa0c62d1ff28a35daaa69e858299c73d30f7559455b58d9d7c4cd8ac5d965e47f6ac661331064d4da4578e0a51d6a36484fc7b7e14b8349072be68bb7f825452efb32e7159a6cc29d62a33ef44b015482285688d19573404b45b73beb1008118616ce414a7895b7680bc46da403e22986da5742165eaeec9181e0be677aac3f66dc96ad574ef32ebd4a41c58b71a9797cf382475a4552e12adc405097cdff74bf2f48988a0a494d08d3f79fc95a483ae784c43a166fc3cce096523028483839336b8fe40d78bbe355ba385629cdbf" } }, { "event_id": "evt-a362512828b23d5f19e5bef6", "kind": "unclassified_tcp", "frame_number": 2398, "timestamp_epoch": "1647896403.827801000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "6d515648d32855708c7d37bf23570abef34392d45622bbf58d3bfbb9d2d5a5597d3e5c5550f89fe14f478abd05890c2812714883ab8cce9e85bf46481aeeab771670d7b1921190c41a0c4d672c8a5b831f5b75e0708456c7df1a66aa300dcf84b02bf7b5b7699c8b7bc3e344108c3ab7d5ae8ae1638a32cfb4b64957e9bf9f2a9af64cda29fd85857f317ed8f167e10d312e14343d10c548036dfaa2c94f605cea0a962ce5475e95c8fd1806900c617accc3052f1007dd594fa58dad746d4b2301734dd6b863142255e5b004e4a906d282f70905740c21935f5a9a15f88dcb7522946fbfe1ad424653de8dc9869312503c80a2d6f5cbbe9127b031126b8148e013b9a8443686d2cb977b5003dd86004a938a2c62443cfdc51ed00fd4d9571a102153f5ef6cad9d2c302360a65d7d5f3ac8e487f026c56e44d1ca9c3093cdb2ce431a6881bd9222fdc94f86251b1988d3561cc9bc62033e64fc036f8bd9bc46e9fa35e4860aebb942d0bad9679f6aebae6d752825c1ea1ef99efa1c3f7676463c1c250da75e5ef97ff4a750bf5ef6fd0e783abecefe6fec26311a3308fdfa8284d4a93131ed49bb51a790e7f5700b27f375626394d7e6556b98e480a6e3fbc117c9986d4ec3244f28d0fd124fcaff34240f2e89cc6e1ac505f49db9b3ff6e75461a5b20cc4716a31dcc1e7e305ea5265f0b957d07597f1b0e3952ee94fd04e08fe7d1f10063617c45195eaa2dad0435b79cbe49ab281bc14ddb8ec8fe8c8abdfc1d9fcb76a489478b978de41346727ef251693ae03a5da648467bdebeb29cee1e3bf36c49134e0bbc374ff63b1e4bf8d42b24b1935e241ded21dfebc165f4c656de288b880970a8194a5b835314bb858a66b2368fdd5fda0025b9a9ee012f056494765aafab89bf347311d74a74397333c2260ade24233f59cc09f6772b747aea1c60b1590738db714c8188a92e76bc73ce2587390e325c14d01f8d6cfa4de8616583b643707dbb662d16ec7efd188013e8a29bb5c599a426b9b5f1fce87ae6f900a3bdf5e0ee794202bf92c4d95140ae1e4b5c8bf54414af07d90f765c131015a055214f6625b9e671e04c7dc37bd0ecec62538a6cc2bc4ff6cc0ba957fcef02506d01806062afde383a5b4477fd1d4b8e40a9bd5e2a68ca5cf3b0da4114b8171293391b2bdad4dc7f5c27ab6f52913f8506bfa5d1f60b52014c8371380cc894f74951825174eceea35aed97218ea8a9b5323d2fdaaa3967a9e1e2f78a01a71792bcca79d71ca7512503ebdd9153b30b7b58880c4e82e4bf29fdd19b3241bdaf250dd420a81a6fc9e81ba0e596f5634450b3c833c1bc1376870581137723ea26df042a4a43c43c4defd74a9f368a872556f64d165ca0a9f7696ef126a795eaaaf9a5c64b2cec75c248018ccd0f3b2a7f41feedf313787d51834cf4c2ad614c14c311ff61d82b5f445a4cb36f66ef05b5e285c68a77cd41a16ab6ba39b9c2a8f0f24b56a4956080931d399b902f78632da98f1d72fd9d494672fa70b60debe337c6ea2374bc81fda85dae656c13d57a31575a86b7d2dc8d52a89e6bb7f525834454e7e24d1dce5d6a1186ccaf3009ee6216b614d0621faaa65799b4b0fa440293e003aebded697dcd4272d6a379262336b9b91ebd32b939b08d62c6e1cfd4b5df7a2412ab085cd4c5ad7ff31a725819def3667609ce77885601587341188dd0ecb6ef22203b9cd610f605ba3a641ac62f531e630d74ad3d6384414522b9be8a7e1739e92ac6881f316af31336eb3e1ae2dea81cedcbdec776b0f02e74b367a2e33e7aff9e186a2321d1a823411d3f12729796f7787adfec7afbe1afaf6ef958027de18d779f50b39d9c516c02acf344462642adbe58b97ca40a2fbfe63cde0b8e9dd52fa3b2b4e0fc899613541607003dac84c712960927bb8a032165cca7f9d20b717701238355dc6430cb4d" } }, { "event_id": "evt-c513085a322523d0211cb80f", "kind": "unclassified_tcp", "frame_number": 2556, "timestamp_epoch": "1647896408.258370000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "41716e24c6cf5238d529928f0ebfd11df97d74b3a66a8f9a9db7d456d2c6af744b53225da0c7f88570a11dbc97c8f914dacf19802c94567d953bd853c4e02a3c82604e400b4b0fd41625c319a4a7d76c615c3a3b7b1d9885ef5071b5a6a5cb3d2248615df447f7d45de7a1b30a7d4640f5653c0d40c8de5269e9321d8f350175f509b8d050dbf99aea13a606b0d92ef44aa25c53c5e8adc0cc40e8d8ba305ff60d01c0d9724d88478d9558310c110243eb0afb737e87acc664bb5221a15ac6911e2293cf14bf1f093a5d008df419972601a31437e3cef680f0d47ffde5549d130d19560b9efdea6c22ff821e37d74c1a6ef9249eb77888941794cac9235568eab9ac2d129f0dc4571d575b3e5684d23d952af6953b3cdeef6dd54adeb367bd1205ef2cd84f8305a5c7b2aa75d84ec86ed492832d6b2155dbc0e3edd13ff95bb882d47cfae1c04e573d07e84f232ec6b99f2488783d2fc3bf0ee039494df7cc47e5f99656d768f9d9d2d546af72e2011dbdce51212381a027140715f32d0ae0f9dc32067ffbea6d29ce14ac27067646669b7b8d4afee6c392b5d283720238bb50f6bcff55544d490d573b47f027a4c1021b837c23456d1510cbc8eaa2ff23161e4f769bebc5b3f03a8aec06b69f430ebf89ed0d05f70f1c3dbe3c95b5f705fe4e52a0608218086f262fdbd3d46ba8d87ca7c10e148e093d65435cb9f99f4e3640e138b2aad52e744c1b0c360f5bf27293fe79740b6b2e89b4ff1049cecdf982043a6e5552e6fa39db314541b6706cf6367c6bebddb78b01d0107e02302d2127b860d9f8cad3cf962984133c0acb2a032244e8cf1ad7a4d5916bbd16c720bc84c66e4e5ac75d9eb70d147dc573494e71338b0335562d4352b1ac0d2cb89b20b15417c022712e79462847c60c4d24dae665250613e6c61223ca534553f5d21d5afe089bd51f59f35439c7e4e69a63d8a29a7aa6fd80827e397a5ad29fa922d2deab8c2762deefc51a7d69cb0734c85d3f8b3da566b7183598d3fb7c5c22651884d4e81c4c8601978fbb99bccd37e6a5abbbe6450220374a62c4d5dc3c89dcd308c1314752d145b0a4271614f11aacaec7e9a52386b13cdba49ea86151a7fdd7b5eb83f28578036d490c22ae389266cc2cdd6d611598aa6c99015ff7991c70bb6109050b6b545f7afa600f6131cb09a51cdc4b0268fdd7b4cbd1493261b3735db4b2a25c452ffb6f6765da0521918ef8d5484c0b0caec86b55e95f4fae6ec775574a1df20791c34634fffd5bad3d80ccb6d1a063df7ad6137e26cf1f19cc7e93892270014d9a8a6657eca5f26758d52304cb77e8220e6ea954aac73c3ed00fad9447ff311b0d03e387f1156b92a65b1b59df80623fe126cb224d599cd2aef9811e5215c80e523c8a7cb07c152fb23529802f1222b6073692f58d16e4b4d5ba42de3304b416894e6297c066c6f5bfaf78f9e0b695f3c6191f7906228d382b7d3410975c6a4092e0e4c374e9bc1e49333ea08d220546736ee2c543e839e6b6621bcec66d76d12b1207d30315762f3319dda6ada3c0426a88446bedf48d697a0357e16b32d2ae868aeed620294e70267dc2ce67526c1f70d8877bda583672339acefd74161ba1c78288887fb565b00870bcdf2548c5341b8c040a04675d73d566e636eff338fd34e4855e485a7d34291f5e2ab971cd4f0f5eefd97c9581dd087b62ee83c62f8690fdab8a32eecb6d1469bcce83c60544f59e73f1a649c28b8f96be8c85b1772a8d4157506b1a1dc5f4fdc3485b845b09c0731c84368120697786b951fee3087f59ce31f6af709fc906ea6a2750ef0bbe46f69e937a8824d19d8cfe9cb6ba5bc49f18fe0e4bb67b8cb56bc7345c610010ca794acaf8e21fbf46ac6234a777f41bf4457d86f11e324a6e3c02166196d03f14b13785b712d35886c46ffb6c634cbe021b9aff3ee41f276d" } }, { "event_id": "evt-58694f19d58d957ba4093c45", "kind": "unclassified_tcp", "frame_number": 2775, "timestamp_epoch": "1647896409.591225000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "6e26283ec3b8906f14fe286a3d990eca4b472992e08cb11993d24a2c52ec96e8cb5c173dd455e18f475631aa9479d2d2ac9136ce8728a2a7fd6a01db1c6f961bf9a2c00a001c7cbe2adafc31885e1d489f110b5db1633f7e64511dd2b21d95534566acb12d8a6e387913865ed20a4ea794350afc008344e36c44daa25b0603457600b89d947bb0ff729cfcc81bad862f648da432872515cb25c36b05e96c5bfc1db2a018437a502a14b05d8288221d09f8bacc1be7dce3ed23155c971654b479d4599393de8285ae486040d7b5d1d412e15154e0337511970b3c27dad7f31a4d4ac88872133f4bc5fafd81107bfd50dffe9a5f06f94eaea3077fc89ec65240bb8b65c90cbdae12566252b616f35b3e86f037da659fa3045b12a874ed2c43215f41c486ac09e2e98715fc949f4734c198f24dc11b6599a37023b6fa59d8d765bb833217e337fb96ef875daada14f345130dc51582a822854e6051c676aca848da11730eff466a9fb3e46ce9a942ae0bb146f193864256b5ed6e656b1ffb47b3bb14cc0bfb02a9e2c275221ebd4a77e520b2bc4ae14c76d45d8032e457de8c79205c07e7bacc369190179fbab9ad579822f2d07fab11cb69296c1c2ccb48a3fbf8da53cda06c28189470cebb52effb7ecfde65fba747a2e9af88da2f4f1564f0cc77ca3536d78fcb35d25a9a774be2ba7e2c84bcbcda3eab8b8351a2d378fb376cad46a8a120697c849fafcdf300c2c55915ea1a8b4b8ecf1b34d0ed2325a554fcd9159396355c75ee6155801d7a49df563b0ed91e5d9b56f92149a3a87f110ab3e61f6bf9aacd5ce41cd8b649e1711ecc0a0a5dd037925ce78f9f3cb9cb2d14426d302463e625179b7a0d40038341d3ad34e235cac94bd492928d283624ea66ce853c4b09941ea023605a5e062e602e3763f263d9e602963014366ed064738b3fa00f0f7dc7dca63ef386f0db170ed1e210bc726622d07268e17831fbc000a86f9a1659f1c103f6ca471856fb2d1b5b5836de471ddac4dd752c75f8d248bdf22500fb30b61f1f6a5176d0e141747427202710858caa0d6a34ecdda00236fa7e68ceca918b4b634413acaa3a726aa09c5ae945a737af865edbd9b3ea79f394812dde5ade4b1965828114f59bd410d7a4e4894f78b90b424e61eaae2614619df143597460be16d0bf1dbd0b80a4ac3c2a261d849b6b67f4e6d117a8b49cb6685438fc3bd562819b4838f0a8508b6378fcc2981bf8de14a153f3d89794f0ca98ff68b5128b78beaf3edb1a61f922d1fc0f02e5e38ad6668869e99e7b018936297ef9338db83f996fbd750ef32eaf29fc9feeb76d85c7bddf2f2ec14e2066b7099510cb75bde32836fabca6073dfa72c010c98b5d7cf14bdcc934a57297cf8c0cb4bda38aa8cd53040fec186c6e62225d076baf95ebc56d07cdf5734064091777a9181b9e77a6924606358151844039e775f67e3d39037b48d35ce6134c49023203f52465cf1eeb2e2f7bbb90e7d00e32e9bb3f76ac66c735f0f0134c03ec0b2d92d81d32fab5ba0c9d0ca9d07537c5f6334a5f11dffa30b85ebc267e5d50a89c061b6fadbb2591cd4be7aa1076f0d3a28339a69c1ea6d09da0418da7087d257d5bb78bff284b919a0e195ee1ce990e63cf0ea40ef97e1d24fc8598ad633d609b641a9e63dab4ab95989c3d4fe37dc3d8826c18762dfc185b0dc6096606c0aa06db1a897a7479aca6ff7aac3277538ad70666616213ed07b5af2ee9f4c901e2f4c1f9029a0496fdfaa8bc2dc127f6aebd92200187cfca6e1c0c6783442c65a937244cb76b6ea4a109f301b67cdbe36a4313ba624db3df50fbb2e293379f2d21b17170ac898d37f30fb57f2cc3cb421d7e63b0fde0cb274f43e07b33f0ec3895c2289394122965bda03e7ba51811d4215398a190a23fe25689e140e1a252fad70bde28e625eed794344255b7588d0c" } }, { "event_id": "evt-3b13cbc617fafd4adae58332", "kind": "unclassified_tcp", "frame_number": 2992, "timestamp_epoch": "1647896410.725269000", "src_ip": "157.245.142.66", "dst_ip": "10.0.19.14", "src_port": 443, "dst_port": 62183, "tcp_stream": 7, "udp_stream": null, "fields": { "tcp.payload": "3e702420e25ca268c0b2328bfb3f7cc20583d9e5512cf0ef108e8f388450419cc5a13e3ca57849d1d4e729d2b772eead3fff8cd388962ca7ea935d21f1f093d69eabe5cef8a3b1adaee5605a619d4d6f4140ef8b27a85cd8e36f45b7243368fb8e519865ee7bd30c75f548f7d81434c9fa8097fed91ebb846127e64a4e635ba4e19418bc1900e24e6d00b9e073ec9cdcd39773caf059a05533d085e33d9311cc13f08b23e43c5a36d59ea3fc83027ffd089007c294637a35a293f6f38317681a70a46590f4fe6dce04ec463e8405295b7578d84b0a748b4dae115d67235f4cc26d40fe6bcf12016e0dc23908765cd0bed92c3c67631b260072a4c08400fb2e5c2a4ba48adc393f510810b437f82db7c6671cabbfb578bf8de95f45f1e78d0c0570e64824a178d30debe91de04e4133593749fecb0fd89dd5bdb7c9e499c354439f2ab02a780ea76b74d42275f3dda70c1ff130e26a9360716cda45d12130111839fa8868b1901901ebe9a1a1665147a4dbeb7e1abf03dd9b6f2e1f4365f086dc3c57037921ff51ebf2e641320b283ab3a29d6d86914f9bcb7942dae6827686538f1e1620e3a135ff4c6c2ca89e4a59773626a577c6d8b1f465cc1a5bbaebc707333c0954ad55ad439be5fad4048b8a8419e40e34fe1ff0a60c29f1dfd3973b9e7d1d26c39d3e89b83b39883ada89ce4519f214ad4a8e0ea17bb2a75ced879f8690adf4a344d76612317b8a33b21d44b7ae8d99597ec07130a3659af568ed0b3fdab9927bd9dc9d25f3377aad463f54ce93618ac5d2d5182748d50265a08d2ffc531b5cc900c48dc7452f9e769bfd5e2d993301809ecea23992cd24c22c08c5688c67930aa27e940e9848fa124186380db68bb11846f77a6c870c8956fd7f2f940d3d3f71fcbc63d8260650a4aef1184fdc86b5662a316588a6240eebb02fe3c801a01b3fe18cead0b538b354babd56d36ffaac0bcde0b3d18a27bf263234985968a9da2b7057aa0909ad13f54a60b09f45630831be8857b50e35f0b7642e5cc2e5d08d4a651caa09a5146089f4eba855738f717e55da4ebb831079bce679b9a919f84fa69aeb32afbd4dc5be9c4fc3d1b9809f40ad0937b7beb3fc93bb1d6a1cfc5d38e496533d08b1f06b06f4574b8e756ea9a344051847c8d58ba3f9306157d4898b91fc9532052a89d21168247d393dbec21479a293d869a60eaa05fe76e8ca6d31a0781e041ab6aca9051037c2e4c382fe07263f93a7453fccb12806ffe8585f17ba59a0976351dd26d17b07ef66287e57ad851466a81b7ca33c195585252bd6d98fda2970e8b5e7714a78fa7e40bd2f807d0ae9e822ecfdb9bb540ef9163e36f62328a6f999ed2cbb87d1c650b04c30c7f29fd426bd5d9441a82243e4e5aee680897925ccd0f39480b55365b4c28a3e85e06970b09dd194ca26d09796274ac46f4b6c57f656e3f7f22cf0aaa57f5bc29462e4511e0988b502693f50f8476402d1e047304335c47261f1f41852503e157293d34ee8002f86749ef485230ecd35311683d4ea7f3cd876e717030340182ee6b743221c109c7a6bfc0d0e62a99d1f8be6392d4b2c699d78e4e3206c80344fefe1ada5e12aaba747e0b1c471a0602711d6b3479dd471ce216649d41ac8f7f8954f0a8ce97ec00638fee939fe47954f0594a43e2a0e71296da4aa9d0af0c8fe8c53d6f5a069ea7a740c76c2121ebdfd7cc39057ec5e277b2e37e2323ad7eeab04f5693c9cc72e62cde1806cfd0fef0927a0dc6863fff0b8e6b7e3530072762eb79636302b0a9e24258775f30f8d75376b6da492cdb4e6542768301ea68876255dfa64c3bccd186485289fbf9da637347df8b83c61ba9fd7330a48626a843cc0f7f7b08d544063fc58da70ef19222ed16a941a13184a84781eb0d371255560f69d21abe87973a6ddf3cb3cac20e71a5846c980ff3384dbb1bbed" } }, { "event_id": "evt-dde751837fe4e15410f3acce", "kind": "unclassified_tcp", "frame_number": 4757, "timestamp_epoch": "1647899038.917814000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4d7a3b63f5c341bd0825df28", "kind": "unclassified_tcp", "frame_number": 4821, "timestamp_epoch": "1647899068.923640000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5d1d591b8e8bfcdf47982772", "kind": "unclassified_tcp", "frame_number": 4937, "timestamp_epoch": "1647899128.930059000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8618c61ca9f0f56f433a3f9c", "kind": "unclassified_tcp", "frame_number": 4964, "timestamp_epoch": "1647899248.937290000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-00e8525271a069db329be4f5", "kind": "unclassified_tcp", "frame_number": 4987, "timestamp_epoch": "1647899319.116132000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d4a3360165f9465a843b09d9", "kind": "unclassified_tcp", "frame_number": 4991, "timestamp_epoch": "1647899349.121359000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9b5f43c37e0a12303019579b", "kind": "unclassified_tcp", "frame_number": 5021, "timestamp_epoch": "1647899409.150912000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d687bbcb434b4f68a3feb322", "kind": "unclassified_tcp", "frame_number": 5038, "timestamp_epoch": "1647899529.153313000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5785225bc2ddfe878725f5e6", "kind": "unclassified_tcp", "frame_number": 5055, "timestamp_epoch": "1647899649.160505000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-40ecd8575f647e040a9322d9", "kind": "unclassified_tcp", "frame_number": 5833, "timestamp_epoch": "1647899769.167667000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-42f3b4b94cc59c87fe6133ee", "kind": "unclassified_tcp", "frame_number": 5911, "timestamp_epoch": "1647899889.179869000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6d8a16fddd82aa0ebc1823c9", "kind": "unclassified_tcp", "frame_number": 6000, "timestamp_epoch": "1647899919.435936000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-216517aed2951e04eba69540", "kind": "unclassified_tcp", "frame_number": 6023, "timestamp_epoch": "1647899949.441701000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c26af7d858d37c2ad180291b", "kind": "unclassified_tcp", "frame_number": 6124, "timestamp_epoch": "1647900009.454648000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dd6731702b2bf91b17248247", "kind": "unclassified_tcp", "frame_number": 6197, "timestamp_epoch": "1647900129.466949000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b91ab2c68df258a45f95bf22", "kind": "unclassified_tcp", "frame_number": 6291, "timestamp_epoch": "1647900249.478654000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4da26db25339298459b14997", "kind": "unclassified_tcp", "frame_number": 7588, "timestamp_epoch": "1647900369.486382000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e31b64f482ddca5ad4b2741f", "kind": "unclassified_tcp", "frame_number": 7752, "timestamp_epoch": "1647900395.410269000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62286, "dst_port": 445, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4a22d6ddc011d342309494a2", "kind": "unclassified_tcp", "frame_number": 7862, "timestamp_epoch": "1647900425.410434000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62286, "dst_port": 445, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5cbb9e473c669acd88fd47d1", "kind": "unclassified_tcp", "frame_number": 7866, "timestamp_epoch": "1647900455.411606000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62286, "dst_port": 445, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0389441e652a9db0b0f26e59", "kind": "unclassified_tcp", "frame_number": 7888, "timestamp_epoch": "1647900485.422047000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62286, "dst_port": 445, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b57e39d07f06e201ddfd1771", "kind": "unclassified_tcp", "frame_number": 7890, "timestamp_epoch": "1647900485.453665000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62286, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7e0c189024b917ba39067669", "kind": "unclassified_tcp", "frame_number": 7903, "timestamp_epoch": "1647900519.758012000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62286, "dst_port": 445, "tcp_stream": 107, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ef045006b24a84eb4a62ed6a", "kind": "unclassified_tcp", "frame_number": 7904, "timestamp_epoch": "1647900519.758012000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-33a6fa67e286ed6e983f50fd", "kind": "unclassified_tcp", "frame_number": 7928, "timestamp_epoch": "1647900549.756761000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0b52ad87a7b8a273c2ecb529", "kind": "unclassified_tcp", "frame_number": 7959, "timestamp_epoch": "1647900609.794179000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0bfe290730c8176ca391d0c4", "kind": "unclassified_tcp", "frame_number": 7999, "timestamp_epoch": "1647900729.801944000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b86fa138582861c35dfacd56", "kind": "unclassified_tcp", "frame_number": 8285, "timestamp_epoch": "1647900804.786809000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62313, "dst_port": 445, "tcp_stream": 133, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1166de4f5c24e7ff562d029a", "kind": "unclassified_tcp", "frame_number": 8297, "timestamp_epoch": "1647900834.786409000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62313, "dst_port": 445, "tcp_stream": 133, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1d18bc5cc424b651cdd1afde", "kind": "unclassified_tcp", "frame_number": 8310, "timestamp_epoch": "1647900849.809160000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9a62f7a0597c0341e5096f6d", "kind": "unclassified_tcp", "frame_number": 8336, "timestamp_epoch": "1647900879.926505000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62313, "dst_port": 445, "tcp_stream": 133, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-34a887ad69297dc918287e78", "kind": "unclassified_tcp", "frame_number": 8340, "timestamp_epoch": "1647900909.927314000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62313, "dst_port": 445, "tcp_stream": 133, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a9f6084861145fbb926c8ce9", "kind": "unclassified_tcp", "frame_number": 8352, "timestamp_epoch": "1647900939.934433000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62313, "dst_port": 445, "tcp_stream": 133, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-38775b0343c0c9ce2f2fe984", "kind": "unclassified_tcp", "frame_number": 8373, "timestamp_epoch": "1647900969.811198000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d36d332af29b6fa25b16ddc4", "kind": "unclassified_tcp", "frame_number": 8388, "timestamp_epoch": "1647901089.823540000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fc854652ee6e7176ec4e4b8c", "kind": "unclassified_tcp", "frame_number": 8394, "timestamp_epoch": "1647901120.084685000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-71fdc0c1a2e6d17f30c366da", "kind": "unclassified_tcp", "frame_number": 8404, "timestamp_epoch": "1647901150.083067000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d3c2c97322da920251b3b0a1", "kind": "unclassified_tcp", "frame_number": 8436, "timestamp_epoch": "1647901210.115880000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5cff5b03a7e4cbebd0cdc859", "kind": "unclassified_tcp", "frame_number": 8453, "timestamp_epoch": "1647901330.115752000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dc9d86454ad63d2678207cc5", "kind": "unclassified_tcp", "frame_number": 8469, "timestamp_epoch": "1647901450.123022000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-634cc5102f9d85fca1f78fe0", "kind": "unclassified_tcp", "frame_number": 8514, "timestamp_epoch": "1647901570.125109000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-221fcc0db9c3bb6eda4ef6d0", "kind": "unclassified_tcp", "frame_number": 8530, "timestamp_epoch": "1647901690.132247000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d42608040c6dadde0c1153d0", "kind": "unclassified_tcp", "frame_number": 8560, "timestamp_epoch": "1647901720.449554000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-06559bcdc9d6f6fb9f05b3e4", "kind": "unclassified_tcp", "frame_number": 8619, "timestamp_epoch": "1647901750.463198000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ab22d6d177b0ab0014606dd2", "kind": "unclassified_tcp", "frame_number": 8657, "timestamp_epoch": "1647901810.480598000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c5650fd9cd04cf2b1ccd7291", "kind": "unclassified_tcp", "frame_number": 8680, "timestamp_epoch": "1647901930.487784000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8598387cd7b45171b85c0716", "kind": "unclassified_tcp", "frame_number": 8721, "timestamp_epoch": "1647902050.494941000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e84d87f7cde275267d72db77", "kind": "unclassified_tcp", "frame_number": 8756, "timestamp_epoch": "1647902170.496277000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e8a9dc3d5904482fa43f89c5", "kind": "unclassified_tcp", "frame_number": 8779, "timestamp_epoch": "1647902290.503475000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5d1de1f039cd01e414ec18bc", "kind": "unclassified_tcp", "frame_number": 8785, "timestamp_epoch": "1647902320.771952000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ee4905ab50ee49108ed7128f", "kind": "unclassified_tcp", "frame_number": 8793, "timestamp_epoch": "1647902350.770646000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ff273c6c5b86cdb2d44fa78b", "kind": "unclassified_tcp", "frame_number": 8823, "timestamp_epoch": "1647902410.799128000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-cd2bc1542a62ba69018db38d", "kind": "unclassified_tcp", "frame_number": 8841, "timestamp_epoch": "1647902530.801211000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ae76b45b73a4876095c825a2", "kind": "unclassified_tcp", "frame_number": 8953, "timestamp_epoch": "1647902650.808957000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f081ec8e1f157fbed7a9808e", "kind": "unclassified_tcp", "frame_number": 8984, "timestamp_epoch": "1647902770.810073000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d70705e3b5443609476bb47a", "kind": "unclassified_tcp", "frame_number": 9000, "timestamp_epoch": "1647902890.812256000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fe503a1592a6d9a32eed928a", "kind": "unclassified_tcp", "frame_number": 9006, "timestamp_epoch": "1647902921.108075000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-017795f4bb4489c3a0ad3be0", "kind": "unclassified_tcp", "frame_number": 9016, "timestamp_epoch": "1647902951.106462000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0dab74266c94a40bf343a750", "kind": "unclassified_tcp", "frame_number": 9046, "timestamp_epoch": "1647903011.133822000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-53848a8e8cc76b3f1f2ef93c", "kind": "unclassified_tcp", "frame_number": 9063, "timestamp_epoch": "1647903131.136530000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27d3b874ddecd8c2763e3bb5", "kind": "unclassified_tcp", "frame_number": 9086, "timestamp_epoch": "1647903251.141859000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a5fe87f1d986c1b51365de47", "kind": "unclassified_tcp", "frame_number": 9119, "timestamp_epoch": "1647903371.150563000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-19de0b5babd3c8776006d01b", "kind": "unclassified_tcp", "frame_number": 9136, "timestamp_epoch": "1647903491.157785000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1fdd50f92a1733d9ac72b393", "kind": "unclassified_tcp", "frame_number": 9142, "timestamp_epoch": "1647903521.421037000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ea4195046b949e880b3c616f", "kind": "unclassified_tcp", "frame_number": 9176, "timestamp_epoch": "1647903551.421708000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-60dff56f83306a39e7b74f35", "kind": "unclassified_tcp", "frame_number": 9204, "timestamp_epoch": "1647903611.458366000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a71ee01fe93be27555f8c087", "kind": "unclassified_tcp", "frame_number": 9221, "timestamp_epoch": "1647903731.465590000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ff96833040f9f2f474ae3767", "kind": "unclassified_tcp", "frame_number": 9287, "timestamp_epoch": "1647903851.464601000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c98ae79f6b717dd0173f478f", "kind": "unclassified_tcp", "frame_number": 9331, "timestamp_epoch": "1647903971.472822000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-cd1044c99ff1b31711844ccd", "kind": "unclassified_tcp", "frame_number": 9347, "timestamp_epoch": "1647904091.486551000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8a8e1eef2028c687cffa4449", "kind": "unclassified_tcp", "frame_number": 9353, "timestamp_epoch": "1647904121.750427000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27c26e9be3d4f1df64e75e31", "kind": "unclassified_tcp", "frame_number": 9363, "timestamp_epoch": "1647904151.750277000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-10c98d272c5f6c48a8f4f887", "kind": "unclassified_tcp", "frame_number": 9394, "timestamp_epoch": "1647904211.766504000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bbe3dcd4c799cb4155289e7b", "kind": "unclassified_tcp", "frame_number": 9495, "timestamp_epoch": "1647904331.774228000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c85919c46aeae16a48c8c2f9", "kind": "unclassified_tcp", "frame_number": 9533, "timestamp_epoch": "1647904451.785453000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-66bb160b366099f7cc6db0da", "kind": "unclassified_tcp", "frame_number": 9568, "timestamp_epoch": "1647904571.790418000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-afd4613e9cd33f7cad5b5bea", "kind": "unclassified_tcp", "frame_number": 9678, "timestamp_epoch": "1647904691.800908000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6e0f81999cf427db70b70c82", "kind": "unclassified_tcp", "frame_number": 9684, "timestamp_epoch": "1647904722.059405000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d601afbb7ffa19f7e3593a5b", "kind": "unclassified_tcp", "frame_number": 9694, "timestamp_epoch": "1647904752.067388000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8dea40829ac3ee14c0e78f56", "kind": "unclassified_tcp", "frame_number": 9724, "timestamp_epoch": "1647904812.085887000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-51f766c269b8a6f35934e1ed", "kind": "unclassified_tcp", "frame_number": 9801, "timestamp_epoch": "1647904932.098657000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-cade42b046718a67b74a79f1", "kind": "unclassified_tcp", "frame_number": 9818, "timestamp_epoch": "1647905052.105880000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6db21a6154bcc8cb0c86bd0d", "kind": "unclassified_tcp", "frame_number": 9851, "timestamp_epoch": "1647905172.107550000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-61cb2c4487a9b1f61bce91f1", "kind": "unclassified_tcp", "frame_number": 9873, "timestamp_epoch": "1647905292.116982000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-98343e5a6d22f06bf377abb7", "kind": "unclassified_tcp", "frame_number": 9909, "timestamp_epoch": "1647905322.395444000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7988ef0610d30ef7b8e2d3dd", "kind": "unclassified_tcp", "frame_number": 9944, "timestamp_epoch": "1647905352.406302000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c78c7574a6ed594378170473", "kind": "unclassified_tcp", "frame_number": 9972, "timestamp_epoch": "1647905412.420876000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-01a189220bd1e6f8b81c44d7", "kind": "unclassified_tcp", "frame_number": 9989, "timestamp_epoch": "1647905532.433555000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9b8c34cd7ad8b367bf063eef", "kind": "unclassified_tcp", "frame_number": 10086, "timestamp_epoch": "1647905652.440263000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f4e7462bd2b4b1d0018249d4", "kind": "unclassified_tcp", "frame_number": 10120, "timestamp_epoch": "1647905772.452985000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a5cf643ac52f796211d77da9", "kind": "unclassified_tcp", "frame_number": 10136, "timestamp_epoch": "1647905892.455407000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3de45a569b3155eb6a9294e7", "kind": "unclassified_tcp", "frame_number": 10142, "timestamp_epoch": "1647905922.725532000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9b9ef259e9372223f94601c1", "kind": "unclassified_tcp", "frame_number": 10152, "timestamp_epoch": "1647905952.738506000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5edf75368acaef73b2cc57ff", "kind": "unclassified_tcp", "frame_number": 10182, "timestamp_epoch": "1647906012.766262000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-aaf6a7aeaa7ac4175dc265af", "kind": "unclassified_tcp", "frame_number": 10200, "timestamp_epoch": "1647906132.773448000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-334c4ef937735abd596cdc08", "kind": "unclassified_tcp", "frame_number": 10268, "timestamp_epoch": "1647906252.785739000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4ead0a443e922e030d750657", "kind": "unclassified_tcp", "frame_number": 10318, "timestamp_epoch": "1647906372.798426000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9c5d7cba37fffcd45828e365", "kind": "unclassified_tcp", "frame_number": 10334, "timestamp_epoch": "1647906492.811036000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b2b3f8238945965c3491f4e5", "kind": "unclassified_tcp", "frame_number": 10340, "timestamp_epoch": "1647906523.080647000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bcbfac75b30468aae6d0c2d8", "kind": "unclassified_tcp", "frame_number": 10350, "timestamp_epoch": "1647906553.079703000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-aa3a444eff66dcc548d5db93", "kind": "unclassified_tcp", "frame_number": 10380, "timestamp_epoch": "1647906613.116387000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2a59dcb91283f4bac5af8bc6", "kind": "unclassified_tcp", "frame_number": 10397, "timestamp_epoch": "1647906733.113534000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-da01819db74e7ff17e5a79ac", "kind": "unclassified_tcp", "frame_number": 10414, "timestamp_epoch": "1647906853.115661000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-41442202ad3600eaa11a6ccd", "kind": "unclassified_tcp", "frame_number": 10660, "timestamp_epoch": "1647906973.117576000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-43f249aaea0b1a5c35ff7d6d", "kind": "unclassified_tcp", "frame_number": 10662, "timestamp_epoch": "1647906985.561930000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62371, "dst_port": 445, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-64d70e16b9cc9630b20576f9", "kind": "unclassified_tcp", "frame_number": 10668, "timestamp_epoch": "1647907015.562036000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62371, "dst_port": 445, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4405885023af3f16aa7128bf", "kind": "unclassified_tcp", "frame_number": 10678, "timestamp_epoch": "1647907045.562148000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62371, "dst_port": 445, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a66aad05a04c20592d12953f", "kind": "unclassified_tcp", "frame_number": 10682, "timestamp_epoch": "1647907075.571468000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62371, "dst_port": 445, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-da9071480c6336094282c7bd", "kind": "unclassified_tcp", "frame_number": 10684, "timestamp_epoch": "1647907075.582473000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62371, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-78b8e1927c2edca3e41742e7", "kind": "unclassified_tcp", "frame_number": 10692, "timestamp_epoch": "1647907093.119560000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ff10d46d977685b3cd040fee", "kind": "unclassified_tcp", "frame_number": 10702, "timestamp_epoch": "1647907123.419211000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1062f842054ac98231063b8c", "kind": "unclassified_tcp", "frame_number": 10703, "timestamp_epoch": "1647907123.419257000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62371, "dst_port": 445, "tcp_stream": 191, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2f063f7505d4c3dcbb543584", "kind": "unclassified_tcp", "frame_number": 10751, "timestamp_epoch": "1647907153.423612000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-57d6234d5aaaba159f40d55b", "kind": "unclassified_tcp", "frame_number": 10779, "timestamp_epoch": "1647907213.451861000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1e215fb2d69708a36196ec55", "kind": "unclassified_tcp", "frame_number": 10805, "timestamp_epoch": "1647907333.464148000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9ebc37d15666ab1c05021c61", "kind": "unclassified_tcp", "frame_number": 10840, "timestamp_epoch": "1647907453.466228000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6ce881ae54dc2f0e41799ae7", "kind": "unclassified_tcp", "frame_number": 10878, "timestamp_epoch": "1647907573.467390000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dcf0bb24855a028c822d43c7", "kind": "unclassified_tcp", "frame_number": 10892, "timestamp_epoch": "1647907693.480565000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1ba1fb46ccadb819189b9e4b", "kind": "unclassified_tcp", "frame_number": 10900, "timestamp_epoch": "1647907723.767989000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b799923b735cea4f2ba72e9d", "kind": "unclassified_tcp", "frame_number": 10906, "timestamp_epoch": "1647907753.768873000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4c5d785afaa41cf2954f5bab", "kind": "unclassified_tcp", "frame_number": 10938, "timestamp_epoch": "1647907813.807391000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a71d5758a36a8c97b6b68cbe", "kind": "unclassified_tcp", "frame_number": 11028, "timestamp_epoch": "1647907933.814596000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8873aaf35a69fb7e6f3bf1c3", "kind": "unclassified_tcp", "frame_number": 11066, "timestamp_epoch": "1647908053.816323000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-567545917871039e7b0f95e7", "kind": "unclassified_tcp", "frame_number": 11099, "timestamp_epoch": "1647908173.823910000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-948067e2d076bebdacc1000e", "kind": "unclassified_tcp", "frame_number": 11112, "timestamp_epoch": "1647908293.826176000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-edc387c872c8ce7b4a390332", "kind": "unclassified_tcp", "frame_number": 11120, "timestamp_epoch": "1647908324.091009000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6c7b3ec2889a0bc1a878e5b3", "kind": "unclassified_tcp", "frame_number": 11139, "timestamp_epoch": "1647908354.102549000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1ea1b452abbc2c752c1bca89", "kind": "unclassified_tcp", "frame_number": 11173, "timestamp_epoch": "1647908414.115621000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-39097b341f91bfd31363dab4", "kind": "unclassified_tcp", "frame_number": 11380, "timestamp_epoch": "1647908534.117805000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-67752a0e4025d6f48347855a", "kind": "unclassified_tcp", "frame_number": 11429, "timestamp_epoch": "1647908654.125026000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d961055127a9bbb5bba45ea3", "kind": "unclassified_tcp", "frame_number": 11433, "timestamp_epoch": "1647908774.127207000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0d814647173668d75c6610d7", "kind": "unclassified_tcp", "frame_number": 11661, "timestamp_epoch": "1647908894.139240000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e6c6357e17982f7097c21628", "kind": "unclassified_tcp", "frame_number": 11705, "timestamp_epoch": "1647908924.395696000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-db25b4291e89f8ffd50375fd", "kind": "unclassified_tcp", "frame_number": 11750, "timestamp_epoch": "1647908954.402348000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6b1b6f6a2896c1b1e5f4806f", "kind": "unclassified_tcp", "frame_number": 11788, "timestamp_epoch": "1647909014.424399000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3b4d153f87f786258c6901d0", "kind": "unclassified_tcp", "frame_number": 11859, "timestamp_epoch": "1647909134.437220000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-efe8239fbd48d47f17f646a8", "kind": "unclassified_tcp", "frame_number": 11915, "timestamp_epoch": "1647909254.439341000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-96e60b88fab26ea289e2da32", "kind": "unclassified_tcp", "frame_number": 11919, "timestamp_epoch": "1647909374.446557000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27c3c3adfb0e9e38e63da33a", "kind": "unclassified_tcp", "frame_number": 11955, "timestamp_epoch": "1647909494.453756000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4d43ad02ab7551230d16c30a", "kind": "unclassified_tcp", "frame_number": 11973, "timestamp_epoch": "1647909524.763283000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fa60f7fbb0b95e673868f56e", "kind": "unclassified_tcp", "frame_number": 11990, "timestamp_epoch": "1647909554.762342000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-36fa6513a43b7de8a7d86a21", "kind": "unclassified_tcp", "frame_number": 12020, "timestamp_epoch": "1647909614.780587000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e93e28b86a3cb8aa17ed4747", "kind": "unclassified_tcp", "frame_number": 12048, "timestamp_epoch": "1647909734.787758000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f1565991d8493beb8d1ad4b7", "kind": "unclassified_tcp", "frame_number": 12094, "timestamp_epoch": "1647909854.795214000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-690b381f835718c5bcdaca7f", "kind": "unclassified_tcp", "frame_number": 12096, "timestamp_epoch": "1647909974.802043000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-356cfaf3710c6b6716f66d0e", "kind": "unclassified_tcp", "frame_number": 12147, "timestamp_epoch": "1647910094.809833000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-791aa92e1419684a5e9756ce", "kind": "unclassified_tcp", "frame_number": 12167, "timestamp_epoch": "1647910125.092758000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4545e5ea3ec34aa5d2f1619f", "kind": "unclassified_tcp", "frame_number": 12169, "timestamp_epoch": "1647910155.100909000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f2cbb69ee4edbc6df839eee2", "kind": "unclassified_tcp", "frame_number": 12302, "timestamp_epoch": "1647910215.125891000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8fa8f6263a89bd3d3758683d", "kind": "unclassified_tcp", "frame_number": 12334, "timestamp_epoch": "1647910335.134793000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2d9e52ccb47582e67f591871", "kind": "unclassified_tcp", "frame_number": 12361, "timestamp_epoch": "1647910455.140349000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-15a4dd8e031e701c81418d17", "kind": "unclassified_tcp", "frame_number": 12365, "timestamp_epoch": "1647910575.147557000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f010fb61a8649e603d15f27d", "kind": "unclassified_tcp", "frame_number": 12416, "timestamp_epoch": "1647910695.154774000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-124a9f0e040f3be3cd207c24", "kind": "unclassified_tcp", "frame_number": 12458, "timestamp_epoch": "1647910725.412711000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1cf3f9d2379a5663672176c7", "kind": "unclassified_tcp", "frame_number": 12494, "timestamp_epoch": "1647910755.411091000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ccee272a75e3dcebcb9541c7", "kind": "unclassified_tcp", "frame_number": 12531, "timestamp_epoch": "1647910815.429171000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-de7a6201bbda8e6eb1a92ec5", "kind": "unclassified_tcp", "frame_number": 12563, "timestamp_epoch": "1647910935.441449000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4931b431e69aea5d64f9bbbd", "kind": "unclassified_tcp", "frame_number": 12807, "timestamp_epoch": "1647911055.443096000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-470c5ae7f3468894447fca35", "kind": "unclassified_tcp", "frame_number": 12830, "timestamp_epoch": "1647911175.450829000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fc9529454d0b033aa65750c8", "kind": "unclassified_tcp", "frame_number": 12876, "timestamp_epoch": "1647911295.458064000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-64916dfd55e462ce20ab839b", "kind": "unclassified_tcp", "frame_number": 12895, "timestamp_epoch": "1647911325.732427000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b9da8ab854ad85fc5c0f78d6", "kind": "unclassified_tcp", "frame_number": 12912, "timestamp_epoch": "1647911355.731770000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c639b282d3ec6fe8dd66a128", "kind": "unclassified_tcp", "frame_number": 12932, "timestamp_epoch": "1647911415.757178000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-41d4c8851a04b2ba53c8402d", "kind": "unclassified_tcp", "frame_number": 13033, "timestamp_epoch": "1647911535.764655000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c6036772d0e3a8b05f2bc084", "kind": "unclassified_tcp", "frame_number": 13059, "timestamp_epoch": "1647911655.766042000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a6b336d77b3aebfffcb2b253", "kind": "unclassified_tcp", "frame_number": 13078, "timestamp_epoch": "1647911775.773256000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1be90ac230350ee522c76ffc", "kind": "unclassified_tcp", "frame_number": 13134, "timestamp_epoch": "1647911895.780485000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2c6772b2d36009577aca0423", "kind": "unclassified_tcp", "frame_number": 13152, "timestamp_epoch": "1647911926.046190000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-587bf50391c8149a048ecf35", "kind": "unclassified_tcp", "frame_number": 13186, "timestamp_epoch": "1647911956.060183000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6f971bdcbcb292238bf2e34f", "kind": "unclassified_tcp", "frame_number": 13216, "timestamp_epoch": "1647912016.078434000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d45ba8d8c94750fdb8f60275", "kind": "unclassified_tcp", "frame_number": 13232, "timestamp_epoch": "1647912136.091711000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1395457f2444145a8b146219", "kind": "unclassified_tcp", "frame_number": 13236, "timestamp_epoch": "1647912256.102642000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fb32588ce62bd9906aba3d38", "kind": "unclassified_tcp", "frame_number": 13261, "timestamp_epoch": "1647912376.110359000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8382eb0544812ed492b97426", "kind": "unclassified_tcp", "frame_number": 13327, "timestamp_epoch": "1647912496.117534000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f7f6c262369d4ce9cb3f3301", "kind": "unclassified_tcp", "frame_number": 13368, "timestamp_epoch": "1647912526.375279000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3a1807d3a05d740ae45f244b", "kind": "unclassified_tcp", "frame_number": 13398, "timestamp_epoch": "1647912556.379253000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5817da0c265a8cdfa35c23f2", "kind": "unclassified_tcp", "frame_number": 13427, "timestamp_epoch": "1647912616.397360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-75ac9f1c8e13c147467ecf9f", "kind": "unclassified_tcp", "frame_number": 13445, "timestamp_epoch": "1647912736.404374000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a853a2749fb2d3e96c0e35b1", "kind": "unclassified_tcp", "frame_number": 13449, "timestamp_epoch": "1647912856.415738000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-34b09bb0c54ebee82703bb52", "kind": "unclassified_tcp", "frame_number": 13485, "timestamp_epoch": "1647912976.418901000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-360c541e39152275a83f3f80", "kind": "unclassified_tcp", "frame_number": 13534, "timestamp_epoch": "1647913096.420608000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e69a924e85aaecbbad3a53dc", "kind": "unclassified_tcp", "frame_number": 13551, "timestamp_epoch": "1647913126.713692000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ed7eb47f31e07b446be118de", "kind": "unclassified_tcp", "frame_number": 13775, "timestamp_epoch": "1647913156.716476000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4d0e0f193701d41216dc6c8a", "kind": "unclassified_tcp", "frame_number": 13777, "timestamp_epoch": "1647913165.402088000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 445, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0c17c243b23682c0d3c3350d", "kind": "unclassified_tcp", "frame_number": 13798, "timestamp_epoch": "1647913195.410460000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 445, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fa9d0d46389d2ca56c3b961d", "kind": "unclassified_tcp", "frame_number": 13801, "timestamp_epoch": "1647913216.742336000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3245d7e383f2cb7092e08715", "kind": "unclassified_tcp", "frame_number": 13813, "timestamp_epoch": "1647913225.414190000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 445, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-64a0de3ab64506a37ce1ff57", "kind": "unclassified_tcp", "frame_number": 13817, "timestamp_epoch": "1647913255.420358000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 445, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0edc04fc0ff151688b1eb6b7", "kind": "unclassified_tcp", "frame_number": 13819, "timestamp_epoch": "1647913255.439581000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62515, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-008f0b6b3d28bea87d2c199a", "kind": "unclassified_tcp", "frame_number": 13821, "timestamp_epoch": "1647913285.419086000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62515, "dst_port": 445, "tcp_stream": 335, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dcfed2b1cc2fee4dc4434782", "kind": "unclassified_tcp", "frame_number": 13838, "timestamp_epoch": "1647913336.751301000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-211d564ed5ecd4fa9ae7b7c1", "kind": "unclassified_tcp", "frame_number": 13864, "timestamp_epoch": "1647913456.752296000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-703e5a39947e6b93d9493d41", "kind": "unclassified_tcp", "frame_number": 13894, "timestamp_epoch": "1647913576.753446000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-55294e5911b5eff015748bc8", "kind": "unclassified_tcp", "frame_number": 13944, "timestamp_epoch": "1647913696.754865000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e88d3887b9e562cf964340b8", "kind": "unclassified_tcp", "frame_number": 13960, "timestamp_epoch": "1647913727.046917000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e66ccd90902c88151f6f94af", "kind": "unclassified_tcp", "frame_number": 13973, "timestamp_epoch": "1647913757.053740000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ad92ef759c4ba4a9750e8421", "kind": "unclassified_tcp", "frame_number": 14003, "timestamp_epoch": "1647913817.075309000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9c4b9cbbb6b470ae181bff2d", "kind": "unclassified_tcp", "frame_number": 14008, "timestamp_epoch": "1647913937.086541000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a39da9ce27ad755a78b3339e", "kind": "unclassified_tcp", "frame_number": 14018, "timestamp_epoch": "1647914057.089714000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3e152cd30608d3734ef819de", "kind": "unclassified_tcp", "frame_number": 14041, "timestamp_epoch": "1647914177.096977000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e12e68b5bdf0a829afa294f3", "kind": "unclassified_tcp", "frame_number": 14255, "timestamp_epoch": "1647914297.109248000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-36937ce9bdf1d22eb9b08406", "kind": "unclassified_tcp", "frame_number": 14272, "timestamp_epoch": "1647914327.382863000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9cd48704e620be1c577280ab", "kind": "unclassified_tcp", "frame_number": 14299, "timestamp_epoch": "1647914357.388094000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0dd57eb2ee4438daa9a29d66", "kind": "unclassified_tcp", "frame_number": 14328, "timestamp_epoch": "1647914417.411360000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d12b57f68926dd632636b169", "kind": "unclassified_tcp", "frame_number": 14339, "timestamp_epoch": "1647914537.409070000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e38492cc4c58f170338750a9", "kind": "unclassified_tcp", "frame_number": 14391, "timestamp_epoch": "1647914657.407124000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f384da7bc5c8d40ad2d64430", "kind": "unclassified_tcp", "frame_number": 14432, "timestamp_epoch": "1647914777.419328000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-90baa320aa19fcb2a03d2503", "kind": "unclassified_tcp", "frame_number": 14491, "timestamp_epoch": "1647914897.431620000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce755dc5f2f76be43a9e4eb5", "kind": "unclassified_tcp", "frame_number": 14508, "timestamp_epoch": "1647914927.729878000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-065c542f16f1dcdd28e17fbf", "kind": "unclassified_tcp", "frame_number": 14521, "timestamp_epoch": "1647914957.728144000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-127651734beafd4c3bdc6a44", "kind": "unclassified_tcp", "frame_number": 14541, "timestamp_epoch": "1647915017.757546000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-572aac2bd922ecd07c31d662", "kind": "unclassified_tcp", "frame_number": 14626, "timestamp_epoch": "1647915137.770357000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-20acc732edde6f47b00a9f71", "kind": "unclassified_tcp", "frame_number": 14652, "timestamp_epoch": "1647915257.771992000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0701754cc3a895671c508f75", "kind": "unclassified_tcp", "frame_number": 14683, "timestamp_epoch": "1647915377.779208000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d9a7e40c8811434d2398ecfa", "kind": "unclassified_tcp", "frame_number": 14741, "timestamp_epoch": "1647915497.788352000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-773dfcda4671cc9167410c7a", "kind": "unclassified_tcp", "frame_number": 14788, "timestamp_epoch": "1647915528.057694000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-51531a66542d54bc0d1422fb", "kind": "unclassified_tcp", "frame_number": 14801, "timestamp_epoch": "1647915558.063817000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-52ebc4714905b20f39c541a3", "kind": "unclassified_tcp", "frame_number": 14830, "timestamp_epoch": "1647915618.087552000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8d7ae134dcbae7874ac3ef85", "kind": "unclassified_tcp", "frame_number": 14842, "timestamp_epoch": "1647915738.094772000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9f58fcfb315b86e38effe2e4", "kind": "unclassified_tcp", "frame_number": 14950, "timestamp_epoch": "1647915858.106823000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-08b6ccc2b69ee9c24d4730bb", "kind": "unclassified_tcp", "frame_number": 14983, "timestamp_epoch": "1647915978.119735000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ed365734ffcde863cae519a0", "kind": "unclassified_tcp", "frame_number": 15038, "timestamp_epoch": "1647916098.132046000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d32179c7b5e1ad09b128fa85", "kind": "unclassified_tcp", "frame_number": 15095, "timestamp_epoch": "1647916128.396106000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-03b79af679bc247d22a2b52f", "kind": "unclassified_tcp", "frame_number": 15131, "timestamp_epoch": "1647916158.402260000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-73ee1d1132a5b42ec11da54a", "kind": "unclassified_tcp", "frame_number": 15151, "timestamp_epoch": "1647916218.422789000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1b16fc61b93891ce6eaa516d", "kind": "unclassified_tcp", "frame_number": 15201, "timestamp_epoch": "1647916338.430067000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-293e2bb7a2288a63990a0294", "kind": "unclassified_tcp", "frame_number": 15231, "timestamp_epoch": "1647916458.436874000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ae94cf1221d1e9d389abb4ab", "kind": "unclassified_tcp", "frame_number": 15281, "timestamp_epoch": "1647916578.444114000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-84811d746ce7f0e5d34f6ff2", "kind": "unclassified_tcp", "frame_number": 15320, "timestamp_epoch": "1647916698.443405000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ec6ab2e18ce0f1028235d83c", "kind": "unclassified_tcp", "frame_number": 15337, "timestamp_epoch": "1647916728.734868000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2b1c82f6c430e28f9051e464", "kind": "unclassified_tcp", "frame_number": 15362, "timestamp_epoch": "1647916758.743191000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1e0928b1a3b61b9b5b25eec8", "kind": "unclassified_tcp", "frame_number": 15375, "timestamp_epoch": "1647916818.767097000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e20593354bbbb2d1d0f50481", "kind": "unclassified_tcp", "frame_number": 15380, "timestamp_epoch": "1647916938.780327000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8f0cd4afb01b36a311605c09", "kind": "unclassified_tcp", "frame_number": 15436, "timestamp_epoch": "1647917058.787526000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4cea7464c5c375bc9cc1adc8", "kind": "unclassified_tcp", "frame_number": 15480, "timestamp_epoch": "1647917178.794758000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8e91c61dcb1ccff95d71cc82", "kind": "unclassified_tcp", "frame_number": 15522, "timestamp_epoch": "1647917298.807051000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1ff60872356e06d285504fcc", "kind": "unclassified_tcp", "frame_number": 15539, "timestamp_epoch": "1647917329.057309000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9cf7c16d4ef767c9fca5bcad", "kind": "unclassified_tcp", "frame_number": 15552, "timestamp_epoch": "1647917359.064132000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7fa5ad0e4a96d8e6a8f3459f", "kind": "unclassified_tcp", "frame_number": 15577, "timestamp_epoch": "1647917419.097506000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f3af42e5fd0fecd0ce7f4857", "kind": "unclassified_tcp", "frame_number": 15581, "timestamp_epoch": "1647917539.099226000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2e0735d6294bc0d94e645710", "kind": "unclassified_tcp", "frame_number": 15586, "timestamp_epoch": "1647917659.112284000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d64f2a781af3017234cf56e6", "kind": "unclassified_tcp", "frame_number": 15634, "timestamp_epoch": "1647917779.119151000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-af2cb90a6864f5ab3d8e38d6", "kind": "unclassified_tcp", "frame_number": 15684, "timestamp_epoch": "1647917899.126338000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1962a58012df68ae63b928cf", "kind": "unclassified_tcp", "frame_number": 15715, "timestamp_epoch": "1647917929.403102000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f0a177921f75bec57e00a19a", "kind": "unclassified_tcp", "frame_number": 15763, "timestamp_epoch": "1647917959.402397000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0a3ed66906f53076f60f7000", "kind": "unclassified_tcp", "frame_number": 15784, "timestamp_epoch": "1647918019.428060000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4c7260d8bc4a9cd5f4784436", "kind": "unclassified_tcp", "frame_number": 15792, "timestamp_epoch": "1647918139.429118000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-217104416dfc5e1b91c0b260", "kind": "unclassified_tcp", "frame_number": 15819, "timestamp_epoch": "1647918259.436332000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-56d6f107a5b1186d440e43b0", "kind": "unclassified_tcp", "frame_number": 15941, "timestamp_epoch": "1647918379.443089000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0fe18c99ce259fa3b5d7831e", "kind": "unclassified_tcp", "frame_number": 15976, "timestamp_epoch": "1647918499.450772000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fbd6fb07fed794d9b83837b5", "kind": "unclassified_tcp", "frame_number": 15993, "timestamp_epoch": "1647918529.744583000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-992d5458790a561c0f7643cb", "kind": "unclassified_tcp", "frame_number": 15996, "timestamp_epoch": "1647918559.758025000", "src_ip": "10.0.19.14", "dst_ip": "10.0.19.9", "src_port": 62231, "dst_port": 445, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9b6a05c4ec967ae4b6a7a79c", "kind": "unclassified_tcp", "frame_number": 16006, "timestamp_epoch": "1647918619.772542000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2f44ed57c0f96b3052145ae2", "kind": "unclassified_tcp", "frame_number": 16150, "timestamp_epoch": "1647918739.779761000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-257f261cdef2f68c20865fc8", "kind": "unclassified_tcp", "frame_number": 16222, "timestamp_epoch": "1647918859.781790000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-aa2e44689f7ff320b22c192d", "kind": "unclassified_tcp", "frame_number": 16272, "timestamp_epoch": "1647918979.794021000", "src_ip": "10.0.19.9", "dst_ip": "10.0.19.14", "src_port": 445, "dst_port": 62231, "tcp_stream": 53, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-d24255e48e0070f8c225c93c", "type": "http-exported-object", "filename": "%2f", "filenames": [ "%2f" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 393277, "sha256": "ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-5492fcec932ba9fc3902fb19", "type": "http-exported-object", "filename": "%2f(1)", "filenames": [ "%2f(1)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 1306, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1306, "sha256": "67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-e8b6b872ff4dbe06f5f4ca3f", "type": "domain", "value": "antnosience.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647896315.838802000", "last_seen_epoch": "1647918928.982963000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1647896315.838802000", "display_filter": "frame.number == 499", "udp_stream": 0 }, { "frame_number": 501, "timestamp_epoch": "1647896315.891442000", "display_filter": "frame.number == 501", "udp_stream": 0 }, { "frame_number": 543, "timestamp_epoch": "1647896375.854295000", "display_filter": "frame.number == 543", "udp_stream": 3 }, { "frame_number": 544, "timestamp_epoch": "1647896375.854615000", "display_filter": "frame.number == 544", "udp_stream": 3 }, { "frame_number": 3262, "timestamp_epoch": "1647896678.078409000", "display_filter": "frame.number == 3262", "udp_stream": 10 }, { "frame_number": 3263, "timestamp_epoch": "1647896678.124960000", "display_filter": "frame.number == 3263", "udp_stream": 10 }, { "frame_number": 3321, "timestamp_epoch": "1647896979.101968000", "display_filter": "frame.number == 3321", "udp_stream": 13 }, { "frame_number": 3322, "timestamp_epoch": "1647896979.163440000", "display_filter": "frame.number == 3322", "udp_stream": 13 }, { "frame_number": 3546, "timestamp_epoch": "1647897280.810233000", "display_filter": "frame.number == 3546", "udp_stream": 19 }, { "frame_number": 3547, "timestamp_epoch": "1647897280.856532000", "display_filter": "frame.number == 3547", "udp_stream": 19 }, { "frame_number": 3609, "timestamp_epoch": "1647897582.385735000", "display_filter": "frame.number == 3609", "udp_stream": 22 }, { "frame_number": 3610, "timestamp_epoch": "1647897582.421490000", "display_filter": "frame.number == 3610", "udp_stream": 22 }, { "frame_number": 4437, "timestamp_epoch": "1647899009.913079000", "display_filter": "frame.number == 4437", "udp_stream": 69 }, { "frame_number": 4438, "timestamp_epoch": "1647899009.985888000", "display_filter": "frame.number == 4438", "udp_stream": 69 }, { "frame_number": 4898, "timestamp_epoch": "1647899069.929878000", "display_filter": "frame.number == 4898", "udp_stream": 81 }, { "frame_number": 4899, "timestamp_epoch": "1647899069.930175000", "display_filter": "frame.number == 4899", "udp_stream": 81 }, { "frame_number": 4995, "timestamp_epoch": "1647899371.184324000", "display_filter": "frame.number == 4995", "udp_stream": 82 }, { "frame_number": 4996, "timestamp_epoch": "1647899371.287345000", "display_filter": "frame.number == 4996", "udp_stream": 82 }, { "frame_number": 5059, "timestamp_epoch": "1647899672.532037000", "display_filter": "frame.number == 5059", "udp_stream": 85 }, { "frame_number": 5060, "timestamp_epoch": "1647899672.614809000", "display_filter": "frame.number == 5060", "udp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c76503d5e8a9888618a2e2c1", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899009.434906000", "last_seen_epoch": "1647899009.573706000", "evidence": [ { "frame_number": 4405, "timestamp_epoch": "1647899009.434906000", "display_filter": "frame.number == 4405", "udp_stream": 68 }, { "frame_number": 4414, "timestamp_epoch": "1647899009.500569000", "display_filter": "frame.number == 4414", "udp_stream": 68 }, { "frame_number": 4418, "timestamp_epoch": "1647899009.573706000", "display_filter": "frame.number == 4418", "tcp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-53b4e1015dd1ff0fe473d47a", "type": "domain", "value": "arc.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647908842.090282000", "last_seen_epoch": "1647908842.258357000", "evidence": [ { "frame_number": 11610, "timestamp_epoch": "1647908842.090282000", "display_filter": "frame.number == 11610", "udp_stream": 197 }, { "frame_number": 11611, "timestamp_epoch": "1647908842.157512000", "display_filter": "frame.number == 11611", "udp_stream": 197 }, { "frame_number": 11615, "timestamp_epoch": "1647908842.258357000", "display_filter": "frame.number == 11615", "tcp_stream": 229 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b9a32f023054345ead40e9f", "type": "domain", "value": "bupdater.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899683.660908000", "last_seen_epoch": "1647900404.306429000", "evidence": [ { "frame_number": 5735, "timestamp_epoch": "1647899683.660908000", "display_filter": "frame.number == 5735", "udp_stream": 88 }, { "frame_number": 5736, "timestamp_epoch": "1647899683.825443000", "display_filter": "frame.number == 5736", "udp_stream": 88 }, { "frame_number": 5740, "timestamp_epoch": "1647899683.949375000", "display_filter": "frame.number == 5740", "tcp_stream": 80 }, { "frame_number": 5804, "timestamp_epoch": "1647899737.335769000", "display_filter": "frame.number == 5804", "tcp_stream": 82 }, { "frame_number": 5840, "timestamp_epoch": "1647899788.744707000", "display_filter": "frame.number == 5840", "tcp_stream": 83 }, { "frame_number": 5885, "timestamp_epoch": "1647899846.925124000", "display_filter": "frame.number == 5885", "tcp_stream": 85 }, { "frame_number": 5921, "timestamp_epoch": "1647899900.628517000", "display_filter": "frame.number == 5921", "tcp_stream": 86 }, { "frame_number": 6029, "timestamp_epoch": "1647899950.105443000", "display_filter": "frame.number == 6029", "tcp_stream": 90 }, { "frame_number": 6100, "timestamp_epoch": "1647899996.939371000", "display_filter": "frame.number == 6100", "tcp_stream": 94 }, { "frame_number": 6146, "timestamp_epoch": "1647900047.787833000", "display_filter": "frame.number == 6146", "tcp_stream": 95 }, { "frame_number": 6176, "timestamp_epoch": "1647900097.098030000", "display_filter": "frame.number == 6176", "tcp_stream": 96 }, { "frame_number": 6205, "timestamp_epoch": "1647900140.318377000", "display_filter": "frame.number == 6205", "tcp_stream": 97 }, { "frame_number": 6239, "timestamp_epoch": "1647900186.948538000", "display_filter": "frame.number == 6239", "tcp_stream": 98 }, { "frame_number": 6269, "timestamp_epoch": "1647900237.726544000", "display_filter": "frame.number == 6269", "tcp_stream": 99 }, { "frame_number": 6322, "timestamp_epoch": "1647900292.865402000", "display_filter": "frame.number == 6322", "tcp_stream": 101 }, { "frame_number": 6356, "timestamp_epoch": "1647900347.763979000", "display_filter": "frame.number == 6356", "tcp_stream": 102 }, { "frame_number": 6383, "timestamp_epoch": "1647900351.254840000", "display_filter": "frame.number == 6383", "tcp_stream": 103 }, { "frame_number": 7457, "timestamp_epoch": "1647900355.657462000", "display_filter": "frame.number == 7457", "tcp_stream": 108 }, { "frame_number": 7482, "timestamp_epoch": "1647900359.167016000", "display_filter": "frame.number == 7482", "tcp_stream": 109 }, { "frame_number": 7509, "timestamp_epoch": "1647900359.643154000", "display_filter": "frame.number == 7509", "tcp_stream": 110 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-375eb2cac2d4f14f6d156634", "type": "domain", "value": "burnincandle-dc.burnincandle.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1647898110.857134000", "last_seen_epoch": "1647916138.996603000", "evidence": [ { "frame_number": 3792, "timestamp_epoch": "1647898110.857134000", "display_filter": "frame.number == 3792", "udp_stream": 34 }, { "frame_number": 3793, "timestamp_epoch": "1647898110.857406000", "display_filter": "frame.number == 3793", "udp_stream": 34 }, { "frame_number": 3894, "timestamp_epoch": "1647898112.354005000", "display_filter": "frame.number == 3894", "udp_stream": 49 }, { "frame_number": 3895, "timestamp_epoch": "1647898112.354302000", "display_filter": "frame.number == 3895", "udp_stream": 49 }, { "frame_number": 4302, "timestamp_epoch": "1647899008.806161000", "display_filter": "frame.number == 4302", "udp_stream": 67 }, { "frame_number": 4304, "timestamp_epoch": "1647899008.806292000", "display_filter": "frame.number == 4304", "udp_stream": 67 }, { "frame_number": 8593, "timestamp_epoch": "1647901739.547395000", "display_filter": "frame.number == 8593", "udp_stream": 115 }, { "frame_number": 8594, "timestamp_epoch": "1647901739.547659000", "display_filter": "frame.number == 8594", "udp_stream": 115 }, { "frame_number": 9609, "timestamp_epoch": "1647904588.611287000", "display_filter": "frame.number == 9609", "udp_stream": 146 }, { "frame_number": 9610, "timestamp_epoch": "1647904588.611570000", "display_filter": "frame.number == 9610", "udp_stream": 146 }, { "frame_number": 9914, "timestamp_epoch": "1647905339.407608000", "display_filter": "frame.number == 9914", "udp_stream": 154 }, { "frame_number": 9915, "timestamp_epoch": "1647905339.407918000", "display_filter": "frame.number == 9915", "udp_stream": 154 }, { "frame_number": 11709, "timestamp_epoch": "1647908939.270586000", "display_filter": "frame.number == 11709", "udp_stream": 201 }, { "frame_number": 11710, "timestamp_epoch": "1647908939.270960000", "display_filter": "frame.number == 11710", "udp_stream": 201 }, { "frame_number": 12203, "timestamp_epoch": "1647910170.319167000", "display_filter": "frame.number == 12203", "udp_stream": 221 }, { "frame_number": 12204, "timestamp_epoch": "1647910170.319478000", "display_filter": "frame.number == 12204", "udp_stream": 221 }, { "frame_number": 13371, "timestamp_epoch": "1647912539.132317000", "display_filter": "frame.number == 13371", "udp_stream": 264 }, { "frame_number": 13372, "timestamp_epoch": "1647912539.132630000", "display_filter": "frame.number == 13372", "udp_stream": 264 }, { "frame_number": 14882, "timestamp_epoch": "1647915749.946515000", "display_filter": "frame.number == 14882", "udp_stream": 313 }, { "frame_number": 14883, "timestamp_epoch": "1647915749.946750000", "display_filter": "frame.number == 14883", "udp_stream": 313 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7337e1a38092da58cfbde1a1", "type": "domain", "value": "checkappexec.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647897262.965449000", "last_seen_epoch": "1647900610.001383000", "evidence": [ { "frame_number": 3520, "timestamp_epoch": "1647897262.965449000", "display_filter": "frame.number == 3520", "udp_stream": 18 }, { "frame_number": 3521, "timestamp_epoch": "1647897262.992763000", "display_filter": "frame.number == 3521", "udp_stream": 18 }, { "frame_number": 4725, "timestamp_epoch": "1647899020.405676000", "display_filter": "frame.number == 4725", "udp_stream": 77 }, { "frame_number": 4726, "timestamp_epoch": "1647899020.483805000", "display_filter": "frame.number == 4726", "udp_stream": 77 }, { "frame_number": 7956, "timestamp_epoch": "1647900608.854196000", "display_filter": "frame.number == 7956", "udp_stream": 105 }, { "frame_number": 7957, "timestamp_epoch": "1647900608.859056000", "display_filter": "frame.number == 7957", "udp_stream": 105 }, { "frame_number": 3525, "timestamp_epoch": "1647897263.120360000", "display_filter": "frame.number == 3525", "tcp_stream": 26 }, { "frame_number": 4730, "timestamp_epoch": "1647899020.612258000", "display_filter": "frame.number == 4730", "tcp_stream": 68 }, { "frame_number": 7964, "timestamp_epoch": "1647900610.001383000", "display_filter": "frame.number == 7964", "tcp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5c093ca8d9bb81a4d16ae72c", "type": "domain", "value": "client.wns.windows.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647898111.960561000", "last_seen_epoch": "1647898233.876453000", "evidence": [ { "frame_number": 3867, "timestamp_epoch": "1647898111.960561000", "display_filter": "frame.number == 3867", "udp_stream": 48 }, { "frame_number": 3873, "timestamp_epoch": "1647898112.044407000", "display_filter": "frame.number == 3873", "udp_stream": 48 }, { "frame_number": 3880, "timestamp_epoch": "1647898112.120655000", "display_filter": "frame.number == 3880", "tcp_stream": 32 }, { "frame_number": 4093, "timestamp_epoch": "1647898233.876453000", "display_filter": "frame.number == 4093", "tcp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-74b75fb860a18bb565682e84", "type": "domain", "value": "config.edge.skype.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647902555.456382000", "last_seen_epoch": "1647902555.586899000", "evidence": [ { "frame_number": 8880, "timestamp_epoch": "1647902555.456382000", "display_filter": "frame.number == 8880", "udp_stream": 125 }, { "frame_number": 8881, "timestamp_epoch": "1647902555.517525000", "display_filter": "frame.number == 8881", "udp_stream": 125 }, { "frame_number": 8885, "timestamp_epoch": "1647902555.586899000", "display_filter": "frame.number == 8885", "tcp_stream": 146 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-098359bd5eb55f544e2fd880", "type": "domain", "value": "ctldl.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1647898171.890703000", "last_seen_epoch": "1647915587.324783000", "evidence": [ { "frame_number": 4069, "timestamp_epoch": "1647898171.890703000", "display_filter": "frame.number == 4069", "udp_stream": 59 }, { "frame_number": 4070, "timestamp_epoch": "1647898171.973323000", "display_filter": "frame.number == 4070", "udp_stream": 59 }, { "frame_number": 6062, "timestamp_epoch": "1647899971.353169000", "display_filter": "frame.number == 6062", "udp_stream": 96 }, { "frame_number": 6064, "timestamp_epoch": "1647899971.439881000", "display_filter": "frame.number == 6064", "udp_stream": 96 }, { "frame_number": 8621, "timestamp_epoch": "1647901774.196387000", "display_filter": "frame.number == 8621", "udp_stream": 116 }, { "frame_number": 8622, "timestamp_epoch": "1647901774.201605000", "display_filter": "frame.number == 8622", "udp_stream": 116 }, { "frame_number": 9273, "timestamp_epoch": "1647903846.159132000", "display_filter": "frame.number == 9273", "udp_stream": 136 }, { "frame_number": 9275, "timestamp_epoch": "1647903846.224583000", "display_filter": "frame.number == 9275", "udp_stream": 136 }, { "frame_number": 9784, "timestamp_epoch": "1647904915.972082000", "display_filter": "frame.number == 9784", "udp_stream": 151 }, { "frame_number": 9785, "timestamp_epoch": "1647904915.972540000", "display_filter": "frame.number == 9785", "udp_stream": 151 }, { "frame_number": 10270, "timestamp_epoch": "1647906274.228386000", "display_filter": "frame.number == 10270", "udp_stream": 163 }, { "frame_number": 10271, "timestamp_epoch": "1647906274.295724000", "display_filter": "frame.number == 10271", "udp_stream": 163 }, { "frame_number": 11762, "timestamp_epoch": "1647908975.095262000", "display_filter": "frame.number == 11762", "udp_stream": 204 }, { "frame_number": 11763, "timestamp_epoch": "1647908975.099405000", "display_filter": "frame.number == 11763", "udp_stream": 204 }, { "frame_number": 12497, "timestamp_epoch": "1647910775.633696000", "display_filter": "frame.number == 12497", "udp_stream": 230 }, { "frame_number": 12498, "timestamp_epoch": "1647910775.634931000", "display_filter": "frame.number == 12498", "udp_stream": 230 }, { "frame_number": 12813, "timestamp_epoch": "1647911082.802391000", "display_filter": "frame.number == 12813", "udp_stream": 240 }, { "frame_number": 12814, "timestamp_epoch": "1647911082.885047000", "display_filter": "frame.number == 12814", "udp_stream": 240 }, { "frame_number": 14374, "timestamp_epoch": "1647914646.617477000", "display_filter": "frame.number == 14374", "udp_stream": 293 }, { "frame_number": 14376, "timestamp_epoch": "1647914646.687373000", "display_filter": "frame.number == 14376", "udp_stream": 293 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6d6560b9517d142333526a54", "type": "domain", "value": "desktop-lr77s6e.burnincandle.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1647900354.636510000", "last_seen_epoch": "1647900354.636703000", "evidence": [ { "frame_number": 7375, "timestamp_epoch": "1647900354.636510000", "display_filter": "frame.number == 7375", "udp_stream": 101 }, { "frame_number": 7376, "timestamp_epoch": "1647900354.636703000", "display_filter": "frame.number == 7376", "udp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a2beddf512d68962f3152eeb", "type": "domain", "value": "dilimoretast.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647908506.018605000", "last_seen_epoch": "1647919036.944271000", "evidence": [ { "frame_number": 11265, "timestamp_epoch": "1647908506.018605000", "display_filter": "frame.number == 11265", "udp_stream": 191 }, { "frame_number": 11266, "timestamp_epoch": "1647908506.092539000", "display_filter": "frame.number == 11266", "udp_stream": 191 }, { "frame_number": 11279, "timestamp_epoch": "1647908509.232882000", "display_filter": "frame.number == 11279", "udp_stream": 192 }, { "frame_number": 11280, "timestamp_epoch": "1647908509.233184000", "display_filter": "frame.number == 11280", "udp_stream": 192 }, { "frame_number": 11437, "timestamp_epoch": "1647908834.950001000", "display_filter": "frame.number == 11437", "udp_stream": 193 }, { "frame_number": 11438, "timestamp_epoch": "1647908835.020571000", "display_filter": "frame.number == 11438", "udp_stream": 193 }, { "frame_number": 11942, "timestamp_epoch": "1647909460.971903000", "display_filter": "frame.number == 11942", "udp_stream": 211 }, { "frame_number": 11943, "timestamp_epoch": "1647909461.046360000", "display_filter": "frame.number == 11943", "udp_stream": 211 }, { "frame_number": 12130, "timestamp_epoch": "1647910085.943073000", "display_filter": "frame.number == 12130", "udp_stream": 218 }, { "frame_number": 12131, "timestamp_epoch": "1647910086.023225000", "display_filter": "frame.number == 12131", "udp_stream": 218 }, { "frame_number": 12446, "timestamp_epoch": "1647910717.948763000", "display_filter": "frame.number == 12446", "udp_stream": 229 }, { "frame_number": 12447, "timestamp_epoch": "1647910718.028919000", "display_filter": "frame.number == 12447", "udp_stream": 229 }, { "frame_number": 12795, "timestamp_epoch": "1647911037.330182000", "display_filter": "frame.number == 12795", "udp_stream": 239 }, { "frame_number": 12796, "timestamp_epoch": "1647911037.410122000", "display_filter": "frame.number == 12796", "udp_stream": 239 }, { "frame_number": 12834, "timestamp_epoch": "1647911198.910591000", "display_filter": "frame.number == 12834", "udp_stream": 241 }, { "frame_number": 12835, "timestamp_epoch": "1647911198.910947000", "display_filter": "frame.number == 12835", "udp_stream": 241 }, { "frame_number": 12898, "timestamp_epoch": "1647911343.929581000", "display_filter": "frame.number == 12898", "udp_stream": 245 }, { "frame_number": 12899, "timestamp_epoch": "1647911344.013831000", "display_filter": "frame.number == 12899", "udp_stream": 245 }, { "frame_number": 13097, "timestamp_epoch": "1647911824.845402000", "display_filter": "frame.number == 13097", "udp_stream": 252 }, { "frame_number": 13098, "timestamp_epoch": "1647911824.921618000", "display_filter": "frame.number == 13098", "udp_stream": 252 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-221258164ce66cf107d12c72", "type": "domain", "value": "dns.msftncsi.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1647898111.386634000", "last_seen_epoch": "1647898111.450439000", "evidence": [ { "frame_number": 3822, "timestamp_epoch": "1647898111.386634000", "display_filter": "frame.number == 3822", "udp_stream": 37 }, { "frame_number": 3824, "timestamp_epoch": "1647898111.450439000", "display_filter": "frame.number == 3824", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff0911959fa9190d5148cd93", "type": "domain", "value": "ecs.office.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647914217.065831000", "last_seen_epoch": "1647918266.368049000", "evidence": [ { "frame_number": 14078, "timestamp_epoch": "1647914217.065831000", "display_filter": "frame.number == 14078", "udp_stream": 287 }, { "frame_number": 14079, "timestamp_epoch": "1647914217.136915000", "display_filter": "frame.number == 14079", "udp_stream": 287 }, { "frame_number": 15823, "timestamp_epoch": "1647918266.223832000", "display_filter": "frame.number == 15823", "udp_stream": 350 }, { "frame_number": 15824, "timestamp_epoch": "1647918266.296010000", "display_filter": "frame.number == 15824", "udp_stream": 350 }, { "frame_number": 14115, "timestamp_epoch": "1647914217.211911000", "display_filter": "frame.number == 14115", "tcp_stream": 353 }, { "frame_number": 14116, "timestamp_epoch": "1647914217.211985000", "display_filter": "frame.number == 14116", "tcp_stream": 354 }, { "frame_number": 15828, "timestamp_epoch": "1647918266.368049000", "display_filter": "frame.number == 15828", "tcp_stream": 444 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6faae2838c6fc28de043dddd", "type": "domain", "value": "filebin.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899673.951105000", "last_seen_epoch": "1647899674.239763000", "evidence": [ { "frame_number": 5073, "timestamp_epoch": "1647899673.951105000", "display_filter": "frame.number == 5073", "udp_stream": 86 }, { "frame_number": 5075, "timestamp_epoch": "1647899674.021764000", "display_filter": "frame.number == 5075", "udp_stream": 86 }, { "frame_number": 5081, "timestamp_epoch": "1647899674.239763000", "display_filter": "frame.number == 5081", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7a368aa8158eff1c136afdf3", "type": "domain", "value": "fp-vp-nocache.azureedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.276273000", "last_seen_epoch": "1647899010.412558000", "evidence": [ { "frame_number": 4447, "timestamp_epoch": "1647899010.276273000", "display_filter": "frame.number == 4447", "udp_stream": 71 }, { "frame_number": 4452, "timestamp_epoch": "1647899010.343243000", "display_filter": "frame.number == 4452", "udp_stream": 71 }, { "frame_number": 4481, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4481", "tcp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d7ad685d1f1cbfdf44a7e294", "type": "domain", "value": "fp-vp.azureedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.277995000", "last_seen_epoch": "1647899010.412558000", "evidence": [ { "frame_number": 4450, "timestamp_epoch": "1647899010.277995000", "display_filter": "frame.number == 4450", "udp_stream": 74 }, { "frame_number": 4456, "timestamp_epoch": "1647899010.343628000", "display_filter": "frame.number == 4456", "udp_stream": 74 }, { "frame_number": 4480, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4480", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0e157b370cb340b3fcb28524", "type": "domain", "value": "fp-vs-nocache.azureedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.276622000", "last_seen_epoch": "1647899010.412558000", "evidence": [ { "frame_number": 4448, "timestamp_epoch": "1647899010.276622000", "display_filter": "frame.number == 4448", "udp_stream": 72 }, { "frame_number": 4453, "timestamp_epoch": "1647899010.343277000", "display_filter": "frame.number == 4453", "udp_stream": 72 }, { "frame_number": 4479, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4479", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c9efe1ce454acfedd8cbbdc2", "type": "domain", "value": "licensing.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647911021.994279000", "last_seen_epoch": "1647911022.191097000", "evidence": [ { "frame_number": 12670, "timestamp_epoch": "1647911021.994279000", "display_filter": "frame.number == 12670", "udp_stream": 236 }, { "frame_number": 12671, "timestamp_epoch": "1647911022.071953000", "display_filter": "frame.number == 12671", "udp_stream": 236 }, { "frame_number": 12678, "timestamp_epoch": "1647911022.191097000", "display_filter": "frame.number == 12678", "tcp_stream": 285 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a03674bee1e1e92c0dee64a3", "type": "domain", "value": "login.microsoftonline.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647908840.836334000", "last_seen_epoch": "1647908841.010710000", "evidence": [ { "frame_number": 11573, "timestamp_epoch": "1647908840.836334000", "display_filter": "frame.number == 11573", "udp_stream": 196 }, { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 }, { "frame_number": 11592, "timestamp_epoch": "1647908841.010710000", "display_filter": "frame.number == 11592", "tcp_stream": 228 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eabffc6733cec700de762663", "type": "domain", "value": "msedge.api.cdp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647902554.350747000", "last_seen_epoch": "1647902554.549722000", "evidence": [ { "frame_number": 8845, "timestamp_epoch": "1647902554.350747000", "display_filter": "frame.number == 8845", "udp_stream": 124 }, { "frame_number": 8846, "timestamp_epoch": "1647902554.431788000", "display_filter": "frame.number == 8846", "udp_stream": 124 }, { "frame_number": 8850, "timestamp_epoch": "1647902554.549722000", "display_filter": "frame.number == 8850", "tcp_stream": 145 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-117d8e65e4a4640efec567e1", "type": "domain", "value": "nexusrules.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647901731.556468000", "last_seen_epoch": "1647916312.693791000", "evidence": [ { "frame_number": 8569, "timestamp_epoch": "1647901731.556468000", "display_filter": "frame.number == 8569", "udp_stream": 114 }, { "frame_number": 8570, "timestamp_epoch": "1647901731.556759000", "display_filter": "frame.number == 8570", "udp_stream": 114 }, { "frame_number": 11802, "timestamp_epoch": "1647909021.912173000", "display_filter": "frame.number == 11802", "udp_stream": 207 }, { "frame_number": 11803, "timestamp_epoch": "1647909021.990143000", "display_filter": "frame.number == 11803", "udp_stream": 207 }, { "frame_number": 15155, "timestamp_epoch": "1647916312.509495000", "display_filter": "frame.number == 15155", "udp_stream": 324 }, { "frame_number": 15156, "timestamp_epoch": "1647916312.580226000", "display_filter": "frame.number == 15156", "udp_stream": 324 }, { "frame_number": 8574, "timestamp_epoch": "1647901731.671276000", "display_filter": "frame.number == 8574", "tcp_stream": 138 }, { "frame_number": 11807, "timestamp_epoch": "1647909022.109690000", "display_filter": "frame.number == 11807", "tcp_stream": 239 }, { "frame_number": 15160, "timestamp_epoch": "1647916312.693791000", "display_filter": "frame.number == 15160", "tcp_stream": 408 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b0c6195aaaa9a441a7ef590", "type": "domain", "value": "oceriesfornot.top", "roles": [ "http-host" ], "is_private": null, "first_seen_epoch": "1647896291.303409000", "last_seen_epoch": "1647896291.303409000", "evidence": [ { "frame_number": 4, "timestamp_epoch": "1647896291.303409000", "display_filter": "frame.number == 4", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9f1d94b951890036e22e78e6", "type": "domain", "value": "otectagain.top", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647908484.394650000", "last_seen_epoch": "1647919000.883944000", "evidence": [ { "frame_number": 11231, "timestamp_epoch": "1647908484.394650000", "display_filter": "frame.number == 11231", "udp_stream": 189 }, { "frame_number": 11232, "timestamp_epoch": "1647908484.447812000", "display_filter": "frame.number == 11232", "udp_stream": 189 }, { "frame_number": 11249, "timestamp_epoch": "1647908503.229161000", "display_filter": "frame.number == 11249", "udp_stream": 190 }, { "frame_number": 11250, "timestamp_epoch": "1647908503.229541000", "display_filter": "frame.number == 11250", "udp_stream": 190 }, { "frame_number": 11733, "timestamp_epoch": "1647908943.956509000", "display_filter": "frame.number == 11733", "udp_stream": 202 }, { "frame_number": 11734, "timestamp_epoch": "1647908944.028205000", "display_filter": "frame.number == 11734", "udp_stream": 202 }, { "frame_number": 11863, "timestamp_epoch": "1647909140.335688000", "display_filter": "frame.number == 11863", "udp_stream": 208 }, { "frame_number": 11864, "timestamp_epoch": "1647909140.335995000", "display_filter": "frame.number == 11864", "udp_stream": 208 }, { "frame_number": 11923, "timestamp_epoch": "1647909423.949276000", "display_filter": "frame.number == 11923", "udp_stream": 210 }, { "frame_number": 11924, "timestamp_epoch": "1647909424.026850000", "display_filter": "frame.number == 11924", "udp_stream": 210 }, { "frame_number": 12115, "timestamp_epoch": "1647910049.945298000", "display_filter": "frame.number == 12115", "udp_stream": 217 }, { "frame_number": 12116, "timestamp_epoch": "1647910050.021645000", "display_filter": "frame.number == 12116", "udp_stream": 217 }, { "frame_number": 12404, "timestamp_epoch": "1647910679.014059000", "display_filter": "frame.number == 12404", "udp_stream": 227 }, { "frame_number": 12405, "timestamp_epoch": "1647910679.289365000", "display_filter": "frame.number == 12405", "udp_stream": 227 }, { "frame_number": 12883, "timestamp_epoch": "1647911307.912343000", "display_filter": "frame.number == 12883", "udp_stream": 244 }, { "frame_number": 12884, "timestamp_epoch": "1647911307.987080000", "display_filter": "frame.number == 12884", "udp_stream": 244 }, { "frame_number": 13061, "timestamp_epoch": "1647911670.707342000", "display_filter": "frame.number == 13061", "udp_stream": 250 }, { "frame_number": 13062, "timestamp_epoch": "1647911670.800172000", "display_filter": "frame.number == 13062", "udp_stream": 250 }, { "frame_number": 13063, "timestamp_epoch": "1647911670.806801000", "display_filter": "frame.number == 13063", "udp_stream": 250 }, { "frame_number": 13082, "timestamp_epoch": "1647911787.888846000", "display_filter": "frame.number == 13082", "udp_stream": 251 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9411d8a03945ae8c92860752", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1647901731.556759000", "last_seen_epoch": "1647916312.580226000", "evidence": [ { "frame_number": 8570, "timestamp_epoch": "1647901731.556759000", "display_filter": "frame.number == 8570", "udp_stream": 114 }, { "frame_number": 11803, "timestamp_epoch": "1647909021.990143000", "display_filter": "frame.number == 11803", "udp_stream": 207 }, { "frame_number": 15156, "timestamp_epoch": "1647916312.580226000", "display_filter": "frame.number == 15156", "udp_stream": 324 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6184ef5781b4b0ca6287e8c4", "type": "domain", "value": "r3.i.lencr.org", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1647899684.209025000", "last_seen_epoch": "1647899684.353032000", "evidence": [ { "frame_number": 5748, "timestamp_epoch": "1647899684.209025000", "display_filter": "frame.number == 5748", "udp_stream": 89 }, { "frame_number": 5749, "timestamp_epoch": "1647899684.275556000", "display_filter": "frame.number == 5749", "udp_stream": 89 }, { "frame_number": 5753, "timestamp_epoch": "1647899684.353032000", "display_filter": "frame.number == 5753", "tcp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-de2cdefebdd08c1d13dd850f", "type": "domain", "value": "seaskysafe.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647908448.299104000", "last_seen_epoch": "1647918965.017079000", "evidence": [ { "frame_number": 11196, "timestamp_epoch": "1647908448.299104000", "display_filter": "frame.number == 11196", "udp_stream": 187 }, { "frame_number": 11197, "timestamp_epoch": "1647908448.369261000", "display_filter": "frame.number == 11197", "udp_stream": 187 }, { "frame_number": 11212, "timestamp_epoch": "1647908464.863822000", "display_filter": "frame.number == 11212", "udp_stream": 188 }, { "frame_number": 11213, "timestamp_epoch": "1647908464.864132000", "display_filter": "frame.number == 11213", "udp_stream": 188 }, { "frame_number": 11669, "timestamp_epoch": "1647908907.971170000", "display_filter": "frame.number == 11669", "udp_stream": 199 }, { "frame_number": 11670, "timestamp_epoch": "1647908908.046392000", "display_filter": "frame.number == 11670", "udp_stream": 199 }, { "frame_number": 11976, "timestamp_epoch": "1647909532.954492000", "display_filter": "frame.number == 11976", "udp_stream": 158 }, { "frame_number": 11977, "timestamp_epoch": "1647909533.036511000", "display_filter": "frame.number == 11977", "udp_stream": 158 }, { "frame_number": 12052, "timestamp_epoch": "1647909772.652427000", "display_filter": "frame.number == 12052", "udp_stream": 215 }, { "frame_number": 12053, "timestamp_epoch": "1647909772.652796000", "display_filter": "frame.number == 12053", "udp_stream": 215 }, { "frame_number": 12100, "timestamp_epoch": "1647910012.936622000", "display_filter": "frame.number == 12100", "udp_stream": 216 }, { "frame_number": 12101, "timestamp_epoch": "1647910013.007175000", "display_filter": "frame.number == 12101", "udp_stream": 216 }, { "frame_number": 12387, "timestamp_epoch": "1647910642.928367000", "display_filter": "frame.number == 12387", "udp_stream": 226 }, { "frame_number": 12388, "timestamp_epoch": "1647910642.997866000", "display_filter": "frame.number == 12388", "udp_stream": 226 }, { "frame_number": 12864, "timestamp_epoch": "1647911271.917415000", "display_filter": "frame.number == 12864", "udp_stream": 243 }, { "frame_number": 12865, "timestamp_epoch": "1647911271.991372000", "display_filter": "frame.number == 12865", "udp_stream": 243 }, { "frame_number": 13140, "timestamp_epoch": "1647911896.909321000", "display_filter": "frame.number == 13140", "udp_stream": 254 }, { "frame_number": 13141, "timestamp_epoch": "1647911896.988464000", "display_filter": "frame.number == 13141", "udp_stream": 254 }, { "frame_number": 13240, "timestamp_epoch": "1647912303.161494000", "display_filter": "frame.number == 13240", "udp_stream": 258 }, { "frame_number": 13242, "timestamp_epoch": "1647912303.235697000", "display_filter": "frame.number == 13242", "udp_stream": 258 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8487a15fb0d7dc4048d0cab2", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647897103.636741000", "last_seen_epoch": "1647917918.053968000", "evidence": [ { "frame_number": 3379, "timestamp_epoch": "1647897103.636741000", "display_filter": "frame.number == 3379", "udp_stream": 14 }, { "frame_number": 3381, "timestamp_epoch": "1647897103.673485000", "display_filter": "frame.number == 3381", "udp_stream": 14 }, { "frame_number": 3826, "timestamp_epoch": "1647898111.499380000", "display_filter": "frame.number == 3826", "udp_stream": 38 }, { "frame_number": 3827, "timestamp_epoch": "1647898111.570693000", "display_filter": "frame.number == 3827", "udp_stream": 38 }, { "frame_number": 5969, "timestamp_epoch": "1647899911.916838000", "display_filter": "frame.number == 5969", "udp_stream": 94 }, { "frame_number": 5970, "timestamp_epoch": "1647899911.999060000", "display_filter": "frame.number == 5970", "udp_stream": 94 }, { "frame_number": 8536, "timestamp_epoch": "1647901712.694874000", "display_filter": "frame.number == 8536", "udp_stream": 113 }, { "frame_number": 8537, "timestamp_epoch": "1647901712.776868000", "display_filter": "frame.number == 8537", "udp_stream": 113 }, { "frame_number": 9726, "timestamp_epoch": "1647904855.490035000", "display_filter": "frame.number == 9726", "udp_stream": 150 }, { "frame_number": 9727, "timestamp_epoch": "1647904855.570192000", "display_filter": "frame.number == 9727", "udp_stream": 150 }, { "frame_number": 9879, "timestamp_epoch": "1647905313.116471000", "display_filter": "frame.number == 9879", "udp_stream": 153 }, { "frame_number": 9880, "timestamp_epoch": "1647905313.197580000", "display_filter": "frame.number == 9880", "udp_stream": 153 }, { "frame_number": 10210, "timestamp_epoch": "1647906213.831441000", "display_filter": "frame.number == 10210", "udp_stream": 162 }, { "frame_number": 10211, "timestamp_epoch": "1647906213.909932000", "display_filter": "frame.number == 10211", "udp_stream": 162 }, { "frame_number": 11681, "timestamp_epoch": "1647908914.366050000", "display_filter": "frame.number == 11681", "udp_stream": 200 }, { "frame_number": 11682, "timestamp_epoch": "1647908914.373928000", "display_filter": "frame.number == 11682", "udp_stream": 200 }, { "frame_number": 12424, "timestamp_epoch": "1647910714.738620000", "display_filter": "frame.number == 12424", "udp_stream": 228 }, { "frame_number": 12425, "timestamp_epoch": "1647910714.821659000", "display_filter": "frame.number == 12425", "udp_stream": 228 }, { "frame_number": 12673, "timestamp_epoch": "1647911022.097836000", "display_filter": "frame.number == 12673", "udp_stream": 237 }, { "frame_number": 12674, "timestamp_epoch": "1647911022.178753000", "display_filter": "frame.number == 12674", "udp_stream": 237 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1c75fdc43e10806f68211fce", "type": "domain", "value": "situla.bitbit.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899675.035792000", "last_seen_epoch": "1647899675.358295000", "evidence": [ { "frame_number": 5098, "timestamp_epoch": "1647899675.035792000", "display_filter": "frame.number == 5098", "udp_stream": 87 }, { "frame_number": 5100, "timestamp_epoch": "1647899675.140469000", "display_filter": "frame.number == 5100", "udp_stream": 87 }, { "frame_number": 5104, "timestamp_epoch": "1647899675.358295000", "display_filter": "frame.number == 5104", "tcp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-34b4455025352dede164b78e", "type": "domain", "value": "spo-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.344998000", "last_seen_epoch": "1647899010.486057000", "evidence": [ { "frame_number": 4462, "timestamp_epoch": "1647899010.344998000", "display_filter": "frame.number == 4462", "udp_stream": 76 }, { "frame_number": 4467, "timestamp_epoch": "1647899010.410006000", "display_filter": "frame.number == 4467", "udp_stream": 76 }, { "frame_number": 4494, "timestamp_epoch": "1647899010.486057000", "display_filter": "frame.number == 4494", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-28941595f81bd8eab4bcf565", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647911025.667607000", "last_seen_epoch": "1647911025.819022000", "evidence": [ { "frame_number": 12768, "timestamp_epoch": "1647911025.667607000", "display_filter": "frame.number == 12768", "udp_stream": 238 }, { "frame_number": 12769, "timestamp_epoch": "1647911025.745073000", "display_filter": "frame.number == 12769", "udp_stream": 238 }, { "frame_number": 12773, "timestamp_epoch": "1647911025.819022000", "display_filter": "frame.number == 12773", "tcp_stream": 288 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-53cb1ad60e1e0f51e0f2b714", "type": "domain", "value": "suncoastpinball.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647896378.094570000", "last_seen_epoch": "1647896406.787125000", "evidence": [ { "frame_number": 564, "timestamp_epoch": "1647896378.094570000", "display_filter": "frame.number == 564", "udp_stream": 4 }, { "frame_number": 566, "timestamp_epoch": "1647896378.163267000", "display_filter": "frame.number == 566", "udp_stream": 4 }, { "frame_number": 573, "timestamp_epoch": "1647896378.273018000", "display_filter": "frame.number == 573", "tcp_stream": 5 }, { "frame_number": 1107, "timestamp_epoch": "1647896384.773124000", "display_filter": "frame.number == 1107", "tcp_stream": 13 }, { "frame_number": 1703, "timestamp_epoch": "1647896390.406451000", "display_filter": "frame.number == 1703", "tcp_stream": 14 }, { "frame_number": 2253, "timestamp_epoch": "1647896399.499457000", "display_filter": "frame.number == 2253", "tcp_stream": 15 }, { "frame_number": 2438, "timestamp_epoch": "1647896406.787125000", "display_filter": "frame.number == 2438", "tcp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-23f83e8c17bc01daceaf0a11", "type": "domain", "value": "t-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.277385000", "last_seen_epoch": "1647899010.412599000", "evidence": [ { "frame_number": 4449, "timestamp_epoch": "1647899010.277385000", "display_filter": "frame.number == 4449", "udp_stream": 73 }, { "frame_number": 4454, "timestamp_epoch": "1647899010.343476000", "display_filter": "frame.number == 4454", "udp_stream": 73 }, { "frame_number": 4483, "timestamp_epoch": "1647899010.412599000", "display_filter": "frame.number == 4483", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c71252af40a11e5633e193ff", "type": "domain", "value": "teams-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.278640000", "last_seen_epoch": "1647899010.412599000", "evidence": [ { "frame_number": 4451, "timestamp_epoch": "1647899010.278640000", "display_filter": "frame.number == 4451", "udp_stream": 75 }, { "frame_number": 4455, "timestamp_epoch": "1647899010.343547000", "display_filter": "frame.number == 4455", "udp_stream": 75 }, { "frame_number": 4482, "timestamp_epoch": "1647899010.412599000", "display_filter": "frame.number == 4482", "tcp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d7f4c416ba1d81242dcc11cb", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647896327.883955000", "last_seen_epoch": "1647918184.876342000", "evidence": [ { "frame_number": 517, "timestamp_epoch": "1647896327.883955000", "display_filter": "frame.number == 517", "udp_stream": 1 }, { "frame_number": 518, "timestamp_epoch": "1647896327.921157000", "display_filter": "frame.number == 518", "udp_stream": 1 }, { "frame_number": 4039, "timestamp_epoch": "1647898144.014429000", "display_filter": "frame.number == 4039", "udp_stream": 58 }, { "frame_number": 4040, "timestamp_epoch": "1647898144.079150000", "display_filter": "frame.number == 4040", "udp_stream": 58 }, { "frame_number": 5944, "timestamp_epoch": "1647899910.255986000", "display_filter": "frame.number == 5944", "udp_stream": 93 }, { "frame_number": 5945, "timestamp_epoch": "1647899910.335698000", "display_filter": "frame.number == 5945", "udp_stream": 93 }, { "frame_number": 8690, "timestamp_epoch": "1647901985.572592000", "display_filter": "frame.number == 8690", "udp_stream": 119 }, { "frame_number": 8691, "timestamp_epoch": "1647901985.638021000", "display_filter": "frame.number == 8691", "udp_stream": 119 }, { "frame_number": 9232, "timestamp_epoch": "1647903785.463465000", "display_filter": "frame.number == 9232", "udp_stream": 134 }, { "frame_number": 9233, "timestamp_epoch": "1647903785.528028000", "display_filter": "frame.number == 9233", "udp_stream": 134 }, { "frame_number": 10043, "timestamp_epoch": "1647905585.390605000", "display_filter": "frame.number == 10043", "udp_stream": 158 }, { "frame_number": 10044, "timestamp_epoch": "1647905585.460309000", "display_filter": "frame.number == 10044", "udp_stream": 158 }, { "frame_number": 10807, "timestamp_epoch": "1647907385.286879000", "display_filter": "frame.number == 10807", "udp_stream": 174 }, { "frame_number": 10808, "timestamp_epoch": "1647907385.351605000", "display_filter": "frame.number == 10808", "udp_stream": 174 }, { "frame_number": 11880, "timestamp_epoch": "1647909185.185821000", "display_filter": "frame.number == 11880", "udp_stream": 209 }, { "frame_number": 11881, "timestamp_epoch": "1647909185.251727000", "display_filter": "frame.number == 11881", "udp_stream": 209 }, { "frame_number": 12567, "timestamp_epoch": "1647910985.189193000", "display_filter": "frame.number == 12567", "udp_stream": 233 }, { "frame_number": 12568, "timestamp_epoch": "1647910985.194080000", "display_filter": "frame.number == 12568", "udp_stream": 233 }, { "frame_number": 13155, "timestamp_epoch": "1647911928.459649000", "display_filter": "frame.number == 13155", "udp_stream": 255 }, { "frame_number": 13156, "timestamp_epoch": "1647911928.525445000", "display_filter": "frame.number == 13156", "udp_stream": 255 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d8f7e431437acbe8eda532da", "type": "domain", "value": "wns.notify.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1647898112.044407000", "last_seen_epoch": "1647898112.044407000", "evidence": [ { "frame_number": 3873, "timestamp_epoch": "1647898112.044407000", "display_filter": "frame.number == 3873", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2a3bc587cd8d5db11e10de80", "type": "domain", "value": "wpad.burnincandle.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1647896803.730229000", "last_seen_epoch": "1647918591.326440000", "evidence": [ { "frame_number": 3297, "timestamp_epoch": "1647896803.730229000", "display_filter": "frame.number == 3297", "udp_stream": 11 }, { "frame_number": 3298, "timestamp_epoch": "1647896803.730603000", "display_filter": "frame.number == 3298", "udp_stream": 11 }, { "frame_number": 3583, "timestamp_epoch": "1647897403.696275000", "display_filter": "frame.number == 3583", "udp_stream": 20 }, { "frame_number": 3584, "timestamp_epoch": "1647897403.696658000", "display_filter": "frame.number == 3584", "udp_stream": 20 }, { "frame_number": 3842, "timestamp_epoch": "1647898111.853586000", "display_filter": "frame.number == 3842", "udp_stream": 40 }, { "frame_number": 3845, "timestamp_epoch": "1647898111.854034000", "display_filter": "frame.number == 3845", "udp_stream": 40 }, { "frame_number": 3915, "timestamp_epoch": "1647898113.838379000", "display_filter": "frame.number == 3915", "udp_stream": 50 }, { "frame_number": 3916, "timestamp_epoch": "1647898113.838694000", "display_filter": "frame.number == 3916", "udp_stream": 50 }, { "frame_number": 4013, "timestamp_epoch": "1647898132.382978000", "display_filter": "frame.number == 4013", "udp_stream": 55 }, { "frame_number": 4014, "timestamp_epoch": "1647898132.383360000", "display_filter": "frame.number == 4014", "udp_stream": 55 }, { "frame_number": 4078, "timestamp_epoch": "1647898192.390075000", "display_filter": "frame.number == 4078", "udp_stream": 60 }, { "frame_number": 4079, "timestamp_epoch": "1647898192.390434000", "display_filter": "frame.number == 4079", "udp_stream": 60 }, { "frame_number": 4117, "timestamp_epoch": "1647898792.359885000", "display_filter": "frame.number == 4117", "udp_stream": 62 }, { "frame_number": 4118, "timestamp_epoch": "1647898792.360245000", "display_filter": "frame.number == 4118", "udp_stream": 62 }, { "frame_number": 4119, "timestamp_epoch": "1647898792.360754000", "display_filter": "frame.number == 4119", "udp_stream": 62 }, { "frame_number": 5013, "timestamp_epoch": "1647899392.323744000", "display_filter": "frame.number == 5013", "udp_stream": 83 }, { "frame_number": 5014, "timestamp_epoch": "1647899392.324173000", "display_filter": "frame.number == 5014", "udp_stream": 83 }, { "frame_number": 5781, "timestamp_epoch": "1647899730.286540000", "display_filter": "frame.number == 5781", "udp_stream": 90 }, { "frame_number": 5782, "timestamp_epoch": "1647899730.286884000", "display_filter": "frame.number == 5782", "udp_stream": 90 }, { "frame_number": 6090, "timestamp_epoch": "1647899992.295984000", "display_filter": "frame.number == 6090", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ffb435e26374ac48fe6a94dd", "type": "domain", "value": "wpad.mshome.net", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1647896803.731257000", "last_seen_epoch": "1647918591.328918000", "evidence": [ { "frame_number": 3299, "timestamp_epoch": "1647896803.731257000", "display_filter": "frame.number == 3299", "udp_stream": 12 }, { "frame_number": 3300, "timestamp_epoch": "1647896803.732244000", "display_filter": "frame.number == 3300", "udp_stream": 12 }, { "frame_number": 3585, "timestamp_epoch": "1647897403.697276000", "display_filter": "frame.number == 3585", "udp_stream": 21 }, { "frame_number": 3586, "timestamp_epoch": "1647897403.699036000", "display_filter": "frame.number == 3586", "udp_stream": 21 }, { "frame_number": 3849, "timestamp_epoch": "1647898111.854269000", "display_filter": "frame.number == 3849", "udp_stream": 43 }, { "frame_number": 3851, "timestamp_epoch": "1647898111.855443000", "display_filter": "frame.number == 3851", "udp_stream": 43 }, { "frame_number": 3917, "timestamp_epoch": "1647898113.838908000", "display_filter": "frame.number == 3917", "udp_stream": 51 }, { "frame_number": 3918, "timestamp_epoch": "1647898113.839108000", "display_filter": "frame.number == 3918", "udp_stream": 51 }, { "frame_number": 4015, "timestamp_epoch": "1647898132.383697000", "display_filter": "frame.number == 4015", "udp_stream": 56 }, { "frame_number": 4016, "timestamp_epoch": "1647898132.383920000", "display_filter": "frame.number == 4016", "udp_stream": 56 }, { "frame_number": 4080, "timestamp_epoch": "1647898192.391133000", "display_filter": "frame.number == 4080", "udp_stream": 61 }, { "frame_number": 4081, "timestamp_epoch": "1647898192.392675000", "display_filter": "frame.number == 4081", "udp_stream": 61 }, { "frame_number": 4120, "timestamp_epoch": "1647898792.360865000", "display_filter": "frame.number == 4120", "udp_stream": 63 }, { "frame_number": 4121, "timestamp_epoch": "1647898792.362398000", "display_filter": "frame.number == 4121", "udp_stream": 63 }, { "frame_number": 5015, "timestamp_epoch": "1647899392.324828000", "display_filter": "frame.number == 5015", "udp_stream": 84 }, { "frame_number": 5016, "timestamp_epoch": "1647899392.326523000", "display_filter": "frame.number == 5016", "udp_stream": 84 }, { "frame_number": 5783, "timestamp_epoch": "1647899730.287071000", "display_filter": "frame.number == 5783", "udp_stream": 91 }, { "frame_number": 5784, "timestamp_epoch": "1647899730.288672000", "display_filter": "frame.number == 5784", "udp_stream": 91 }, { "frame_number": 6092, "timestamp_epoch": "1647899992.296749000", "display_filter": "frame.number == 6092", "udp_stream": 99 }, { "frame_number": 6093, "timestamp_epoch": "1647899992.298308000", "display_filter": "frame.number == 6093", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2491844d69315a23a345561", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1647899010.276273000", "last_seen_epoch": "1647908840.700762000", "evidence": [ { "frame_number": 4446, "timestamp_epoch": "1647899010.276273000", "display_filter": "frame.number == 4446", "udp_stream": 70 }, { "frame_number": 4463, "timestamp_epoch": "1647899010.351545000", "display_filter": "frame.number == 4463", "udp_stream": 70 }, { "frame_number": 4759, "timestamp_epoch": "1647899039.501726000", "display_filter": "frame.number == 4759", "udp_stream": 78 }, { "frame_number": 4760, "timestamp_epoch": "1647899039.573949000", "display_filter": "frame.number == 4760", "udp_stream": 78 }, { "frame_number": 11453, "timestamp_epoch": "1647908840.549542000", "display_filter": "frame.number == 11453", "udp_stream": 194 }, { "frame_number": 11454, "timestamp_epoch": "1647908840.620000000", "display_filter": "frame.number == 11454", "udp_stream": 194 }, { "frame_number": 4486, "timestamp_epoch": "1647899010.425633000", "display_filter": "frame.number == 4486", "tcp_stream": 64 }, { "frame_number": 4569, "timestamp_epoch": "1647899010.498005000", "display_filter": "frame.number == 4569", "tcp_stream": 66 }, { "frame_number": 4572, "timestamp_epoch": "1647899010.504176000", "display_filter": "frame.number == 4572", "tcp_stream": 67 }, { "frame_number": 4764, "timestamp_epoch": "1647899039.649817000", "display_filter": "frame.number == 4764", "tcp_stream": 69 }, { "frame_number": 10006, "timestamp_epoch": "1647905583.762922000", "display_filter": "frame.number == 10006", "tcp_stream": 177 }, { "frame_number": 11496, "timestamp_epoch": "1647908840.700762000", "display_filter": "frame.number == 11496", "tcp_stream": 221 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8e9dfeb98333f9c3c6ac1f0f", "type": "domain", "value": "x1.c.lencr.org", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1647899971.010337000", "last_seen_epoch": "1647914646.526312000", "evidence": [ { "frame_number": 6054, "timestamp_epoch": "1647899971.010337000", "display_filter": "frame.number == 6054", "udp_stream": 95 }, { "frame_number": 6055, "timestamp_epoch": "1647899971.120928000", "display_filter": "frame.number == 6055", "udp_stream": 95 }, { "frame_number": 9263, "timestamp_epoch": "1647903845.891286000", "display_filter": "frame.number == 9263", "udp_stream": 135 }, { "frame_number": 9264, "timestamp_epoch": "1647903845.962934000", "display_filter": "frame.number == 9264", "udp_stream": 135 }, { "frame_number": 11752, "timestamp_epoch": "1647908974.712537000", "display_filter": "frame.number == 11752", "udp_stream": 203 }, { "frame_number": 11753, "timestamp_epoch": "1647908974.793242000", "display_filter": "frame.number == 11753", "udp_stream": 203 }, { "frame_number": 14366, "timestamp_epoch": "1647914646.361799000", "display_filter": "frame.number == 14366", "udp_stream": 292 }, { "frame_number": 14367, "timestamp_epoch": "1647914646.445953000", "display_filter": "frame.number == 14367", "udp_stream": 292 }, { "frame_number": 6059, "timestamp_epoch": "1647899971.243136000", "display_filter": "frame.number == 6059", "tcp_stream": 91 }, { "frame_number": 9268, "timestamp_epoch": "1647903846.058127000", "display_filter": "frame.number == 9268", "tcp_stream": 154 }, { "frame_number": 11757, "timestamp_epoch": "1647908974.887435000", "display_filter": "frame.number == 11757", "tcp_stream": 235 }, { "frame_number": 14371, "timestamp_epoch": "1647914646.526312000", "display_filter": "frame.number == 14371", "tcp_stream": 364 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-09f12585a41b46d52a198c2a", "type": "ipv4", "value": "0.0.0.0", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d336d1ce5f37c7dddd74a56c", "type": "ipv4", "value": "10.0.19.1", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2a51163ddf054db956a54365", "type": "ipv4", "value": "10.0.19.14", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0b8095c6094215bdcc845fa4", "type": "ipv4", "value": "10.0.19.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-642ec52e1db8f28cde15c973", "type": "ipv4", "value": "10.0.19.9", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1647897130.188604000", "last_seen_epoch": "1647918729.616940000", "evidence": [ { "frame_number": 3431, "timestamp_epoch": "1647897130.188604000", "display_filter": "frame.number == 3431", "udp_stream": 15 }, { "frame_number": 3790, "timestamp_epoch": "1647898110.856122000", "display_filter": "frame.number == 3790", "udp_stream": 32 }, { "frame_number": 3793, "timestamp_epoch": "1647898110.857406000", "display_filter": "frame.number == 3793", "udp_stream": 34 }, { "frame_number": 3895, "timestamp_epoch": "1647898112.354302000", "display_filter": "frame.number == 3895", "udp_stream": 49 }, { "frame_number": 4130, "timestamp_epoch": "1647899008.693693000", "display_filter": "frame.number == 4130", "udp_stream": 65 }, { "frame_number": 4215, "timestamp_epoch": "1647899008.794789000", "display_filter": "frame.number == 4215", "udp_stream": 66 }, { "frame_number": 4304, "timestamp_epoch": "1647899008.806292000", "display_filter": "frame.number == 4304", "udp_stream": 67 }, { "frame_number": 4824, "timestamp_epoch": "1647899069.513278000", "display_filter": "frame.number == 4824", "udp_stream": 79 }, { "frame_number": 8002, "timestamp_epoch": "1647900730.088913000", "display_filter": "frame.number == 8002", "udp_stream": 106 }, { "frame_number": 8594, "timestamp_epoch": "1647901739.547659000", "display_filter": "frame.number == 8594", "udp_stream": 115 }, { "frame_number": 9419, "timestamp_epoch": "1647904329.932844000", "display_filter": "frame.number == 9419", "udp_stream": 141 }, { "frame_number": 9610, "timestamp_epoch": "1647904588.611570000", "display_filter": "frame.number == 9610", "udp_stream": 146 }, { "frame_number": 9915, "timestamp_epoch": "1647905339.407918000", "display_filter": "frame.number == 9915", "udp_stream": 154 }, { "frame_number": 10950, "timestamp_epoch": "1647907929.982475000", "display_filter": "frame.number == 10950", "udp_stream": 179 }, { "frame_number": 11710, "timestamp_epoch": "1647908939.270960000", "display_filter": "frame.number == 11710", "udp_stream": 201 }, { "frame_number": 12204, "timestamp_epoch": "1647910170.319478000", "display_filter": "frame.number == 12204", "udp_stream": 221 }, { "frame_number": 12959, "timestamp_epoch": "1647911529.875891000", "display_filter": "frame.number == 12959", "udp_stream": 248 }, { "frame_number": 13372, "timestamp_epoch": "1647912539.132630000", "display_filter": "frame.number == 13372", "udp_stream": 264 }, { "frame_number": 14546, "timestamp_epoch": "1647915129.730185000", "display_filter": "frame.number == 14546", "udp_stream": 301 }, { "frame_number": 14883, "timestamp_epoch": "1647915749.946750000", "display_filter": "frame.number == 14883", "udp_stream": 313 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-82f4648566f2434957e6b1b9", "type": "ipv4", "value": "104.80.96.219", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899684.275556000", "last_seen_epoch": "1647914646.445953000", "evidence": [ { "frame_number": 5749, "timestamp_epoch": "1647899684.275556000", "display_filter": "frame.number == 5749", "udp_stream": 89 }, { "frame_number": 6055, "timestamp_epoch": "1647899971.120928000", "display_filter": "frame.number == 6055", "udp_stream": 95 }, { "frame_number": 9264, "timestamp_epoch": "1647903845.962934000", "display_filter": "frame.number == 9264", "udp_stream": 135 }, { "frame_number": 11753, "timestamp_epoch": "1647908974.793242000", "display_filter": "frame.number == 11753", "udp_stream": 203 }, { "frame_number": 14367, "timestamp_epoch": "1647914646.445953000", "display_filter": "frame.number == 14367", "udp_stream": 292 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ffed1a56d0155b05de51974c", "type": "ipv4", "value": "13.107.136.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899010.410006000", "last_seen_epoch": "1647899010.410006000", "evidence": [ { "frame_number": 4467, "timestamp_epoch": "1647899010.410006000", "display_filter": "frame.number == 4467", "udp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b7f1467d71b23866f811b713", "type": "ipv4", "value": "13.107.21.200", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647899010.351545000", "last_seen_epoch": "1647908840.620000000", "evidence": [ { "frame_number": 4463, "timestamp_epoch": "1647899010.351545000", "display_filter": "frame.number == 4463", "udp_stream": 70 }, { "frame_number": 4760, "timestamp_epoch": "1647899039.573949000", "display_filter": "frame.number == 4760", "udp_stream": 78 }, { "frame_number": 11454, "timestamp_epoch": "1647908840.620000000", "display_filter": "frame.number == 11454", "udp_stream": 194 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d13b254afdc7a858ecbde8f6", "type": "ipv4", "value": "13.107.246.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899010.343476000", "last_seen_epoch": "1647899010.343476000", "evidence": [ { "frame_number": 4454, "timestamp_epoch": "1647899010.343476000", "display_filter": "frame.number == 4454", "udp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7a963c4c1cc3aa26af732603", "type": "ipv4", "value": "13.107.42.16", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647902555.517525000", "last_seen_epoch": "1647902555.517525000", "evidence": [ { "frame_number": 8881, "timestamp_epoch": "1647902555.517525000", "display_filter": "frame.number == 8881", "udp_stream": 125 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2ed55005f5d5cde1018c7ccf", "type": "ipv4", "value": "13.69.116.104", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899910.335698000", "last_seen_epoch": "1647899910.335698000", "evidence": [ { "frame_number": 5945, "timestamp_epoch": "1647899910.335698000", "display_filter": "frame.number == 5945", "udp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-64a5e1415536d74814bae48f", "type": "ipv4", "value": "13.69.239.74", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647905585.460309000", "last_seen_epoch": "1647905585.460309000", "evidence": [ { "frame_number": 10044, "timestamp_epoch": "1647905585.460309000", "display_filter": "frame.number == 10044", "udp_stream": 158 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-371060a4cb757d96915a9ac1", "type": "ipv4", "value": "13.87.188.105", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647897262.992763000", "last_seen_epoch": "1647897262.992763000", "evidence": [ { "frame_number": 3521, "timestamp_epoch": "1647897262.992763000", "display_filter": "frame.number == 3521", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-77add993148ca915352e93db", "type": "ipv4", "value": "13.89.179.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647901985.638021000", "last_seen_epoch": "1647901985.638021000", "evidence": [ { "frame_number": 8691, "timestamp_epoch": "1647901985.638021000", "display_filter": "frame.number == 8691", "udp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b595f588961a9eb5af302c2f", "type": "ipv4", "value": "13.89.179.9", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898144.079150000", "last_seen_epoch": "1647898144.079150000", "evidence": [ { "frame_number": 4040, "timestamp_epoch": "1647898144.079150000", "display_filter": "frame.number == 4040", "udp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e4f63adcd5900bb6ea1d7ee6", "type": "ipv4", "value": "131.107.255.255", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647898111.450439000", "last_seen_epoch": "1647898111.450439000", "evidence": [ { "frame_number": 3824, "timestamp_epoch": "1647898111.450439000", "display_filter": "frame.number == 3824", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1dc12bcd26cf139c0f66a1a1", "type": "ipv4", "value": "157.245.142.66", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647896315.891442000", "last_seen_epoch": "1647918928.840121000", "evidence": [ { "frame_number": 501, "timestamp_epoch": "1647896315.891442000", "display_filter": "frame.number == 501", "udp_stream": 0 }, { "frame_number": 544, "timestamp_epoch": "1647896375.854615000", "display_filter": "frame.number == 544", "udp_stream": 3 }, { "frame_number": 3263, "timestamp_epoch": "1647896678.124960000", "display_filter": "frame.number == 3263", "udp_stream": 10 }, { "frame_number": 3322, "timestamp_epoch": "1647896979.163440000", "display_filter": "frame.number == 3322", "udp_stream": 13 }, { "frame_number": 3547, "timestamp_epoch": "1647897280.856532000", "display_filter": "frame.number == 3547", "udp_stream": 19 }, { "frame_number": 3610, "timestamp_epoch": "1647897582.421490000", "display_filter": "frame.number == 3610", "udp_stream": 22 }, { "frame_number": 4438, "timestamp_epoch": "1647899009.985888000", "display_filter": "frame.number == 4438", "udp_stream": 69 }, { "frame_number": 4899, "timestamp_epoch": "1647899069.930175000", "display_filter": "frame.number == 4899", "udp_stream": 81 }, { "frame_number": 4996, "timestamp_epoch": "1647899371.287345000", "display_filter": "frame.number == 4996", "udp_stream": 82 }, { "frame_number": 5060, "timestamp_epoch": "1647899672.614809000", "display_filter": "frame.number == 5060", "udp_stream": 85 }, { "frame_number": 6073, "timestamp_epoch": "1647899974.003979000", "display_filter": "frame.number == 6073", "udp_stream": 97 }, { "frame_number": 6296, "timestamp_epoch": "1647900275.400240000", "display_filter": "frame.number == 6296", "udp_stream": 100 }, { "frame_number": 7931, "timestamp_epoch": "1647900576.716133000", "display_filter": "frame.number == 7931", "udp_stream": 102 }, { "frame_number": 8319, "timestamp_epoch": "1647900878.134945000", "display_filter": "frame.number == 8319", "udp_stream": 108 }, { "frame_number": 8409, "timestamp_epoch": "1647901179.367274000", "display_filter": "frame.number == 8409", "udp_stream": 109 }, { "frame_number": 8486, "timestamp_epoch": "1647901480.625418000", "display_filter": "frame.number == 8486", "udp_stream": 112 }, { "frame_number": 8632, "timestamp_epoch": "1647901781.967039000", "display_filter": "frame.number == 8632", "udp_stream": 117 }, { "frame_number": 8726, "timestamp_epoch": "1647902083.298925000", "display_filter": "frame.number == 8726", "udp_stream": 120 }, { "frame_number": 8798, "timestamp_epoch": "1647902384.595952000", "display_filter": "frame.number == 8798", "udp_stream": 121 }, { "frame_number": 8956, "timestamp_epoch": "1647902685.997939000", "display_filter": "frame.number == 8956", "udp_stream": 126 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6fc81ec868fdd0a602efcf15", "type": "ipv4", "value": "160.153.32.99", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647896378.163267000", "last_seen_epoch": "1647896378.163267000", "evidence": [ { "frame_number": 566, "timestamp_epoch": "1647896378.163267000", "display_filter": "frame.number == 566", "udp_stream": 4 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4c688ad06f432df683466b1e", "type": "ipv4", "value": "169.254.179.89", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-bcf07dd8d71467180306f872", "type": "ipv4", "value": "169.254.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-dc19ed36254b0542192615d5", "type": "ipv4", "value": "184.85.64.91", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647911025.745073000", "last_seen_epoch": "1647911025.745073000", "evidence": [ { "frame_number": 12769, "timestamp_epoch": "1647911025.745073000", "display_filter": "frame.number == 12769", "udp_stream": 238 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6cb9c0d32c69e6708d10482e", "type": "ipv4", "value": "185.47.40.36", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899674.021764000", "last_seen_epoch": "1647899674.021764000", "evidence": [ { "frame_number": 5075, "timestamp_epoch": "1647899674.021764000", "display_filter": "frame.number == 5075", "udp_stream": 86 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cf76a94c51f7ce317be4f182", "type": "ipv4", "value": "188.166.154.118", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5b3bab2c4cb749ed5696e8ce", "type": "ipv4", "value": "20.189.173.15", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647896327.921157000", "last_seen_epoch": "1647896327.921157000", "evidence": [ { "frame_number": 518, "timestamp_epoch": "1647896327.921157000", "display_filter": "frame.number == 518", "udp_stream": 1 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4631873a9b9995a59a52e73d", "type": "ipv4", "value": "20.189.173.2", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647907385.351605000", "last_seen_epoch": "1647907385.351605000", "evidence": [ { "frame_number": 10808, "timestamp_epoch": "1647907385.351605000", "display_filter": "frame.number == 10808", "udp_stream": 174 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ef7f985f8a5cca706dd8aceb", "type": "ipv4", "value": "20.190.154.137", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-15f31631e604a32f4215463a", "type": "ipv4", "value": "20.190.154.139", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-66b1e4e9a0e8b27866585365", "type": "ipv4", "value": "20.190.154.16", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b4b066d24af5ad777e1bf367", "type": "ipv4", "value": "20.190.154.17", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-18ddeab32f0e7d5666c6218b", "type": "ipv4", "value": "20.190.154.18", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4aae5b5261329c42e99ba568", "type": "ipv4", "value": "20.190.154.19", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d5c538ded351f33378f39c6a", "type": "ipv4", "value": "20.42.65.89", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647916384.861314000", "last_seen_epoch": "1647916384.861314000", "evidence": [ { "frame_number": 15204, "timestamp_epoch": "1647916384.861314000", "display_filter": "frame.number == 15204", "udp_stream": 325 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0c0ff726e3e86b5754768fa8", "type": "ipv4", "value": "20.44.10.123", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647903785.528028000", "last_seen_epoch": "1647903785.528028000", "evidence": [ { "frame_number": 9233, "timestamp_epoch": "1647903785.528028000", "display_filter": "frame.number == 9233", "udp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6463d671dcf2caaf623e4dbc", "type": "ipv4", "value": "20.69.130.185", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647908842.157512000", "last_seen_epoch": "1647908842.157512000", "evidence": [ { "frame_number": 11611, "timestamp_epoch": "1647908842.157512000", "display_filter": "frame.number == 11611", "udp_stream": 197 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e698f2ed0fa105eed15ee075", "type": "ipv4", "value": "20.72.205.209", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647915526.311808000", "last_seen_epoch": "1647915526.311808000", "evidence": [ { "frame_number": 14763, "timestamp_epoch": "1647915526.311808000", "display_filter": "frame.number == 14763", "udp_stream": 309 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e5839d89559cc1c90bcea102", "type": "ipv4", "value": "20.81.51.95", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899020.483805000", "last_seen_epoch": "1647899020.483805000", "evidence": [ { "frame_number": 4726, "timestamp_epoch": "1647899020.483805000", "display_filter": "frame.number == 4726", "udp_stream": 77 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-93ad47d10ef8fa296448ca59", "type": "ipv4", "value": "20.81.52.156", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647900608.859056000", "last_seen_epoch": "1647900608.859056000", "evidence": [ { "frame_number": 7957, "timestamp_epoch": "1647900608.859056000", "display_filter": "frame.number == 7957", "udp_stream": 105 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-873a6bdb17cc080a7e8fa0e7", "type": "ipv4", "value": "204.79.197.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899010.351545000", "last_seen_epoch": "1647908840.620000000", "evidence": [ { "frame_number": 4463, "timestamp_epoch": "1647899010.351545000", "display_filter": "frame.number == 4463", "udp_stream": 70 }, { "frame_number": 4760, "timestamp_epoch": "1647899039.573949000", "display_filter": "frame.number == 4760", "udp_stream": 78 }, { "frame_number": 11454, "timestamp_epoch": "1647908840.620000000", "display_filter": "frame.number == 11454", "udp_stream": 194 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e8fa5e5f960400148879eab7", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899009.500569000", "last_seen_epoch": "1647899009.500569000", "evidence": [ { "frame_number": 4414, "timestamp_epoch": "1647899009.500569000", "display_filter": "frame.number == 4414", "udp_stream": 68 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d02b1753a3d815aae36cf9e", "type": "ipv4", "value": "209.197.3.8", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647901774.201605000", "last_seen_epoch": "1647910775.634931000", "evidence": [ { "frame_number": 8622, "timestamp_epoch": "1647901774.201605000", "display_filter": "frame.number == 8622", "udp_stream": 116 }, { "frame_number": 11763, "timestamp_epoch": "1647908975.099405000", "display_filter": "frame.number == 11763", "udp_stream": 204 }, { "frame_number": 12498, "timestamp_epoch": "1647910775.634931000", "display_filter": "frame.number == 12498", "udp_stream": 230 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-40851b18e0e5a93f7a7c5fe2", "type": "ipv4", "value": "224.0.0.22", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-30e5ae032b598bdfbabbda0e", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab2da13fa443dbc60af67a4e", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ef64ee7ce57a48c26bc20aac", "type": "ipv4", "value": "23.219.38.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647915587.238901000", "last_seen_epoch": "1647915587.238901000", "evidence": [ { "frame_number": 14817, "timestamp_epoch": "1647915587.238901000", "display_filter": "frame.number == 14817", "udp_stream": 310 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c32b6a8e8e285dc7d07b1863", "type": "ipv4", "value": "23.219.38.40", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647915587.238901000", "last_seen_epoch": "1647915587.238901000", "evidence": [ { "frame_number": 14817, "timestamp_epoch": "1647915587.238901000", "display_filter": "frame.number == 14817", "udp_stream": 310 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d810f6c19e48e8ed8eeeb64a", "type": "ipv4", "value": "23.227.198.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899683.825443000", "last_seen_epoch": "1647899683.825443000", "evidence": [ { "frame_number": 5736, "timestamp_epoch": "1647899683.825443000", "display_filter": "frame.number == 5736", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-78076c4acfb4da83912f41eb", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898090.369579000", "last_seen_epoch": "1647918744.211724000", "evidence": [ { "frame_number": 3730, "timestamp_epoch": "1647898090.369579000", "display_filter": "frame.number == 3730" }, { "frame_number": 3739, "timestamp_epoch": "1647898093.369769000", "display_filter": "frame.number == 3739" }, { "frame_number": 3742, "timestamp_epoch": "1647898095.120037000", "display_filter": "frame.number == 3742" }, { "frame_number": 3745, "timestamp_epoch": "1647898096.371268000", "display_filter": "frame.number == 3745" }, { "frame_number": 3747, "timestamp_epoch": "1647898098.120255000", "display_filter": "frame.number == 3747" }, { "frame_number": 3749, "timestamp_epoch": "1647898099.370494000", "display_filter": "frame.number == 3749" }, { "frame_number": 3752, "timestamp_epoch": "1647898102.370736000", "display_filter": "frame.number == 3752" }, { "frame_number": 3762, "timestamp_epoch": "1647898105.385194000", "display_filter": "frame.number == 3762" }, { "frame_number": 3767, "timestamp_epoch": "1647898108.384633000", "display_filter": "frame.number == 3767" }, { "frame_number": 3817, "timestamp_epoch": "1647898111.072041000", "display_filter": "frame.number == 3817" }, { "frame_number": 3823, "timestamp_epoch": "1647898111.400073000", "display_filter": "frame.number == 3823" }, { "frame_number": 3833, "timestamp_epoch": "1647898111.721068000", "display_filter": "frame.number == 3833" }, { "frame_number": 3921, "timestamp_epoch": "1647898114.072232000", "display_filter": "frame.number == 3921" }, { "frame_number": 3925, "timestamp_epoch": "1647898114.400258000", "display_filter": "frame.number == 3925" }, { "frame_number": 3927, "timestamp_epoch": "1647898115.385356000", "display_filter": "frame.number == 3927" }, { "frame_number": 3993, "timestamp_epoch": "1647898118.400032000", "display_filter": "frame.number == 3993" }, { "frame_number": 3998, "timestamp_epoch": "1647898121.403287000", "display_filter": "frame.number == 3998" }, { "frame_number": 16149, "timestamp_epoch": "1647918738.205627000", "display_filter": "frame.number == 16149" }, { "frame_number": 16152, "timestamp_epoch": "1647918741.211965000", "display_filter": "frame.number == 16152" }, { "frame_number": 16177, "timestamp_epoch": "1647918744.211724000", "display_filter": "frame.number == 16177" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8b1af4167d81037251d3d620", "type": "ipv4", "value": "255.255.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-024efcdf5d264b70f9561b80", "type": "ipv4", "value": "40.124.168.44", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647902554.431788000", "last_seen_epoch": "1647902554.431788000", "evidence": [ { "frame_number": 8846, "timestamp_epoch": "1647902554.431788000", "display_filter": "frame.number == 8846", "udp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-359c3a4fe4fa872c75226c0a", "type": "ipv4", "value": "40.126.26.134", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cdc5538a3b65c59d5f5c5722", "type": "ipv4", "value": "40.126.26.135", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647908840.907101000", "last_seen_epoch": "1647908840.907101000", "evidence": [ { "frame_number": 11583, "timestamp_epoch": "1647908840.907101000", "display_filter": "frame.number == 11583", "udp_stream": 196 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-838b02dbc8af21aeacbbee55", "type": "ipv4", "value": "40.74.98.194", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647909185.251727000", "last_seen_epoch": "1647909185.251727000", "evidence": [ { "frame_number": 11881, "timestamp_epoch": "1647909185.251727000", "display_filter": "frame.number == 11881", "udp_stream": 209 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-853f7ecfe0ee78ae02976438", "type": "ipv4", "value": "40.83.240.146", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898112.044407000", "last_seen_epoch": "1647898112.044407000", "evidence": [ { "frame_number": 3873, "timestamp_epoch": "1647898112.044407000", "display_filter": "frame.number == 3873", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a3dd09e09dec88d74e5d83ed", "type": "ipv4", "value": "51.105.71.137", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647911928.525445000", "last_seen_epoch": "1647911928.525445000", "evidence": [ { "frame_number": 13156, "timestamp_epoch": "1647911928.525445000", "display_filter": "frame.number == 13156", "udp_stream": 255 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-be51fc8cf6ed079b029a1561", "type": "ipv4", "value": "52.109.8.19", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647909021.990143000", "last_seen_epoch": "1647909021.990143000", "evidence": [ { "frame_number": 11803, "timestamp_epoch": "1647909021.990143000", "display_filter": "frame.number == 11803", "udp_stream": 207 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-36504b1941454517c20d7f4a", "type": "ipv4", "value": "52.109.8.20", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647901731.556759000", "last_seen_epoch": "1647901731.556759000", "evidence": [ { "frame_number": 8570, "timestamp_epoch": "1647901731.556759000", "display_filter": "frame.number == 8570", "udp_stream": 114 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7b5eb6e2001ef3a3287b84d5", "type": "ipv4", "value": "52.109.8.21", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647916312.580226000", "last_seen_epoch": "1647916312.580226000", "evidence": [ { "frame_number": 15156, "timestamp_epoch": "1647916312.580226000", "display_filter": "frame.number == 15156", "udp_stream": 324 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-40686d41d4811fe7263040fd", "type": "ipv4", "value": "52.113.194.132", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647914217.136915000", "last_seen_epoch": "1647918266.296010000", "evidence": [ { "frame_number": 14079, "timestamp_epoch": "1647914217.136915000", "display_filter": "frame.number == 14079", "udp_stream": 287 }, { "frame_number": 15824, "timestamp_epoch": "1647918266.296010000", "display_filter": "frame.number == 15824", "udp_stream": 350 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7bb7eb7b8d11f01dea261615", "type": "ipv4", "value": "52.113.196.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899010.343547000", "last_seen_epoch": "1647899010.343547000", "evidence": [ { "frame_number": 4455, "timestamp_epoch": "1647899010.343547000", "display_filter": "frame.number == 4455", "udp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d53eb498028f62de18938077", "type": "ipv4", "value": "52.137.108.250", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647911022.071953000", "last_seen_epoch": "1647911022.071953000", "evidence": [ { "frame_number": 12671, "timestamp_epoch": "1647911022.071953000", "display_filter": "frame.number == 12671", "udp_stream": 236 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cc2728117c918b622afc3c5e", "type": "ipv4", "value": "52.168.117.170", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647914584.964691000", "last_seen_epoch": "1647914584.964691000", "evidence": [ { "frame_number": 14342, "timestamp_epoch": "1647914584.964691000", "display_filter": "frame.number == 14342", "udp_stream": 291 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ae1ba3d9410d0770b9269727", "type": "ipv4", "value": "52.182.143.208", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647918184.767153000", "last_seen_epoch": "1647918184.767153000", "evidence": [ { "frame_number": 15797, "timestamp_epoch": "1647918184.767153000", "display_filter": "frame.number == 15797", "udp_stream": 349 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3cf726178cb471d4ac7c6241", "type": "ipv4", "value": "52.182.143.210", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647910985.194080000", "last_seen_epoch": "1647910985.194080000", "evidence": [ { "frame_number": 12568, "timestamp_epoch": "1647910985.194080000", "display_filter": "frame.number == 12568", "udp_stream": 233 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dedcd10c9314e3118a13e062", "type": "ipv4", "value": "52.183.220.149", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898111.570693000", "last_seen_epoch": "1647917917.954719000", "evidence": [ { "frame_number": 3827, "timestamp_epoch": "1647898111.570693000", "display_filter": "frame.number == 3827", "udp_stream": 38 }, { "frame_number": 5970, "timestamp_epoch": "1647899911.999060000", "display_filter": "frame.number == 5970", "udp_stream": 94 }, { "frame_number": 8537, "timestamp_epoch": "1647901712.776868000", "display_filter": "frame.number == 8537", "udp_stream": 113 }, { "frame_number": 9727, "timestamp_epoch": "1647904855.570192000", "display_filter": "frame.number == 9727", "udp_stream": 150 }, { "frame_number": 9880, "timestamp_epoch": "1647905313.197580000", "display_filter": "frame.number == 9880", "udp_stream": 153 }, { "frame_number": 10211, "timestamp_epoch": "1647906213.909932000", "display_filter": "frame.number == 10211", "udp_stream": 162 }, { "frame_number": 15691, "timestamp_epoch": "1647917917.954719000", "display_filter": "frame.number == 15691", "udp_stream": 345 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0cc1c5ac573d8e54583f313d", "type": "ipv4", "value": "52.185.211.133", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647897103.673485000", "last_seen_epoch": "1647916116.299439000", "evidence": [ { "frame_number": 3381, "timestamp_epoch": "1647897103.673485000", "display_filter": "frame.number == 3381", "udp_stream": 14 }, { "frame_number": 11682, "timestamp_epoch": "1647908914.373928000", "display_filter": "frame.number == 11682", "udp_stream": 200 }, { "frame_number": 12425, "timestamp_epoch": "1647910714.821659000", "display_filter": "frame.number == 12425", "udp_stream": 228 }, { "frame_number": 12674, "timestamp_epoch": "1647911022.178753000", "display_filter": "frame.number == 12674", "udp_stream": 237 }, { "frame_number": 13334, "timestamp_epoch": "1647912515.828585000", "display_filter": "frame.number == 13334", "udp_stream": 263 }, { "frame_number": 15057, "timestamp_epoch": "1647916116.299439000", "display_filter": "frame.number == 15057", "udp_stream": 320 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-de5ca850c3be13c5d96a5ea6", "type": "ipv4", "value": "68.142.107.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647914646.687373000", "last_seen_epoch": "1647914646.687373000", "evidence": [ { "frame_number": 14376, "timestamp_epoch": "1647914646.687373000", "display_filter": "frame.number == 14376", "udp_stream": 293 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a84d757ecbb0565e4ef17912", "type": "ipv4", "value": "68.142.107.129", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898171.973323000", "last_seen_epoch": "1647914646.687373000", "evidence": [ { "frame_number": 4070, "timestamp_epoch": "1647898171.973323000", "display_filter": "frame.number == 4070", "udp_stream": 59 }, { "frame_number": 6064, "timestamp_epoch": "1647899971.439881000", "display_filter": "frame.number == 6064", "udp_stream": 96 }, { "frame_number": 9275, "timestamp_epoch": "1647903846.224583000", "display_filter": "frame.number == 9275", "udp_stream": 136 }, { "frame_number": 14376, "timestamp_epoch": "1647914646.687373000", "display_filter": "frame.number == 14376", "udp_stream": 293 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a59c76c0c127466c11e03876", "type": "ipv4", "value": "69.28.162.0", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647898171.973323000", "last_seen_epoch": "1647899971.439881000", "evidence": [ { "frame_number": 4070, "timestamp_epoch": "1647898171.973323000", "display_filter": "frame.number == 4070", "udp_stream": 59 }, { "frame_number": 6064, "timestamp_epoch": "1647899971.439881000", "display_filter": "frame.number == 6064", "udp_stream": 96 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7eea9796a363f2870bc714f2", "type": "ipv4", "value": "69.28.162.128", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647903846.224583000", "last_seen_epoch": "1647903846.224583000", "evidence": [ { "frame_number": 9275, "timestamp_epoch": "1647903846.224583000", "display_filter": "frame.number == 9275", "udp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ecaf60e5fdcb6c0946259bae", "type": "ipv4", "value": "72.21.81.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899010.343243000", "last_seen_epoch": "1647899010.343628000", "evidence": [ { "frame_number": 4452, "timestamp_epoch": "1647899010.343243000", "display_filter": "frame.number == 4452", "udp_stream": 71 }, { "frame_number": 4453, "timestamp_epoch": "1647899010.343277000", "display_filter": "frame.number == 4453", "udp_stream": 72 }, { "frame_number": 4456, "timestamp_epoch": "1647899010.343628000", "display_filter": "frame.number == 4456", "udp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c9ac70fd619ae60ef900c668", "type": "ipv4", "value": "72.21.81.240", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647904915.972540000", "last_seen_epoch": "1647911082.885047000", "evidence": [ { "frame_number": 9785, "timestamp_epoch": "1647904915.972540000", "display_filter": "frame.number == 9785", "udp_stream": 151 }, { "frame_number": 10271, "timestamp_epoch": "1647906274.295724000", "display_filter": "frame.number == 10271", "udp_stream": 163 }, { "frame_number": 12814, "timestamp_epoch": "1647911082.885047000", "display_filter": "frame.number == 12814", "udp_stream": 240 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-57de68251e3279e8a1f4d2cd", "type": "ipv4", "value": "87.238.33.7", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1647899675.140469000", "last_seen_epoch": "1647899675.140469000", "evidence": [ { "frame_number": 5100, "timestamp_epoch": "1647899675.140469000", "display_filter": "frame.number == 5100", "udp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c0617c727aef3c7c052bc6a0", "type": "ipv4", "value": "87.238.33.8", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647899675.140469000", "last_seen_epoch": "1647899675.140469000", "evidence": [ { "frame_number": 5100, "timestamp_epoch": "1647899675.140469000", "display_filter": "frame.number == 5100", "udp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-aad3edbcad55ab0d79a40071", "type": "ipv4", "value": "91.193.16.181", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1647908448.369261000", "last_seen_epoch": "1647918964.817552000", "evidence": [ { "frame_number": 11197, "timestamp_epoch": "1647908448.369261000", "display_filter": "frame.number == 11197", "udp_stream": 187 }, { "frame_number": 11213, "timestamp_epoch": "1647908464.864132000", "display_filter": "frame.number == 11213", "udp_stream": 188 }, { "frame_number": 11266, "timestamp_epoch": "1647908506.092539000", "display_filter": "frame.number == 11266", "udp_stream": 191 }, { "frame_number": 11280, "timestamp_epoch": "1647908509.233184000", "display_filter": "frame.number == 11280", "udp_stream": 192 }, { "frame_number": 11438, "timestamp_epoch": "1647908835.020571000", "display_filter": "frame.number == 11438", "udp_stream": 193 }, { "frame_number": 11670, "timestamp_epoch": "1647908908.046392000", "display_filter": "frame.number == 11670", "udp_stream": 199 }, { "frame_number": 11943, "timestamp_epoch": "1647909461.046360000", "display_filter": "frame.number == 11943", "udp_stream": 211 }, { "frame_number": 11977, "timestamp_epoch": "1647909533.036511000", "display_filter": "frame.number == 11977", "udp_stream": 158 }, { "frame_number": 12053, "timestamp_epoch": "1647909772.652796000", "display_filter": "frame.number == 12053", "udp_stream": 215 }, { "frame_number": 12101, "timestamp_epoch": "1647910013.007175000", "display_filter": "frame.number == 12101", "udp_stream": 216 }, { "frame_number": 12131, "timestamp_epoch": "1647910086.023225000", "display_filter": "frame.number == 12131", "udp_stream": 218 }, { "frame_number": 12388, "timestamp_epoch": "1647910642.997866000", "display_filter": "frame.number == 12388", "udp_stream": 226 }, { "frame_number": 12447, "timestamp_epoch": "1647910718.028919000", "display_filter": "frame.number == 12447", "udp_stream": 229 }, { "frame_number": 12796, "timestamp_epoch": "1647911037.410122000", "display_filter": "frame.number == 12796", "udp_stream": 239 }, { "frame_number": 12835, "timestamp_epoch": "1647911198.910947000", "display_filter": "frame.number == 12835", "udp_stream": 241 }, { "frame_number": 12865, "timestamp_epoch": "1647911271.991372000", "display_filter": "frame.number == 12865", "udp_stream": 243 }, { "frame_number": 12899, "timestamp_epoch": "1647911344.013831000", "display_filter": "frame.number == 12899", "udp_stream": 245 }, { "frame_number": 13098, "timestamp_epoch": "1647911824.921618000", "display_filter": "frame.number == 13098", "udp_stream": 252 }, { "frame_number": 13141, "timestamp_epoch": "1647911896.988464000", "display_filter": "frame.number == 13141", "udp_stream": 254 }, { "frame_number": 13242, "timestamp_epoch": "1647912303.235697000", "display_filter": "frame.number == 13242", "udp_stream": 258 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d4beb1ca0567fcca9d5ef49a", "type": "ja3", "value": "28a2c9bd18a11de089ef85a160da29e4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1647896328.036073000", "last_seen_epoch": "1647918266.368049000", "evidence": [ { "frame_number": 522, "timestamp_epoch": "1647896328.036073000", "display_filter": "frame.number == 522", "tcp_stream": 2 }, { "frame_number": 3385, "timestamp_epoch": "1647897103.747128000", "display_filter": "frame.number == 3385", "tcp_stream": 20 }, { "frame_number": 3407, "timestamp_epoch": "1647897104.093038000", "display_filter": "frame.number == 3407", "tcp_stream": 21 }, { "frame_number": 3832, "timestamp_epoch": "1647898111.668568000", "display_filter": "frame.number == 3832", "tcp_stream": 31 }, { "frame_number": 4044, "timestamp_epoch": "1647898144.192840000", "display_filter": "frame.number == 4044", "tcp_stream": 36 }, { "frame_number": 5949, "timestamp_epoch": "1647899910.545288000", "display_filter": "frame.number == 5949", "tcp_stream": 87 }, { "frame_number": 5974, "timestamp_epoch": "1647899912.099981000", "display_filter": "frame.number == 5974", "tcp_stream": 88 }, { "frame_number": 8541, "timestamp_epoch": "1647901712.880554000", "display_filter": "frame.number == 8541", "tcp_stream": 137 }, { "frame_number": 8574, "timestamp_epoch": "1647901731.671276000", "display_filter": "frame.number == 8574", "tcp_stream": 138 }, { "frame_number": 8695, "timestamp_epoch": "1647901985.750481000", "display_filter": "frame.number == 8695", "tcp_stream": 142 }, { "frame_number": 8850, "timestamp_epoch": "1647902554.549722000", "display_filter": "frame.number == 8850", "tcp_stream": 145 }, { "frame_number": 8885, "timestamp_epoch": "1647902555.586899000", "display_filter": "frame.number == 8885", "tcp_stream": 146 }, { "frame_number": 9237, "timestamp_epoch": "1647903785.637959000", "display_filter": "frame.number == 9237", "tcp_stream": 153 }, { "frame_number": 9731, "timestamp_epoch": "1647904855.678758000", "display_filter": "frame.number == 9731", "tcp_stream": 170 }, { "frame_number": 9753, "timestamp_epoch": "1647904856.504908000", "display_filter": "frame.number == 9753", "tcp_stream": 171 }, { "frame_number": 9884, "timestamp_epoch": "1647905313.298989000", "display_filter": "frame.number == 9884", "tcp_stream": 174 }, { "frame_number": 10048, "timestamp_epoch": "1647905585.664402000", "display_filter": "frame.number == 10048", "tcp_stream": 178 }, { "frame_number": 10215, "timestamp_epoch": "1647906214.008016000", "display_filter": "frame.number == 10215", "tcp_stream": 181 }, { "frame_number": 10812, "timestamp_epoch": "1647907385.424509000", "display_filter": "frame.number == 10812", "tcp_stream": 194 }, { "frame_number": 11686, "timestamp_epoch": "1647908914.476305000", "display_filter": "frame.number == 11686", "tcp_stream": 232 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5af56f448cf2750181b01f79", "type": "ja3", "value": "37f463bf4616ecd445d4a1937da06e19", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1647899009.573706000", "last_seen_epoch": "1647900404.306429000", "evidence": [ { "frame_number": 4418, "timestamp_epoch": "1647899009.573706000", "display_filter": "frame.number == 4418", "tcp_stream": 57 }, { "frame_number": 5740, "timestamp_epoch": "1647899683.949375000", "display_filter": "frame.number == 5740", "tcp_stream": 80 }, { "frame_number": 5804, "timestamp_epoch": "1647899737.335769000", "display_filter": "frame.number == 5804", "tcp_stream": 82 }, { "frame_number": 5840, "timestamp_epoch": "1647899788.744707000", "display_filter": "frame.number == 5840", "tcp_stream": 83 }, { "frame_number": 5885, "timestamp_epoch": "1647899846.925124000", "display_filter": "frame.number == 5885", "tcp_stream": 85 }, { "frame_number": 5921, "timestamp_epoch": "1647899900.628517000", "display_filter": "frame.number == 5921", "tcp_stream": 86 }, { "frame_number": 6029, "timestamp_epoch": "1647899950.105443000", "display_filter": "frame.number == 6029", "tcp_stream": 90 }, { "frame_number": 6100, "timestamp_epoch": "1647899996.939371000", "display_filter": "frame.number == 6100", "tcp_stream": 94 }, { "frame_number": 6146, "timestamp_epoch": "1647900047.787833000", "display_filter": "frame.number == 6146", "tcp_stream": 95 }, { "frame_number": 6176, "timestamp_epoch": "1647900097.098030000", "display_filter": "frame.number == 6176", "tcp_stream": 96 }, { "frame_number": 6205, "timestamp_epoch": "1647900140.318377000", "display_filter": "frame.number == 6205", "tcp_stream": 97 }, { "frame_number": 6239, "timestamp_epoch": "1647900186.948538000", "display_filter": "frame.number == 6239", "tcp_stream": 98 }, { "frame_number": 6269, "timestamp_epoch": "1647900237.726544000", "display_filter": "frame.number == 6269", "tcp_stream": 99 }, { "frame_number": 6322, "timestamp_epoch": "1647900292.865402000", "display_filter": "frame.number == 6322", "tcp_stream": 101 }, { "frame_number": 6356, "timestamp_epoch": "1647900347.763979000", "display_filter": "frame.number == 6356", "tcp_stream": 102 }, { "frame_number": 6383, "timestamp_epoch": "1647900351.254840000", "display_filter": "frame.number == 6383", "tcp_stream": 103 }, { "frame_number": 7457, "timestamp_epoch": "1647900355.657462000", "display_filter": "frame.number == 7457", "tcp_stream": 108 }, { "frame_number": 7482, "timestamp_epoch": "1647900359.167016000", "display_filter": "frame.number == 7482", "tcp_stream": 109 }, { "frame_number": 7509, "timestamp_epoch": "1647900359.643154000", "display_filter": "frame.number == 7509", "tcp_stream": 110 }, { "frame_number": 7535, "timestamp_epoch": "1647900363.153620000", "display_filter": "frame.number == 7535", "tcp_stream": 111 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d46109cbae6a93ed0c733a07", "type": "ja3", "value": "3b5074b1b5d032e5620f69f9f700ff0e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1647896315.996143000", "last_seen_epoch": "1647918629.907299000", "evidence": [ { "frame_number": 505, "timestamp_epoch": "1647896315.996143000", "display_filter": "frame.number == 505", "tcp_stream": 1 }, { "frame_number": 597, "timestamp_epoch": "1647896378.802591000", "display_filter": "frame.number == 597", "tcp_stream": 6 }, { "frame_number": 3880, "timestamp_epoch": "1647898112.120655000", "display_filter": "frame.number == 3880", "tcp_stream": 32 }, { "frame_number": 4093, "timestamp_epoch": "1647898233.876453000", "display_filter": "frame.number == 4093", "tcp_stream": 38 }, { "frame_number": 4442, "timestamp_epoch": "1647899010.127524000", "display_filter": "frame.number == 4442", "tcp_stream": 58 }, { "frame_number": 11132, "timestamp_epoch": "1647908352.931041000", "display_filter": "frame.number == 11132", "tcp_stream": 203 }, { "frame_number": 11150, "timestamp_epoch": "1647908390.298652000", "display_filter": "frame.number == 11150", "tcp_stream": 204 }, { "frame_number": 11186, "timestamp_epoch": "1647908427.663740000", "display_filter": "frame.number == 11186", "tcp_stream": 206 }, { "frame_number": 11217, "timestamp_epoch": "1647908465.063552000", "display_filter": "frame.number == 11217", "tcp_stream": 208 }, { "frame_number": 11254, "timestamp_epoch": "1647908503.363311000", "display_filter": "frame.number == 11254", "tcp_stream": 210 }, { "frame_number": 11284, "timestamp_epoch": "1647908509.437071000", "display_filter": "frame.number == 11284", "tcp_stream": 212 }, { "frame_number": 11312, "timestamp_epoch": "1647908515.401190000", "display_filter": "frame.number == 11312", "tcp_stream": 214 }, { "frame_number": 11338, "timestamp_epoch": "1647908521.494078000", "display_filter": "frame.number == 11338", "tcp_stream": 216 }, { "frame_number": 11356, "timestamp_epoch": "1647908527.446384000", "display_filter": "frame.number == 11356", "tcp_stream": 217 }, { "frame_number": 11374, "timestamp_epoch": "1647908533.536591000", "display_filter": "frame.number == 11374", "tcp_stream": 218 }, { "frame_number": 11392, "timestamp_epoch": "1647908539.565614000", "display_filter": "frame.number == 11392", "tcp_stream": 219 }, { "frame_number": 11868, "timestamp_epoch": "1647909140.471706000", "display_filter": "frame.number == 11868", "tcp_stream": 242 }, { "frame_number": 12057, "timestamp_epoch": "1647909772.856450000", "display_filter": "frame.number == 12057", "tcp_stream": 252 }, { "frame_number": 12348, "timestamp_epoch": "1647910405.103135000", "display_filter": "frame.number == 12348", "tcp_stream": 267 }, { "frame_number": 12800, "timestamp_epoch": "1647911037.611571000", "display_filter": "frame.number == 12800", "tcp_stream": 289 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-187854b249a40800250cee41", "type": "ja3", "value": "6271f898ce5be7dd52b0fc260d0662b3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1647897263.120360000", "last_seen_epoch": "1647908842.258357000", "evidence": [ { "frame_number": 3525, "timestamp_epoch": "1647897263.120360000", "display_filter": "frame.number == 3525", "tcp_stream": 26 }, { "frame_number": 4479, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4479", "tcp_stream": 62 }, { "frame_number": 4480, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4480", "tcp_stream": 60 }, { "frame_number": 4481, "timestamp_epoch": "1647899010.412558000", "display_filter": "frame.number == 4481", "tcp_stream": 59 }, { "frame_number": 4482, "timestamp_epoch": "1647899010.412599000", "display_filter": "frame.number == 4482", "tcp_stream": 63 }, { "frame_number": 4483, "timestamp_epoch": "1647899010.412599000", "display_filter": "frame.number == 4483", "tcp_stream": 61 }, { "frame_number": 4486, "timestamp_epoch": "1647899010.425633000", "display_filter": "frame.number == 4486", "tcp_stream": 64 }, { "frame_number": 4494, "timestamp_epoch": "1647899010.486057000", "display_filter": "frame.number == 4494", "tcp_stream": 65 }, { "frame_number": 4569, "timestamp_epoch": "1647899010.498005000", "display_filter": "frame.number == 4569", "tcp_stream": 66 }, { "frame_number": 4572, "timestamp_epoch": "1647899010.504176000", "display_filter": "frame.number == 4572", "tcp_stream": 67 }, { "frame_number": 4730, "timestamp_epoch": "1647899020.612258000", "display_filter": "frame.number == 4730", "tcp_stream": 68 }, { "frame_number": 4764, "timestamp_epoch": "1647899039.649817000", "display_filter": "frame.number == 4764", "tcp_stream": 69 }, { "frame_number": 7964, "timestamp_epoch": "1647900610.001383000", "display_filter": "frame.number == 7964", "tcp_stream": 124 }, { "frame_number": 10006, "timestamp_epoch": "1647905583.762922000", "display_filter": "frame.number == 10006", "tcp_stream": 177 }, { "frame_number": 11496, "timestamp_epoch": "1647908840.700762000", "display_filter": "frame.number == 11496", "tcp_stream": 221 }, { "frame_number": 11592, "timestamp_epoch": "1647908841.010710000", "display_filter": "frame.number == 11592", "tcp_stream": 228 }, { "frame_number": 11615, "timestamp_epoch": "1647908842.258357000", "display_filter": "frame.number == 11615", "tcp_stream": 229 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f479243f93ef94d28b44d6c0", "type": "ja3", "value": "a0e9f5d64349fb13191bc781f81f42e1", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1647896376.982682000", "last_seen_epoch": "1647919036.944271000", "evidence": [ { "frame_number": 550, "timestamp_epoch": "1647896376.982682000", "display_filter": "frame.number == 550", "tcp_stream": 3 }, { "frame_number": 570, "timestamp_epoch": "1647896378.204975000", "display_filter": "frame.number == 570", "tcp_stream": 4 }, { "frame_number": 573, "timestamp_epoch": "1647896378.273018000", "display_filter": "frame.number == 573", "tcp_stream": 5 }, { "frame_number": 613, "timestamp_epoch": "1647896379.212110000", "display_filter": "frame.number == 613", "tcp_stream": 7 }, { "frame_number": 1107, "timestamp_epoch": "1647896384.773124000", "display_filter": "frame.number == 1107", "tcp_stream": 13 }, { "frame_number": 1703, "timestamp_epoch": "1647896390.406451000", "display_filter": "frame.number == 1703", "tcp_stream": 14 }, { "frame_number": 2253, "timestamp_epoch": "1647896399.499457000", "display_filter": "frame.number == 2253", "tcp_stream": 15 }, { "frame_number": 2438, "timestamp_epoch": "1647896406.787125000", "display_filter": "frame.number == 2438", "tcp_stream": 16 }, { "frame_number": 3267, "timestamp_epoch": "1647896678.223403000", "display_filter": "frame.number == 3267", "tcp_stream": 17 }, { "frame_number": 3326, "timestamp_epoch": "1647896979.376171000", "display_filter": "frame.number == 3326", "tcp_stream": 18 }, { "frame_number": 3551, "timestamp_epoch": "1647897280.971962000", "display_filter": "frame.number == 3551", "tcp_stream": 27 }, { "frame_number": 3614, "timestamp_epoch": "1647897582.543838000", "display_filter": "frame.number == 3614", "tcp_stream": 28 }, { "frame_number": 4903, "timestamp_epoch": "1647899070.073098000", "display_filter": "frame.number == 4903", "tcp_stream": 75 }, { "frame_number": 5000, "timestamp_epoch": "1647899371.433479000", "display_filter": "frame.number == 5000", "tcp_stream": 76 }, { "frame_number": 5064, "timestamp_epoch": "1647899672.755120000", "display_filter": "frame.number == 5064", "tcp_stream": 77 }, { "frame_number": 5081, "timestamp_epoch": "1647899674.239763000", "display_filter": "frame.number == 5081", "tcp_stream": 78 }, { "frame_number": 5104, "timestamp_epoch": "1647899675.358295000", "display_filter": "frame.number == 5104", "tcp_stream": 79 }, { "frame_number": 6077, "timestamp_epoch": "1647899974.152615000", "display_filter": "frame.number == 6077", "tcp_stream": 93 }, { "frame_number": 6300, "timestamp_epoch": "1647900275.540229000", "display_filter": "frame.number == 6300", "tcp_stream": 100 }, { "frame_number": 7935, "timestamp_epoch": "1647900576.883045000", "display_filter": "frame.number == 7935", "tcp_stream": 123 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a7e50fcf120e1e5fad4fc450", "type": "sha256", "value": "67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-340c8e038339f450c41ba154", "type": "sha256", "value": "ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a44749c92986567bcd171126", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647898090.369579000", "last_seen_epoch": "1647918744.211724000", "evidence": [ { "frame_number": 3730, "timestamp_epoch": "1647898090.369579000", "display_filter": "frame.number == 3730" }, { "frame_number": 3739, "timestamp_epoch": "1647898093.369769000", "display_filter": "frame.number == 3739" }, { "frame_number": 3742, "timestamp_epoch": "1647898095.120037000", "display_filter": "frame.number == 3742" }, { "frame_number": 3745, "timestamp_epoch": "1647898096.371268000", "display_filter": "frame.number == 3745" }, { "frame_number": 3747, "timestamp_epoch": "1647898098.120255000", "display_filter": "frame.number == 3747" }, { "frame_number": 3749, "timestamp_epoch": "1647898099.370494000", "display_filter": "frame.number == 3749" }, { "frame_number": 3752, "timestamp_epoch": "1647898102.370736000", "display_filter": "frame.number == 3752" }, { "frame_number": 3762, "timestamp_epoch": "1647898105.385194000", "display_filter": "frame.number == 3762" }, { "frame_number": 3767, "timestamp_epoch": "1647898108.384633000", "display_filter": "frame.number == 3767" }, { "frame_number": 3817, "timestamp_epoch": "1647898111.072041000", "display_filter": "frame.number == 3817" }, { "frame_number": 3823, "timestamp_epoch": "1647898111.400073000", "display_filter": "frame.number == 3823" }, { "frame_number": 3833, "timestamp_epoch": "1647898111.721068000", "display_filter": "frame.number == 3833" }, { "frame_number": 3921, "timestamp_epoch": "1647898114.072232000", "display_filter": "frame.number == 3921" }, { "frame_number": 3925, "timestamp_epoch": "1647898114.400258000", "display_filter": "frame.number == 3925" }, { "frame_number": 3927, "timestamp_epoch": "1647898115.385356000", "display_filter": "frame.number == 3927" }, { "frame_number": 3993, "timestamp_epoch": "1647898118.400032000", "display_filter": "frame.number == 3993" }, { "frame_number": 3998, "timestamp_epoch": "1647898121.403287000", "display_filter": "frame.number == 3998" }, { "frame_number": 16149, "timestamp_epoch": "1647918738.205627000", "display_filter": "frame.number == 16149" }, { "frame_number": 16152, "timestamp_epoch": "1647918741.211965000", "display_filter": "frame.number == 16152" }, { "frame_number": 16177, "timestamp_epoch": "1647918744.211724000", "display_filter": "frame.number == 16177" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-94077849f49d59d9ba55d06d", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?161b4282e13b6962", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647903846.356989000", "last_seen_epoch": "1647903846.356989000", "evidence": [ { "frame_number": 9279, "timestamp_epoch": "1647903846.356989000", "display_filter": "frame.number == 9279", "tcp_stream": 155 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e909441b84185f3fdb754b52", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?48e7354130cbe0e4", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647899971.580964000", "last_seen_epoch": "1647899971.580964000", "evidence": [ { "frame_number": 6068, "timestamp_epoch": "1647899971.580964000", "display_filter": "frame.number == 6068", "tcp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-96c95c602e99a7d8ba88a23b", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c66ea67221454a2e", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647914646.880749000", "last_seen_epoch": "1647914646.880749000", "evidence": [ { "frame_number": 14380, "timestamp_epoch": "1647914646.880749000", "display_filter": "frame.number == 14380", "tcp_stream": 365 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-502c1744319be2d4410e892b", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6c9c220471a286c", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647908975.179327000", "last_seen_epoch": "1647908975.179327000", "evidence": [ { "frame_number": 11767, "timestamp_epoch": "1647908975.179327000", "display_filter": "frame.number == 11767", "tcp_stream": 236 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5b32ab8437b3f14490f0f9b4", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0356947035b28e34", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647911082.964033000", "last_seen_epoch": "1647911082.964033000", "evidence": [ { "frame_number": 12818, "timestamp_epoch": "1647911082.964033000", "display_filter": "frame.number == 12818", "tcp_stream": 290 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0510df8285b764dd26850bee", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1131f2daab4034ba", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647904916.047306000", "last_seen_epoch": "1647904916.047306000", "evidence": [ { "frame_number": 9789, "timestamp_epoch": "1647904916.047306000", "display_filter": "frame.number == 9789", "tcp_stream": 172 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d6d96da334c3cea81e70df31", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fd0590036de0ddd", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647915587.324783000", "last_seen_epoch": "1647915587.324783000", "evidence": [ { "frame_number": 14821, "timestamp_epoch": "1647915587.324783000", "display_filter": "frame.number == 14821", "tcp_stream": 390 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d48e76a417a270f7703109c6", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?36a063424dfa7851", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647910775.716220000", "last_seen_epoch": "1647910775.716220000", "evidence": [ { "frame_number": 12502, "timestamp_epoch": "1647910775.716220000", "display_filter": "frame.number == 12502", "tcp_stream": 275 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-612fcef25cf0f48471058d7f", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?416ee1a6826abea5", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647914647.025310000", "last_seen_epoch": "1647914647.025310000", "evidence": [ { "frame_number": 14383, "timestamp_epoch": "1647914647.025310000", "display_filter": "frame.number == 14383", "tcp_stream": 365 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-730c475d3c0c70dad5adcc6d", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9770388e0c613755", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647906274.371334000", "last_seen_epoch": "1647906274.371334000", "evidence": [ { "frame_number": 10275, "timestamp_epoch": "1647906274.371334000", "display_filter": "frame.number == 10275", "tcp_stream": 183 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-10e232e744f75f3e77a92844", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d1adc478adff0d72", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647898172.135617000", "last_seen_epoch": "1647898172.135617000", "evidence": [ { "frame_number": 4074, "timestamp_epoch": "1647898172.135617000", "display_filter": "frame.number == 4074", "tcp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-288ce7c5269907c55f2f3d09", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?fcfd7669d19bb421", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647901775.281200000", "last_seen_epoch": "1647901775.281200000", "evidence": [ { "frame_number": 8627, "timestamp_epoch": "1647901775.281200000", "display_filter": "frame.number == 8627", "tcp_stream": 140 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9460927ee42f761c3874a52e", "type": "url", "value": "http://oceriesfornot.top/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647896291.303409000", "last_seen_epoch": "1647896291.303409000", "evidence": [ { "frame_number": 4, "timestamp_epoch": "1647896291.303409000", "display_filter": "frame.number == 4", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0344faa7e160bffd743cdc33", "type": "url", "value": "http://r3.i.lencr.org/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647899684.353032000", "last_seen_epoch": "1647899684.353032000", "evidence": [ { "frame_number": 5753, "timestamp_epoch": "1647899684.353032000", "display_filter": "frame.number == 5753", "tcp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-48da76dd329289d3b6048e49", "type": "url", "value": "http://x1.c.lencr.org/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1647899971.243136000", "last_seen_epoch": "1647914646.526312000", "evidence": [ { "frame_number": 6059, "timestamp_epoch": "1647899971.243136000", "display_filter": "frame.number == 6059", "tcp_stream": 91 }, { "frame_number": 9268, "timestamp_epoch": "1647903846.058127000", "display_filter": "frame.number == 9268", "tcp_stream": 154 }, { "frame_number": 11757, "timestamp_epoch": "1647908974.887435000", "display_filter": "frame.number == 11757", "tcp_stream": 235 }, { "frame_number": 14371, "timestamp_epoch": "1647914646.526312000", "display_filter": "frame.number == 14371", "tcp_stream": 364 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fd2abd38dc672e6d1f6f7993", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1647898172.135617000", "last_seen_epoch": "1647915587.324783000", "evidence": [ { "frame_number": 4074, "timestamp_epoch": "1647898172.135617000", "display_filter": "frame.number == 4074", "tcp_stream": 37 }, { "frame_number": 5753, "timestamp_epoch": "1647899684.353032000", "display_filter": "frame.number == 5753", "tcp_stream": 81 }, { "frame_number": 6059, "timestamp_epoch": "1647899971.243136000", "display_filter": "frame.number == 6059", "tcp_stream": 91 }, { "frame_number": 6068, "timestamp_epoch": "1647899971.580964000", "display_filter": "frame.number == 6068", "tcp_stream": 92 }, { "frame_number": 8627, "timestamp_epoch": "1647901775.281200000", "display_filter": "frame.number == 8627", "tcp_stream": 140 }, { "frame_number": 9268, "timestamp_epoch": "1647903846.058127000", "display_filter": "frame.number == 9268", "tcp_stream": 154 }, { "frame_number": 9279, "timestamp_epoch": "1647903846.356989000", "display_filter": "frame.number == 9279", "tcp_stream": 155 }, { "frame_number": 9789, "timestamp_epoch": "1647904916.047306000", "display_filter": "frame.number == 9789", "tcp_stream": 172 }, { "frame_number": 10275, "timestamp_epoch": "1647906274.371334000", "display_filter": "frame.number == 10275", "tcp_stream": 183 }, { "frame_number": 11757, "timestamp_epoch": "1647908974.887435000", "display_filter": "frame.number == 11757", "tcp_stream": 235 }, { "frame_number": 11767, "timestamp_epoch": "1647908975.179327000", "display_filter": "frame.number == 11767", "tcp_stream": 236 }, { "frame_number": 12502, "timestamp_epoch": "1647910775.716220000", "display_filter": "frame.number == 12502", "tcp_stream": 275 }, { "frame_number": 12818, "timestamp_epoch": "1647911082.964033000", "display_filter": "frame.number == 12818", "tcp_stream": 290 }, { "frame_number": 14371, "timestamp_epoch": "1647914646.526312000", "display_filter": "frame.number == 14371", "tcp_stream": 364 }, { "frame_number": 14380, "timestamp_epoch": "1647914646.880749000", "display_filter": "frame.number == 14380", "tcp_stream": 365 }, { "frame_number": 14383, "timestamp_epoch": "1647914647.025310000", "display_filter": "frame.number == 14383", "tcp_stream": 365 }, { "frame_number": 14821, "timestamp_epoch": "1647915587.324783000", "display_filter": "frame.number == 14821", "tcp_stream": 390 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-b3a5d7a8db6cdcb181e9f3ea", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 3298, "timestamp_epoch": "1647896803.730603000", "display_filter": "frame.number == 3298", "udp_stream": 11 }, { "frame_number": 3584, "timestamp_epoch": "1647897403.696658000", "display_filter": "frame.number == 3584", "udp_stream": 20 }, { "frame_number": 3845, "timestamp_epoch": "1647898111.854034000", "display_filter": "frame.number == 3845", "udp_stream": 40 }, { "frame_number": 3916, "timestamp_epoch": "1647898113.838694000", "display_filter": "frame.number == 3916", "udp_stream": 50 }, { "frame_number": 4014, "timestamp_epoch": "1647898132.383360000", "display_filter": "frame.number == 4014", "udp_stream": 55 }, { "frame_number": 4079, "timestamp_epoch": "1647898192.390434000", "display_filter": "frame.number == 4079", "udp_stream": 60 }, { "frame_number": 4118, "timestamp_epoch": "1647898792.360245000", "display_filter": "frame.number == 4118", "udp_stream": 62 }, { "frame_number": 4119, "timestamp_epoch": "1647898792.360754000", "display_filter": "frame.number == 4119", "udp_stream": 62 }, { "frame_number": 5014, "timestamp_epoch": "1647899392.324173000", "display_filter": "frame.number == 5014", "udp_stream": 83 }, { "frame_number": 5782, "timestamp_epoch": "1647899730.286884000", "display_filter": "frame.number == 5782", "udp_stream": 90 }, { "frame_number": 6091, "timestamp_epoch": "1647899992.296362000", "display_filter": "frame.number == 6091", "udp_stream": 98 }, { "frame_number": 7951, "timestamp_epoch": "1647900592.256090000", "display_filter": "frame.number == 7951", "udp_stream": 103 }, { "frame_number": 8431, "timestamp_epoch": "1647901192.230372000", "display_filter": "frame.number == 8431", "udp_stream": 110 }, { "frame_number": 8652, "timestamp_epoch": "1647901792.204194000", "display_filter": "frame.number == 8652", "udp_stream": 32 }, { "frame_number": 8818, "timestamp_epoch": "1647902392.176830000", "display_filter": "frame.number == 8818", "udp_stream": 122 }, { "frame_number": 9041, "timestamp_epoch": "1647902992.140343000", "display_filter": "frame.number == 9041", "udp_stream": 128 }, { "frame_number": 9197, "timestamp_epoch": "1647903592.105367000", "display_filter": "frame.number == 9197", "udp_stream": 132 }, { "frame_number": 9368, "timestamp_epoch": "1647904192.085004000", "display_filter": "frame.number == 9368", "udp_stream": 138 }, { "frame_number": 9699, "timestamp_epoch": "1647904792.054737000", "display_filter": "frame.number == 9699", "udp_stream": 147 }, { "frame_number": 9947, "timestamp_epoch": "1647905392.017569000", "display_filter": "frame.number == 9947", "udp_stream": 155 }, { "frame_number": 10157, "timestamp_epoch": "1647905991.987275000", "display_filter": "frame.number == 10157", "udp_stream": 160 }, { "frame_number": 10355, "timestamp_epoch": "1647906591.950253000", "display_filter": "frame.number == 10355", "udp_stream": 165 }, { "frame_number": 10754, "timestamp_epoch": "1647907191.917931000", "display_filter": "frame.number == 10754", "udp_stream": 171 }, { "frame_number": 10913, "timestamp_epoch": "1647907791.889455000", "display_filter": "frame.number == 10913", "udp_stream": 176 }, { "frame_number": 11158, "timestamp_epoch": "1647908391.857378000", "display_filter": "frame.number == 11158", "udp_stream": 183 }, { "frame_number": 11782, "timestamp_epoch": "1647908991.827209000", "display_filter": "frame.number == 11782", "udp_stream": 205 }, { "frame_number": 12004, "timestamp_epoch": "1647909591.794268000", "display_filter": "frame.number == 12004", "udp_stream": 213 }, { "frame_number": 12284, "timestamp_epoch": "1647910191.759611000", "display_filter": "frame.number == 12284", "udp_stream": 222 }, { "frame_number": 12525, "timestamp_epoch": "1647910791.721741000", "display_filter": "frame.number == 12525", "udp_stream": 231 }, { "frame_number": 12926, "timestamp_epoch": "1647911391.684226000", "display_filter": "frame.number == 12926", "udp_stream": 246 }, { "frame_number": 13202, "timestamp_epoch": "1647911991.654034000", "display_filter": "frame.number == 13202", "udp_stream": 256 }, { "frame_number": 13412, "timestamp_epoch": "1647912591.627274000", "display_filter": "frame.number == 13412", "udp_stream": 265 }, { "frame_number": 13795, "timestamp_epoch": "1647913191.596107000", "display_filter": "frame.number == 13795", "udp_stream": 274 }, { "frame_number": 13989, "timestamp_epoch": "1647913791.566161000", "display_filter": "frame.number == 13989", "udp_stream": 280 }, { "frame_number": 14312, "timestamp_epoch": "1647914391.542881000", "display_filter": "frame.number == 14312", "udp_stream": 289 }, { "frame_number": 14537, "timestamp_epoch": "1647914991.518068000", "display_filter": "frame.number == 14537", "udp_stream": 299 }, { "frame_number": 14826, "timestamp_epoch": "1647915591.487537000", "display_filter": "frame.number == 14826", "udp_stream": 311 }, { "frame_number": 15145, "timestamp_epoch": "1647916191.461328000", "display_filter": "frame.number == 15145", "udp_stream": 322 }, { "frame_number": 15372, "timestamp_epoch": "1647916791.434427000", "display_filter": "frame.number == 15372", "udp_stream": 331 }, { "frame_number": 15570, "timestamp_epoch": "1647917391.399245000", "display_filter": "frame.number == 15570", "udp_stream": 339 }, { "frame_number": 15767, "timestamp_epoch": "1647917991.360726000", "display_filter": "frame.number == 15767", "udp_stream": 346 }, { "frame_number": 16001, "timestamp_epoch": "1647918591.326440000", "display_filter": "frame.number == 16001", "udp_stream": 355 } ], "metrics": { "source": "10.0.19.14", "domain": "wpad.burnincandle.com", "response_count": 42 } }, { "finding_id": "finding-c34632857f7cbf7d79146e68", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 3300, "timestamp_epoch": "1647896803.732244000", "display_filter": "frame.number == 3300", "udp_stream": 12 }, { "frame_number": 3586, "timestamp_epoch": "1647897403.699036000", "display_filter": "frame.number == 3586", "udp_stream": 21 }, { "frame_number": 3851, "timestamp_epoch": "1647898111.855443000", "display_filter": "frame.number == 3851", "udp_stream": 43 }, { "frame_number": 3918, "timestamp_epoch": "1647898113.839108000", "display_filter": "frame.number == 3918", "udp_stream": 51 }, { "frame_number": 4016, "timestamp_epoch": "1647898132.383920000", "display_filter": "frame.number == 4016", "udp_stream": 56 }, { "frame_number": 4081, "timestamp_epoch": "1647898192.392675000", "display_filter": "frame.number == 4081", "udp_stream": 61 }, { "frame_number": 4121, "timestamp_epoch": "1647898792.362398000", "display_filter": "frame.number == 4121", "udp_stream": 63 }, { "frame_number": 5016, "timestamp_epoch": "1647899392.326523000", "display_filter": "frame.number == 5016", "udp_stream": 84 }, { "frame_number": 5784, "timestamp_epoch": "1647899730.288672000", "display_filter": "frame.number == 5784", "udp_stream": 91 }, { "frame_number": 6093, "timestamp_epoch": "1647899992.298308000", "display_filter": "frame.number == 6093", "udp_stream": 99 }, { "frame_number": 7953, "timestamp_epoch": "1647900592.257878000", "display_filter": "frame.number == 7953", "udp_stream": 104 }, { "frame_number": 8433, "timestamp_epoch": "1647901192.232240000", "display_filter": "frame.number == 8433", "udp_stream": 111 }, { "frame_number": 8654, "timestamp_epoch": "1647901792.205809000", "display_filter": "frame.number == 8654", "udp_stream": 118 }, { "frame_number": 8820, "timestamp_epoch": "1647902392.178780000", "display_filter": "frame.number == 8820", "udp_stream": 123 }, { "frame_number": 9043, "timestamp_epoch": "1647902992.142589000", "display_filter": "frame.number == 9043", "udp_stream": 129 }, { "frame_number": 9199, "timestamp_epoch": "1647903592.110381000", "display_filter": "frame.number == 9199", "udp_stream": 133 }, { "frame_number": 9370, "timestamp_epoch": "1647904192.087383000", "display_filter": "frame.number == 9370", "udp_stream": 139 }, { "frame_number": 9701, "timestamp_epoch": "1647904792.056888000", "display_filter": "frame.number == 9701", "udp_stream": 148 }, { "frame_number": 9949, "timestamp_epoch": "1647905392.019817000", "display_filter": "frame.number == 9949", "udp_stream": 156 }, { "frame_number": 10159, "timestamp_epoch": "1647905991.989608000", "display_filter": "frame.number == 10159", "udp_stream": 115 }, { "frame_number": 10357, "timestamp_epoch": "1647906591.952736000", "display_filter": "frame.number == 10357", "udp_stream": 166 }, { "frame_number": 10756, "timestamp_epoch": "1647907191.920306000", "display_filter": "frame.number == 10756", "udp_stream": 172 }, { "frame_number": 10915, "timestamp_epoch": "1647907791.891321000", "display_filter": "frame.number == 10915", "udp_stream": 177 }, { "frame_number": 11160, "timestamp_epoch": "1647908391.859182000", "display_filter": "frame.number == 11160", "udp_stream": 184 }, { "frame_number": 11784, "timestamp_epoch": "1647908991.828577000", "display_filter": "frame.number == 11784", "udp_stream": 206 }, { "frame_number": 12006, "timestamp_epoch": "1647909591.796744000", "display_filter": "frame.number == 12006", "udp_stream": 214 }, { "frame_number": 12286, "timestamp_epoch": "1647910191.761968000", "display_filter": "frame.number == 12286", "udp_stream": 223 }, { "frame_number": 12527, "timestamp_epoch": "1647910791.723893000", "display_filter": "frame.number == 12527", "udp_stream": 232 }, { "frame_number": 12928, "timestamp_epoch": "1647911391.686640000", "display_filter": "frame.number == 12928", "udp_stream": 247 }, { "frame_number": 13204, "timestamp_epoch": "1647911991.656408000", "display_filter": "frame.number == 13204", "udp_stream": 257 }, { "frame_number": 13414, "timestamp_epoch": "1647912591.629330000", "display_filter": "frame.number == 13414", "udp_stream": 266 }, { "frame_number": 13797, "timestamp_epoch": "1647913191.597895000", "display_filter": "frame.number == 13797", "udp_stream": 275 }, { "frame_number": 13991, "timestamp_epoch": "1647913791.568310000", "display_filter": "frame.number == 13991", "udp_stream": 281 }, { "frame_number": 14314, "timestamp_epoch": "1647914391.544845000", "display_filter": "frame.number == 14314", "udp_stream": 290 }, { "frame_number": 14539, "timestamp_epoch": "1647914991.520269000", "display_filter": "frame.number == 14539", "udp_stream": 300 }, { "frame_number": 14828, "timestamp_epoch": "1647915591.489576000", "display_filter": "frame.number == 14828", "udp_stream": 312 }, { "frame_number": 15147, "timestamp_epoch": "1647916191.463679000", "display_filter": "frame.number == 15147", "udp_stream": 323 }, { "frame_number": 15374, "timestamp_epoch": "1647916791.436655000", "display_filter": "frame.number == 15374", "udp_stream": 332 }, { "frame_number": 15572, "timestamp_epoch": "1647917391.401519000", "display_filter": "frame.number == 15572", "udp_stream": 340 }, { "frame_number": 15769, "timestamp_epoch": "1647917991.362925000", "display_filter": "frame.number == 15769", "udp_stream": 347 }, { "frame_number": 16003, "timestamp_epoch": "1647918591.328918000", "display_filter": "frame.number == 16003", "udp_stream": 356 } ], "metrics": { "source": "10.0.19.14", "domain": "wpad.mshome.net", "response_count": 41 } }, { "finding_id": "finding-593a108c471240a6e4d77f6a", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 3450, "timestamp_epoch": "1647897130.329916000", "display_filter": "frame.number == 3450", "tcp_stream": 23 }, { "frame_number": 3452, "timestamp_epoch": "1647897130.330833000", "display_filter": "frame.number == 3452", "tcp_stream": 23 }, { "frame_number": 3454, "timestamp_epoch": "1647897130.331661000", "display_filter": "frame.number == 3454", "tcp_stream": 23 }, { "frame_number": 3458, "timestamp_epoch": "1647897130.333439000", "display_filter": "frame.number == 3458", "tcp_stream": 23 }, { "frame_number": 3460, "timestamp_epoch": "1647897130.333988000", "display_filter": "frame.number == 3460", "tcp_stream": 23 }, { "frame_number": 3462, "timestamp_epoch": "1647897130.334759000", "display_filter": "frame.number == 3462", "tcp_stream": 23 }, { "frame_number": 4206, "timestamp_epoch": "1647899008.789886000", "display_filter": "frame.number == 4206", "tcp_stream": 42 }, { "frame_number": 4208, "timestamp_epoch": "1647899008.790396000", "display_filter": "frame.number == 4208", "tcp_stream": 42 }, { "frame_number": 4210, "timestamp_epoch": "1647899008.791156000", "display_filter": "frame.number == 4210", "tcp_stream": 42 }, { "frame_number": 4212, "timestamp_epoch": "1647899008.791779000", "display_filter": "frame.number == 4212", "tcp_stream": 42 }, { "frame_number": 4843, "timestamp_epoch": "1647899069.647910000", "display_filter": "frame.number == 4843", "tcp_stream": 72 }, { "frame_number": 4845, "timestamp_epoch": "1647899069.648662000", "display_filter": "frame.number == 4845", "tcp_stream": 72 }, { "frame_number": 4847, "timestamp_epoch": "1647899069.649532000", "display_filter": "frame.number == 4847", "tcp_stream": 72 }, { "frame_number": 4851, "timestamp_epoch": "1647899069.650809000", "display_filter": "frame.number == 4851", "tcp_stream": 72 }, { "frame_number": 4853, "timestamp_epoch": "1647899069.651273000", "display_filter": "frame.number == 4853", "tcp_stream": 72 }, { "frame_number": 4855, "timestamp_epoch": "1647899069.652082000", "display_filter": "frame.number == 4855", "tcp_stream": 72 }, { "frame_number": 8021, "timestamp_epoch": "1647900730.232183000", "display_filter": "frame.number == 8021", "tcp_stream": 126 }, { "frame_number": 8023, "timestamp_epoch": "1647900730.233113000", "display_filter": "frame.number == 8023", "tcp_stream": 126 }, { "frame_number": 8025, "timestamp_epoch": "1647900730.234054000", "display_filter": "frame.number == 8025", "tcp_stream": 126 }, { "frame_number": 8029, "timestamp_epoch": "1647900730.236009000", "display_filter": "frame.number == 8029", "tcp_stream": 126 }, { "frame_number": 8031, "timestamp_epoch": "1647900730.236528000", "display_filter": "frame.number == 8031", "tcp_stream": 126 }, { "frame_number": 8033, "timestamp_epoch": "1647900730.237364000", "display_filter": "frame.number == 8033", "tcp_stream": 126 }, { "frame_number": 8098, "timestamp_epoch": "1647900774.085161000", "display_filter": "frame.number == 8098", "tcp_stream": 130 }, { "frame_number": 8100, "timestamp_epoch": "1647900774.085821000", "display_filter": "frame.number == 8100", "tcp_stream": 130 }, { "frame_number": 8102, "timestamp_epoch": "1647900774.086655000", "display_filter": "frame.number == 8102", "tcp_stream": 130 }, { "frame_number": 9438, "timestamp_epoch": "1647904330.058457000", "display_filter": "frame.number == 9438", "tcp_stream": 159 }, { "frame_number": 9440, "timestamp_epoch": "1647904330.059151000", "display_filter": "frame.number == 9440", "tcp_stream": 159 }, { "frame_number": 9442, "timestamp_epoch": "1647904330.060195000", "display_filter": "frame.number == 9442", "tcp_stream": 159 }, { "frame_number": 9446, "timestamp_epoch": "1647904330.061393000", "display_filter": "frame.number == 9446", "tcp_stream": 159 }, { "frame_number": 9448, "timestamp_epoch": "1647904330.061881000", "display_filter": "frame.number == 9448", "tcp_stream": 159 }, { "frame_number": 9450, "timestamp_epoch": "1647904330.062663000", "display_filter": "frame.number == 9450", "tcp_stream": 159 }, { "frame_number": 9590, "timestamp_epoch": "1647904588.486786000", "display_filter": "frame.number == 9590", "tcp_stream": 165 }, { "frame_number": 9592, "timestamp_epoch": "1647904588.487394000", "display_filter": "frame.number == 9592", "tcp_stream": 165 }, { "frame_number": 9594, "timestamp_epoch": "1647904588.487966000", "display_filter": "frame.number == 9594", "tcp_stream": 165 }, { "frame_number": 10460, "timestamp_epoch": "1647906954.856669000", "display_filter": "frame.number == 10460", "tcp_stream": 188 }, { "frame_number": 10462, "timestamp_epoch": "1647906954.857548000", "display_filter": "frame.number == 10462", "tcp_stream": 188 }, { "frame_number": 10464, "timestamp_epoch": "1647906954.858600000", "display_filter": "frame.number == 10464", "tcp_stream": 188 }, { "frame_number": 10969, "timestamp_epoch": "1647907930.110233000", "display_filter": "frame.number == 10969", "tcp_stream": 198 }, { "frame_number": 10971, "timestamp_epoch": "1647907930.110995000", "display_filter": "frame.number == 10971", "tcp_stream": 198 }, { "frame_number": 10973, "timestamp_epoch": "1647907930.111776000", "display_filter": "frame.number == 10973", "tcp_stream": 198 }, { "frame_number": 10977, "timestamp_epoch": "1647907930.112974000", "display_filter": "frame.number == 10977", "tcp_stream": 198 }, { "frame_number": 10979, "timestamp_epoch": "1647907930.113518000", "display_filter": "frame.number == 10979", "tcp_stream": 198 }, { "frame_number": 10981, "timestamp_epoch": "1647907930.113942000", "display_filter": "frame.number == 10981", "tcp_stream": 198 }, { "frame_number": 11475, "timestamp_epoch": "1647908840.696407000", "display_filter": "frame.number == 11475", "tcp_stream": 223 }, { "frame_number": 11480, "timestamp_epoch": "1647908840.696950000", "display_filter": "frame.number == 11480", "tcp_stream": 223 }, { "frame_number": 11483, "timestamp_epoch": "1647908840.697862000", "display_filter": "frame.number == 11483", "tcp_stream": 223 }, { "frame_number": 11497, "timestamp_epoch": "1647908840.701487000", "display_filter": "frame.number == 11497", "tcp_stream": 225 }, { "frame_number": 11499, "timestamp_epoch": "1647908840.702094000", "display_filter": "frame.number == 11499", "tcp_stream": 225 }, { "frame_number": 11501, "timestamp_epoch": "1647908840.702969000", "display_filter": "frame.number == 11501", "tcp_stream": 225 }, { "frame_number": 11505, "timestamp_epoch": "1647908840.704548000", "display_filter": "frame.number == 11505", "tcp_stream": 225 }, { "frame_number": 11507, "timestamp_epoch": "1647908840.704817000", "display_filter": "frame.number == 11507", "tcp_stream": 225 }, { "frame_number": 11509, "timestamp_epoch": "1647908840.705354000", "display_filter": "frame.number == 11509", "tcp_stream": 225 }, { "frame_number": 12220, "timestamp_epoch": "1647910170.412565000", "display_filter": "frame.number == 12220", "tcp_stream": 261 }, { "frame_number": 12222, "timestamp_epoch": "1647910170.413416000", "display_filter": "frame.number == 12222", "tcp_stream": 261 }, { "frame_number": 12224, "timestamp_epoch": "1647910170.414352000", "display_filter": "frame.number == 12224", "tcp_stream": 261 }, { "frame_number": 12978, "timestamp_epoch": "1647911530.003178000", "display_filter": "frame.number == 12978", "tcp_stream": 300 }, { "frame_number": 12980, "timestamp_epoch": "1647911530.003944000", "display_filter": "frame.number == 12980", "tcp_stream": 300 }, { "frame_number": 12982, "timestamp_epoch": "1647911530.004826000", "display_filter": "frame.number == 12982", "tcp_stream": 300 }, { "frame_number": 12986, "timestamp_epoch": "1647911530.006063000", "display_filter": "frame.number == 12986", "tcp_stream": 300 }, { "frame_number": 12988, "timestamp_epoch": "1647911530.006552000", "display_filter": "frame.number == 12988", "tcp_stream": 300 }, { "frame_number": 12990, "timestamp_epoch": "1647911530.007251000", "display_filter": "frame.number == 12990", "tcp_stream": 300 }, { "frame_number": 13569, "timestamp_epoch": "1647913134.468590000", "display_filter": "frame.number == 13569", "tcp_stream": 332 }, { "frame_number": 13571, "timestamp_epoch": "1647913134.469202000", "display_filter": "frame.number == 13571", "tcp_stream": 332 }, { "frame_number": 13573, "timestamp_epoch": "1647913134.470106000", "display_filter": "frame.number == 13573", "tcp_stream": 332 }, { "frame_number": 14098, "timestamp_epoch": "1647914217.148203000", "display_filter": "frame.number == 14098", "tcp_stream": 356 }, { "frame_number": 14100, "timestamp_epoch": "1647914217.148795000", "display_filter": "frame.number == 14100", "tcp_stream": 356 }, { "frame_number": 14102, "timestamp_epoch": "1647914217.149362000", "display_filter": "frame.number == 14102", "tcp_stream": 356 }, { "frame_number": 14565, "timestamp_epoch": "1647915129.856757000", "display_filter": "frame.number == 14565", "tcp_stream": 376 }, { "frame_number": 14567, "timestamp_epoch": "1647915129.857508000", "display_filter": "frame.number == 14567", "tcp_stream": 376 }, { "frame_number": 14569, "timestamp_epoch": "1647915129.858309000", "display_filter": "frame.number == 14569", "tcp_stream": 376 }, { "frame_number": 14573, "timestamp_epoch": "1647915129.859628000", "display_filter": "frame.number == 14573", "tcp_stream": 376 }, { "frame_number": 14575, "timestamp_epoch": "1647915129.860112000", "display_filter": "frame.number == 14575", "tcp_stream": 376 }, { "frame_number": 14577, "timestamp_epoch": "1647915129.860818000", "display_filter": "frame.number == 14577", "tcp_stream": 376 }, { "frame_number": 14876, "timestamp_epoch": "1647915749.943400000", "display_filter": "frame.number == 14876", "tcp_stream": 393 }, { "frame_number": 14878, "timestamp_epoch": "1647915749.943940000", "display_filter": "frame.number == 14878", "tcp_stream": 393 }, { "frame_number": 14880, "timestamp_epoch": "1647915749.944642000", "display_filter": "frame.number == 14880", "tcp_stream": 393 }, { "frame_number": 16088, "timestamp_epoch": "1647918729.788121000", "display_filter": "frame.number == 16088", "tcp_stream": 455 }, { "frame_number": 16090, "timestamp_epoch": "1647918729.788791000", "display_filter": "frame.number == 16090", "tcp_stream": 455 }, { "frame_number": 16092, "timestamp_epoch": "1647918729.789657000", "display_filter": "frame.number == 16092", "tcp_stream": 455 }, { "frame_number": 16096, "timestamp_epoch": "1647918729.790856000", "display_filter": "frame.number == 16096", "tcp_stream": 455 }, { "frame_number": 16098, "timestamp_epoch": "1647918729.791316000", "display_filter": "frame.number == 16098", "tcp_stream": 455 }, { "frame_number": 16100, "timestamp_epoch": "1647918729.792122000", "display_filter": "frame.number == 16100", "tcp_stream": 455 } ], "metrics": { "source": "10.0.19.14", "destination": "10.0.19.9", "protocol": "drsuapi", "event_count": 82, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-5f3db67192d2d79c57dd665c", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 3473, "timestamp_epoch": "1647897130.443849000", "display_filter": "frame.number == 3473", "tcp_stream": 24 }, { "frame_number": 3478, "timestamp_epoch": "1647897130.446665000", "display_filter": "frame.number == 3478", "tcp_stream": 24 }, { "frame_number": 3481, "timestamp_epoch": "1647897130.448276000", "display_filter": "frame.number == 3481", "tcp_stream": 24 }, { "frame_number": 3483, "timestamp_epoch": "1647897130.449057000", "display_filter": "frame.number == 3483", "tcp_stream": 24 }, { "frame_number": 3485, "timestamp_epoch": "1647897130.449815000", "display_filter": "frame.number == 3485", "tcp_stream": 24 }, { "frame_number": 3491, "timestamp_epoch": "1647897130.456341000", "display_filter": "frame.number == 3491", "tcp_stream": 25 }, { "frame_number": 3494, "timestamp_epoch": "1647897130.457863000", "display_filter": "frame.number == 3494", "tcp_stream": 25 }, { "frame_number": 3499, "timestamp_epoch": "1647897130.459238000", "display_filter": "frame.number == 3499", "tcp_stream": 25 }, { "frame_number": 3501, "timestamp_epoch": "1647897130.459792000", "display_filter": "frame.number == 3501", "tcp_stream": 25 }, { "frame_number": 3503, "timestamp_epoch": "1647897130.460220000", "display_filter": "frame.number == 3503", "tcp_stream": 24 }, { "frame_number": 3804, "timestamp_epoch": "1647898110.964639000", "display_filter": "frame.number == 3804", "tcp_stream": 30 }, { "frame_number": 3809, "timestamp_epoch": "1647898110.966086000", "display_filter": "frame.number == 3809", "tcp_stream": 30 }, { "frame_number": 3812, "timestamp_epoch": "1647898110.967231000", "display_filter": "frame.number == 3812", "tcp_stream": 30 }, { "frame_number": 4378, "timestamp_epoch": "1647899009.107932000", "display_filter": "frame.number == 4378", "tcp_stream": 55 }, { "frame_number": 4383, "timestamp_epoch": "1647899009.109732000", "display_filter": "frame.number == 4383", "tcp_stream": 55 }, { "frame_number": 4386, "timestamp_epoch": "1647899009.116568000", "display_filter": "frame.number == 4386", "tcp_stream": 55 }, { "frame_number": 4392, "timestamp_epoch": "1647899009.119228000", "display_filter": "frame.number == 4392", "tcp_stream": 56 }, { "frame_number": 4395, "timestamp_epoch": "1647899009.120885000", "display_filter": "frame.number == 4395", "tcp_stream": 56 }, { "frame_number": 4397, "timestamp_epoch": "1647899009.121276000", "display_filter": "frame.number == 4397", "tcp_stream": 56 }, { "frame_number": 4399, "timestamp_epoch": "1647899009.122580000", "display_filter": "frame.number == 4399", "tcp_stream": 55 }, { "frame_number": 4406, "timestamp_epoch": "1647899009.435538000", "display_filter": "frame.number == 4406", "tcp_stream": 56 }, { "frame_number": 4410, "timestamp_epoch": "1647899009.437661000", "display_filter": "frame.number == 4410", "tcp_stream": 55 }, { "frame_number": 4860, "timestamp_epoch": "1647899069.653574000", "display_filter": "frame.number == 4860", "tcp_stream": 73 }, { "frame_number": 4865, "timestamp_epoch": "1647899069.654943000", "display_filter": "frame.number == 4865", "tcp_stream": 73 }, { "frame_number": 4868, "timestamp_epoch": "1647899069.656581000", "display_filter": "frame.number == 4868", "tcp_stream": 73 }, { "frame_number": 4870, "timestamp_epoch": "1647899069.657280000", "display_filter": "frame.number == 4870", "tcp_stream": 73 }, { "frame_number": 4872, "timestamp_epoch": "1647899069.657888000", "display_filter": "frame.number == 4872", "tcp_stream": 73 }, { "frame_number": 4878, "timestamp_epoch": "1647899069.660236000", "display_filter": "frame.number == 4878", "tcp_stream": 74 }, { "frame_number": 4881, "timestamp_epoch": "1647899069.661912000", "display_filter": "frame.number == 4881", "tcp_stream": 74 }, { "frame_number": 4886, "timestamp_epoch": "1647899069.662851000", "display_filter": "frame.number == 4886", "tcp_stream": 74 }, { "frame_number": 4888, "timestamp_epoch": "1647899069.663504000", "display_filter": "frame.number == 4888", "tcp_stream": 74 }, { "frame_number": 4890, "timestamp_epoch": "1647899069.663604000", "display_filter": "frame.number == 4890", "tcp_stream": 73 }, { "frame_number": 6994, "timestamp_epoch": "1647900354.449183000", "display_filter": "frame.number == 6994", "tcp_stream": 104 }, { "frame_number": 7011, "timestamp_epoch": "1647900354.454129000", "display_filter": "frame.number == 7011", "tcp_stream": 104 }, { "frame_number": 7014, "timestamp_epoch": "1647900354.458460000", "display_filter": "frame.number == 7014", "tcp_stream": 104 }, { "frame_number": 7019, "timestamp_epoch": "1647900354.459585000", "display_filter": "frame.number == 7019", "tcp_stream": 104 }, { "frame_number": 7027, "timestamp_epoch": "1647900354.461285000", "display_filter": "frame.number == 7027", "tcp_stream": 106 }, { "frame_number": 7030, "timestamp_epoch": "1647900354.462864000", "display_filter": "frame.number == 7030", "tcp_stream": 106 }, { "frame_number": 7032, "timestamp_epoch": "1647900354.463895000", "display_filter": "frame.number == 7032", "tcp_stream": 106 }, { "frame_number": 7034, "timestamp_epoch": "1647900354.464614000", "display_filter": "frame.number == 7034", "tcp_stream": 106 }, { "frame_number": 7042, "timestamp_epoch": "1647900354.466502000", "display_filter": "frame.number == 7042", "tcp_stream": 106 }, { "frame_number": 7044, "timestamp_epoch": "1647900354.467062000", "display_filter": "frame.number == 7044", "tcp_stream": 106 }, { "frame_number": 7046, "timestamp_epoch": "1647900354.467536000", "display_filter": "frame.number == 7046", "tcp_stream": 106 }, { "frame_number": 7048, "timestamp_epoch": "1647900354.470742000", "display_filter": "frame.number == 7048", "tcp_stream": 106 }, { "frame_number": 7364, "timestamp_epoch": "1647900354.547930000", "display_filter": "frame.number == 7364", "tcp_stream": 106 }, { "frame_number": 7366, "timestamp_epoch": "1647900354.551729000", "display_filter": "frame.number == 7366", "tcp_stream": 106 }, { "frame_number": 8038, "timestamp_epoch": "1647900730.239879000", "display_filter": "frame.number == 8038", "tcp_stream": 127 }, { "frame_number": 8043, "timestamp_epoch": "1647900730.241525000", "display_filter": "frame.number == 8043", "tcp_stream": 127 }, { "frame_number": 8046, "timestamp_epoch": "1647900730.243268000", "display_filter": "frame.number == 8046", "tcp_stream": 127 }, { "frame_number": 8048, "timestamp_epoch": "1647900730.243842000", "display_filter": "frame.number == 8048", "tcp_stream": 127 }, { "frame_number": 8050, "timestamp_epoch": "1647900730.244387000", "display_filter": "frame.number == 8050", "tcp_stream": 127 }, { "frame_number": 8056, "timestamp_epoch": "1647900730.246986000", "display_filter": "frame.number == 8056", "tcp_stream": 128 }, { "frame_number": 8059, "timestamp_epoch": "1647900730.248658000", "display_filter": "frame.number == 8059", "tcp_stream": 128 }, { "frame_number": 8064, "timestamp_epoch": "1647900730.249607000", "display_filter": "frame.number == 8064", "tcp_stream": 128 }, { "frame_number": 8066, "timestamp_epoch": "1647900730.250180000", "display_filter": "frame.number == 8066", "tcp_stream": 128 }, { "frame_number": 8068, "timestamp_epoch": "1647900730.250278000", "display_filter": "frame.number == 8068", "tcp_stream": 127 }, { "frame_number": 8111, "timestamp_epoch": "1647900774.396959000", "display_filter": "frame.number == 8111", "tcp_stream": 131 }, { "frame_number": 8116, "timestamp_epoch": "1647900774.398700000", "display_filter": "frame.number == 8116", "tcp_stream": 131 }, { "frame_number": 8119, "timestamp_epoch": "1647900774.406542000", "display_filter": "frame.number == 8119", "tcp_stream": 131 }, { "frame_number": 8125, "timestamp_epoch": "1647900774.409200000", "display_filter": "frame.number == 8125", "tcp_stream": 132 }, { "frame_number": 8128, "timestamp_epoch": "1647900774.410956000", "display_filter": "frame.number == 8128", "tcp_stream": 132 }, { "frame_number": 8130, "timestamp_epoch": "1647900774.411273000", "display_filter": "frame.number == 8130", "tcp_stream": 132 }, { "frame_number": 8132, "timestamp_epoch": "1647900774.412115000", "display_filter": "frame.number == 8132", "tcp_stream": 131 }, { "frame_number": 8271, "timestamp_epoch": "1647900774.787829000", "display_filter": "frame.number == 8271", "tcp_stream": 132 }, { "frame_number": 8275, "timestamp_epoch": "1647900774.792853000", "display_filter": "frame.number == 8275", "tcp_stream": 131 }, { "frame_number": 9461, "timestamp_epoch": "1647904330.170760000", "display_filter": "frame.number == 9461", "tcp_stream": 160 }, { "frame_number": 9466, "timestamp_epoch": "1647904330.173540000", "display_filter": "frame.number == 9466", "tcp_stream": 160 }, { "frame_number": 9469, "timestamp_epoch": "1647904330.175091000", "display_filter": "frame.number == 9469", "tcp_stream": 160 }, { "frame_number": 9471, "timestamp_epoch": "1647904330.175929000", "display_filter": "frame.number == 9471", "tcp_stream": 160 }, { "frame_number": 9473, "timestamp_epoch": "1647904330.176753000", "display_filter": "frame.number == 9473", "tcp_stream": 160 }, { "frame_number": 9479, "timestamp_epoch": "1647904330.183723000", "display_filter": "frame.number == 9479", "tcp_stream": 161 }, { "frame_number": 9482, "timestamp_epoch": "1647904330.185261000", "display_filter": "frame.number == 9482", "tcp_stream": 161 }, { "frame_number": 9487, "timestamp_epoch": "1647904330.186488000", "display_filter": "frame.number == 9487", "tcp_stream": 161 }, { "frame_number": 9489, "timestamp_epoch": "1647904330.187120000", "display_filter": "frame.number == 9489", "tcp_stream": 161 }, { "frame_number": 9491, "timestamp_epoch": "1647904330.187616000", "display_filter": "frame.number == 9491", "tcp_stream": 160 }, { "frame_number": 9618, "timestamp_epoch": "1647904588.928065000", "display_filter": "frame.number == 9618", "tcp_stream": 167 }, { "frame_number": 9623, "timestamp_epoch": "1647904588.929938000", "display_filter": "frame.number == 9623", "tcp_stream": 167 }, { "frame_number": 9626, "timestamp_epoch": "1647904588.935196000", "display_filter": "frame.number == 9626", "tcp_stream": 167 }, { "frame_number": 9632, "timestamp_epoch": "1647904588.938139000", "display_filter": "frame.number == 9632", "tcp_stream": 168 }, { "frame_number": 9635, "timestamp_epoch": "1647904588.939972000", "display_filter": "frame.number == 9635", "tcp_stream": 168 }, { "frame_number": 9637, "timestamp_epoch": "1647904588.940374000", "display_filter": "frame.number == 9637", "tcp_stream": 168 }, { "frame_number": 9639, "timestamp_epoch": "1647904588.941217000", "display_filter": "frame.number == 9639", "tcp_stream": 167 }, { "frame_number": 9645, "timestamp_epoch": "1647904589.255267000", "display_filter": "frame.number == 9645", "tcp_stream": 168 }, { "frame_number": 9649, "timestamp_epoch": "1647904589.257630000", "display_filter": "frame.number == 9649", "tcp_stream": 167 }, { "frame_number": 10473, "timestamp_epoch": "1647906955.060541000", "display_filter": "frame.number == 10473", "tcp_stream": 189 }, { "frame_number": 10478, "timestamp_epoch": "1647906955.062253000", "display_filter": "frame.number == 10478", "tcp_stream": 189 }, { "frame_number": 10481, "timestamp_epoch": "1647906955.068834000", "display_filter": "frame.number == 10481", "tcp_stream": 189 }, { "frame_number": 10491, "timestamp_epoch": "1647906955.179897000", "display_filter": "frame.number == 10491", "tcp_stream": 190 }, { "frame_number": 10494, "timestamp_epoch": "1647906955.182116000", "display_filter": "frame.number == 10494", "tcp_stream": 190 }, { "frame_number": 10496, "timestamp_epoch": "1647906955.182881000", "display_filter": "frame.number == 10496", "tcp_stream": 190 }, { "frame_number": 10498, "timestamp_epoch": "1647906955.184570000", "display_filter": "frame.number == 10498", "tcp_stream": 189 }, { "frame_number": 10637, "timestamp_epoch": "1647906955.553261000", "display_filter": "frame.number == 10637", "tcp_stream": 190 }, { "frame_number": 10641, "timestamp_epoch": "1647906955.556880000", "display_filter": "frame.number == 10641", "tcp_stream": 189 }, { "frame_number": 10986, "timestamp_epoch": "1647907930.115333000", "display_filter": "frame.number == 10986", "tcp_stream": 199 }, { "frame_number": 10991, "timestamp_epoch": "1647907930.116627000", "display_filter": "frame.number == 10991", "tcp_stream": 199 }, { "frame_number": 10994, "timestamp_epoch": "1647907930.117789000", "display_filter": "frame.number == 10994", "tcp_stream": 199 }, { "frame_number": 10996, "timestamp_epoch": "1647907930.118054000", "display_filter": "frame.number == 10996", "tcp_stream": 199 }, { "frame_number": 10998, "timestamp_epoch": "1647907930.118326000", "display_filter": "frame.number == 10998", "tcp_stream": 199 }, { "frame_number": 11004, "timestamp_epoch": "1647907930.120660000", "display_filter": "frame.number == 11004", "tcp_stream": 200 }, { "frame_number": 11007, "timestamp_epoch": "1647907930.121650000", "display_filter": "frame.number == 11007", "tcp_stream": 200 } ], "metrics": { "source": "10.0.19.14", "destination": "10.0.19.9", "protocol": "ldap", "event_count": 182, "operation_numbers": [ "0", "2", "3" ] } }, { "finding_id": "finding-897b1f6799ffb5e559c204ca", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 816, "timestamp_epoch": "1647896381.095711000", "display_filter": "frame.number == 816", "tcp_stream": 12 }, { "frame_number": 818, "timestamp_epoch": "1647896381.096261000", "display_filter": "frame.number == 818", "tcp_stream": 12 }, { "frame_number": 820, "timestamp_epoch": "1647896381.096678000", "display_filter": "frame.number == 820", "tcp_stream": 12 }, { "frame_number": 822, "timestamp_epoch": "1647896381.097074000", "display_filter": "frame.number == 822", "tcp_stream": 12 }, { "frame_number": 824, "timestamp_epoch": "1647896381.097515000", "display_filter": "frame.number == 824", "tcp_stream": 12 }, { "frame_number": 826, "timestamp_epoch": "1647896381.097970000", "display_filter": "frame.number == 826", "tcp_stream": 12 }, { "frame_number": 828, "timestamp_epoch": "1647896381.098472000", "display_filter": "frame.number == 828", "tcp_stream": 12 }, { "frame_number": 830, "timestamp_epoch": "1647896381.098861000", "display_filter": "frame.number == 830", "tcp_stream": 12 }, { "frame_number": 832, "timestamp_epoch": "1647896381.099183000", "display_filter": "frame.number == 832", "tcp_stream": 12 }, { "frame_number": 834, "timestamp_epoch": "1647896381.099575000", "display_filter": "frame.number == 834", "tcp_stream": 12 }, { "frame_number": 846, "timestamp_epoch": "1647896381.101875000", "display_filter": "frame.number == 846", "tcp_stream": 12 }, { "frame_number": 848, "timestamp_epoch": "1647896381.102276000", "display_filter": "frame.number == 848", "tcp_stream": 12 }, { "frame_number": 850, "timestamp_epoch": "1647896381.102669000", "display_filter": "frame.number == 850", "tcp_stream": 12 }, { "frame_number": 852, "timestamp_epoch": "1647896381.102982000", "display_filter": "frame.number == 852", "tcp_stream": 12 }, { "frame_number": 854, "timestamp_epoch": "1647896381.103307000", "display_filter": "frame.number == 854", "tcp_stream": 12 }, { "frame_number": 856, "timestamp_epoch": "1647896381.103795000", "display_filter": "frame.number == 856", "tcp_stream": 12 }, { "frame_number": 858, "timestamp_epoch": "1647896381.104259000", "display_filter": "frame.number == 858", "tcp_stream": 12 }, { "frame_number": 860, "timestamp_epoch": "1647896381.104696000", "display_filter": "frame.number == 860", "tcp_stream": 12 }, { "frame_number": 862, "timestamp_epoch": "1647896381.105037000", "display_filter": "frame.number == 862", "tcp_stream": 12 }, { "frame_number": 864, "timestamp_epoch": "1647896381.105372000", "display_filter": "frame.number == 864", "tcp_stream": 12 }, { "frame_number": 866, "timestamp_epoch": "1647896381.105662000", "display_filter": "frame.number == 866", "tcp_stream": 12 }, { "frame_number": 3681, "timestamp_epoch": "1647897816.611458000", "display_filter": "frame.number == 3681", "tcp_stream": 29 }, { "frame_number": 3683, "timestamp_epoch": "1647897816.612142000", "display_filter": "frame.number == 3683", "tcp_stream": 29 }, { "frame_number": 3685, "timestamp_epoch": "1647897816.612669000", "display_filter": "frame.number == 3685", "tcp_stream": 29 }, { "frame_number": 3687, "timestamp_epoch": "1647897816.613135000", "display_filter": "frame.number == 3687", "tcp_stream": 29 }, { "frame_number": 3689, "timestamp_epoch": "1647897816.613810000", "display_filter": "frame.number == 3689", "tcp_stream": 29 }, { "frame_number": 3691, "timestamp_epoch": "1647897816.614434000", "display_filter": "frame.number == 3691", "tcp_stream": 29 }, { "frame_number": 3693, "timestamp_epoch": "1647897816.615140000", "display_filter": "frame.number == 3693", "tcp_stream": 29 }, { "frame_number": 3695, "timestamp_epoch": "1647897816.616146000", "display_filter": "frame.number == 3695", "tcp_stream": 29 }, { "frame_number": 3697, "timestamp_epoch": "1647897816.617090000", "display_filter": "frame.number == 3697", "tcp_stream": 29 }, { "frame_number": 3699, "timestamp_epoch": "1647897816.617874000", "display_filter": "frame.number == 3699", "tcp_stream": 29 }, { "frame_number": 3701, "timestamp_epoch": "1647897816.618400000", "display_filter": "frame.number == 3701", "tcp_stream": 29 }, { "frame_number": 3703, "timestamp_epoch": "1647897816.618923000", "display_filter": "frame.number == 3703", "tcp_stream": 29 }, { "frame_number": 3705, "timestamp_epoch": "1647897816.619345000", "display_filter": "frame.number == 3705", "tcp_stream": 29 }, { "frame_number": 3707, "timestamp_epoch": "1647897816.619815000", "display_filter": "frame.number == 3707", "tcp_stream": 29 }, { "frame_number": 3709, "timestamp_epoch": "1647897816.620282000", "display_filter": "frame.number == 3709", "tcp_stream": 29 }, { "frame_number": 4286, "timestamp_epoch": "1647899008.803809000", "display_filter": "frame.number == 4286", "tcp_stream": 39 }, { "frame_number": 4288, "timestamp_epoch": "1647899008.804203000", "display_filter": "frame.number == 4288", "tcp_stream": 39 }, { "frame_number": 4290, "timestamp_epoch": "1647899008.804548000", "display_filter": "frame.number == 4290", "tcp_stream": 39 }, { "frame_number": 4292, "timestamp_epoch": "1647899008.804874000", "display_filter": "frame.number == 4292", "tcp_stream": 39 }, { "frame_number": 4294, "timestamp_epoch": "1647899008.805311000", "display_filter": "frame.number == 4294", "tcp_stream": 39 }, { "frame_number": 4296, "timestamp_epoch": "1647899008.805736000", "display_filter": "frame.number == 4296", "tcp_stream": 39 }, { "frame_number": 4303, "timestamp_epoch": "1647899008.806272000", "display_filter": "frame.number == 4303", "tcp_stream": 39 }, { "frame_number": 4311, "timestamp_epoch": "1647899008.807109000", "display_filter": "frame.number == 4311", "tcp_stream": 39 }, { "frame_number": 4319, "timestamp_epoch": "1647899008.807815000", "display_filter": "frame.number == 4319", "tcp_stream": 39 }, { "frame_number": 4321, "timestamp_epoch": "1647899008.808319000", "display_filter": "frame.number == 4321", "tcp_stream": 39 }, { "frame_number": 4329, "timestamp_epoch": "1647899008.808946000", "display_filter": "frame.number == 4329", "tcp_stream": 39 }, { "frame_number": 4331, "timestamp_epoch": "1647899008.809305000", "display_filter": "frame.number == 4331", "tcp_stream": 39 }, { "frame_number": 4333, "timestamp_epoch": "1647899008.809642000", "display_filter": "frame.number == 4333", "tcp_stream": 39 }, { "frame_number": 4335, "timestamp_epoch": "1647899008.809986000", "display_filter": "frame.number == 4335", "tcp_stream": 39 }, { "frame_number": 4337, "timestamp_epoch": "1647899008.810323000", "display_filter": "frame.number == 4337", "tcp_stream": 39 } ], "metrics": { "source": "10.0.19.14", "destination": "10.0.19.9", "protocol": "samr", "event_count": 51, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-6d28dc4eeda888f87080f720", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 3451, "timestamp_epoch": "1647897130.330464000", "display_filter": "frame.number == 3451", "tcp_stream": 23 }, { "frame_number": 3453, "timestamp_epoch": "1647897130.331478000", "display_filter": "frame.number == 3453", "tcp_stream": 23 }, { "frame_number": 3455, "timestamp_epoch": "1647897130.331868000", "display_filter": "frame.number == 3455", "tcp_stream": 23 }, { "frame_number": 3459, "timestamp_epoch": "1647897130.333787000", "display_filter": "frame.number == 3459", "tcp_stream": 23 }, { "frame_number": 3461, "timestamp_epoch": "1647897130.334601000", "display_filter": "frame.number == 3461", "tcp_stream": 23 }, { "frame_number": 3463, "timestamp_epoch": "1647897130.334959000", "display_filter": "frame.number == 3463", "tcp_stream": 23 }, { "frame_number": 4207, "timestamp_epoch": "1647899008.790196000", "display_filter": "frame.number == 4207", "tcp_stream": 42 }, { "frame_number": 4209, "timestamp_epoch": "1647899008.791040000", "display_filter": "frame.number == 4209", "tcp_stream": 42 }, { "frame_number": 4211, "timestamp_epoch": "1647899008.791690000", "display_filter": "frame.number == 4211", "tcp_stream": 42 }, { "frame_number": 4213, "timestamp_epoch": "1647899008.792028000", "display_filter": "frame.number == 4213", "tcp_stream": 42 }, { "frame_number": 4844, "timestamp_epoch": "1647899069.648413000", "display_filter": "frame.number == 4844", "tcp_stream": 72 }, { "frame_number": 4846, "timestamp_epoch": "1647899069.649388000", "display_filter": "frame.number == 4846", "tcp_stream": 72 }, { "frame_number": 4848, "timestamp_epoch": "1647899069.649830000", "display_filter": "frame.number == 4848", "tcp_stream": 72 }, { "frame_number": 4852, "timestamp_epoch": "1647899069.651114000", "display_filter": "frame.number == 4852", "tcp_stream": 72 }, { "frame_number": 4854, "timestamp_epoch": "1647899069.651939000", "display_filter": "frame.number == 4854", "tcp_stream": 72 }, { "frame_number": 4856, "timestamp_epoch": "1647899069.652331000", "display_filter": "frame.number == 4856", "tcp_stream": 72 }, { "frame_number": 8022, "timestamp_epoch": "1647900730.232641000", "display_filter": "frame.number == 8022", "tcp_stream": 126 }, { "frame_number": 8024, "timestamp_epoch": "1647900730.233793000", "display_filter": "frame.number == 8024", "tcp_stream": 126 }, { "frame_number": 8026, "timestamp_epoch": "1647900730.234210000", "display_filter": "frame.number == 8026", "tcp_stream": 126 }, { "frame_number": 8030, "timestamp_epoch": "1647900730.236260000", "display_filter": "frame.number == 8030", "tcp_stream": 126 }, { "frame_number": 8032, "timestamp_epoch": "1647900730.237141000", "display_filter": "frame.number == 8032", "tcp_stream": 126 }, { "frame_number": 8034, "timestamp_epoch": "1647900730.237519000", "display_filter": "frame.number == 8034", "tcp_stream": 126 }, { "frame_number": 8099, "timestamp_epoch": "1647900774.085535000", "display_filter": "frame.number == 8099", "tcp_stream": 130 }, { "frame_number": 8101, "timestamp_epoch": "1647900774.086435000", "display_filter": "frame.number == 8101", "tcp_stream": 130 }, { "frame_number": 8103, "timestamp_epoch": "1647900774.086815000", "display_filter": "frame.number == 8103", "tcp_stream": 130 }, { "frame_number": 9439, "timestamp_epoch": "1647904330.058917000", "display_filter": "frame.number == 9439", "tcp_stream": 159 }, { "frame_number": 9441, "timestamp_epoch": "1647904330.060052000", "display_filter": "frame.number == 9441", "tcp_stream": 159 }, { "frame_number": 9443, "timestamp_epoch": "1647904330.060448000", "display_filter": "frame.number == 9443", "tcp_stream": 159 }, { "frame_number": 9447, "timestamp_epoch": "1647904330.061712000", "display_filter": "frame.number == 9447", "tcp_stream": 159 }, { "frame_number": 9449, "timestamp_epoch": "1647904330.062522000", "display_filter": "frame.number == 9449", "tcp_stream": 159 }, { "frame_number": 9451, "timestamp_epoch": "1647904330.062912000", "display_filter": "frame.number == 9451", "tcp_stream": 159 }, { "frame_number": 9591, "timestamp_epoch": "1647904588.487085000", "display_filter": "frame.number == 9591", "tcp_stream": 165 }, { "frame_number": 9593, "timestamp_epoch": "1647904588.487713000", "display_filter": "frame.number == 9593", "tcp_stream": 165 }, { "frame_number": 9595, "timestamp_epoch": "1647904588.488042000", "display_filter": "frame.number == 9595", "tcp_stream": 165 }, { "frame_number": 10461, "timestamp_epoch": "1647906954.857096000", "display_filter": "frame.number == 10461", "tcp_stream": 188 }, { "frame_number": 10463, "timestamp_epoch": "1647906954.858287000", "display_filter": "frame.number == 10463", "tcp_stream": 188 }, { "frame_number": 10465, "timestamp_epoch": "1647906954.858873000", "display_filter": "frame.number == 10465", "tcp_stream": 188 }, { "frame_number": 10970, "timestamp_epoch": "1647907930.110749000", "display_filter": "frame.number == 10970", "tcp_stream": 198 }, { "frame_number": 10972, "timestamp_epoch": "1647907930.111583000", "display_filter": "frame.number == 10972", "tcp_stream": 198 }, { "frame_number": 10974, "timestamp_epoch": "1647907930.112026000", "display_filter": "frame.number == 10974", "tcp_stream": 198 }, { "frame_number": 10978, "timestamp_epoch": "1647907930.113346000", "display_filter": "frame.number == 10978", "tcp_stream": 198 }, { "frame_number": 10980, "timestamp_epoch": "1647907930.113766000", "display_filter": "frame.number == 10980", "tcp_stream": 198 }, { "frame_number": 10982, "timestamp_epoch": "1647907930.114099000", "display_filter": "frame.number == 10982", "tcp_stream": 198 }, { "frame_number": 11479, "timestamp_epoch": "1647908840.696826000", "display_filter": "frame.number == 11479", "tcp_stream": 223 }, { "frame_number": 11482, "timestamp_epoch": "1647908840.697765000", "display_filter": "frame.number == 11482", "tcp_stream": 223 }, { "frame_number": 11485, "timestamp_epoch": "1647908840.698022000", "display_filter": "frame.number == 11485", "tcp_stream": 223 }, { "frame_number": 11498, "timestamp_epoch": "1647908840.701869000", "display_filter": "frame.number == 11498", "tcp_stream": 225 }, { "frame_number": 11500, "timestamp_epoch": "1647908840.702783000", "display_filter": "frame.number == 11500", "tcp_stream": 225 }, { "frame_number": 11502, "timestamp_epoch": "1647908840.703170000", "display_filter": "frame.number == 11502", "tcp_stream": 225 }, { "frame_number": 11506, "timestamp_epoch": "1647908840.704658000", "display_filter": "frame.number == 11506", "tcp_stream": 225 }, { "frame_number": 11508, "timestamp_epoch": "1647908840.705128000", "display_filter": "frame.number == 11508", "tcp_stream": 225 }, { "frame_number": 11510, "timestamp_epoch": "1647908840.705419000", "display_filter": "frame.number == 11510", "tcp_stream": 225 }, { "frame_number": 12221, "timestamp_epoch": "1647910170.412890000", "display_filter": "frame.number == 12221", "tcp_stream": 261 }, { "frame_number": 12223, "timestamp_epoch": "1647910170.413997000", "display_filter": "frame.number == 12223", "tcp_stream": 261 }, { "frame_number": 12225, "timestamp_epoch": "1647910170.414508000", "display_filter": "frame.number == 12225", "tcp_stream": 261 }, { "frame_number": 12979, "timestamp_epoch": "1647911530.003637000", "display_filter": "frame.number == 12979", "tcp_stream": 300 }, { "frame_number": 12981, "timestamp_epoch": "1647911530.004663000", "display_filter": "frame.number == 12981", "tcp_stream": 300 }, { "frame_number": 12983, "timestamp_epoch": "1647911530.005078000", "display_filter": "frame.number == 12983", "tcp_stream": 300 }, { "frame_number": 12987, "timestamp_epoch": "1647911530.006336000", "display_filter": "frame.number == 12987", "tcp_stream": 300 }, { "frame_number": 12989, "timestamp_epoch": "1647911530.007117000", "display_filter": "frame.number == 12989", "tcp_stream": 300 }, { "frame_number": 12991, "timestamp_epoch": "1647911530.007501000", "display_filter": "frame.number == 12991", "tcp_stream": 300 }, { "frame_number": 13570, "timestamp_epoch": "1647913134.468953000", "display_filter": "frame.number == 13570", "tcp_stream": 332 }, { "frame_number": 13572, "timestamp_epoch": "1647913134.469962000", "display_filter": "frame.number == 13572", "tcp_stream": 332 }, { "frame_number": 13574, "timestamp_epoch": "1647913134.470412000", "display_filter": "frame.number == 13574", "tcp_stream": 332 }, { "frame_number": 14099, "timestamp_epoch": "1647914217.148610000", "display_filter": "frame.number == 14099", "tcp_stream": 356 }, { "frame_number": 14101, "timestamp_epoch": "1647914217.149233000", "display_filter": "frame.number == 14101", "tcp_stream": 356 }, { "frame_number": 14103, "timestamp_epoch": "1647914217.149525000", "display_filter": "frame.number == 14103", "tcp_stream": 356 }, { "frame_number": 14566, "timestamp_epoch": "1647915129.857261000", "display_filter": "frame.number == 14566", "tcp_stream": 376 }, { "frame_number": 14568, "timestamp_epoch": "1647915129.858163000", "display_filter": "frame.number == 14568", "tcp_stream": 376 }, { "frame_number": 14570, "timestamp_epoch": "1647915129.858619000", "display_filter": "frame.number == 14570", "tcp_stream": 376 }, { "frame_number": 14574, "timestamp_epoch": "1647915129.859941000", "display_filter": "frame.number == 14574", "tcp_stream": 376 }, { "frame_number": 14576, "timestamp_epoch": "1647915129.860677000", "display_filter": "frame.number == 14576", "tcp_stream": 376 }, { "frame_number": 14578, "timestamp_epoch": "1647915129.861069000", "display_filter": "frame.number == 14578", "tcp_stream": 376 }, { "frame_number": 14877, "timestamp_epoch": "1647915749.943809000", "display_filter": "frame.number == 14877", "tcp_stream": 393 }, { "frame_number": 14879, "timestamp_epoch": "1647915749.944573000", "display_filter": "frame.number == 14879", "tcp_stream": 393 }, { "frame_number": 14881, "timestamp_epoch": "1647915749.944882000", "display_filter": "frame.number == 14881", "tcp_stream": 393 }, { "frame_number": 16089, "timestamp_epoch": "1647918729.788462000", "display_filter": "frame.number == 16089", "tcp_stream": 455 }, { "frame_number": 16091, "timestamp_epoch": "1647918729.789463000", "display_filter": "frame.number == 16091", "tcp_stream": 455 }, { "frame_number": 16093, "timestamp_epoch": "1647918729.789814000", "display_filter": "frame.number == 16093", "tcp_stream": 455 }, { "frame_number": 16097, "timestamp_epoch": "1647918729.791089000", "display_filter": "frame.number == 16097", "tcp_stream": 455 }, { "frame_number": 16099, "timestamp_epoch": "1647918729.791931000", "display_filter": "frame.number == 16099", "tcp_stream": 455 }, { "frame_number": 16101, "timestamp_epoch": "1647918729.792269000", "display_filter": "frame.number == 16101", "tcp_stream": 455 } ], "metrics": { "source": "10.0.19.9", "destination": "10.0.19.14", "protocol": "drsuapi", "event_count": 82, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-9efbfc0f8ac7dc15a8f29bc2", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 3475, "timestamp_epoch": "1647897130.444539000", "display_filter": "frame.number == 3475", "tcp_stream": 24 }, { "frame_number": 3480, "timestamp_epoch": "1647897130.447415000", "display_filter": "frame.number == 3480", "tcp_stream": 24 }, { "frame_number": 3482, "timestamp_epoch": "1647897130.448652000", "display_filter": "frame.number == 3482", "tcp_stream": 24 }, { "frame_number": 3484, "timestamp_epoch": "1647897130.449446000", "display_filter": "frame.number == 3484", "tcp_stream": 24 }, { "frame_number": 3486, "timestamp_epoch": "1647897130.449967000", "display_filter": "frame.number == 3486", "tcp_stream": 24 }, { "frame_number": 3493, "timestamp_epoch": "1647897130.457079000", "display_filter": "frame.number == 3493", "tcp_stream": 25 }, { "frame_number": 3497, "timestamp_epoch": "1647897130.458656000", "display_filter": "frame.number == 3497", "tcp_stream": 25 }, { "frame_number": 3500, "timestamp_epoch": "1647897130.459447000", "display_filter": "frame.number == 3500", "tcp_stream": 25 }, { "frame_number": 3806, "timestamp_epoch": "1647898110.965251000", "display_filter": "frame.number == 3806", "tcp_stream": 30 }, { "frame_number": 3811, "timestamp_epoch": "1647898110.966963000", "display_filter": "frame.number == 3811", "tcp_stream": 30 }, { "frame_number": 4380, "timestamp_epoch": "1647899009.108807000", "display_filter": "frame.number == 4380", "tcp_stream": 55 }, { "frame_number": 4385, "timestamp_epoch": "1647899009.111125000", "display_filter": "frame.number == 4385", "tcp_stream": 55 }, { "frame_number": 4387, "timestamp_epoch": "1647899009.117212000", "display_filter": "frame.number == 4387", "tcp_stream": 55 }, { "frame_number": 4394, "timestamp_epoch": "1647899009.120599000", "display_filter": "frame.number == 4394", "tcp_stream": 56 }, { "frame_number": 4396, "timestamp_epoch": "1647899009.121107000", "display_filter": "frame.number == 4396", "tcp_stream": 56 }, { "frame_number": 4398, "timestamp_epoch": "1647899009.121530000", "display_filter": "frame.number == 4398", "tcp_stream": 56 }, { "frame_number": 4400, "timestamp_epoch": "1647899009.123168000", "display_filter": "frame.number == 4400", "tcp_stream": 55 }, { "frame_number": 4862, "timestamp_epoch": "1647899069.654272000", "display_filter": "frame.number == 4862", "tcp_stream": 73 }, { "frame_number": 4867, "timestamp_epoch": "1647899069.656347000", "display_filter": "frame.number == 4867", "tcp_stream": 73 }, { "frame_number": 4869, "timestamp_epoch": "1647899069.657116000", "display_filter": "frame.number == 4869", "tcp_stream": 73 }, { "frame_number": 4871, "timestamp_epoch": "1647899069.657633000", "display_filter": "frame.number == 4871", "tcp_stream": 73 }, { "frame_number": 4873, "timestamp_epoch": "1647899069.658294000", "display_filter": "frame.number == 4873", "tcp_stream": 73 }, { "frame_number": 4880, "timestamp_epoch": "1647899069.661690000", "display_filter": "frame.number == 4880", "tcp_stream": 74 }, { "frame_number": 4884, "timestamp_epoch": "1647899069.662733000", "display_filter": "frame.number == 4884", "tcp_stream": 74 }, { "frame_number": 4887, "timestamp_epoch": "1647899069.663368000", "display_filter": "frame.number == 4887", "tcp_stream": 74 }, { "frame_number": 6996, "timestamp_epoch": "1647900354.450032000", "display_filter": "frame.number == 6996", "tcp_stream": 104 }, { "frame_number": 7013, "timestamp_epoch": "1647900354.455609000", "display_filter": "frame.number == 7013", "tcp_stream": 104 }, { "frame_number": 7017, "timestamp_epoch": "1647900354.459404000", "display_filter": "frame.number == 7017", "tcp_stream": 104 }, { "frame_number": 7029, "timestamp_epoch": "1647900354.462709000", "display_filter": "frame.number == 7029", "tcp_stream": 106 }, { "frame_number": 7031, "timestamp_epoch": "1647900354.463138000", "display_filter": "frame.number == 7031", "tcp_stream": 106 }, { "frame_number": 7033, "timestamp_epoch": "1647900354.464508000", "display_filter": "frame.number == 7033", "tcp_stream": 106 }, { "frame_number": 7040, "timestamp_epoch": "1647900354.466354000", "display_filter": "frame.number == 7040", "tcp_stream": 106 }, { "frame_number": 7043, "timestamp_epoch": "1647900354.466963000", "display_filter": "frame.number == 7043", "tcp_stream": 106 }, { "frame_number": 7045, "timestamp_epoch": "1647900354.467490000", "display_filter": "frame.number == 7045", "tcp_stream": 106 }, { "frame_number": 7047, "timestamp_epoch": "1647900354.467881000", "display_filter": "frame.number == 7047", "tcp_stream": 106 }, { "frame_number": 7362, "timestamp_epoch": "1647900354.506596000", "display_filter": "frame.number == 7362", "tcp_stream": 106 }, { "frame_number": 7365, "timestamp_epoch": "1647900354.548251000", "display_filter": "frame.number == 7365", "tcp_stream": 106 }, { "frame_number": 7372, "timestamp_epoch": "1647900354.553730000", "display_filter": "frame.number == 7372", "tcp_stream": 106 }, { "frame_number": 8040, "timestamp_epoch": "1647900730.240537000", "display_filter": "frame.number == 8040", "tcp_stream": 127 }, { "frame_number": 8045, "timestamp_epoch": "1647900730.242950000", "display_filter": "frame.number == 8045", "tcp_stream": 127 }, { "frame_number": 8047, "timestamp_epoch": "1647900730.243600000", "display_filter": "frame.number == 8047", "tcp_stream": 127 }, { "frame_number": 8049, "timestamp_epoch": "1647900730.244212000", "display_filter": "frame.number == 8049", "tcp_stream": 127 }, { "frame_number": 8051, "timestamp_epoch": "1647900730.244712000", "display_filter": "frame.number == 8051", "tcp_stream": 127 }, { "frame_number": 8058, "timestamp_epoch": "1647900730.248438000", "display_filter": "frame.number == 8058", "tcp_stream": 128 }, { "frame_number": 8062, "timestamp_epoch": "1647900730.249442000", "display_filter": "frame.number == 8062", "tcp_stream": 128 }, { "frame_number": 8065, "timestamp_epoch": "1647900730.250043000", "display_filter": "frame.number == 8065", "tcp_stream": 128 }, { "frame_number": 8113, "timestamp_epoch": "1647900774.397637000", "display_filter": "frame.number == 8113", "tcp_stream": 131 }, { "frame_number": 8118, "timestamp_epoch": "1647900774.400149000", "display_filter": "frame.number == 8118", "tcp_stream": 131 }, { "frame_number": 8120, "timestamp_epoch": "1647900774.407213000", "display_filter": "frame.number == 8120", "tcp_stream": 131 }, { "frame_number": 8127, "timestamp_epoch": "1647900774.410661000", "display_filter": "frame.number == 8127", "tcp_stream": 132 }, { "frame_number": 8129, "timestamp_epoch": "1647900774.411124000", "display_filter": "frame.number == 8129", "tcp_stream": 132 }, { "frame_number": 8131, "timestamp_epoch": "1647900774.411575000", "display_filter": "frame.number == 8131", "tcp_stream": 132 }, { "frame_number": 8133, "timestamp_epoch": "1647900774.413002000", "display_filter": "frame.number == 8133", "tcp_stream": 131 }, { "frame_number": 9463, "timestamp_epoch": "1647904330.171499000", "display_filter": "frame.number == 9463", "tcp_stream": 160 }, { "frame_number": 9468, "timestamp_epoch": "1647904330.174261000", "display_filter": "frame.number == 9468", "tcp_stream": 160 }, { "frame_number": 9470, "timestamp_epoch": "1647904330.175513000", "display_filter": "frame.number == 9470", "tcp_stream": 160 }, { "frame_number": 9472, "timestamp_epoch": "1647904330.176339000", "display_filter": "frame.number == 9472", "tcp_stream": 160 }, { "frame_number": 9474, "timestamp_epoch": "1647904330.177144000", "display_filter": "frame.number == 9474", "tcp_stream": 160 }, { "frame_number": 9481, "timestamp_epoch": "1647904330.184486000", "display_filter": "frame.number == 9481", "tcp_stream": 161 }, { "frame_number": 9485, "timestamp_epoch": "1647904330.186013000", "display_filter": "frame.number == 9485", "tcp_stream": 161 }, { "frame_number": 9488, "timestamp_epoch": "1647904330.186717000", "display_filter": "frame.number == 9488", "tcp_stream": 161 }, { "frame_number": 9620, "timestamp_epoch": "1647904588.928829000", "display_filter": "frame.number == 9620", "tcp_stream": 167 }, { "frame_number": 9625, "timestamp_epoch": "1647904588.931407000", "display_filter": "frame.number == 9625", "tcp_stream": 167 }, { "frame_number": 9627, "timestamp_epoch": "1647904588.935824000", "display_filter": "frame.number == 9627", "tcp_stream": 167 }, { "frame_number": 9634, "timestamp_epoch": "1647904588.939622000", "display_filter": "frame.number == 9634", "tcp_stream": 168 }, { "frame_number": 9636, "timestamp_epoch": "1647904588.940139000", "display_filter": "frame.number == 9636", "tcp_stream": 168 }, { "frame_number": 9638, "timestamp_epoch": "1647904588.940679000", "display_filter": "frame.number == 9638", "tcp_stream": 168 }, { "frame_number": 9640, "timestamp_epoch": "1647904588.941779000", "display_filter": "frame.number == 9640", "tcp_stream": 167 }, { "frame_number": 10475, "timestamp_epoch": "1647906955.061243000", "display_filter": "frame.number == 10475", "tcp_stream": 189 }, { "frame_number": 10480, "timestamp_epoch": "1647906955.063721000", "display_filter": "frame.number == 10480", "tcp_stream": 189 }, { "frame_number": 10482, "timestamp_epoch": "1647906955.069495000", "display_filter": "frame.number == 10482", "tcp_stream": 189 }, { "frame_number": 10493, "timestamp_epoch": "1647906955.181313000", "display_filter": "frame.number == 10493", "tcp_stream": 190 }, { "frame_number": 10495, "timestamp_epoch": "1647906955.182467000", "display_filter": "frame.number == 10495", "tcp_stream": 190 }, { "frame_number": 10497, "timestamp_epoch": "1647906955.183225000", "display_filter": "frame.number == 10497", "tcp_stream": 190 }, { "frame_number": 10499, "timestamp_epoch": "1647906955.185548000", "display_filter": "frame.number == 10499", "tcp_stream": 189 }, { "frame_number": 10988, "timestamp_epoch": "1647907930.115919000", "display_filter": "frame.number == 10988", "tcp_stream": 199 }, { "frame_number": 10993, "timestamp_epoch": "1647907930.117506000", "display_filter": "frame.number == 10993", "tcp_stream": 199 }, { "frame_number": 10995, "timestamp_epoch": "1647907930.117911000", "display_filter": "frame.number == 10995", "tcp_stream": 199 }, { "frame_number": 10997, "timestamp_epoch": "1647907930.118191000", "display_filter": "frame.number == 10997", "tcp_stream": 199 }, { "frame_number": 10999, "timestamp_epoch": "1647907930.118489000", "display_filter": "frame.number == 10999", "tcp_stream": 199 }, { "frame_number": 11006, "timestamp_epoch": "1647907930.121390000", "display_filter": "frame.number == 11006", "tcp_stream": 200 }, { "frame_number": 11010, "timestamp_epoch": "1647907930.122292000", "display_filter": "frame.number == 11010", "tcp_stream": 200 }, { "frame_number": 11013, "timestamp_epoch": "1647907930.122703000", "display_filter": "frame.number == 11013", "tcp_stream": 200 }, { "frame_number": 11539, "timestamp_epoch": "1647908840.811717000", "display_filter": "frame.number == 11539", "tcp_stream": 226 }, { "frame_number": 11544, "timestamp_epoch": "1647908840.813200000", "display_filter": "frame.number == 11544", "tcp_stream": 226 }, { "frame_number": 11546, "timestamp_epoch": "1647908840.813822000", "display_filter": "frame.number == 11546", "tcp_stream": 226 }, { "frame_number": 11548, "timestamp_epoch": "1647908840.814228000", "display_filter": "frame.number == 11548", "tcp_stream": 226 }, { "frame_number": 11550, "timestamp_epoch": "1647908840.814573000", "display_filter": "frame.number == 11550", "tcp_stream": 226 }, { "frame_number": 11557, "timestamp_epoch": "1647908840.818465000", "display_filter": "frame.number == 11557", "tcp_stream": 227 }, { "frame_number": 11561, "timestamp_epoch": "1647908840.819302000", "display_filter": "frame.number == 11561", "tcp_stream": 227 }, { "frame_number": 11564, "timestamp_epoch": "1647908840.819798000", "display_filter": "frame.number == 11564", "tcp_stream": 227 }, { "frame_number": 12235, "timestamp_epoch": "1647910170.634213000", "display_filter": "frame.number == 12235", "tcp_stream": 262 }, { "frame_number": 12240, "timestamp_epoch": "1647910170.636624000", "display_filter": "frame.number == 12240", "tcp_stream": 262 }, { "frame_number": 12242, "timestamp_epoch": "1647910170.651132000", "display_filter": "frame.number == 12242", "tcp_stream": 262 }, { "frame_number": 12249, "timestamp_epoch": "1647910170.657336000", "display_filter": "frame.number == 12249", "tcp_stream": 263 }, { "frame_number": 12251, "timestamp_epoch": "1647910170.658123000", "display_filter": "frame.number == 12251", "tcp_stream": 263 }, { "frame_number": 12253, "timestamp_epoch": "1647910170.658740000", "display_filter": "frame.number == 12253", "tcp_stream": 263 }, { "frame_number": 12255, "timestamp_epoch": "1647910170.660209000", "display_filter": "frame.number == 12255", "tcp_stream": 262 }, { "frame_number": 12597, "timestamp_epoch": "1647911020.564721000", "display_filter": "frame.number == 12597", "tcp_stream": 280 }, { "frame_number": 12602, "timestamp_epoch": "1647911020.566898000", "display_filter": "frame.number == 12602", "tcp_stream": 280 } ], "metrics": { "source": "10.0.19.9", "destination": "10.0.19.14", "protocol": "ldap", "event_count": 146, "operation_numbers": [ "1", "4,19,19,19,5", "4,4,4,5", "4,5", "5" ] } }, { "finding_id": "finding-2b995c5daa308c57c19adc02", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 817, "timestamp_epoch": "1647896381.096044000", "display_filter": "frame.number == 817", "tcp_stream": 12 }, { "frame_number": 819, "timestamp_epoch": "1647896381.096521000", "display_filter": "frame.number == 819", "tcp_stream": 12 }, { "frame_number": 821, "timestamp_epoch": "1647896381.096926000", "display_filter": "frame.number == 821", "tcp_stream": 12 }, { "frame_number": 823, "timestamp_epoch": "1647896381.097325000", "display_filter": "frame.number == 823", "tcp_stream": 12 }, { "frame_number": 825, "timestamp_epoch": "1647896381.097809000", "display_filter": "frame.number == 825", "tcp_stream": 12 }, { "frame_number": 827, "timestamp_epoch": "1647896381.098306000", "display_filter": "frame.number == 827", "tcp_stream": 12 }, { "frame_number": 829, "timestamp_epoch": "1647896381.098696000", "display_filter": "frame.number == 829", "tcp_stream": 12 }, { "frame_number": 831, "timestamp_epoch": "1647896381.099041000", "display_filter": "frame.number == 831", "tcp_stream": 12 }, { "frame_number": 833, "timestamp_epoch": "1647896381.099367000", "display_filter": "frame.number == 833", "tcp_stream": 12 }, { "frame_number": 835, "timestamp_epoch": "1647896381.099713000", "display_filter": "frame.number == 835", "tcp_stream": 12 }, { "frame_number": 847, "timestamp_epoch": "1647896381.102111000", "display_filter": "frame.number == 847", "tcp_stream": 12 }, { "frame_number": 849, "timestamp_epoch": "1647896381.102499000", "display_filter": "frame.number == 849", "tcp_stream": 12 }, { "frame_number": 851, "timestamp_epoch": "1647896381.102814000", "display_filter": "frame.number == 851", "tcp_stream": 12 }, { "frame_number": 853, "timestamp_epoch": "1647896381.103174000", "display_filter": "frame.number == 853", "tcp_stream": 12 }, { "frame_number": 855, "timestamp_epoch": "1647896381.103576000", "display_filter": "frame.number == 855", "tcp_stream": 12 }, { "frame_number": 857, "timestamp_epoch": "1647896381.104034000", "display_filter": "frame.number == 857", "tcp_stream": 12 }, { "frame_number": 859, "timestamp_epoch": "1647896381.104481000", "display_filter": "frame.number == 859", "tcp_stream": 12 }, { "frame_number": 861, "timestamp_epoch": "1647896381.104879000", "display_filter": "frame.number == 861", "tcp_stream": 12 }, { "frame_number": 863, "timestamp_epoch": "1647896381.105216000", "display_filter": "frame.number == 863", "tcp_stream": 12 }, { "frame_number": 865, "timestamp_epoch": "1647896381.105502000", "display_filter": "frame.number == 865", "tcp_stream": 12 }, { "frame_number": 867, "timestamp_epoch": "1647896381.105800000", "display_filter": "frame.number == 867", "tcp_stream": 12 }, { "frame_number": 3682, "timestamp_epoch": "1647897816.612077000", "display_filter": "frame.number == 3682", "tcp_stream": 29 }, { "frame_number": 3684, "timestamp_epoch": "1647897816.612601000", "display_filter": "frame.number == 3684", "tcp_stream": 29 }, { "frame_number": 3686, "timestamp_epoch": "1647897816.613032000", "display_filter": "frame.number == 3686", "tcp_stream": 29 }, { "frame_number": 3688, "timestamp_epoch": "1647897816.613753000", "display_filter": "frame.number == 3688", "tcp_stream": 29 }, { "frame_number": 3690, "timestamp_epoch": "1647897816.614360000", "display_filter": "frame.number == 3690", "tcp_stream": 29 }, { "frame_number": 3692, "timestamp_epoch": "1647897816.615084000", "display_filter": "frame.number == 3692", "tcp_stream": 29 }, { "frame_number": 3694, "timestamp_epoch": "1647897816.616039000", "display_filter": "frame.number == 3694", "tcp_stream": 29 }, { "frame_number": 3696, "timestamp_epoch": "1647897816.616993000", "display_filter": "frame.number == 3696", "tcp_stream": 29 }, { "frame_number": 3698, "timestamp_epoch": "1647897816.617777000", "display_filter": "frame.number == 3698", "tcp_stream": 29 }, { "frame_number": 3700, "timestamp_epoch": "1647897816.618281000", "display_filter": "frame.number == 3700", "tcp_stream": 29 }, { "frame_number": 3702, "timestamp_epoch": "1647897816.618775000", "display_filter": "frame.number == 3702", "tcp_stream": 29 }, { "frame_number": 3704, "timestamp_epoch": "1647897816.619241000", "display_filter": "frame.number == 3704", "tcp_stream": 29 }, { "frame_number": 3706, "timestamp_epoch": "1647897816.619754000", "display_filter": "frame.number == 3706", "tcp_stream": 29 }, { "frame_number": 3708, "timestamp_epoch": "1647897816.620196000", "display_filter": "frame.number == 3708", "tcp_stream": 29 }, { "frame_number": 3710, "timestamp_epoch": "1647897816.620689000", "display_filter": "frame.number == 3710", "tcp_stream": 29 }, { "frame_number": 4287, "timestamp_epoch": "1647899008.804112000", "display_filter": "frame.number == 4287", "tcp_stream": 39 }, { "frame_number": 4289, "timestamp_epoch": "1647899008.804461000", "display_filter": "frame.number == 4289", "tcp_stream": 39 }, { "frame_number": 4291, "timestamp_epoch": "1647899008.804796000", "display_filter": "frame.number == 4291", "tcp_stream": 39 }, { "frame_number": 4293, "timestamp_epoch": "1647899008.805122000", "display_filter": "frame.number == 4293", "tcp_stream": 39 }, { "frame_number": 4295, "timestamp_epoch": "1647899008.805561000", "display_filter": "frame.number == 4295", "tcp_stream": 39 }, { "frame_number": 4301, "timestamp_epoch": "1647899008.806089000", "display_filter": "frame.number == 4301", "tcp_stream": 39 }, { "frame_number": 4307, "timestamp_epoch": "1647899008.806952000", "display_filter": "frame.number == 4307", "tcp_stream": 39 }, { "frame_number": 4317, "timestamp_epoch": "1647899008.807692000", "display_filter": "frame.number == 4317", "tcp_stream": 39 }, { "frame_number": 4320, "timestamp_epoch": "1647899008.808242000", "display_filter": "frame.number == 4320", "tcp_stream": 39 }, { "frame_number": 4324, "timestamp_epoch": "1647899008.808757000", "display_filter": "frame.number == 4324", "tcp_stream": 39 }, { "frame_number": 4330, "timestamp_epoch": "1647899008.809201000", "display_filter": "frame.number == 4330", "tcp_stream": 39 }, { "frame_number": 4332, "timestamp_epoch": "1647899008.809495000", "display_filter": "frame.number == 4332", "tcp_stream": 39 }, { "frame_number": 4334, "timestamp_epoch": "1647899008.809881000", "display_filter": "frame.number == 4334", "tcp_stream": 39 }, { "frame_number": 4336, "timestamp_epoch": "1647899008.810217000", "display_filter": "frame.number == 4336", "tcp_stream": 39 }, { "frame_number": 4338, "timestamp_epoch": "1647899008.810629000", "display_filter": "frame.number == 4338", "tcp_stream": 39 } ], "metrics": { "source": "10.0.19.9", "destination": "10.0.19.14", "protocol": "samr", "event_count": 51, "operation_numbers": [ "1", "16", "17", "18", "19", "20", "25", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 640, "truncated": false }, "http_request": { "returned": 38, "truncated": false }, "http_response": { "returned": 18, "truncated": false }, "tls_client_hello": { "returned": 313, "truncated": false }, "dhcp": { "returned": 4, "truncated": false }, "identity": { "returned": 1446, "truncated": false }, "directory_service": { "returned": 594, "truncated": false }, "unclassified_tcp": { "returned": 271, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 2, "hashed_objects": 2, "unique_hashes": 2, "returned_unique_hashes": 2, "detailed_objects": 2, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 394583, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 16296 packets across 63 IP endpoints and 837 transport flows. Observed 640 DNS events, 38 HTTP requests, 313 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 0 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:09:11.063080+00:00", "session_id": "2571013a-e926-41d7-b13c-b180a0720a96", "source_semantic_sha256": "f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 137, "observables_checked": 137, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 137, "prior_cases_checked": 10, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [], "cross_case_correlations": [ { "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1", "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "arc.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "msedge.api.cdp.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.42.16" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.194.132" } ], "shared_count": 18, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "ipv4", "value": "52.168.117.170" } ], "shared_count": 17, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "arc.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "x1.c.lencr.org" }, { "type": "ipv4", "value": "13.89.179.9" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "52.113.194.132" } ], "shared_count": 18, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "checkappexec.microsoft.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "wpad.mshome.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.194.132" } ], "shared_count": 19, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" } ], "shared_count": 4, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" } ], "shared_count": 14, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "wpad.mshome.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.89.179.9" }, { "type": "ipv4", "value": "20.189.173.2" }, { "type": "ipv4", "value": "20.72.205.209" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "51.105.71.137" }, { "type": "ipv4", "value": "52.183.220.149" }, { "type": "ipv4", "value": "52.185.211.133" } ], "shared_count": 22, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wpad.mshome.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" } ], "shared_count": 16, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "teams-ring.msedge.net" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.42.16" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.196.254" } ], "shared_count": 19, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "checkappexec.microsoft.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "13.107.42.16" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.113.194.132" } ], "shared_count": 19, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "6a2316caee77621222da55a0117f143ac0b4ad630ec057912dd940e824fe529d" }, "techniques": [], "apt_matches": [] }