{ "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142", "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1", "status": "completed", "filename": "2024-07-30-traffic-analysis-exercise.pcap", "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "source_size_bytes": 11526388, "schema_version": "pcap-analysis-v1", "semantic_sha256": "58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 11562 packets across 45 IP endpoints and 199 transport flows. Observed 174 DNS events, 10 HTTP requests, 77 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 1 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-07-30-traffic-analysis-exercise.pcap\nCapture SHA-256: `c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68`\nSemantic result SHA-256: `58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 11562 packets across 45 IP endpoints and 199 transport flows. Observed 174 DNS events, 10 HTTP requests, 77 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 1 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 11562\n- Duration: 585.662377 seconds\n- Captured bytes: 11341372\n- Endpoints: 45\n- Flows: 199\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 194 / TCP stream 11, frame 196 / TCP stream 11, frame 198 / TCP stream 11, frame 200 / TCP stream 11, frame 663 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":33,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 44 / TCP stream 0, frame 45 / TCP stream 0, frame 49 / TCP stream 1, frame 50 / TCP stream 1, frame 136 / TCP stream 1.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":87,\"operation_numbers\":[\"\",\"1\",\"4\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1056 / TCP stream 21, frame 1058 / TCP stream 21, frame 1060 / TCP stream 21, frame 1062 / TCP stream 21, frame 1064 / TCP stream 21.\n\nMetrics: `{\"destination\":\"172.16.1.66\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.1.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 193 / TCP stream 11, frame 195 / TCP stream 11, frame 197 / TCP stream 11, frame 199 / TCP stream 11, frame 662 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":33,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.1.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 42 / TCP stream 0, frame 46 / TCP stream 1, frame 128 / TCP stream 5, frame 130 / TCP stream 1, frame 133 / TCP stream 0.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":99,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.1.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1055 / TCP stream 21, frame 1057 / TCP stream 21, frame 1059 / TCP stream 21, frame 1061 / TCP stream 21, frame 1063 / TCP stream 21.\n\nMetrics: `{\"destination\":\"172.16.1.4\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.1.66\"}`\n\n### HIGH — Client announces a software label and host identity\n\nAn otherwise unclassified TCP payload contains a structured ping, software label, client identifier, hostname and account. These are literal self-reported values, not authenticated identity or independent malware-family attribution.\n\nRule: `cleartext-tool-self-identification@pcap-rules-v3`; confidence: 0.98; evidence: frame 9119 / TCP stream 83, frame 9352 / TCP stream 83, frame 9530 / TCP stream 83, frame 9537 / TCP stream 83, frame 9563 / TCP stream 83.\n\nMetrics: `{\"claimed_account\":\"ccollier\",\"claimed_hostname\":\"DESKTOP-SKBR25F\",\"client_id\":\"1BE8292C\",\"destination\":\"141.98.10.79\",\"destination_port\":12132,\"message_count\":102,\"software_label\":\"STRRAT\",\"source\":\"172.16.1.66\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 9066 / TCP stream 83.\n\nMetrics: `{\"destination\":\"141.98.10.79\",\"destination_port\":12132,\"duration_seconds\":508.67,\"packets\":411,\"source\":\"172.16.1.66\",\"wire_bytes\":39064}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `ccollier`; client IPs: 172.16.1.66; frames: 913, 921, 923, 935, 956\n- account: `desktop-skbr25f$`; client IPs: 172.16.1.66; frames: 58, 59, 71, 73, 84\n- domain: `WIRESHARKWORKSH`; client IPs: 172.16.1.66; frames: 275\n- full-name: `Clark Collier`; client IPs: 172.16.1.66; frames: 1070\n- hostname: `DESKTOP-SKBR25F`; client IPs: 172.16.1.66; frames: 29, 30, 275, 499, 500\n- netbios-group: `WIRESHARKWORKSH`; client IPs: unbound subject; frames: 31, 501, 615, 616, 624\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `api-msn-com.a-0003.a-msedge.net`; roles: dns-cname\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `autodiscover-s.outlook.com`; roles: dns-query, tls-sni\n- domain: `autodiscover.wiresharkworkshop.online`; roles: dns-query\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `desktop-skbr25f.wiresharkworkshop.online`; roles: dns-query\n- domain: `dualstack.sonatype.map.fastly.net`; roles: dns-cname\n- domain: `ecn.dev.virtualearth.net`; roles: dns-query, tls-sni\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `github.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `ip-api.com`; roles: dns-query, http-host\n- domain: `javadl-esd-secure.oracle.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `metadata.templates.cdn.office.net`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `msedge.api.cdp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `objects.githubusercontent.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `repo1.maven.org`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wireshark-ws-dc.wiresharkworkshop.online`; roles: dns-query\n- domain: `wiresharkworkshop.online`; roles: dns-query\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.wiresharkworkshop.online`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `13.107.42.16`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.79`; roles: dns-answer, network-endpoint\n- ipv4: `140.82.113.3`; roles: dns-answer, network-endpoint\n- ipv4: `141.98.10.79`; roles: network-endpoint\n- ipv4: `172.16.1.255`; roles: network-endpoint\n- ipv4: `172.16.1.4`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.1.66`; roles: dns-answer, network-endpoint\n- ipv4: `185.199.108.133`; roles: dns-answer\n- ipv4: `185.199.109.133`; roles: dns-answer\n- ipv4: `185.199.110.133`; roles: dns-answer, network-endpoint\n- ipv4: `185.199.111.133`; roles: dns-answer\n- ipv4: `199.232.192.209`; roles: dns-answer\n- ipv4: `199.232.196.209`; roles: dns-answer, network-endpoint\n- ipv4: `20.166.2.191`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.10`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.16`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.26`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.11`; roles: dns-answer\n- ipv4: `20.190.157.9`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.1.246`; roles: network-endpoint\n- ipv4: `20.7.2.167`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `208.95.112.1`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.164.136`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.167`; roles: dns-answer\n- ipv4: `23.198.7.168`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.169`; roles: dns-answer\n- ipv4: `23.198.7.170`; roles: dns-answer\n- ipv4: `23.198.7.172`; roles: dns-answer\n- ipv4: `23.198.7.173`; roles: dns-answer\n- ipv4: `23.198.7.174`; roles: dns-answer\n- ipv4: `23.198.7.175`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.176`; roles: dns-answer\n- ipv4: `23.198.7.177`; roles: dns-answer, network-endpoint\n- ipv4: `23.198.7.182`; roles: dns-answer\n- ipv4: `23.198.7.183`; roles: dns-answer\n- ipv4: `23.198.7.186`; roles: dns-answer\n- ipv4: `23.215.55.133`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.137`; roles: dns-answer\n- ipv4: `23.215.55.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.144`; roles: dns-answer\n- ipv4: `23.221.22.68`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.87`; roles: dns-answer\n- ipv4: `23.46.192.165`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.199`; roles: dns-answer\n- ipv4: `23.48.203.200`; roles: dns-answer\n- ipv4: `23.48.203.201`; roles: dns-answer\n- ipv4: `23.48.203.203`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.204`; roles: dns-answer\n- ipv4: `23.48.203.205`; roles: dns-answer\n- ipv4: `23.48.203.206`; roles: dns-answer\n- ipv4: `23.48.203.207`; roles: dns-answer\n- ipv4: `23.48.203.208`; roles: dns-answer, network-endpoint\n- ipv4: `23.48.203.210`; roles: dns-answer\n- ipv4: `23.52.9.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.52.9.222`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.11.164`; roles: dns-answer\n- ipv4: `23.53.11.165`; roles: dns-answer\n- ipv4: `23.53.11.166`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.11.174`; roles: dns-answer\n- ipv4: `23.53.11.175`; roles: dns-answer\n- ipv4: `23.53.11.176`; roles: dns-answer\n- ipv4: `23.53.11.177`; roles: dns-answer\n- ipv4: `23.53.11.178`; roles: dns-answer\n- ipv4: `23.53.11.179`; roles: dns-answer\n- ipv4: `23.96.180.189`; roles: dns-answer\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer\n- ipv4: `40.126.29.14`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.5`; roles: dns-answer\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.97.199.114`; roles: dns-answer, network-endpoint\n- ipv4: `40.99.169.130`; roles: dns-answer\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.91`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.47`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.6.53`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.191.219.104`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.121.130`; roles: dns-answer\n- ipv4: `52.96.57.2`; roles: dns-answer\n- ja3: `026e5ca865ce1f09da3a81d8a4e3effb`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `1541459f873df5079e5cf7ff2c951ca0`; roles: tls-client-fingerprint\n- ja3: `17e7f892bd0cb5409482f240c9ca2934`; roles: tls-client-fingerprint\n- ja3: `1968767952a7e119234b43165830caaf`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `292a36e182b3281950ca910a639428ec`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `46f5131e766d248db0248a86c494b71c`; roles: tls-client-fingerprint\n- ja3: `54e118fb6c893793f9955efcc86a6132`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `6764675c1ca709250abb58a1ed36b1a9`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `6d162fd4fcafeafc279a32732bb583ab`; roles: tls-client-fingerprint\n- ja3: `7dcea60ae4f829abcfa00bd64ab6f937`; roles: tls-client-fingerprint\n- ja3: `930a922a3aeaa3a5590435675e8a4bb9`; roles: tls-client-fingerprint\n- sha256: `47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://ip-api.com/json/`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36`; roles: http-client\n- exported object `json`; SHA-256 `47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb`; size 294 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `32e9d5fcf77c5a465a8b3ffc21d77a172a52a6eb0c40ad986ced99d0994dd0d3`; recorded 2026-09-19T12:09:03.146463+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":157,\"observable_limit\":5000,\"observables_checked\":157,\"observables_total\":157,\"prior_case_limit_reached\":false,\"prior_cases_checked\":9,\"truncated\":false}`\n\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 45 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 27 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 48 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"exported_objects\":2,\"hashed_bytes\":316,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 6/6, observables 157/157, artifacts 2/2. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 11562, "captured_bytes": 11341372, "first_packet_epoch": "1722307128.960835", "last_packet_epoch": "1722307714.623212", "duration_seconds": 585.662377, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68", "source_size_bytes": 11526388, "protocol_counts": { "eth": 11562, "ethertype": 11562, "ip": 11534, "tcp": 11276, "tls": 1423, "x509ce": 491, "x509sat": 476, "nbss": 365, "spnego-krb5": 328, "smb2": 273, "data": 250, "udp": 246, "dcerpc": 188, "ldap": 186, "dns": 174, "gss-api": 172, "spnego": 116, "smb": 96, "kerberos": 56, "pkix1implicit": 51, "arp": 31, "ntlmssp": 30, "ocsp": 28, "cldap": 24, "nbns": 21, "pkix1explicit": 21, "igmp": 18, "browser": 14, "nbdgm": 14, "ssdp": 8, "pkcs-1": 6, "http": 4, "icmp": 3, "mdns": 2, "ntp": 2, "data-text-lines": 1, "json": 1, "llmnr": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-9f581cee2ae40dc2c1e369f1", "ip": "13.107.42.16", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 19, "packets_received": 13, "bytes_sent": 8269, "bytes_received": 3584, "first_seen_epoch": "1722307242.95745", "last_seen_epoch": "1722307243.546702", "evidence_frames": [ 9809, 9810, 9811, 9812, 9813 ] }, { "endpoint_id": "endpoint-cb83b5f8de1dcb7bf6d5ed4a", "ip": "13.107.5.93", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 18, "packets_received": 10, "bytes_sent": 15467, "bytes_received": 1817, "first_seen_epoch": "1722307167.629882", "last_seen_epoch": "1722307233.201439", "evidence_frames": [ 1666, 1669, 1670, 1671, 1672 ] }, { "endpoint_id": "endpoint-0623cd84cffdc83fa5bee77c", "ip": "13.69.239.79", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 15, "packets_received": 13, "bytes_sent": 5492, "bytes_received": 2728, "first_seen_epoch": "1722307154.626989", "last_seen_epoch": "1722307155.720403", "evidence_frames": [ 1159, 1160, 1161, 1162, 1163 ] }, { "endpoint_id": "endpoint-04f4d93c56f3fcb8b55b7f31", "ip": "140.82.113.3", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 16, "packets_received": 12, "bytes_sent": 8491, "bytes_received": 1392, "first_seen_epoch": "1722307193.011903", "last_seen_epoch": "1722307193.816247", "evidence_frames": [ 1829, 1830, 1831, 1832, 1833 ] }, { "endpoint_id": "endpoint-8bf618e3edb32bade895a8f5", "ip": "141.98.10.79", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 205, "packets_received": 206, "bytes_sent": 11074, "bytes_received": 27990, "first_seen_epoch": "1722307205.953226", "last_seen_epoch": "1722307714.623212", "evidence_frames": [ 9066, 9067, 9068, 9117, 9118 ] }, { "endpoint_id": "endpoint-305cb0135a1ad75f595bb10e", "ip": "172.16.1.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 34, "bytes_sent": 0, "bytes_received": 5404, "first_seen_epoch": "1722307128.960835", "last_seen_epoch": "1722307612.61328", "evidence_frames": [ 1, 2, 5, 29, 30 ] }, { "endpoint_id": "endpoint-ece1a32fda36100cd115b831", "ip": "172.16.1.4", "ip_version": 4, "is_private": true, "mac_addresses": [ "5c:f9:dd:8c:97:35" ], "packets_sent": 805, "packets_received": 908, "bytes_sent": 209787, "bytes_received": 235175, "first_seen_epoch": "1722307128.981301", "last_seen_epoch": "1722307711.66907", "evidence_frames": [ 12, 13, 14, 15, 17 ] }, { "endpoint_id": "endpoint-bc3b4b07853558c871e105ab", "ip": "172.16.1.66", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:1e:64:ec:f3:08" ], "packets_sent": 2578, "packets_received": 8953, "bytes_sent": 565419, "bytes_received": 10774651, "first_seen_epoch": "1722307128.960835", "last_seen_epoch": "1722307714.623212", "evidence_frames": [ 1, 2, 3, 4, 5 ] }, { "endpoint_id": "endpoint-a477767f9c525867774a07b0", "ip": "185.199.110.133", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 582, "packets_received": 71, "bytes_sent": 828901, "bytes_received": 5068, "first_seen_epoch": "1722307193.788197", "last_seen_epoch": "1722307199.819428", "evidence_frames": [ 1857, 1860, 1861, 1862, 1863 ] }, { "endpoint_id": "endpoint-c97a6ba05d3cbebab2a4b0b9", "ip": "199.232.196.209", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 6085, "packets_received": 455, "bytes_sent": 8868103, "bytes_received": 26728, "first_seen_epoch": "1722307196.968037", "last_seen_epoch": "1722307202.806473", "evidence_frames": [ 2510, 2511, 2512, 2513, 2514 ] }, { "endpoint_id": "endpoint-ce4353ba635e03a85e3d7e35", "ip": "20.166.2.191", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 17, "packets_received": 13, "bytes_sent": 5620, "bytes_received": 4270, "first_seen_epoch": "1722307241.909758", "last_seen_epoch": "1722307243.642312", "evidence_frames": [ 9780, 9781, 9782, 9783, 9784 ] }, { "endpoint_id": "endpoint-6f0d2afbea2160d06285fbbf", "ip": "20.189.173.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 30, "packets_received": 29, "bytes_sent": 8642, "bytes_received": 26814, "first_seen_epoch": "1722307339.487531", "last_seen_epoch": "1722307366.269725", "evidence_frames": [ 10346, 10347, 10348, 10349, 10350 ] }, { "endpoint_id": "endpoint-0bdc5840d7dc4ac48fbb74d5", "ip": "20.189.173.16", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 22, "packets_received": 19, "bytes_sent": 8208, "bytes_received": 12878, "first_seen_epoch": "1722307129.370273", "last_seen_epoch": "1722307132.047437", "evidence_frames": [ 240, 286, 287, 289, 290 ] }, { "endpoint_id": "endpoint-20bf176beacc45e30ed3f111", "ip": "20.189.173.26", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 64, "packets_received": 57, "bytes_sent": 8456, "bytes_received": 61918, "first_seen_epoch": "1722307356.013842", "last_seen_epoch": "1722307357.337905", "evidence_frames": [ 10450, 10451, 10452, 10453, 10454 ] }, { "endpoint_id": "endpoint-38f40c468edb4589f32c5c0d", "ip": "20.241.44.114", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 12, "packets_received": 9, "bytes_sent": 7281, "bytes_received": 1228, "first_seen_epoch": "1722307163.375197", "last_seen_epoch": "1722307198.191652", "evidence_frames": [ 1454, 1457, 1458, 1459, 1460 ] }, { "endpoint_id": "endpoint-a34e52bd467bc952ea0458e4", "ip": "20.7.1.246", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 1, "packets_received": 1, "bytes_sent": 205, "bytes_received": 54, "first_seen_epoch": "1722307639.841191", "last_seen_epoch": "1722307639.841456", "evidence_frames": [ 11470, 11472 ] }, { "endpoint_id": "endpoint-a2332f3879c77151e2c95965", "ip": "20.7.2.167", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 19, "packets_received": 17, "bytes_sent": 6432, "bytes_received": 3677, "first_seen_epoch": "1722307164.09388", "last_seen_epoch": "1722307639.886918", "evidence_frames": [ 1513, 1521, 1522, 1523, 1524 ] }, { "endpoint_id": "endpoint-e39da9ab8dfe51d8af8e707f", "ip": "20.96.153.111", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 14, "packets_received": 12, "bytes_sent": 7320, "bytes_received": 2576, "first_seen_epoch": "1722307155.052583", "last_seen_epoch": "1722307263.888386", "evidence_frames": [ 1177, 1188, 1189, 1190, 1191 ] }, { "endpoint_id": "endpoint-69237f46f0ceef63cd8a7311", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 118, "packets_received": 76, "bytes_sent": 70677, "bytes_received": 19994, "first_seen_epoch": "1722307157.679217", "last_seen_epoch": "1722307460.0396", "evidence_frames": [ 1257, 1264, 1265, 1308, 1309 ] }, { "endpoint_id": "endpoint-a24d60136e06dac660a2abab", "ip": "208.95.112.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 4, "packets_received": 5, "bytes_sent": 691, "bytes_received": 470, "first_seen_epoch": "1722307206.922045", "last_seen_epoch": "1722307207.013466", "evidence_frames": [ 9108, 9109, 9110, 9111, 9112 ] }, { "endpoint_id": "endpoint-9ef2787313fcc9be2cc1011e", "ip": "224.0.0.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:16" ], "packets_sent": 0, "packets_received": 9, "bytes_sent": 0, "bytes_received": 494, "first_seen_epoch": "1722307128.964025", "last_seen_epoch": "1722307153.847015", "evidence_frames": [ 3, 4, 8, 9, 16 ] }, { "endpoint_id": "endpoint-070c142be2e4ca62ec6ba85b", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 172, "first_seen_epoch": "1722307128.988144", "last_seen_epoch": "1722307128.988311", "evidence_frames": [ 26, 27 ] }, { "endpoint_id": "endpoint-fd8cf298e0b6c5fd70ac1071", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 75, "first_seen_epoch": "1722307128.98856", "last_seen_epoch": "1722307128.98856", "evidence_frames": [ 28 ] }, { "endpoint_id": "endpoint-8a5619d3aa0872d73f33e360", "ip": "23.194.164.136", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 40, "packets_received": 15, "bytes_sent": 47462, "bytes_received": 1399, "first_seen_epoch": "1722307469.4442", "last_seen_epoch": "1722307579.426232", "evidence_frames": [ 11234, 11235, 11236, 11237, 11238 ] }, { "endpoint_id": "endpoint-41701b13a75064e923c39571", "ip": "23.198.7.168", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 44, "packets_received": 21, "bytes_sent": 43920, "bytes_received": 3889, "first_seen_epoch": "1722307457.737302", "last_seen_epoch": "1722307460.039708", "evidence_frames": [ 10962, 10973, 10979, 10986, 10987 ] }, { "endpoint_id": "endpoint-860f3e94b8aea223792cd7e6", "ip": "23.198.7.175", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 120, "packets_received": 69, "bytes_sent": 108514, "bytes_received": 20371, "first_seen_epoch": "1722307153.916627", "last_seen_epoch": "1722307332.157154", "evidence_frames": [ 1128, 1129, 1130, 1131, 1132 ] }, { "endpoint_id": "endpoint-f37f7eb2a070e0a408479d3a", "ip": "23.198.7.177", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 96, "packets_received": 77, "bytes_sent": 57150, "bytes_received": 8228, "first_seen_epoch": "1722307212.331591", "last_seen_epoch": "1722307332.773326", "evidence_frames": [ 9195, 9196, 9197, 9198, 9199 ] }, { "endpoint_id": "endpoint-9ad6ef61c0af3cbf4d9a7f0b", "ip": "23.215.55.133", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 6848, "bytes_received": 3232, "first_seen_epoch": "1722307457.759539", "last_seen_epoch": "1722307459.951286", "evidence_frames": [ 10966, 10974, 10980, 10982, 10983 ] }, { "endpoint_id": "endpoint-e534abf7f5569b190fe14bab", "ip": "23.215.55.140", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 4, "packets_received": 5, "bytes_sent": 407, "bytes_received": 393, "first_seen_epoch": "1722307129.58805", "last_seen_epoch": "1722307129.698276", "evidence_frames": [ 446, 464, 465, 466, 467 ] }, { "endpoint_id": "endpoint-8d69c182ab184f22f8a60c1d", "ip": "23.221.22.68", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 10, "packets_received": 8, "bytes_sent": 5880, "bytes_received": 1613, "first_seen_epoch": "1722307345.578458", "last_seen_epoch": "1722307366.269922", "evidence_frames": [ 10421, 10422, 10423, 10424, 10425 ] }, { "endpoint_id": "endpoint-ffbb9671e02e6bdfa08c704b", "ip": "23.46.192.165", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 29, "packets_received": 15, "bytes_sent": 26849, "bytes_received": 3372, "first_seen_epoch": "1722307458.007422", "last_seen_epoch": "1722307460.039786", "evidence_frames": [ 11032, 11050, 11051, 11052, 11053 ] }, { "endpoint_id": "endpoint-c2f37636bf4cc2a0b6f001c5", "ip": "23.48.203.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 17, "packets_received": 15, "bytes_sent": 12832, "bytes_received": 1822, "first_seen_epoch": "1722307225.688095", "last_seen_epoch": "1722307373.909845", "evidence_frames": [ 9541, 9542, 9543, 9544, 9545 ] }, { "endpoint_id": "endpoint-9a1e90fc07931f4e732e87ae", "ip": "23.48.203.208", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 108, "packets_received": 57, "bytes_sent": 106085, "bytes_received": 7656, "first_seen_epoch": "1722307164.129285", "last_seen_epoch": "1722307267.584972", "evidence_frames": [ 1515, 1516, 1525, 1526, 1527 ] }, { "endpoint_id": "endpoint-d0b54ea1890e76d4e5ee920f", "ip": "23.52.9.140", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 15, "packets_received": 13, "bytes_sent": 10790, "bytes_received": 1451, "first_seen_epoch": "1722307163.75416", "last_seen_epoch": "1722307273.308496", "evidence_frames": [ 1495, 1496, 1497, 1498, 1499 ] }, { "endpoint_id": "endpoint-f8129340a72b17be6c4e4109", "ip": "23.52.9.222", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 121, "packets_received": 111, "bytes_sent": 27234, "bytes_received": 38495, "first_seen_epoch": "1722307136.81097", "last_seen_epoch": "1722307155.249912", "evidence_frames": [ 685, 686, 687, 688, 689 ] }, { "endpoint_id": "endpoint-cc8cfa196a8255453b7b47aa", "ip": "23.53.11.166", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 56, "packets_received": 29, "bytes_sent": 52825, "bytes_received": 5226, "first_seen_epoch": "1722307457.1802", "last_seen_epoch": "1722307460.039639", "evidence_frames": [ 10890, 10899, 10900, 10901, 10902 ] }, { "endpoint_id": "endpoint-1695b084e37d2eb40d70bc45", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 8, "bytes_sent": 0, "bytes_received": 1432, "first_seen_epoch": "1722307233.647114", "last_seen_epoch": "1722307239.669881", "evidence_frames": [ 9596, 9597, 9602, 9603, 9604 ] }, { "endpoint_id": "endpoint-8d58ce6cf34b137edacc4c90", "ip": "40.126.29.14", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 24, "packets_received": 24, "bytes_sent": 12351, "bytes_received": 4014, "first_seen_epoch": "1722307214.266834", "last_seen_epoch": "1722307239.821341", "evidence_frames": [ 9502, 9503, 9504, 9505, 9506 ] }, { "endpoint_id": "endpoint-24cc5fa5b74ab8be2689e7f8", "ip": "40.97.199.114", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 11, "packets_received": 9, "bytes_sent": 6288, "bytes_received": 1737, "first_seen_epoch": "1722307333.287737", "last_seen_epoch": "1722307366.269468", "evidence_frames": [ 10279, 10280, 10281, 10282, 10283 ] }, { "endpoint_id": "endpoint-bfd842de6379230ddeae9a49", "ip": "52.109.0.142", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 33, "packets_received": 28, "bytes_sent": 19062, "bytes_received": 4298, "first_seen_epoch": "1722307158.609508", "last_seen_epoch": "1722307286.825363", "evidence_frames": [ 1414, 1416, 1417, 1418, 1419 ] }, { "endpoint_id": "endpoint-2e9d9b8a724a08ddb8e26c91", "ip": "52.109.0.91", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 33, "packets_received": 13, "bytes_sent": 37964, "bytes_received": 1686, "first_seen_epoch": "1722307332.138492", "last_seen_epoch": "1722307366.267396", "evidence_frames": [ 10081, 10086, 10087, 10088, 10089 ] }, { "endpoint_id": "endpoint-15c00b8f9bea0c68a3d19eaa", "ip": "52.109.20.47", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 45, "packets_received": 36, "bytes_sent": 32929, "bytes_received": 5306, "first_seen_epoch": "1722307332.703506", "last_seen_epoch": "1722307366.269248", "evidence_frames": [ 10135, 10136, 10137, 10138, 10143 ] }, { "endpoint_id": "endpoint-461b7881be9449009e7adc53", "ip": "52.109.6.53", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 20, "packets_received": 17, "bytes_sent": 8689, "bytes_received": 1727, "first_seen_epoch": "1722307157.672173", "last_seen_epoch": "1722307290.958703", "evidence_frames": [ 1256, 1266, 1267, 1298, 1299 ] }, { "endpoint_id": "endpoint-c4b9e9c2dfcae324ab96f246", "ip": "52.113.194.132", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 51, "packets_received": 12, "bytes_sent": 66389, "bytes_received": 1895, "first_seen_epoch": "1722307332.666639", "last_seen_epoch": "1722307366.268994", "evidence_frames": [ 10133, 10139, 10140, 10141, 10142 ] }, { "endpoint_id": "endpoint-a218b72baf46090037d6d463", "ip": "52.191.219.104", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:15:fa:50:6f:18" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 5067, "bytes_received": 1671, "first_seen_epoch": "1722307211.848451", "last_seen_epoch": "1722307212.36616", "evidence_frames": [ 9164, 9165, 9166, 9167, 9168 ] } ], "identities": [ { "identity_id": "identity-3e6e1a2370b05a6181d516ba", "type": "account", "value": "ccollier", "ip_addresses": [ "172.16.1.66" ], "mac_addresses": [ "00:1e:64:ec:f3:08" ], "evidence": [ { "frame_number": 913, "timestamp_epoch": "1722307152.512235000", "display_filter": "frame.number == 913", "tcp_stream": 46 }, { "frame_number": 921, "timestamp_epoch": "1722307152.518681000", "display_filter": "frame.number == 921", "tcp_stream": 47 }, { "frame_number": 923, "timestamp_epoch": "1722307152.520075000", "display_filter": "frame.number == 923", "tcp_stream": 47 }, { "frame_number": 935, "timestamp_epoch": "1722307152.522364000", "display_filter": "frame.number == 935", "tcp_stream": 48 }, { "frame_number": 956, "timestamp_epoch": "1722307152.758183000", "display_filter": "frame.number == 956", "tcp_stream": 50 }, { "frame_number": 1013, "timestamp_epoch": "1722307152.782154000", "display_filter": "frame.number == 1013", "tcp_stream": 53 }, { "frame_number": 1025, "timestamp_epoch": "1722307152.783333000", "display_filter": "frame.number == 1025", "tcp_stream": 55 }, { "frame_number": 1070, "timestamp_epoch": "1722307152.793528000", "display_filter": "frame.number == 1070", "tcp_stream": 21 }, { "frame_number": 1109, "timestamp_epoch": "1722307153.031311000", "display_filter": "frame.number == 1109", "tcp_stream": 57 }, { "frame_number": 9749, "timestamp_epoch": "1722307241.106569000", "display_filter": "frame.number == 9749", "tcp_stream": 110 } ], "bindings": [ { "frame_number": 913, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 921, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 923, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 935, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 956, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1013, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1025, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1070, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "ccollier", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 1109, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 9749, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "ccollier" ] }, { "identity_id": "identity-173cc151abbb6de85f4229f9", "type": "account", "value": "desktop-skbr25f$", "ip_addresses": [ "172.16.1.66" ], "mac_addresses": [ "00:1e:64:ec:f3:08" ], "evidence": [ { "frame_number": 58, "timestamp_epoch": "1722307129.109387000", "display_filter": "frame.number == 58", "tcp_stream": 2 }, { "frame_number": 59, "timestamp_epoch": "1722307129.109482000", "display_filter": "frame.number == 59", "tcp_stream": 3 }, { "frame_number": 71, "timestamp_epoch": "1722307129.120736000", "display_filter": "frame.number == 71", "tcp_stream": 4 }, { "frame_number": 73, "timestamp_epoch": "1722307129.121401000", "display_filter": "frame.number == 73", "tcp_stream": 4 }, { "frame_number": 84, "timestamp_epoch": "1722307129.129461000", "display_filter": "frame.number == 84", "tcp_stream": 6 }, { "frame_number": 86, "timestamp_epoch": "1722307129.130126000", "display_filter": "frame.number == 86", "tcp_stream": 6 }, { "frame_number": 109, "timestamp_epoch": "1722307129.133775000", "display_filter": "frame.number == 109", "tcp_stream": 8 }, { "frame_number": 113, "timestamp_epoch": "1722307129.133950000", "display_filter": "frame.number == 113", "tcp_stream": 7 }, { "frame_number": 122, "timestamp_epoch": "1722307129.134778000", "display_filter": "frame.number == 122", "tcp_stream": 9 }, { "frame_number": 158, "timestamp_epoch": "1722307129.228943000", "display_filter": "frame.number == 158", "tcp_stream": 12 }, { "frame_number": 166, "timestamp_epoch": "1722307129.240013000", "display_filter": "frame.number == 166", "tcp_stream": 13 }, { "frame_number": 168, "timestamp_epoch": "1722307129.240882000", "display_filter": "frame.number == 168", "tcp_stream": 13 }, { "frame_number": 182, "timestamp_epoch": "1722307129.244452000", "display_filter": "frame.number == 182", "tcp_stream": 14 }, { "frame_number": 223, "timestamp_epoch": "1722307129.275385000", "display_filter": "frame.number == 223", "tcp_stream": 16 }, { "frame_number": 275, "timestamp_epoch": "1722307129.433463000", "display_filter": "frame.number == 275", "tcp_stream": 19 }, { "frame_number": 309, "timestamp_epoch": "1722307129.557404000", "display_filter": "frame.number == 309", "tcp_stream": 22 }, { "frame_number": 321, "timestamp_epoch": "1722307129.558803000", "display_filter": "frame.number == 321", "tcp_stream": 23 }, { "frame_number": 572, "timestamp_epoch": "1722307130.012604000", "display_filter": "frame.number == 572", "tcp_stream": 29 }, { "frame_number": 580, "timestamp_epoch": "1722307130.013677000", "display_filter": "frame.number == 580", "tcp_stream": 30 }, { "frame_number": 582, "timestamp_epoch": "1722307130.014230000", "display_filter": "frame.number == 582", "tcp_stream": 30 } ], "bindings": [ { "frame_number": 58, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 59, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 71, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 73, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 84, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 86, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 109, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 113, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 122, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 158, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 166, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 168, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 182, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 223, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 275, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.username" }, { "frame_number": 309, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 321, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 572, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 580, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 582, "relationship": "kerberos-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "DESKTOP-SKBR25F$", "desktop-skbr25f$" ] }, { "identity_id": "identity-d0264f3d9bc8ad06f5c3cfc9", "type": "domain", "value": "WIRESHARKWORKSH", "ip_addresses": [ "172.16.1.66" ], "mac_addresses": [ "00:1e:64:ec:f3:08" ], "evidence": [ { "frame_number": 275, "timestamp_epoch": "1722307129.433463000", "display_filter": "frame.number == 275", "tcp_stream": 19 } ], "bindings": [ { "frame_number": 275, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.domain" } ], "raw_values": [ "WIRESHARKWORKSH" ] }, { "identity_id": "identity-3246a1fd6f810296d1b5db88", "type": "full-name", "value": "Clark Collier", "ip_addresses": [ "172.16.1.66" ], "mac_addresses": [], "evidence": [ { "frame_number": 1070, "timestamp_epoch": "1722307152.793528000", "display_filter": "frame.number == 1070", "tcp_stream": 21 } ], "bindings": [ { "frame_number": 1070, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.4", "conversation_dst": "172.16.1.66", "account": "ccollier", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Clark Collier" ] }, { "identity_id": "identity-f897e3a088d28332cde22f24", "type": "hostname", "value": "DESKTOP-SKBR25F", "ip_addresses": [ "172.16.1.66" ], "mac_addresses": [ "00:1e:64:ec:f3:08" ], "evidence": [ { "frame_number": 29, "timestamp_epoch": "1722307129.035395000", "display_filter": "frame.number == 29", "udp_stream": 0 }, { "frame_number": 30, "timestamp_epoch": "1722307129.035693000", "display_filter": "frame.number == 30", "udp_stream": 0 }, { "frame_number": 275, "timestamp_epoch": "1722307129.433463000", "display_filter": "frame.number == 275", "tcp_stream": 19 }, { "frame_number": 499, "timestamp_epoch": "1722307129.784130000", "display_filter": "frame.number == 499", "udp_stream": 0 }, { "frame_number": 500, "timestamp_epoch": "1722307129.784176000", "display_filter": "frame.number == 500", "udp_stream": 0 }, { "frame_number": 613, "timestamp_epoch": "1722307130.534452000", "display_filter": "frame.number == 613", "udp_stream": 0 }, { "frame_number": 614, "timestamp_epoch": "1722307130.534562000", "display_filter": "frame.number == 614", "udp_stream": 0 }, { "frame_number": 617, "timestamp_epoch": "1722307131.299702000", "display_filter": "frame.number == 617", "udp_stream": 0 }, { "frame_number": 618, "timestamp_epoch": "1722307131.299750000", "display_filter": "frame.number == 618", "udp_stream": 0 }, { "frame_number": 681, "timestamp_epoch": "1722307135.129046000", "display_filter": "frame.number == 681", "udp_stream": 15 }, { "frame_number": 682, "timestamp_epoch": "1722307135.136488000", "display_filter": "frame.number == 682", "udp_stream": 15 }, { "frame_number": 9900, "timestamp_epoch": "1722307270.485251000", "display_filter": "frame.number == 9900", "udp_stream": 15 }, { "frame_number": 9913, "timestamp_epoch": "1722307270.497131000", "display_filter": "frame.number == 9913", "tcp_stream": 114 }, { "frame_number": 9919, "timestamp_epoch": "1722307270.499929000", "display_filter": "frame.number == 9919", "udp_stream": 15 }, { "frame_number": 9922, "timestamp_epoch": "1722307270.506708000", "display_filter": "frame.number == 9922", "udp_stream": 15 }, { "frame_number": 9992, "timestamp_epoch": "1722307300.509737000", "display_filter": "frame.number == 9992", "tcp_stream": 115 }, { "frame_number": 9998, "timestamp_epoch": "1722307300.512178000", "display_filter": "frame.number == 9998", "udp_stream": 15 }, { "frame_number": 10001, "timestamp_epoch": "1722307300.520305000", "display_filter": "frame.number == 10001", "udp_stream": 15 }, { "frame_number": 10050, "timestamp_epoch": "1722307330.539799000", "display_filter": "frame.number == 10050", "tcp_stream": 116 }, { "frame_number": 10056, "timestamp_epoch": "1722307330.543637000", "display_filter": "frame.number == 10056", "udp_stream": 15 } ], "bindings": [ { "frame_number": 29, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 30, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 275, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 499, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 500, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 613, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 614, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 617, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 618, "relationship": "netbios-registration", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 681, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 682, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.server" }, { "frame_number": 9900, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 9913, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 9919, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 9922, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 9992, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 9998, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 10001, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 10050, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.4", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 10056, "relationship": "client-asserted", "owner_ip": "172.16.1.66", "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "browser.response_computer_name" } ], "raw_values": [ "DESKTOP-SKBR25F", "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)" ] }, { "identity_id": "identity-1bc83fed43574ff0a22b9b2b", "type": "netbios-group", "value": "WIRESHARKWORKSH", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 31, "timestamp_epoch": "1722307129.035966000", "display_filter": "frame.number == 31", "udp_stream": 0 }, { "frame_number": 501, "timestamp_epoch": "1722307129.784191000", "display_filter": "frame.number == 501", "udp_stream": 0 }, { "frame_number": 615, "timestamp_epoch": "1722307130.534744000", "display_filter": "frame.number == 615", "udp_stream": 0 }, { "frame_number": 616, "timestamp_epoch": "1722307131.299650000", "display_filter": "frame.number == 616", "udp_stream": 0 }, { "frame_number": 624, "timestamp_epoch": "1722307132.084215000", "display_filter": "frame.number == 624", "udp_stream": 0 }, { "frame_number": 627, "timestamp_epoch": "1722307132.847008000", "display_filter": "frame.number == 627", "udp_stream": 0 }, { "frame_number": 673, "timestamp_epoch": "1722307133.597005000", "display_filter": "frame.number == 673", "udp_stream": 0 }, { "frame_number": 679, "timestamp_epoch": "1722307134.362626000", "display_filter": "frame.number == 679", "udp_stream": 0 } ], "bindings": [ { "frame_number": 31, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 501, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 615, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 616, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 624, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 627, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 673, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 679, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.16.1.66", "conversation_dst": "172.16.1.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "WIRESHARKWORKSH<1e>,WIRESHARKWORKSH<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-b20cb71ee6c67e157715238a", "transport": "udp", "stream": 0, "initiator_ip": "172.16.1.66", "initiator_port": 137, "responder_ip": "172.16.1.255", "responder_port": 137, "first_frame": 1, "last_frame": 9901, "first_seen_epoch": "1722307128.960835", "last_seen_epoch": "1722307270.493889", "packets": 20, "bytes": 2182, "initiator_bytes": 2182, "responder_bytes": 0 }, { "flow_id": "flow-a2debea3c2d8874fc8938266", "transport": "udp", "stream": 1, "initiator_ip": "172.16.1.66", "initiator_port": 57773, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 12, "last_frame": 15, "first_seen_epoch": "1722307128.981301", "last_seen_epoch": "1722307128.984075", "packets": 4, "bytes": 564, "initiator_bytes": 236, "responder_bytes": 328 }, { "flow_id": "flow-bc4747b027ee5ce481c9c865", "transport": "udp", "stream": 2, "initiator_ip": "172.16.1.66", "initiator_port": 57775, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 17, "last_frame": 35, "first_seen_epoch": "1722307128.986163", "last_seen_epoch": "1722307129.101494", "packets": 10, "bytes": 2700, "initiator_bytes": 1425, "responder_bytes": 1275 }, { "flow_id": "flow-8750c3476912e76398791e7a", "transport": "udp", "stream": 3, "initiator_ip": "172.16.1.66", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 26, "last_frame": 27, "first_seen_epoch": "1722307128.988144", "last_seen_epoch": "1722307128.988311", "packets": 2, "bytes": 172, "initiator_bytes": 172, "responder_bytes": 0 }, { "flow_id": "flow-1814c9cc582944fd300c832f", "transport": "udp", "stream": 4, "initiator_ip": "172.16.1.66", "initiator_port": 51992, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 28, "last_frame": 28, "first_seen_epoch": "1722307128.98856", "last_seen_epoch": "1722307128.98856", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-e991e1891ef5a82b73765032", "transport": "udp", "stream": 5, "initiator_ip": "172.16.1.66", "initiator_port": 54443, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 32, "last_frame": 33, "first_seen_epoch": "1722307129.099969", "last_seen_epoch": "1722307129.10052", "packets": 2, "bytes": 348, "initiator_bytes": 136, "responder_bytes": 212 }, { "flow_id": "flow-7d419500e40c526d28efb45d", "transport": "tcp", "stream": 0, "initiator_ip": "172.16.1.66", "initiator_port": 49673, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 36, "last_frame": 142, "first_seen_epoch": "1722307129.101609", "last_seen_epoch": "1722307129.138222", "packets": 14, "bytes": 6551, "initiator_bytes": 3016, "responder_bytes": 3535 }, { "flow_id": "flow-561c7e50dfb1175627288718", "transport": "tcp", "stream": 1, "initiator_ip": "172.16.1.66", "initiator_port": 49674, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 38, "last_frame": 144, "first_seen_epoch": "1722307129.101951", "last_seen_epoch": "1722307129.13839", "packets": 14, "bytes": 6551, "initiator_bytes": 3016, "responder_bytes": 3535 }, { "flow_id": "flow-156cf35d61545269d5aeec42", "transport": "tcp", "stream": 2, "initiator_ip": "172.16.1.66", "initiator_port": 49676, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 52, "last_frame": 66, "first_seen_epoch": "1722307129.108897", "last_seen_epoch": "1722307129.110536", "packets": 8, "bytes": 990, "initiator_bytes": 493, "responder_bytes": 497 }, { "flow_id": "flow-77be875e9b4303db6ba952e9", "transport": "tcp", "stream": 3, "initiator_ip": "172.16.1.66", "initiator_port": 49675, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 53, "last_frame": 67, "first_seen_epoch": "1722307129.108911", "last_seen_epoch": "1722307129.110551", "packets": 8, "bytes": 990, "initiator_bytes": 493, "responder_bytes": 497 }, { "flow_id": "flow-8755182b7b7cee7d6541f68b", "transport": "tcp", "stream": 4, "initiator_ip": "172.16.1.66", "initiator_port": 49677, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 68, "last_frame": 77, "first_seen_epoch": "1722307129.120416", "last_seen_epoch": "1722307129.121773", "packets": 10, "bytes": 2823, "initiator_bytes": 626, "responder_bytes": 2197 }, { "flow_id": "flow-8e61c7576401461eb67050f3", "transport": "tcp", "stream": 5, "initiator_ip": "172.16.1.66", "initiator_port": 49678, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 78, "last_frame": 143, "first_seen_epoch": "1722307129.128769", "last_seen_epoch": "1722307129.138312", "packets": 9, "bytes": 2996, "initiator_bytes": 2558, "responder_bytes": 438 }, { "flow_id": "flow-0a5ad6fa11a9d624ecf04680", "transport": "tcp", "stream": 6, "initiator_ip": "172.16.1.66", "initiator_port": 49679, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 81, "last_frame": 90, "first_seen_epoch": "1722307129.129089", "last_seen_epoch": "1722307129.130826", "packets": 10, "bytes": 2823, "initiator_bytes": 626, "responder_bytes": 2197 }, { "flow_id": "flow-f4da506400a728f94ca6bb01", "transport": "tcp", "stream": 7, "initiator_ip": "172.16.1.66", "initiator_port": 49680, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 91, "last_frame": 120, "first_seen_epoch": "1722307129.132235", "last_seen_epoch": "1722307129.134407", "packets": 12, "bytes": 4587, "initiator_bytes": 2302, "responder_bytes": 2285 }, { "flow_id": "flow-f3e316f8125c7d26af388ec1", "transport": "tcp", "stream": 8, "initiator_ip": "172.16.1.66", "initiator_port": 49681, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 93, "last_frame": 117, "first_seen_epoch": "1722307129.132389", "last_seen_epoch": "1722307129.134227", "packets": 12, "bytes": 4587, "initiator_bytes": 2302, "responder_bytes": 2285 }, { "flow_id": "flow-ebd3e43d24e2e6a1c6f49dc5", "transport": "tcp", "stream": 9, "initiator_ip": "172.16.1.66", "initiator_port": 49682, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 103, "last_frame": 126, "first_seen_epoch": "1722307129.133408", "last_seen_epoch": "1722307129.135078", "packets": 12, "bytes": 4587, "initiator_bytes": 2302, "responder_bytes": 2285 }, { "flow_id": "flow-ecc737739a570d439ba0399b", "transport": "tcp", "stream": 10, "initiator_ip": "172.16.1.66", "initiator_port": 49683, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 145, "last_frame": 902, "first_seen_epoch": "1722307129.225266", "last_seen_epoch": "1722307140.285844", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-e8cbfcf1468c40fa25683ce7", "transport": "tcp", "stream": 11, "initiator_ip": "172.16.1.66", "initiator_port": 49684, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 152, "last_frame": 9062, "first_seen_epoch": "1722307129.227924", "last_seen_epoch": "1722307200.294158", "packets": 38, "bytes": 12110, "initiator_bytes": 7972, "responder_bytes": 4138 }, { "flow_id": "flow-9c1ccf7b737947fc1c8d3d5c", "transport": "tcp", "stream": 12, "initiator_ip": "172.16.1.66", "initiator_port": 49685, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 155, "last_frame": 162, "first_seen_epoch": "1722307129.228554", "last_seen_epoch": "1722307129.230004", "packets": 8, "bytes": 990, "initiator_bytes": 493, "responder_bytes": 497 }, { "flow_id": "flow-2ccc40e61dcafaeb011eaf18", "transport": "tcp", "stream": 13, "initiator_ip": "172.16.1.66", "initiator_port": 49686, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 163, "last_frame": 172, "first_seen_epoch": "1722307129.239603", "last_seen_epoch": "1722307129.241237", "packets": 10, "bytes": 2823, "initiator_bytes": 626, "responder_bytes": 2197 }, { "flow_id": "flow-26dfa2aab17d8d32c6631e63", "transport": "tcp", "stream": 14, "initiator_ip": "172.16.1.66", "initiator_port": 49687, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 175, "last_frame": 186, "first_seen_epoch": "1722307129.243216", "last_seen_epoch": "1722307129.244791", "packets": 12, "bytes": 4587, "initiator_bytes": 2302, "responder_bytes": 2285 }, { "flow_id": "flow-6515b39f049ad714a7dbae13", "transport": "udp", "stream": 6, "initiator_ip": "172.16.1.66", "initiator_port": 49844, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 201, "last_frame": 684, "first_seen_epoch": "1722307129.254606", "last_seen_epoch": "1722307136.806788", "packets": 15, "bytes": 1855, "initiator_bytes": 842, "responder_bytes": 1013 }, { "flow_id": "flow-ff1a3c3329c243236dd12192", "transport": "tcp", "stream": 15, "initiator_ip": "172.16.1.66", "initiator_port": 49688, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 203, "last_frame": 463, "first_seen_epoch": "1722307129.259196", "last_seen_epoch": "1722307129.599078", "packets": 22, "bytes": 9587, "initiator_bytes": 4068, "responder_bytes": 5519 }, { "flow_id": "flow-2c80244917de0c297a11f63c", "transport": "tcp", "stream": 16, "initiator_ip": "172.16.1.66", "initiator_port": 49689, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 216, "last_frame": 227, "first_seen_epoch": "1722307129.273878", "last_seen_epoch": "1722307129.275812", "packets": 12, "bytes": 4435, "initiator_bytes": 2246, "responder_bytes": 2189 }, { "flow_id": "flow-2934d6b46fd44b668a4f655f", "transport": "udp", "stream": 7, "initiator_ip": "172.16.1.66", "initiator_port": 49846, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 232, "last_frame": 233, "first_seen_epoch": "1722307129.280897", "last_seen_epoch": "1722307129.281153", "packets": 2, "bytes": 539, "initiator_bytes": 284, "responder_bytes": 255 }, { "flow_id": "flow-886c4df10309fa77ee2fb35c", "transport": "tcp", "stream": 17, "initiator_ip": "172.16.1.66", "initiator_port": 49690, "responder_ip": "20.189.173.16", "responder_port": 443, "first_frame": 240, "last_frame": 623, "first_seen_epoch": "1722307129.370273", "last_seen_epoch": "1722307132.047437", "packets": 41, "bytes": 21086, "initiator_bytes": 12878, "responder_bytes": 8208 }, { "flow_id": "flow-07c39069ae69e65fca209612", "transport": "tcp", "stream": 18, "initiator_ip": "172.16.1.66", "initiator_port": 49691, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 241, "last_frame": 459, "first_seen_epoch": "1722307129.394561", "last_seen_epoch": "1722307129.592614", "packets": 14, "bytes": 3942, "initiator_bytes": 3070, "responder_bytes": 872 }, { "flow_id": "flow-41b880c10b388279c834e957", "transport": "tcp", "stream": 19, "initiator_ip": "172.16.1.66", "initiator_port": 49692, "responder_ip": "172.16.1.4", "responder_port": 445, "first_frame": 256, "last_frame": 905, "first_seen_epoch": "1722307129.420926", "last_seen_epoch": "1722307140.2871", "packets": 21, "bytes": 4602, "initiator_bytes": 2458, "responder_bytes": 2144 }, { "flow_id": "flow-d89e537e232926185be99c8a", "transport": "tcp", "stream": 20, "initiator_ip": "172.16.1.66", "initiator_port": 49693, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 263, "last_frame": 272, "first_seen_epoch": "1722307129.423125", "last_seen_epoch": "1722307129.425369", "packets": 10, "bytes": 2610, "initiator_bytes": 2206, "responder_bytes": 404 }, { "flow_id": "flow-a3ea4684deff070c4ea2ab24", "transport": "udp", "stream": 8, "initiator_ip": "172.16.1.66", "initiator_port": 49847, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 283, "last_frame": 284, "first_seen_epoch": "1722307129.439539", "last_seen_epoch": "1722307129.439793", "packets": 2, "bytes": 539, "initiator_bytes": 284, "responder_bytes": 255 }, { "flow_id": "flow-97d646396bd2e87c6407c80a", "transport": "udp", "stream": 9, "initiator_ip": "172.16.1.66", "initiator_port": 50203, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 292, "last_frame": 1512, "first_seen_epoch": "1722307129.530082", "last_seen_epoch": "1722307164.090128", "packets": 4, "bytes": 533, "initiator_bytes": 165, "responder_bytes": 368 }, { "flow_id": "flow-b01fce39c8c3e1f81c2297e5", "transport": "udp", "stream": 10, "initiator_ip": "172.16.1.66", "initiator_port": 57308, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 293, "last_frame": 9124, "first_seen_epoch": "1722307129.53013", "last_seen_epoch": "1722307207.51687", "packets": 6, "bytes": 795, "initiator_bytes": 267, "responder_bytes": 528 }, { "flow_id": "flow-d39bd3b5fc3ccec868ad8c90", "transport": "tcp", "stream": 21, "initiator_ip": "172.16.1.66", "initiator_port": 49694, "responder_ip": "172.16.1.4", "responder_port": 445, "first_frame": 295, "last_frame": 11558, "first_seen_epoch": "1722307129.553375", "last_seen_epoch": "1722307711.66907", "packets": 248, "bytes": 62771, "initiator_bytes": 34325, "responder_bytes": 28446 }, { "flow_id": "flow-35dacaf3a7dd35eefcd4b0be", "transport": "tcp", "stream": 22, "initiator_ip": "172.16.1.66", "initiator_port": 49695, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 302, "last_frame": 313, "first_seen_epoch": "1722307129.55588", "last_seen_epoch": "1722307129.557784", "packets": 12, "bytes": 4587, "initiator_bytes": 2302, "responder_bytes": 2285 }, { "flow_id": "flow-a182369a97f222024216118c", "transport": "tcp", "stream": 23, "initiator_ip": "172.16.1.66", "initiator_port": 49696, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 314, "last_frame": 325, "first_seen_epoch": "1722307129.557883", "last_seen_epoch": "1722307129.559184", "packets": 12, "bytes": 4169, "initiator_bytes": 2069, "responder_bytes": 2100 }, { "flow_id": "flow-2e50d8a81f45981a3fca972f", "transport": "tcp", "stream": 24, "initiator_ip": "172.16.1.66", "initiator_port": 49697, "responder_ip": "23.215.55.140", "responder_port": 80, "first_frame": 446, "last_frame": 496, "first_seen_epoch": "1722307129.58805", "last_seen_epoch": "1722307129.698276", "packets": 9, "bytes": 800, "initiator_bytes": 393, "responder_bytes": 407 }, { "flow_id": "flow-6a7d122ecf647e9efd8e2ddd", "transport": "tcp", "stream": 25, "initiator_ip": "172.16.1.66", "initiator_port": 49698, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 504, "last_frame": 609, "first_seen_epoch": "1722307129.946513", "last_seen_epoch": "1722307130.018713", "packets": 33, "bytes": 10051, "initiator_bytes": 5099, "responder_bytes": 4952 }, { "flow_id": "flow-ab73443bb21484a1a04ac2cb", "transport": "udp", "stream": 11, "initiator_ip": "172.16.1.66", "initiator_port": 57977, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 532, "last_frame": 533, "first_seen_epoch": "1722307129.987384", "last_seen_epoch": "1722307129.987691", "packets": 2, "bytes": 265, "initiator_bytes": 89, "responder_bytes": 176 }, { "flow_id": "flow-672da4e37536d6577ff7cec0", "transport": "tcp", "stream": 26, "initiator_ip": "172.16.1.66", "initiator_port": 49699, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 534, "last_frame": 546, "first_seen_epoch": "1722307129.993088", "last_seen_epoch": "1722307129.998524", "packets": 13, "bytes": 3589, "initiator_bytes": 2811, "responder_bytes": 778 }, { "flow_id": "flow-422cd1336af0692234cd4a02", "transport": "tcp", "stream": 27, "initiator_ip": "172.16.1.66", "initiator_port": 49700, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 547, "last_frame": 559, "first_seen_epoch": "1722307129.999478", "last_seen_epoch": "1722307130.002452", "packets": 13, "bytes": 3607, "initiator_bytes": 2975, "responder_bytes": 632 }, { "flow_id": "flow-30649dcb3a053a0814e50df4", "transport": "tcp", "stream": 28, "initiator_ip": "172.16.1.66", "initiator_port": 49701, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 560, "last_frame": 604, "first_seen_epoch": "1722307130.008714", "last_seen_epoch": "1722307130.01801", "packets": 15, "bytes": 4781, "initiator_bytes": 3895, "responder_bytes": 886 }, { "flow_id": "flow-b78ea8675e397e416e99b9fd", "transport": "tcp", "stream": 29, "initiator_ip": "172.16.1.66", "initiator_port": 49702, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 569, "last_frame": 576, "first_seen_epoch": "1722307130.012302", "last_seen_epoch": "1722307130.013386", "packets": 8, "bytes": 991, "initiator_bytes": 494, "responder_bytes": 497 }, { "flow_id": "flow-2bd16b32e9790c8a67f5cfd0", "transport": "tcp", "stream": 30, "initiator_ip": "172.16.1.66", "initiator_port": 49703, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 577, "last_frame": 586, "first_seen_epoch": "1722307130.013395", "last_seen_epoch": "1722307130.014579", "packets": 10, "bytes": 2824, "initiator_bytes": 627, "responder_bytes": 2197 }, { "flow_id": "flow-2c6b3ee5f0f5b3ee04ef9978", "transport": "tcp", "stream": 31, "initiator_ip": "172.16.1.66", "initiator_port": 49704, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 587, "last_frame": 598, "first_seen_epoch": "1722307130.014642", "last_seen_epoch": "1722307130.016154", "packets": 12, "bytes": 4373, "initiator_bytes": 2212, "responder_bytes": 2161 }, { "flow_id": "flow-9bdacd590599a8eb3fb5ad9c", "transport": "tcp", "stream": 32, "initiator_ip": "172.16.1.4", "initiator_port": 445, "responder_ip": "172.16.1.66", "responder_port": 49744, "first_frame": 611, "last_frame": 612, "first_seen_epoch": "1722307130.419216", "last_seen_epoch": "1722307130.41969", "packets": 2, "bytes": 109, "initiator_bytes": 55, "responder_bytes": 54 }, { "flow_id": "flow-d524928ca2ea61808ab551f2", "transport": "udp", "stream": 12, "initiator_ip": "172.16.1.66", "initiator_port": 60777, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 628, "last_frame": 1504, "first_seen_epoch": "1722307133.082666", "last_seen_epoch": "1722307164.012919", "packets": 19, "bytes": 2691, "initiator_bytes": 1065, "responder_bytes": 1626 }, { "flow_id": "flow-2b2504de06a5e053dc62999c", "transport": "udp", "stream": 13, "initiator_ip": "172.16.1.66", "initiator_port": 60778, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 630, "last_frame": 631, "first_seen_epoch": "1722307133.084227", "last_seen_epoch": "1722307133.084728", "packets": 2, "bytes": 540, "initiator_bytes": 285, "responder_bytes": 255 }, { "flow_id": "flow-49ebb9a0303897ece6dd04ed", "transport": "udp", "stream": 14, "initiator_ip": "172.16.1.66", "initiator_port": 60779, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 632, "last_frame": 633, "first_seen_epoch": "1722307133.192409", "last_seen_epoch": "1722307133.192987", "packets": 2, "bytes": 540, "initiator_bytes": 285, "responder_bytes": 255 }, { "flow_id": "flow-90fe2794f74cec5ece5d8a98", "transport": "tcp", "stream": 33, "initiator_ip": "172.16.1.66", "initiator_port": 49705, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 634, "last_frame": 1712, "first_seen_epoch": "1722307133.305387", "last_seen_epoch": "1722307171.437595", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-788b7a853f5a659fe6049e5b", "transport": "tcp", "stream": 34, "initiator_ip": "172.16.1.66", "initiator_port": 49706, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 641, "last_frame": 1708, "first_seen_epoch": "1722307133.308978", "last_seen_epoch": "1722307171.436428", "packets": 22, "bytes": 5987, "initiator_bytes": 4454, "responder_bytes": 1533 }, { "flow_id": "flow-32bae71e5b63dfd0d49c4234", "transport": "tcp", "stream": 35, "initiator_ip": "172.16.1.66", "initiator_port": 49707, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 644, "last_frame": 655, "first_seen_epoch": "1722307133.309747", "last_seen_epoch": "1722307133.311638", "packets": 12, "bytes": 4525, "initiator_bytes": 2276, "responder_bytes": 2249 }, { "flow_id": "flow-0c0f58d2aa25863f08c48f52", "transport": "udp", "stream": 15, "initiator_ip": "172.16.1.66", "initiator_port": 138, "responder_ip": "172.16.1.255", "responder_port": 138, "first_frame": 681, "last_frame": 11435, "first_seen_epoch": "1722307135.129046", "last_seen_epoch": "1722307612.61328", "packets": 14, "bytes": 3222, "initiator_bytes": 3222, "responder_bytes": 0 }, { "flow_id": "flow-025b0242ff1135c6e8d4a77b", "transport": "tcp", "stream": 36, "initiator_ip": "172.16.1.66", "initiator_port": 49708, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 685, "last_frame": 710, "first_seen_epoch": "1722307136.81097", "last_seen_epoch": "1722307137.250555", "packets": 25, "bytes": 10971, "initiator_bytes": 2815, "responder_bytes": 8156 }, { "flow_id": "flow-4fe87ea4f18311af0747ac72", "transport": "tcp", "stream": 37, "initiator_ip": "172.16.1.66", "initiator_port": 49709, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 708, "last_frame": 732, "first_seen_epoch": "1722307137.237703", "last_seen_epoch": "1722307137.54594", "packets": 22, "bytes": 5042, "initiator_bytes": 3064, "responder_bytes": 1978 }, { "flow_id": "flow-2b92d6d60f978ce25f1df7d6", "transport": "tcp", "stream": 38, "initiator_ip": "172.16.1.66", "initiator_port": 49710, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 729, "last_frame": 751, "first_seen_epoch": "1722307137.535837", "last_seen_epoch": "1722307137.860161", "packets": 20, "bytes": 6324, "initiator_bytes": 4454, "responder_bytes": 1870 }, { "flow_id": "flow-df79d726fa41ba69fd0e41a7", "transport": "tcp", "stream": 39, "initiator_ip": "172.16.1.66", "initiator_port": 49711, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 752, "last_frame": 775, "first_seen_epoch": "1722307137.862577", "last_seen_epoch": "1722307138.170632", "packets": 24, "bytes": 5266, "initiator_bytes": 3234, "responder_bytes": 2032 }, { "flow_id": "flow-df8393cc08f72b2e53cc30f4", "transport": "tcp", "stream": 40, "initiator_ip": "172.16.1.66", "initiator_port": 49712, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 776, "last_frame": 796, "first_seen_epoch": "1722307138.172563", "last_seen_epoch": "1722307138.481439", "packets": 21, "bytes": 5104, "initiator_bytes": 3180, "responder_bytes": 1924 }, { "flow_id": "flow-e96773df31261ddc7e9c1a3f", "transport": "tcp", "stream": 41, "initiator_ip": "172.16.1.66", "initiator_port": 49713, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 797, "last_frame": 816, "first_seen_epoch": "1722307138.484104", "last_seen_epoch": "1722307138.783731", "packets": 20, "bytes": 6324, "initiator_bytes": 4454, "responder_bytes": 1870 }, { "flow_id": "flow-1c4fb4d8d34d89f02fda09d7", "transport": "tcp", "stream": 42, "initiator_ip": "172.16.1.66", "initiator_port": 49714, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 817, "last_frame": 838, "first_seen_epoch": "1722307138.787182", "last_seen_epoch": "1722307139.079926", "packets": 21, "bytes": 5404, "initiator_bytes": 3480, "responder_bytes": 1924 }, { "flow_id": "flow-3bedfecdacf8e1c513104b2f", "transport": "tcp", "stream": 43, "initiator_ip": "172.16.1.66", "initiator_port": 49715, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 836, "last_frame": 856, "first_seen_epoch": "1722307139.078344", "last_seen_epoch": "1722307139.401137", "packets": 19, "bytes": 4880, "initiator_bytes": 3010, "responder_bytes": 1870 }, { "flow_id": "flow-3e1367c09095cb940b7e27b6", "transport": "tcp", "stream": 44, "initiator_ip": "172.16.1.66", "initiator_port": 49716, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 857, "last_frame": 876, "first_seen_epoch": "1722307139.404338", "last_seen_epoch": "1722307139.690955", "packets": 20, "bytes": 5662, "initiator_bytes": 3792, "responder_bytes": 1870 }, { "flow_id": "flow-06275cd1496864eedff2b256", "transport": "tcp", "stream": 45, "initiator_ip": "172.16.1.66", "initiator_port": 49717, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 877, "last_frame": 896, "first_seen_epoch": "1722307139.693882", "last_seen_epoch": "1722307139.995941", "packets": 20, "bytes": 5570, "initiator_bytes": 3700, "responder_bytes": 1870 }, { "flow_id": "flow-715097515db3daa1af79a87e", "transport": "tcp", "stream": 46, "initiator_ip": "172.16.1.66", "initiator_port": 49718, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 910, "last_frame": 917, "first_seen_epoch": "1722307152.511547", "last_seen_epoch": "1722307152.513078", "packets": 8, "bytes": 904, "initiator_bytes": 466, "responder_bytes": 438 }, { "flow_id": "flow-cfc0cbf089b6ca31192cf475", "transport": "tcp", "stream": 47, "initiator_ip": "172.16.1.66", "initiator_port": 49719, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 918, "last_frame": 927, "first_seen_epoch": "1722307152.518371", "last_seen_epoch": "1722307152.520599", "packets": 10, "bytes": 2713, "initiator_bytes": 600, "responder_bytes": 2113 }, { "flow_id": "flow-e705484932720c1c29573f6b", "transport": "tcp", "stream": 48, "initiator_ip": "172.16.1.66", "initiator_port": 49720, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 928, "last_frame": 939, "first_seen_epoch": "1722307152.520845", "last_seen_epoch": "1722307152.523043", "packets": 12, "bytes": 4168, "initiator_bytes": 2073, "responder_bytes": 2095 }, { "flow_id": "flow-0a2c3660df0f7d0c48a1b0df", "transport": "udp", "stream": 16, "initiator_ip": "172.16.1.66", "initiator_port": 50706, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 940, "last_frame": 941, "first_seen_epoch": "1722307152.539701", "last_seen_epoch": "1722307152.540091", "packets": 2, "bytes": 540, "initiator_bytes": 285, "responder_bytes": 255 }, { "flow_id": "flow-8a140da420e25042be75e98b", "transport": "tcp", "stream": 49, "initiator_ip": "172.16.1.66", "initiator_port": 49721, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 942, "last_frame": 1704, "first_seen_epoch": "1722307152.742092", "last_seen_epoch": "1722307170.296388", "packets": 14, "bytes": 2016, "initiator_bytes": 940, "responder_bytes": 1076 }, { "flow_id": "flow-baa8830c252734b46252f7ad", "transport": "tcp", "stream": 50, "initiator_ip": "172.16.1.66", "initiator_port": 49722, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 949, "last_frame": 960, "first_seen_epoch": "1722307152.756811", "last_seen_epoch": "1722307152.758503", "packets": 12, "bytes": 4491, "initiator_bytes": 2254, "responder_bytes": 2237 }, { "flow_id": "flow-1789cb8dd30de3242ac13efd", "transport": "tcp", "stream": 51, "initiator_ip": "172.16.1.66", "initiator_port": 49723, "responder_ip": "172.16.1.4", "responder_port": 49695, "first_frame": 977, "last_frame": 1703, "first_seen_epoch": "1722307152.765381", "last_seen_epoch": "1722307170.296255", "packets": 22, "bytes": 5243, "initiator_bytes": 3075, "responder_bytes": 2168 }, { "flow_id": "flow-4ed0db3928025dd4133dba75", "transport": "tcp", "stream": 52, "initiator_ip": "172.16.1.66", "initiator_port": 49724, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 994, "last_frame": 1090, "first_seen_epoch": "1722307152.773986", "last_seen_epoch": "1722307152.807734", "packets": 13, "bytes": 4599, "initiator_bytes": 3445, "responder_bytes": 1154 }, { "flow_id": "flow-460488ba2c00d7dc867eacec", "transport": "tcp", "stream": 53, "initiator_ip": "172.16.1.66", "initiator_port": 49725, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 1003, "last_frame": 1017, "first_seen_epoch": "1722307152.780641", "last_seen_epoch": "1722307152.782464", "packets": 12, "bytes": 4429, "initiator_bytes": 2228, "responder_bytes": 2201 }, { "flow_id": "flow-7a10da40ff375c6ed2f074fc", "transport": "tcp", "stream": 54, "initiator_ip": "172.16.1.66", "initiator_port": 49726, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 1009, "last_frame": 1088, "first_seen_epoch": "1722307152.78151", "last_seen_epoch": "1722307152.804342", "packets": 13, "bytes": 3864, "initiator_bytes": 2992, "responder_bytes": 872 }, { "flow_id": "flow-e360a90c5089fa71a3e413ad", "transport": "tcp", "stream": 55, "initiator_ip": "172.16.1.66", "initiator_port": 49727, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 1018, "last_frame": 1029, "first_seen_epoch": "1722307152.78258", "last_seen_epoch": "1722307152.783636", "packets": 12, "bytes": 4073, "initiator_bytes": 2021, "responder_bytes": 2052 }, { "flow_id": "flow-80ff2596de79abb2a2ab9f3e", "transport": "tcp", "stream": 56, "initiator_ip": "172.16.1.66", "initiator_port": 49728, "responder_ip": "172.16.1.4", "responder_port": 445, "first_frame": 1097, "last_frame": 11557, "first_seen_epoch": "1722307153.027794", "last_seen_epoch": "1722307711.669008", "packets": 128, "bytes": 23383, "initiator_bytes": 13626, "responder_bytes": 9757 }, { "flow_id": "flow-c3060d13f204c077527e8438", "transport": "tcp", "stream": 57, "initiator_ip": "172.16.1.66", "initiator_port": 49729, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 1102, "last_frame": 1113, "first_seen_epoch": "1722307153.029819", "last_seen_epoch": "1722307153.031629", "packets": 12, "bytes": 4354, "initiator_bytes": 2203, "responder_bytes": 2151 }, { "flow_id": "flow-212bf9a702337d0de8182eb7", "transport": "tcp", "stream": 58, "initiator_ip": "172.16.1.66", "initiator_port": 49730, "responder_ip": "23.198.7.175", "responder_port": 443, "first_frame": 1128, "last_frame": 9885, "first_seen_epoch": "1722307153.916627", "last_seen_epoch": "1722307263.866733", "packets": 33, "bytes": 8318, "initiator_bytes": 1808, "responder_bytes": 6510 }, { "flow_id": "flow-cc6e8bda4799c8d9cce0cc18", "transport": "tcp", "stream": 59, "initiator_ip": "172.16.1.66", "initiator_port": 49731, "responder_ip": "13.69.239.79", "responder_port": 443, "first_frame": 1159, "last_frame": 1230, "first_seen_epoch": "1722307154.626989", "last_seen_epoch": "1722307155.720403", "packets": 28, "bytes": 8220, "initiator_bytes": 2728, "responder_bytes": 5492 }, { "flow_id": "flow-c1e37d938eed7008db275384", "transport": "tcp", "stream": 60, "initiator_ip": "172.16.1.66", "initiator_port": 49732, "responder_ip": "23.52.9.222", "responder_port": 443, "first_frame": 1164, "last_frame": 1205, "first_seen_epoch": "1722307154.849466", "last_seen_epoch": "1722307155.249912", "packets": 20, "bytes": 5182, "initiator_bytes": 3312, "responder_bytes": 1870 }, { "flow_id": "flow-6a6a76f1b371b1d160657ccd", "transport": "tcp", "stream": 61, "initiator_ip": "172.16.1.66", "initiator_port": 49733, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 1177, "last_frame": 9887, "first_seen_epoch": "1722307155.052583", "last_seen_epoch": "1722307263.888386", "packets": 26, "bytes": 9896, "initiator_bytes": 2576, "responder_bytes": 7320 }, { "flow_id": "flow-90ef891cd448a67b63cfebbe", "transport": "udp", "stream": 17, "initiator_ip": "172.16.1.66", "initiator_port": 64662, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 1232, "last_frame": 1514, "first_seen_epoch": "1722307156.640743", "last_seen_epoch": "1722307164.121276", "packets": 5, "bytes": 588, "initiator_bytes": 296, "responder_bytes": 292 }, { "flow_id": "flow-9a45c3932d447fbb782209e2", "transport": "tcp", "stream": 62, "initiator_ip": "172.16.1.66", "initiator_port": 49734, "responder_ip": "23.198.7.175", "responder_port": 443, "first_frame": 1234, "last_frame": 10085, "first_seen_epoch": "1722307157.494197", "last_seen_epoch": "1722307332.157154", "packets": 156, "bytes": 120567, "initiator_bytes": 18563, "responder_bytes": 102004 }, { "flow_id": "flow-35b61fd3508da6c15de58dec", "transport": "udp", "stream": 18, "initiator_ip": "172.16.1.66", "initiator_port": 51396, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 1239, "last_frame": 9851, "first_seen_epoch": "1722307157.557179", "last_seen_epoch": "1722307245.942176", "packets": 33, "bytes": 4585, "initiator_bytes": 1603, "responder_bytes": 2982 }, { "flow_id": "flow-2e545f0f031ab643df7ed06c", "transport": "udp", "stream": 19, "initiator_ip": "172.16.1.66", "initiator_port": 62463, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 1253, "last_frame": 2509, "first_seen_epoch": "1722307157.666117", "last_seen_epoch": "1722307196.966901", "packets": 11, "bytes": 1253, "initiator_bytes": 530, "responder_bytes": 723 }, { "flow_id": "flow-07e45351e97c523b1d42c91e", "transport": "tcp", "stream": 63, "initiator_ip": "172.16.1.66", "initiator_port": 49735, "responder_ip": "52.109.6.53", "responder_port": 443, "first_frame": 1256, "last_frame": 9973, "first_seen_epoch": "1722307157.672173", "last_seen_epoch": "1722307290.958703", "packets": 37, "bytes": 10416, "initiator_bytes": 1727, "responder_bytes": 8689 }, { "flow_id": "flow-7e0bb683f1f65f216c8c430e", "transport": "tcp", "stream": 64, "initiator_ip": "172.16.1.66", "initiator_port": 49736, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 1257, "last_frame": 9893, "first_seen_epoch": "1722307157.679217", "last_seen_epoch": "1722307267.563748", "packets": 38, "bytes": 19531, "initiator_bytes": 2016, "responder_bytes": 17515 }, { "flow_id": "flow-4eb206edee24bf1922d21034", "transport": "tcp", "stream": 65, "initiator_ip": "172.16.1.66", "initiator_port": 49737, "responder_ip": "52.109.0.142", "responder_port": 443, "first_frame": 1414, "last_frame": 9963, "first_seen_epoch": "1722307158.609508", "last_seen_epoch": "1722307286.825363", "packets": 27, "bytes": 9080, "initiator_bytes": 1353, "responder_bytes": 7727 }, { "flow_id": "flow-0d3c8e2005ddff40b1802ca5", "transport": "tcp", "stream": 66, "initiator_ip": "172.16.1.66", "initiator_port": 49738, "responder_ip": "52.109.0.142", "responder_port": 443, "first_frame": 1450, "last_frame": 9931, "first_seen_epoch": "1722307163.273336", "last_seen_epoch": "1722307273.287436", "packets": 34, "bytes": 14280, "initiator_bytes": 2945, "responder_bytes": 11335 }, { "flow_id": "flow-4ad45314c74b17402967a34b", "transport": "tcp", "stream": 67, "initiator_ip": "172.16.1.66", "initiator_port": 49739, "responder_ip": "20.241.44.114", "responder_port": 443, "first_frame": 1454, "last_frame": 9047, "first_seen_epoch": "1722307163.375197", "last_seen_epoch": "1722307198.191652", "packets": 21, "bytes": 8509, "initiator_bytes": 1228, "responder_bytes": 7281 }, { "flow_id": "flow-ef3d891832bec66d67af4755", "transport": "tcp", "stream": 68, "initiator_ip": "172.16.1.66", "initiator_port": 49740, "responder_ip": "23.52.9.140", "responder_port": 443, "first_frame": 1495, "last_frame": 9933, "first_seen_epoch": "1722307163.75416", "last_seen_epoch": "1722307273.308496", "packets": 28, "bytes": 12241, "initiator_bytes": 1451, "responder_bytes": 10790 }, { "flow_id": "flow-71a99042aead1cd69512c187", "transport": "tcp", "stream": 69, "initiator_ip": "172.16.1.66", "initiator_port": 49741, "responder_ip": "20.7.2.167", "responder_port": 443, "first_frame": 1513, "last_frame": 11473, "first_seen_epoch": "1722307164.09388", "last_seen_epoch": "1722307639.886918", "packets": 36, "bytes": 10109, "initiator_bytes": 3677, "responder_bytes": 6432 }, { "flow_id": "flow-574d2317c246527f9caeb2ad", "transport": "tcp", "stream": 70, "initiator_ip": "172.16.1.66", "initiator_port": 49742, "responder_ip": "23.48.203.208", "responder_port": 443, "first_frame": 1515, "last_frame": 9588, "first_seen_epoch": "1722307164.129285", "last_seen_epoch": "1722307232.592018", "packets": 45, "bytes": 28407, "initiator_bytes": 2661, "responder_bytes": 25746 }, { "flow_id": "flow-59df5d1d2d232f0f0fa01875", "transport": "tcp", "stream": 71, "initiator_ip": "172.16.1.66", "initiator_port": 49743, "responder_ip": "23.48.203.208", "responder_port": 443, "first_frame": 1516, "last_frame": 9895, "first_seen_epoch": "1722307164.129371", "last_seen_epoch": "1722307267.584972", "packets": 74, "bytes": 65007, "initiator_bytes": 2586, "responder_bytes": 62421 }, { "flow_id": "flow-5c386abb2efb7307ad5e7b8b", "transport": "tcp", "stream": 72, "initiator_ip": "172.16.1.66", "initiator_port": 49744, "responder_ip": "13.107.5.93", "responder_port": 443, "first_frame": 1666, "last_frame": 9595, "first_seen_epoch": "1722307167.629882", "last_seen_epoch": "1722307233.201439", "packets": 28, "bytes": 17284, "initiator_bytes": 1817, "responder_bytes": 15467 }, { "flow_id": "flow-e01e6b191c417144514d521b", "transport": "tcp", "stream": 73, "initiator_ip": "172.16.1.66", "initiator_port": 49745, "responder_ip": "23.48.203.208", "responder_port": 443, "first_frame": 1715, "last_frame": 9590, "first_seen_epoch": "1722307171.994719", "last_seen_epoch": "1722307232.592081", "packets": 22, "bytes": 8879, "initiator_bytes": 1109, "responder_bytes": 7770 }, { "flow_id": "flow-836066622ec87778e372ea8d", "transport": "tcp", "stream": 74, "initiator_ip": "172.16.1.66", "initiator_port": 49746, "responder_ip": "23.48.203.208", "responder_port": 443, "first_frame": 1716, "last_frame": 9589, "first_seen_epoch": "1722307171.996546", "last_seen_epoch": "1722307232.592033", "packets": 24, "bytes": 11448, "initiator_bytes": 1300, "responder_bytes": 10148 }, { "flow_id": "flow-72b59ba7c7a61c11b0f1fcec", "transport": "udp", "stream": 20, "initiator_ip": "172.16.1.66", "initiator_port": 123, "responder_ip": "172.16.1.4", "responder_port": 123, "first_frame": 1759, "last_frame": 1760, "first_seen_epoch": "1722307173.975449", "last_seen_epoch": "1722307173.976468", "packets": 2, "bytes": 324, "initiator_bytes": 162, "responder_bytes": 162 }, { "flow_id": "flow-50a7aa645dd68ca5e6761ddb", "transport": "tcp", "stream": 75, "initiator_ip": "172.16.1.4", "initiator_port": 445, "responder_ip": "172.16.1.66", "responder_port": 49708, "first_frame": 1787, "last_frame": 1788, "first_seen_epoch": "1722307184.201467", "last_seen_epoch": "1722307184.201975", "packets": 2, "bytes": 109, "initiator_bytes": 55, "responder_bytes": 54 }, { "flow_id": "flow-70a6b66e8b870ab7b1d3e235", "transport": "tcp", "stream": 76, "initiator_ip": "172.16.1.66", "initiator_port": 49747, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 1792, "last_frame": 1803, "first_seen_epoch": "1722307188.954119", "last_seen_epoch": "1722307188.956762", "packets": 12, "bytes": 4525, "initiator_bytes": 2276, "responder_bytes": 2249 }, { "flow_id": "flow-9e95773828f65b7736385deb", "transport": "tcp", "stream": 77, "initiator_ip": "172.16.1.66", "initiator_port": 49748, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 1804, "last_frame": 1815, "first_seen_epoch": "1722307188.956873", "last_seen_epoch": "1722307188.958298", "packets": 12, "bytes": 4169, "initiator_bytes": 2069, "responder_bytes": 2100 }, { "flow_id": "flow-1fe9990cd9b4b2ec651a9584", "transport": "tcp", "stream": 78, "initiator_ip": "172.16.1.66", "initiator_port": 49749, "responder_ip": "140.82.113.3", "responder_port": 443, "first_frame": 1829, "last_frame": 1859, "first_seen_epoch": "1722307193.011903", "last_seen_epoch": "1722307193.816247", "packets": 28, "bytes": 9883, "initiator_bytes": 1392, "responder_bytes": 8491 }, { "flow_id": "flow-7132cc28649b6b06a7787b4a", "transport": "tcp", "stream": 79, "initiator_ip": "172.16.1.66", "initiator_port": 49750, "responder_ip": "185.199.110.133", "responder_port": 443, "first_frame": 1857, "last_frame": 9058, "first_seen_epoch": "1722307193.788197", "last_seen_epoch": "1722307199.819428", "packets": 653, "bytes": 833969, "initiator_bytes": 5068, "responder_bytes": 828901 }, { "flow_id": "flow-8d85b40e2c731de585e16d16", "transport": "tcp", "stream": 80, "initiator_ip": "172.16.1.66", "initiator_port": 49751, "responder_ip": "199.232.196.209", "responder_port": 443, "first_frame": 2510, "last_frame": 9065, "first_seen_epoch": "1722307196.968037", "last_seen_epoch": "1722307202.806473", "packets": 1172, "bytes": 1578208, "initiator_bytes": 5460, "responder_bytes": 1572748 }, { "flow_id": "flow-a246c3c542877d8443f58b78", "transport": "tcp", "stream": 81, "initiator_ip": "172.16.1.66", "initiator_port": 49752, "responder_ip": "199.232.196.209", "responder_port": 443, "first_frame": 2511, "last_frame": 9064, "first_seen_epoch": "1722307196.968253", "last_seen_epoch": "1722307202.806283", "packets": 3317, "bytes": 4514217, "initiator_bytes": 13576, "responder_bytes": 4500641 }, { "flow_id": "flow-72b8954a927a2fde579d1c61", "transport": "tcp", "stream": 82, "initiator_ip": "172.16.1.66", "initiator_port": 49753, "responder_ip": "199.232.196.209", "responder_port": 443, "first_frame": 2512, "last_frame": 9063, "first_seen_epoch": "1722307196.968421", "last_seen_epoch": "1722307202.806084", "packets": 2051, "bytes": 2802406, "initiator_bytes": 7692, "responder_bytes": 2794714 }, { "flow_id": "flow-ddc6580ab40426f9d03d52dd", "transport": "tcp", "stream": 83, "initiator_ip": "172.16.1.66", "initiator_port": 49754, "responder_ip": "141.98.10.79", "responder_port": 12132, "first_frame": 9066, "last_frame": 11562, "first_seen_epoch": "1722307205.953226", "last_seen_epoch": "1722307714.623212", "packets": 411, "bytes": 39064, "initiator_bytes": 27990, "responder_bytes": 11074 }, { "flow_id": "flow-0b716bf71a5a7c7215e4a0be", "transport": "tcp", "stream": 84, "initiator_ip": "172.16.1.66", "initiator_port": 49755, "responder_ip": "208.95.112.1", "responder_port": 80, "first_frame": 9108, "last_frame": 9116, "first_seen_epoch": "1722307206.922045", "last_seen_epoch": "1722307207.013466", "packets": 9, "bytes": 1161, "initiator_bytes": 470, "responder_bytes": 691 }, { "flow_id": "flow-669830409bf5969ee0a1a117", "transport": "tcp", "stream": 85, "initiator_ip": "172.16.1.66", "initiator_port": 49756, "responder_ip": "52.191.219.104", "responder_port": 443, "first_frame": 9164, "last_frame": 9202, "first_seen_epoch": "1722307211.848451", "last_seen_epoch": "1722307212.36616", "packets": 27, "bytes": 6738, "initiator_bytes": 1671, "responder_bytes": 5067 }, { "flow_id": "flow-228385d14b1bd08121aa9ba8", "transport": "tcp", "stream": 86, "initiator_ip": "172.16.1.66", "initiator_port": 49757, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9195, "last_frame": 9584, "first_seen_epoch": "1722307212.331591", "last_seen_epoch": "1722307232.573649", "packets": 23, "bytes": 6366, "initiator_bytes": 1082, "responder_bytes": 5284 }, { "flow_id": "flow-c55a02522bc3914822c28ab4", "transport": "tcp", "stream": 87, "initiator_ip": "172.16.1.66", "initiator_port": 49758, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9196, "last_frame": 9594, "first_seen_epoch": "1722307212.33194", "last_seen_epoch": "1722307232.621705", "packets": 25, "bytes": 6506, "initiator_bytes": 1136, "responder_bytes": 5370 }, { "flow_id": "flow-630057786d0843838291d2ca", "transport": "tcp", "stream": 88, "initiator_ip": "172.16.1.66", "initiator_port": 49759, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9197, "last_frame": 9583, "first_seen_epoch": "1722307212.332283", "last_seen_epoch": "1722307232.573551", "packets": 21, "bytes": 6289, "initiator_bytes": 1028, "responder_bytes": 5261 }, { "flow_id": "flow-a2f156660287cf3486482a8c", "transport": "tcp", "stream": 89, "initiator_ip": "172.16.1.66", "initiator_port": 49760, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9198, "last_frame": 9574, "first_seen_epoch": "1722307212.332416", "last_seen_epoch": "1722307232.48677", "packets": 21, "bytes": 6256, "initiator_bytes": 1028, "responder_bytes": 5228 }, { "flow_id": "flow-e363665ad0979a10491b32a2", "transport": "tcp", "stream": 90, "initiator_ip": "172.16.1.66", "initiator_port": 49761, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9199, "last_frame": 10162, "first_seen_epoch": "1722307212.332622", "last_seen_epoch": "1722307332.773326", "packets": 58, "bytes": 33472, "initiator_bytes": 2818, "responder_bytes": 30654 }, { "flow_id": "flow-56e72f83ec90c0909f0ffc4a", "transport": "tcp", "stream": 91, "initiator_ip": "172.16.1.66", "initiator_port": 49762, "responder_ip": "23.198.7.177", "responder_port": 443, "first_frame": 9200, "last_frame": 9578, "first_seen_epoch": "1722307212.332747", "last_seen_epoch": "1722307232.509657", "packets": 25, "bytes": 6489, "initiator_bytes": 1136, "responder_bytes": 5353 }, { "flow_id": "flow-78c6b5dbee5fd82f737a5395", "transport": "udp", "stream": 21, "initiator_ip": "172.16.1.66", "initiator_port": 62464, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9356, "last_frame": 9357, "first_seen_epoch": "1722307213.794832", "last_seen_epoch": "1722307213.795134", "packets": 2, "bytes": 540, "initiator_bytes": 285, "responder_bytes": 255 }, { "flow_id": "flow-9eaa28d38e474abfa532dfa5", "transport": "tcp", "stream": 92, "initiator_ip": "172.16.1.66", "initiator_port": 49763, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 9358, "last_frame": 9428, "first_seen_epoch": "1722307213.914826", "last_seen_epoch": "1722307213.946535", "packets": 10, "bytes": 1704, "initiator_bytes": 832, "responder_bytes": 872 }, { "flow_id": "flow-2bae8f6bcb31873866c1c77a", "transport": "tcp", "stream": 93, "initiator_ip": "172.16.1.66", "initiator_port": 49764, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 9365, "last_frame": 9429, "first_seen_epoch": "1722307213.921794", "last_seen_epoch": "1722307213.946722", "packets": 22, "bytes": 7039, "initiator_bytes": 4554, "responder_bytes": 2485 }, { "flow_id": "flow-07b4244ef3a8f9da361edb1d", "transport": "tcp", "stream": 94, "initiator_ip": "172.16.1.66", "initiator_port": 49765, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9388, "last_frame": 9427, "first_seen_epoch": "1722307213.933014", "last_seen_epoch": "1722307213.942892", "packets": 22, "bytes": 8206, "initiator_bytes": 3847, "responder_bytes": 4359 }, { "flow_id": "flow-14c63ad036be4016b959f7ac", "transport": "tcp", "stream": 95, "initiator_ip": "172.16.1.66", "initiator_port": 49766, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9406, "last_frame": 9423, "first_seen_epoch": "1722307213.938802", "last_seen_epoch": "1722307213.942454", "packets": 18, "bytes": 7478, "initiator_bytes": 3199, "responder_bytes": 4279 }, { "flow_id": "flow-e2ca6d5a8e262ce6bd06a728", "transport": "tcp", "stream": 96, "initiator_ip": "172.16.1.66", "initiator_port": 49767, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 9430, "last_frame": 9525, "first_seen_epoch": "1722307214.117767", "last_seen_epoch": "1722307215.094355", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-38697e1dd32bdd43f17aae50", "transport": "tcp", "stream": 97, "initiator_ip": "172.16.1.66", "initiator_port": 49768, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 9437, "last_frame": 9526, "first_seen_epoch": "1722307214.120758", "last_seen_epoch": "1722307215.094451", "packets": 23, "bytes": 7045, "initiator_bytes": 4560, "responder_bytes": 2485 }, { "flow_id": "flow-25ae77db19e448cdd52d0785", "transport": "tcp", "stream": 98, "initiator_ip": "172.16.1.66", "initiator_port": 49769, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9460, "last_frame": 9497, "first_seen_epoch": "1722307214.130058", "last_seen_epoch": "1722307214.140301", "packets": 22, "bytes": 8158, "initiator_bytes": 3799, "responder_bytes": 4359 }, { "flow_id": "flow-906d045421ca4272419a3169", "transport": "tcp", "stream": 99, "initiator_ip": "172.16.1.66", "initiator_port": 49770, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9478, "last_frame": 9493, "first_seen_epoch": "1722307214.135478", "last_seen_epoch": "1722307214.139639", "packets": 16, "bytes": 7322, "initiator_bytes": 3097, "responder_bytes": 4225 }, { "flow_id": "flow-d12c38dd8b46b15f884d4c61", "transport": "tcp", "stream": 100, "initiator_ip": "172.16.1.66", "initiator_port": 49771, "responder_ip": "40.126.29.14", "responder_port": 443, "first_frame": 9502, "last_frame": 9527, "first_seen_epoch": "1722307214.266834", "last_seen_epoch": "1722307215.094929", "packets": 24, "bytes": 8182, "initiator_bytes": 2007, "responder_bytes": 6175 }, { "flow_id": "flow-8f58938d6110e3feee03f109", "transport": "tcp", "stream": 101, "initiator_ip": "172.16.1.66", "initiator_port": 49772, "responder_ip": "23.48.203.203", "responder_port": 443, "first_frame": 9541, "last_frame": 10625, "first_seen_epoch": "1722307225.688095", "last_seen_epoch": "1722307373.909845", "packets": 32, "bytes": 14654, "initiator_bytes": 1822, "responder_bytes": 12832 }, { "flow_id": "flow-18f37e4b953402c4ed7063ed", "transport": "udp", "stream": 22, "initiator_ip": "172.16.1.66", "initiator_port": 62468, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 9596, "last_frame": 9724, "first_seen_epoch": "1722307233.647114", "last_seen_epoch": "1722307239.669881", "packets": 8, "bytes": 1432, "initiator_bytes": 1432, "responder_bytes": 0 }, { "flow_id": "flow-688aa324de7b9a3ec634bb6a", "transport": "tcp", "stream": 102, "initiator_ip": "172.16.1.66", "initiator_port": 49776, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 9606, "last_frame": 9864, "first_seen_epoch": "1722307237.775635", "last_seen_epoch": "1722307251.280994", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-824a734dba82d56a435f011a", "transport": "tcp", "stream": 103, "initiator_ip": "172.16.1.66", "initiator_port": 49777, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 9613, "last_frame": 9865, "first_seen_epoch": "1722307237.777408", "last_seen_epoch": "1722307251.281038", "packets": 16, "bytes": 2418, "initiator_bytes": 1456, "responder_bytes": 962 }, { "flow_id": "flow-d31eedb59b35a50046c83cd6", "transport": "tcp", "stream": 104, "initiator_ip": "172.16.1.66", "initiator_port": 49778, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 9630, "last_frame": 9727, "first_seen_epoch": "1722307239.006784", "last_seen_epoch": "1722307239.820562", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-58f9e681d50e0baf45ddd651", "transport": "tcp", "stream": 105, "initiator_ip": "172.16.1.66", "initiator_port": 49779, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 9637, "last_frame": 9728, "first_seen_epoch": "1722307239.010316", "last_seen_epoch": "1722307239.820752", "packets": 23, "bytes": 7045, "initiator_bytes": 4560, "responder_bytes": 2485 }, { "flow_id": "flow-0753ab235e36b989d80d403c", "transport": "tcp", "stream": 106, "initiator_ip": "172.16.1.66", "initiator_port": 49780, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9660, "last_frame": 9699, "first_seen_epoch": "1722307239.019898", "last_seen_epoch": "1722307239.031078", "packets": 22, "bytes": 8158, "initiator_bytes": 3799, "responder_bytes": 4359 }, { "flow_id": "flow-22cb26e668828197caa7a1c8", "transport": "tcp", "stream": 107, "initiator_ip": "172.16.1.66", "initiator_port": 49781, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9678, "last_frame": 9695, "first_seen_epoch": "1722307239.026222", "last_seen_epoch": "1722307239.030639", "packets": 18, "bytes": 7430, "initiator_bytes": 3151, "responder_bytes": 4279 }, { "flow_id": "flow-dcb7ee5880a0c3ae6dc1aae7", "transport": "tcp", "stream": 108, "initiator_ip": "172.16.1.66", "initiator_port": 49782, "responder_ip": "40.126.29.14", "responder_port": 443, "first_frame": 9701, "last_frame": 9729, "first_seen_epoch": "1722307239.061501", "last_seen_epoch": "1722307239.821341", "packets": 24, "bytes": 8183, "initiator_bytes": 2007, "responder_bytes": 6176 }, { "flow_id": "flow-347d8e76ca95708cf161ae63", "transport": "tcp", "stream": 109, "initiator_ip": "172.16.1.66", "initiator_port": 49783, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9734, "last_frame": 9763, "first_seen_epoch": "1722307241.102579", "last_seen_epoch": "1722307241.11132", "packets": 18, "bytes": 7009, "initiator_bytes": 3178, "responder_bytes": 3831 }, { "flow_id": "flow-62916d5e46e18c0a1cad98a4", "transport": "tcp", "stream": 110, "initiator_ip": "172.16.1.66", "initiator_port": 49784, "responder_ip": "172.16.1.4", "responder_port": 88, "first_frame": 9742, "last_frame": 9753, "first_seen_epoch": "1722307241.105111", "last_seen_epoch": "1722307241.107112", "packets": 12, "bytes": 4429, "initiator_bytes": 2228, "responder_bytes": 2201 }, { "flow_id": "flow-32b15ad66d7edab9b1527f1f", "transport": "tcp", "stream": 111, "initiator_ip": "172.16.1.66", "initiator_port": 49785, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 9764, "last_frame": 9776, "first_seen_epoch": "1722307241.121024", "last_seen_epoch": "1722307241.124144", "packets": 13, "bytes": 3454, "initiator_bytes": 2720, "responder_bytes": 734 }, { "flow_id": "flow-06447da9472b59fab369356d", "transport": "udp", "stream": 23, "initiator_ip": "172.16.1.66", "initiator_port": 59975, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 9778, "last_frame": 10345, "first_seen_epoch": "1722307241.806813", "last_seen_epoch": "1722307339.486871", "packets": 14, "bytes": 2061, "initiator_bytes": 738, "responder_bytes": 1323 }, { "flow_id": "flow-7053d688fe6fe4c1331d4a47", "transport": "tcp", "stream": 112, "initiator_ip": "172.16.1.66", "initiator_port": 49786, "responder_ip": "20.166.2.191", "responder_port": 443, "first_frame": 9780, "last_frame": 9844, "first_seen_epoch": "1722307241.909758", "last_seen_epoch": "1722307243.642312", "packets": 30, "bytes": 9890, "initiator_bytes": 4270, "responder_bytes": 5620 }, { "flow_id": "flow-cb779923d08bdba6143f151a", "transport": "tcp", "stream": 113, "initiator_ip": "172.16.1.66", "initiator_port": 49787, "responder_ip": "13.107.42.16", "responder_port": 443, "first_frame": 9809, "last_frame": 9842, "first_seen_epoch": "1722307242.95745", "last_seen_epoch": "1722307243.546702", "packets": 32, "bytes": 11853, "initiator_bytes": 3584, "responder_bytes": 8269 }, { "flow_id": "flow-1ef0fdf29d285b08c3c5b2cf", "transport": "udp", "stream": 24, "initiator_ip": "172.16.1.4", "initiator_port": 137, "responder_ip": "172.16.1.66", "responder_port": 137, "first_frame": 9902, "last_frame": 9902, "first_seen_epoch": "1722307270.494127", "last_seen_epoch": "1722307270.494127", "packets": 1, "bytes": 104, "initiator_bytes": 104, "responder_bytes": 0 }, { "flow_id": "flow-85282acabac80dfe270e17dc", "transport": "tcp", "stream": 114, "initiator_ip": "172.16.1.66", "initiator_port": 49788, "responder_ip": "172.16.1.4", "responder_port": 139, "first_frame": 9903, "last_frame": 9962, "first_seen_epoch": "1722307270.494332", "last_seen_epoch": "1722307285.735224", "packets": 28, "bytes": 3912, "initiator_bytes": 1851, "responder_bytes": 2061 }, { "flow_id": "flow-bc6df5756b3434fa44ef38e9", "transport": "tcp", "stream": 115, "initiator_ip": "172.16.1.66", "initiator_port": 49789, "responder_ip": "172.16.1.4", "responder_port": 139, "first_frame": 9982, "last_frame": 10019, "first_seen_epoch": "1722307300.506361", "last_seen_epoch": "1722307312.614161", "packets": 26, "bytes": 3724, "initiator_bytes": 1785, "responder_bytes": 1939 }, { "flow_id": "flow-d47727928b27b68563ede70f", "transport": "tcp", "stream": 116, "initiator_ip": "172.16.1.66", "initiator_port": 49790, "responder_ip": "172.16.1.4", "responder_port": 139, "first_frame": 10040, "last_frame": 10418, "first_seen_epoch": "1722307330.536477", "last_seen_epoch": "1722307344.803466", "packets": 26, "bytes": 3724, "initiator_bytes": 1785, "responder_bytes": 1939 }, { "flow_id": "flow-1de0878187c3aa8d892f0668", "transport": "tcp", "stream": 117, "initiator_ip": "172.16.1.66", "initiator_port": 49791, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 10062, "last_frame": 10079, "first_seen_epoch": "1722307332.006354", "last_seen_epoch": "1722307332.014399", "packets": 18, "bytes": 7648, "initiator_bytes": 3615, "responder_bytes": 4033 }, { "flow_id": "flow-8072c261a050cd4088ef1a7a", "transport": "tcp", "stream": 118, "initiator_ip": "172.16.1.66", "initiator_port": 49792, "responder_ip": "52.109.0.91", "responder_port": 443, "first_frame": 10081, "last_frame": 10600, "first_seen_epoch": "1722307332.138492", "last_seen_epoch": "1722307366.267396", "packets": 46, "bytes": 39650, "initiator_bytes": 1686, "responder_bytes": 37964 }, { "flow_id": "flow-ff12b43389372fab6b28afb0", "transport": "udp", "stream": 25, "initiator_ip": "172.16.1.66", "initiator_port": 59905, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10131, "last_frame": 11233, "first_seen_epoch": "1722307332.626466", "last_seen_epoch": "1722307469.440539", "packets": 21, "bytes": 3168, "initiator_bytes": 1046, "responder_bytes": 2122 }, { "flow_id": "flow-4d08066ad23955b615dab1c9", "transport": "tcp", "stream": 119, "initiator_ip": "172.16.1.66", "initiator_port": 49793, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 10133, "last_frame": 10604, "first_seen_epoch": "1722307332.666639", "last_seen_epoch": "1722307366.268994", "packets": 63, "bytes": 68284, "initiator_bytes": 1895, "responder_bytes": 66389 }, { "flow_id": "flow-75c6ff63fadc3e53942f6d66", "transport": "tcp", "stream": 120, "initiator_ip": "172.16.1.66", "initiator_port": 49794, "responder_ip": "52.109.20.47", "responder_port": 443, "first_frame": 10135, "last_frame": 10601, "first_seen_epoch": "1722307332.703506", "last_seen_epoch": "1722307366.268359", "packets": 22, "bytes": 9810, "initiator_bytes": 1537, "responder_bytes": 8273 }, { "flow_id": "flow-4b6d34939ad0b18605ded93b", "transport": "tcp", "stream": 121, "initiator_ip": "172.16.1.66", "initiator_port": 49795, "responder_ip": "52.109.20.47", "responder_port": 443, "first_frame": 10136, "last_frame": 10603, "first_seen_epoch": "1722307332.703548", "last_seen_epoch": "1722307366.268738", "packets": 21, "bytes": 9756, "initiator_bytes": 1537, "responder_bytes": 8219 }, { "flow_id": "flow-d2138b3b22f3439970ca894c", "transport": "tcp", "stream": 122, "initiator_ip": "172.16.1.66", "initiator_port": 49796, "responder_ip": "52.109.20.47", "responder_port": 443, "first_frame": 10137, "last_frame": 10602, "first_seen_epoch": "1722307332.705882", "last_seen_epoch": "1722307366.268633", "packets": 19, "bytes": 9334, "initiator_bytes": 1116, "responder_bytes": 8218 }, { "flow_id": "flow-9e2f93cee3ca355d05240c70", "transport": "tcp", "stream": 123, "initiator_ip": "172.16.1.66", "initiator_port": 49797, "responder_ip": "52.109.20.47", "responder_port": 443, "first_frame": 10138, "last_frame": 10605, "first_seen_epoch": "1722307332.706027", "last_seen_epoch": "1722307366.269248", "packets": 19, "bytes": 9335, "initiator_bytes": 1116, "responder_bytes": 8219 }, { "flow_id": "flow-c8bc25b1861ffa9f4f0a7f49", "transport": "tcp", "stream": 124, "initiator_ip": "172.16.1.66", "initiator_port": 49798, "responder_ip": "40.97.199.114", "responder_port": 443, "first_frame": 10279, "last_frame": 10606, "first_seen_epoch": "1722307333.287737", "last_seen_epoch": "1722307366.269468", "packets": 20, "bytes": 8025, "initiator_bytes": 1737, "responder_bytes": 6288 }, { "flow_id": "flow-bfba0d3f34b0a75c1db2172d", "transport": "udp", "stream": 26, "initiator_ip": "172.16.1.66", "initiator_port": 59906, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 10298, "last_frame": 10299, "first_seen_epoch": "1722307333.585569", "last_seen_epoch": "1722307333.585889", "packets": 2, "bytes": 504, "initiator_bytes": 249, "responder_bytes": 255 }, { "flow_id": "flow-1b321c4e5a91834cde0e9af7", "transport": "tcp", "stream": 125, "initiator_ip": "172.16.1.66", "initiator_port": 49799, "responder_ip": "172.16.1.4", "responder_port": 443, "first_frame": 10301, "last_frame": 10302, "first_seen_epoch": "1722307333.628727", "last_seen_epoch": "1722307333.628916", "packets": 2, "bytes": 120, "initiator_bytes": 66, "responder_bytes": 54 }, { "flow_id": "flow-f6eb372375792dbf50860280", "transport": "tcp", "stream": 126, "initiator_ip": "172.16.1.66", "initiator_port": 49800, "responder_ip": "172.16.1.4", "responder_port": 3268, "first_frame": 10304, "last_frame": 10321, "first_seen_epoch": "1722307333.688602", "last_seen_epoch": "1722307333.696098", "packets": 18, "bytes": 7396, "initiator_bytes": 3394, "responder_bytes": 4002 }, { "flow_id": "flow-b8fc3875248511f2dee95bdf", "transport": "tcp", "stream": 127, "initiator_ip": "172.16.1.66", "initiator_port": 49799, "responder_ip": "172.16.1.4", "responder_port": 443, "first_frame": 10326, "last_frame": 10327, "first_seen_epoch": "1722307334.14148", "last_seen_epoch": "1722307334.141668", "packets": 2, "bytes": 120, "initiator_bytes": 66, "responder_bytes": 54 }, { "flow_id": "flow-0e41355a748d944716b739be", "transport": "tcp", "stream": 128, "initiator_ip": "172.16.1.66", "initiator_port": 49799, "responder_ip": "172.16.1.4", "responder_port": 443, "first_frame": 10328, "last_frame": 10329, "first_seen_epoch": "1722307334.657652", "last_seen_epoch": "1722307334.658081", "packets": 2, "bytes": 120, "initiator_bytes": 66, "responder_bytes": 54 }, { "flow_id": "flow-3a221a0a45639550eca2a689", "transport": "tcp", "stream": 129, "initiator_ip": "172.16.1.66", "initiator_port": 49799, "responder_ip": "172.16.1.4", "responder_port": 443, "first_frame": 10330, "last_frame": 10331, "first_seen_epoch": "1722307335.172965", "last_seen_epoch": "1722307335.173345", "packets": 2, "bytes": 120, "initiator_bytes": 66, "responder_bytes": 54 }, { "flow_id": "flow-8d1509e5510e10a730e13a2f", "transport": "tcp", "stream": 130, "initiator_ip": "172.16.1.66", "initiator_port": 49799, "responder_ip": "172.16.1.4", "responder_port": 443, "first_frame": 10332, "last_frame": 10333, "first_seen_epoch": "1722307335.70432", "last_seen_epoch": "1722307335.704601", "packets": 2, "bytes": 120, "initiator_bytes": 66, "responder_bytes": 54 }, { "flow_id": "flow-a6a63d59b4165d83c4083f4c", "transport": "tcp", "stream": 131, "initiator_ip": "172.16.1.66", "initiator_port": 49801, "responder_ip": "20.189.173.10", "responder_port": 443, "first_frame": 10346, "last_frame": 10607, "first_seen_epoch": "1722307339.487531", "last_seen_epoch": "1722307366.269725", "packets": 59, "bytes": 35456, "initiator_bytes": 26814, "responder_bytes": 8642 }, { "flow_id": "flow-931a78e548a9075f59bf0242", "transport": "tcp", "stream": 132, "initiator_ip": "172.16.1.66", "initiator_port": 49802, "responder_ip": "23.221.22.68", "responder_port": 443, "first_frame": 10421, "last_frame": 10608, "first_seen_epoch": "1722307345.578458", "last_seen_epoch": "1722307366.269922", "packets": 18, "bytes": 7493, "initiator_bytes": 1613, "responder_bytes": 5880 }, { "flow_id": "flow-a1c5039fc55029e3287e2207", "transport": "tcp", "stream": 133, "initiator_ip": "172.16.1.66", "initiator_port": 49803, "responder_ip": "20.189.173.26", "responder_port": 443, "first_frame": 10450, "last_frame": 10570, "first_seen_epoch": "1722307356.013842", "last_seen_epoch": "1722307357.337905", "packets": 121, "bytes": 70374, "initiator_bytes": 61918, "responder_bytes": 8456 }, { "flow_id": "flow-bd8074b503e730c3fb8f3982", "transport": "tcp", "stream": 134, "initiator_ip": "172.16.1.66", "initiator_port": 49804, "responder_ip": "172.16.1.4", "responder_port": 139, "first_frame": 10575, "last_frame": 10621, "first_seen_epoch": "1722307360.554306", "last_seen_epoch": "1722307371.647071", "packets": 26, "bytes": 3724, "initiator_bytes": 1785, "responder_bytes": 1939 }, { "flow_id": "flow-d5267350b8bda33261800c94", "transport": "tcp", "stream": 135, "initiator_ip": "172.16.1.66", "initiator_port": 49805, "responder_ip": "172.16.1.4", "responder_port": 139, "first_frame": 10647, "last_frame": 10682, "first_seen_epoch": "1722307390.585153", "last_seen_epoch": "1722307403.86652", "packets": 26, "bytes": 3724, "initiator_bytes": 1785, "responder_bytes": 1939 }, { "flow_id": "flow-a6dff77d8c1e96d25b6d66ed", "transport": "tcp", "stream": 136, "initiator_ip": "172.16.1.66", "initiator_port": 49806, "responder_ip": "172.16.1.4", "responder_port": 135, "first_frame": 10738, "last_frame": 11226, "first_seen_epoch": "1722307453.815139", "last_seen_epoch": "1722307465.962531", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-b4a189efeda815602e83535a", "transport": "tcp", "stream": 137, "initiator_ip": "172.16.1.66", "initiator_port": 49807, "responder_ip": "172.16.1.4", "responder_port": 49667, "first_frame": 10745, "last_frame": 11302, "first_seen_epoch": "1722307453.816835", "last_seen_epoch": "1722307485.961659", "packets": 20, "bytes": 5291, "initiator_bytes": 3872, "responder_bytes": 1419 }, { "flow_id": "flow-ef15de866d1050901d3a189d", "transport": "udp", "stream": 27, "initiator_ip": "172.16.1.66", "initiator_port": 55637, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10768, "last_frame": 10770, "first_seen_epoch": "1722307455.631145", "last_seen_epoch": "1722307455.696863", "packets": 2, "bytes": 225, "initiator_bytes": 75, "responder_bytes": 150 }, { "flow_id": "flow-5a2c3c9215bdb6699eb0aef0", "transport": "udp", "stream": 28, "initiator_ip": "172.16.1.66", "initiator_port": 50658, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10769, "last_frame": 10773, "first_seen_epoch": "1722307455.631368", "last_seen_epoch": "1722307455.72076", "packets": 2, "bytes": 209, "initiator_bytes": 75, "responder_bytes": 134 }, { "flow_id": "flow-7cdcf4a3a3a27626b5ebd8ca", "transport": "tcp", "stream": 138, "initiator_ip": "172.16.1.66", "initiator_port": 49808, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10771, "last_frame": 11205, "first_seen_epoch": "1722307455.712878", "last_seen_epoch": "1722307460.038816", "packets": 23, "bytes": 10422, "initiator_bytes": 3060, "responder_bytes": 7362 }, { "flow_id": "flow-d216d03b71e859034eafdb82", "transport": "tcp", "stream": 139, "initiator_ip": "172.16.1.66", "initiator_port": 49809, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10772, "last_frame": 11202, "first_seen_epoch": "1722307455.713094", "last_seen_epoch": "1722307460.038653", "packets": 23, "bytes": 10294, "initiator_bytes": 2932, "responder_bytes": 7362 }, { "flow_id": "flow-74fa698d69c47162414c5398", "transport": "udp", "stream": 28, "initiator_ip": "172.16.1.66", "initiator_port": 53, "responder_ip": "172.16.1.4", "responder_port": 50658, "first_frame": 10774, "last_frame": 10774, "first_seen_epoch": "1722307455.720959", "last_seen_epoch": "1722307455.720959", "packets": 1, "bytes": 162, "initiator_bytes": 162, "responder_bytes": 0 }, { "flow_id": "flow-4de50fd7ef56d405aac4f9d8", "transport": "udp", "stream": 29, "initiator_ip": "172.16.1.66", "initiator_port": 55856, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10813, "last_frame": 10816, "first_seen_epoch": "1722307456.394861", "last_seen_epoch": "1722307456.395453", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-82dd6b102bdca0e2aa15c438", "transport": "udp", "stream": 30, "initiator_ip": "172.16.1.66", "initiator_port": 52530, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10814, "last_frame": 10815, "first_seen_epoch": "1722307456.394983", "last_seen_epoch": "1722307456.395379", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-8c3144be67fe1837b0c4e562", "transport": "tcp", "stream": 140, "initiator_ip": "172.16.1.66", "initiator_port": 49810, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10817, "last_frame": 11211, "first_seen_epoch": "1722307456.396798", "last_seen_epoch": "1722307460.0396", "packets": 48, "bytes": 25673, "initiator_bytes": 4805, "responder_bytes": 20868 }, { "flow_id": "flow-39707465d7f07fca70d8127d", "transport": "tcp", "stream": 141, "initiator_ip": "172.16.1.66", "initiator_port": 49811, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 10828, "last_frame": 10843, "first_seen_epoch": "1722307456.675654", "last_seen_epoch": "1722307456.68098", "packets": 16, "bytes": 6901, "initiator_bytes": 3124, "responder_bytes": 3777 }, { "flow_id": "flow-343d1bb626ddab713ad11f6d", "transport": "tcp", "stream": 142, "initiator_ip": "172.16.1.66", "initiator_port": 49812, "responder_ip": "172.16.1.4", "responder_port": 389, "first_frame": 10845, "last_frame": 10857, "first_seen_epoch": "1722307456.688635", "last_seen_epoch": "1722307456.691619", "packets": 11, "bytes": 3346, "initiator_bytes": 2666, "responder_bytes": 680 }, { "flow_id": "flow-e06d1a49917f49c20e2efda1", "transport": "udp", "stream": 31, "initiator_ip": "172.16.1.66", "initiator_port": 56529, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10882, "last_frame": 10887, "first_seen_epoch": "1722307457.084249", "last_seen_epoch": "1722307457.15161", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-bf5962e0e0e4ad1613a41493", "transport": "udp", "stream": 32, "initiator_ip": "172.16.1.66", "initiator_port": 64049, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10883, "last_frame": 10886, "first_seen_epoch": "1722307457.084322", "last_seen_epoch": "1722307457.130075", "packets": 2, "bytes": 187, "initiator_bytes": 71, "responder_bytes": 116 }, { "flow_id": "flow-85826ceb4794c8d73fa266ca", "transport": "udp", "stream": 33, "initiator_ip": "172.16.1.66", "initiator_port": 59386, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10884, "last_frame": 10888, "first_seen_epoch": "1722307457.085408", "last_seen_epoch": "1722307457.151764", "packets": 2, "bytes": 366, "initiator_bytes": 74, "responder_bytes": 292 }, { "flow_id": "flow-ffeb35fdf845834a8ca6d023", "transport": "udp", "stream": 34, "initiator_ip": "172.16.1.66", "initiator_port": 61940, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10885, "last_frame": 10891, "first_seen_epoch": "1722307457.085581", "last_seen_epoch": "1722307457.215525", "packets": 2, "bytes": 222, "initiator_bytes": 74, "responder_bytes": 148 }, { "flow_id": "flow-d13af597d8c7e7b5a785a1e2", "transport": "tcp", "stream": 143, "initiator_ip": "172.16.1.66", "initiator_port": 49813, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10889, "last_frame": 11210, "first_seen_epoch": "1722307457.153805", "last_seen_epoch": "1722307460.039535", "packets": 36, "bytes": 14221, "initiator_bytes": 4071, "responder_bytes": 10150 }, { "flow_id": "flow-69c172e343d2ffccb05d0d5f", "transport": "tcp", "stream": 144, "initiator_ip": "172.16.1.66", "initiator_port": 49814, "responder_ip": "23.53.11.166", "responder_port": 443, "first_frame": 10890, "last_frame": 11212, "first_seen_epoch": "1722307457.1802", "last_seen_epoch": "1722307460.039639", "packets": 85, "bytes": 58051, "initiator_bytes": 5226, "responder_bytes": 52825 }, { "flow_id": "flow-2475ebc861435f34fd4891bd", "transport": "udp", "stream": 34, "initiator_ip": "172.16.1.66", "initiator_port": 53, "responder_ip": "172.16.1.4", "responder_port": 61940, "first_frame": 10892, "last_frame": 10892, "first_seen_epoch": "1722307457.215675", "last_seen_epoch": "1722307457.215675", "packets": 1, "bytes": 176, "initiator_bytes": 176, "responder_bytes": 0 }, { "flow_id": "flow-8ade30a9650d1d8810508303", "transport": "tcp", "stream": 145, "initiator_ip": "172.16.1.66", "initiator_port": 49815, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10908, "last_frame": 10934, "first_seen_epoch": "1722307457.460082", "last_seen_epoch": "1722307457.582343", "packets": 3, "bytes": 178, "initiator_bytes": 120, "responder_bytes": 58 }, { "flow_id": "flow-074c7ff71a2c5ea4a3724211", "transport": "udp", "stream": 35, "initiator_ip": "172.16.1.66", "initiator_port": 58319, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10909, "last_frame": 10911, "first_seen_epoch": "1722307457.468275", "last_seen_epoch": "1722307457.468893", "packets": 2, "bytes": 237, "initiator_bytes": 72, "responder_bytes": 165 }, { "flow_id": "flow-f9533722c0ba4fcee2bcba58", "transport": "udp", "stream": 36, "initiator_ip": "172.16.1.66", "initiator_port": 50142, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10910, "last_frame": 10912, "first_seen_epoch": "1722307457.468577", "last_seen_epoch": "1722307457.46895", "packets": 2, "bytes": 278, "initiator_bytes": 72, "responder_bytes": 206 }, { "flow_id": "flow-01b92f7839c0a7869878f47f", "transport": "tcp", "stream": 146, "initiator_ip": "172.16.1.66", "initiator_port": 49816, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 10913, "last_frame": 11204, "first_seen_epoch": "1722307457.469836", "last_seen_epoch": "1722307460.038711", "packets": 23, "bytes": 10352, "initiator_bytes": 2990, "responder_bytes": 7362 }, { "flow_id": "flow-8df73b14d844b00ca69ebe90", "transport": "udp", "stream": 37, "initiator_ip": "172.16.1.66", "initiator_port": 50831, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10949, "last_frame": 10958, "first_seen_epoch": "1722307457.59457", "last_seen_epoch": "1722307457.735297", "packets": 2, "bytes": 403, "initiator_bytes": 71, "responder_bytes": 332 }, { "flow_id": "flow-6edf5beedb3fd0b5496fccee", "transport": "udp", "stream": 38, "initiator_ip": "172.16.1.66", "initiator_port": 58238, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10950, "last_frame": 10957, "first_seen_epoch": "1722307457.594916", "last_seen_epoch": "1722307457.73518", "packets": 2, "bytes": 259, "initiator_bytes": 71, "responder_bytes": 188 }, { "flow_id": "flow-d306cf7b9485688bcb46fa12", "transport": "udp", "stream": 39, "initiator_ip": "172.16.1.66", "initiator_port": 54510, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10951, "last_frame": 10959, "first_seen_epoch": "1722307457.670395", "last_seen_epoch": "1722307457.735336", "packets": 2, "bytes": 239, "initiator_bytes": 87, "responder_bytes": 152 }, { "flow_id": "flow-eea382aab366cdafd9ea6efc", "transport": "udp", "stream": 40, "initiator_ip": "172.16.1.66", "initiator_port": 63424, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 10952, "last_frame": 10972, "first_seen_epoch": "1722307457.670594", "last_seen_epoch": "1722307457.790314", "packets": 2, "bytes": 207, "initiator_bytes": 87, "responder_bytes": 120 }, { "flow_id": "flow-9717cce7b724e8c7336880be", "transport": "tcp", "stream": 147, "initiator_ip": "172.16.1.66", "initiator_port": 49817, "responder_ip": "23.198.7.168", "responder_port": 443, "first_frame": 10962, "last_frame": 11213, "first_seen_epoch": "1722307457.737302", "last_seen_epoch": "1722307460.039708", "packets": 65, "bytes": 47809, "initiator_bytes": 3889, "responder_bytes": 43920 }, { "flow_id": "flow-3132aa7462807c8f4a663d57", "transport": "tcp", "stream": 148, "initiator_ip": "172.16.1.66", "initiator_port": 49818, "responder_ip": "23.215.55.133", "responder_port": 443, "first_frame": 10966, "last_frame": 11201, "first_seen_epoch": "1722307457.759539", "last_seen_epoch": "1722307459.951286", "packets": 27, "bytes": 10080, "initiator_bytes": 3232, "responder_bytes": 6848 }, { "flow_id": "flow-eaebbc63d8caa13c247caf01", "transport": "udp", "stream": 41, "initiator_ip": "172.16.1.66", "initiator_port": 60123, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 11000, "last_frame": 11031, "first_seen_epoch": "1722307457.919944", "last_seen_epoch": "1722307457.99019", "packets": 2, "bytes": 270, "initiator_bytes": 84, "responder_bytes": 186 }, { "flow_id": "flow-50f8d75df34d372341138499", "transport": "udp", "stream": 42, "initiator_ip": "172.16.1.66", "initiator_port": 63490, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 11001, "last_frame": 11039, "first_seen_epoch": "1722307457.920102", "last_seen_epoch": "1722307458.040471", "packets": 2, "bytes": 254, "initiator_bytes": 84, "responder_bytes": 170 }, { "flow_id": "flow-b849406999c09f49eb7a1e62", "transport": "tcp", "stream": 149, "initiator_ip": "172.16.1.66", "initiator_port": 49819, "responder_ip": "23.46.192.165", "responder_port": 443, "first_frame": 11032, "last_frame": 11214, "first_seen_epoch": "1722307458.007422", "last_seen_epoch": "1722307460.039786", "packets": 44, "bytes": 30221, "initiator_bytes": 3372, "responder_bytes": 26849 }, { "flow_id": "flow-ca4cb535844647e6fba0d181", "transport": "udp", "stream": 42, "initiator_ip": "172.16.1.66", "initiator_port": 53, "responder_ip": "172.16.1.4", "responder_port": 63490, "first_frame": 11040, "last_frame": 11040, "first_seen_epoch": "1722307458.040574", "last_seen_epoch": "1722307458.040574", "packets": 1, "bytes": 198, "initiator_bytes": 198, "responder_bytes": 0 }, { "flow_id": "flow-c37943084d4558ea3f246202", "transport": "tcp", "stream": 150, "initiator_ip": "172.16.1.66", "initiator_port": 49820, "responder_ip": "23.194.164.136", "responder_port": 443, "first_frame": 11234, "last_frame": 11404, "first_seen_epoch": "1722307469.4442", "last_seen_epoch": "1722307579.426232", "packets": 55, "bytes": 48861, "initiator_bytes": 1399, "responder_bytes": 47462 }, { "flow_id": "flow-b8b0b41dc100ba634917bc01", "transport": "tcp", "stream": 151, "initiator_ip": "20.7.1.246", "initiator_port": 443, "responder_ip": "172.16.1.66", "responder_port": 49750, "first_frame": 11470, "last_frame": 11472, "first_seen_epoch": "1722307639.841191", "last_seen_epoch": "1722307639.841456", "packets": 2, "bytes": 259, "initiator_bytes": 205, "responder_bytes": 54 }, { "flow_id": "flow-da9498259c3a4a6c5e475f5b", "transport": "udp", "stream": 43, "initiator_ip": "172.16.1.66", "initiator_port": 61316, "responder_ip": "172.16.1.4", "responder_port": 53, "first_frame": 11474, "last_frame": 11476, "first_seen_epoch": "1722307639.923844", "last_seen_epoch": "1722307640.021468", "packets": 3, "bytes": 322, "initiator_bytes": 166, "responder_bytes": 156 } ], "events": { "dns": [ { "event_id": "evt-7c1eff6df53543b43365144a", "kind": "dns", "frame_number": 12, "timestamp_epoch": "1722307128.981301000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57773, "dst_port": 53, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-0bbed3437d00c3f9ac1adb4d", "kind": "dns", "frame_number": 13, "timestamp_epoch": "1722307128.981686000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57773, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-ae597f98bdedf938dbef02bf", "kind": "dns", "frame_number": 14, "timestamp_epoch": "1722307128.983844000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57773, "dst_port": 53, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.flags.response": "False", "dns.qry.name": "wireshark-ws-dc.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-517a7247e7444f0b7a313d0c", "kind": "dns", "frame_number": 15, "timestamp_epoch": "1722307128.984075000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57773, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "wireshark-ws-dc.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-cffa9f7a26de2329fadb33ac", "kind": "dns", "frame_number": 32, "timestamp_epoch": "1722307129.099969000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 54443, "dst_port": 53, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-42bdd67163607b30503a73c1", "kind": "dns", "frame_number": 33, "timestamp_epoch": "1722307129.100520000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 54443, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-faf7b300f8e69871f1102cef", "kind": "dns", "frame_number": 201, "timestamp_epoch": "1722307129.254606000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-727f4f4a0e585d553bc5e454", "kind": "dns", "frame_number": 202, "timestamp_epoch": "1722307129.254902000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-752374eb356507a3b62a4f8d", "kind": "dns", "frame_number": 230, "timestamp_epoch": "1722307129.280180000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-b9104b72d9fd17d11778e21e", "kind": "dns", "frame_number": 231, "timestamp_epoch": "1722307129.280355000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-3937320a41b6fdff6c6d9e23", "kind": "dns", "frame_number": 235, "timestamp_epoch": "1722307129.303735000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c10213b2e7caf78723e02557", "kind": "dns", "frame_number": 239, "timestamp_epoch": "1722307129.366654000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "20.189.173.16", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdwus17.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6d9392d9efc26bb18fb112bd", "kind": "dns", "frame_number": 254, "timestamp_epoch": "1722307129.415741000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-3951595712501fac609fef4f", "kind": "dns", "frame_number": 255, "timestamp_epoch": "1722307129.415994000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-1ff7b3a578218421d4e3bfe0", "kind": "dns", "frame_number": 281, "timestamp_epoch": "1722307129.438784000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-da5a2c8e1b08809ba596aba5", "kind": "dns", "frame_number": 282, "timestamp_epoch": "1722307129.438970000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-e119a7439f087b0e0fe17f1e", "kind": "dns", "frame_number": 292, "timestamp_epoch": "1722307129.530082000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 50203, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-8b3120d9cd6a72d6720b10b2", "kind": "dns", "frame_number": 293, "timestamp_epoch": "1722307129.530130000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57308, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-712cb65425c9d13f036835c0", "kind": "dns", "frame_number": 294, "timestamp_epoch": "1722307129.530426000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57308, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-faa540055100d425b07e02d5", "kind": "dns", "frame_number": 433, "timestamp_epoch": "1722307129.585895000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 50203, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "23.215.55.140,23.215.55.144", "dns.cname": "ncsi-geo.trafficmanager.net,www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-30625a43a840812b76f25cae", "kind": "dns", "frame_number": 532, "timestamp_epoch": "1722307129.987384000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57977, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-e44804006d780b5d3ad3c29c", "kind": "dns", "frame_number": 533, "timestamp_epoch": "1722307129.987691000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57977, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-01a11f05b631dca3c0edb76a", "kind": "dns", "frame_number": 626, "timestamp_epoch": "1722307132.536031000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-45a03a7af1428e19343cff42", "kind": "dns", "frame_number": 628, "timestamp_epoch": "1722307133.082666000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-f2280a37de1dd85e39f8b20c", "kind": "dns", "frame_number": 629, "timestamp_epoch": "1722307133.083161000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-0eb9f4ecba96d640eb667c7e", "kind": "dns", "frame_number": 672, "timestamp_epoch": "1722307133.534420000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-72c23f81e3fdff22a10e1bfe", "kind": "dns", "frame_number": 674, "timestamp_epoch": "1722307133.973694000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-SKBR25F.wiresharkworkshop.online", "dns.qry.type": "6" } }, { "event_id": "evt-152d99df5ce9ffd188c4af74", "kind": "dns", "frame_number": 675, "timestamp_epoch": "1722307133.974139000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-SKBR25F.wiresharkworkshop.online", "dns.qry.type": "6" } }, { "event_id": "evt-135812d533ab6ef814e117cd", "kind": "dns", "frame_number": 676, "timestamp_epoch": "1722307133.975534000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "172.16.1.66", "dns.flags.response": "False", "dns.qry.name": "wiresharkworkshop.online", "dns.qry.type": "6" } }, { "event_id": "evt-0f5112c51e0626299b7e17e1", "kind": "dns", "frame_number": 677, "timestamp_epoch": "1722307133.976648000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "172.16.1.66", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "wiresharkworkshop.online", "dns.qry.type": "6" } }, { "event_id": "evt-725593a8d1c0829a8a012a4d", "kind": "dns", "frame_number": 680, "timestamp_epoch": "1722307134.550047000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-30aa2663bf379f20416e4e74", "kind": "dns", "frame_number": 683, "timestamp_epoch": "1722307136.565828000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49844, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ec3a112024366af996293017", "kind": "dns", "frame_number": 684, "timestamp_epoch": "1722307136.806788000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 49844, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "23.52.9.222", "dns.cname": "go.microsoft.com.edgekey.net,e11290.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-160959897826ffd1fd607ea7", "kind": "dns", "frame_number": 906, "timestamp_epoch": "1722307147.508287000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57308, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-8447d25eec063a0f8e6341f6", "kind": "dns", "frame_number": 907, "timestamp_epoch": "1722307147.508334000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-0de1d5e6c9cbf8a63f353b09", "kind": "dns", "frame_number": 908, "timestamp_epoch": "1722307147.508687000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57308, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-a6ab1b9ec89e4868f23492cf", "kind": "dns", "frame_number": 909, "timestamp_epoch": "1722307147.508788000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-7964aa446ed9b8c14703a582", "kind": "dns", "frame_number": 1125, "timestamp_epoch": "1722307153.826352000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-3140f1372a157bd9198cfc38", "kind": "dns", "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "23.198.7.175,23.198.7.176,23.198.7.177,23.198.7.167,23.198.7.173,23.198.7.172,23.198.7.169,23.198.7.168,23.198.7.174", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-01f7cc622811d237745c21fa", "kind": "dns", "frame_number": 1157, "timestamp_epoch": "1722307154.533981000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-cbedc708389da52f0a59b1d3", "kind": "dns", "frame_number": 1158, "timestamp_epoch": "1722307154.585802000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "13.69.239.79", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdneu12.northeurope.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-221f33e6c400558908eb0519", "kind": "dns", "frame_number": 1173, "timestamp_epoch": "1722307154.986927000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-ac1d4f66467195332a4d7d1b", "kind": "dns", "frame_number": 1176, "timestamp_epoch": "1722307155.052038000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "20.96.153.111", "dns.cname": "arc.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-968853446ce4faea9c49fcd1", "kind": "dns", "frame_number": 1231, "timestamp_epoch": "1722307156.006600000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-5b50ae9bd410e535010ad6c8", "kind": "dns", "frame_number": 1232, "timestamp_epoch": "1722307156.640743000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 64662, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f4e9a502a8d0a819a376fc15", "kind": "dns", "frame_number": 1233, "timestamp_epoch": "1722307157.021273000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-43bb624b28a093cdb1181689", "kind": "dns", "frame_number": 1239, "timestamp_epoch": "1722307157.557179000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-463718c22832dc19857b5ee1", "kind": "dns", "frame_number": 1252, "timestamp_epoch": "1722307157.665911000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "52.109.6.53", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,eus2-azsc-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-85e129978d86eeea8c8c6f18", "kind": "dns", "frame_number": 1253, "timestamp_epoch": "1722307157.666117000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-2e0d720d95be0ae038ac3966", "kind": "dns", "frame_number": 1254, "timestamp_epoch": "1722307157.666329000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 62463, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-ca80cabf1a91a7a5f1b013e1", "kind": "dns", "frame_number": 1255, "timestamp_epoch": "1722307157.667160000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 64662, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-0e8814b73d9f7abc1f2bb255", "kind": "dns", "frame_number": 1356, "timestamp_epoch": "1722307158.105546000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-0cfb093acd7f6a7653f2bfb9", "kind": "dns", "frame_number": 1402, "timestamp_epoch": "1722307158.359295000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-1367977185abea0cf0f4dd15", "kind": "dns", "frame_number": 1413, "timestamp_epoch": "1722307158.584984000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 62463, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "52.109.0.142", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,wus-azsc-000.odc.officeapps.live.com,osiprod-wus-bronze-azsc-000.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-d09ce05d9e175e74a7af82b6", "kind": "dns", "frame_number": 1415, "timestamp_epoch": "1722307158.672779000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 64662, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-e759f37a4b6b667567d46bc4", "kind": "dns", "frame_number": 1447, "timestamp_epoch": "1722307160.110624000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60777, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-d2904ec563184e9e689cdea1", "kind": "dns", "frame_number": 1448, "timestamp_epoch": "1722307160.673169000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 64662, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-012c1fe8899ebe8aa57c677f", "kind": "dns", "frame_number": 1449, "timestamp_epoch": "1722307163.203736000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-21696131a052688f37f17371", "kind": "dns", "frame_number": 1453, "timestamp_epoch": "1722307163.374312000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "20.241.44.114", "dns.cname": "g.msn.com,g-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-dc4ce8e61b192acf9ad0a9d1", "kind": "dns", "frame_number": 1493, "timestamp_epoch": "1722307163.708422000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-3ee613f418f436e08bbd8770", "kind": "dns", "frame_number": 1494, "timestamp_epoch": "1722307163.752638000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 62463, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "23.52.9.140", "dns.cname": "oneclient.sfx.ms.edgekey.net,e9659.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-0034dd24b6429fad9ddf9522", "kind": "dns", "frame_number": 1504, "timestamp_epoch": "1722307164.012919000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60777, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-141ccc7b227f1402d33adb7e", "kind": "dns", "frame_number": 1505, "timestamp_epoch": "1722307164.014160000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 50203, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-a7c484b80c21744bf01c8f4c", "kind": "dns", "frame_number": 1512, "timestamp_epoch": "1722307164.090128000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 50203, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "20.7.2.167", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-5fec8302d0c142072e5e94b9", "kind": "dns", "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 64662, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.a": "23.48.203.208,23.48.203.204,23.48.203.203,23.48.203.207,23.48.203.201,23.48.203.205,23.48.203.200,23.48.203.206,23.48.203.199", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-13b40169c9e8aee26be023be", "kind": "dns", "frame_number": 1664, "timestamp_epoch": "1722307167.566283000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-07e53eb4f29fbd176f5b8864", "kind": "dns", "frame_number": 1665, "timestamp_epoch": "1722307167.626543000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "13.107.5.93", "dns.cname": "deault-exp-tas-com.e-0014.e-msedge.net,e-0014.e-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-bfdaa1471b2db659220bd373", "kind": "dns", "frame_number": 1826, "timestamp_epoch": "1722307192.925833000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "github.com", "dns.qry.type": "1" } }, { "event_id": "evt-640cee03f0dab420ed19ec3b", "kind": "dns", "frame_number": 1827, "timestamp_epoch": "1722307192.925870000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "repo1.maven.org", "dns.qry.type": "1" } }, { "event_id": "evt-1cbafd2a0ab2b3a2b2d7ad60", "kind": "dns", "frame_number": 1828, "timestamp_epoch": "1722307193.006441000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "140.82.113.3", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "github.com", "dns.qry.type": "1" } }, { "event_id": "evt-c67a698a81ee5697f4a683a8", "kind": "dns", "frame_number": 1855, "timestamp_epoch": "1722307193.733807000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "objects.githubusercontent.com", "dns.qry.type": "1" } }, { "event_id": "evt-fb9535fbf91aba31e18db2ed", "kind": "dns", "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "185.199.110.133,185.199.109.133,185.199.111.133,185.199.108.133", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "objects.githubusercontent.com", "dns.qry.type": "1" } }, { "event_id": "evt-57a4c1c0655d1d99357fa019", "kind": "dns", "frame_number": 1874, "timestamp_epoch": "1722307193.919107000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "repo1.maven.org", "dns.qry.type": "1" } }, { "event_id": "evt-26b9f6115beaf09161a8f1fa", "kind": "dns", "frame_number": 2507, "timestamp_epoch": "1722307194.919271000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "repo1.maven.org", "dns.qry.type": "1" } }, { "event_id": "evt-324f14d446d868665a2c40e9", "kind": "dns", "frame_number": 2508, "timestamp_epoch": "1722307196.934703000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 62463, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "repo1.maven.org", "dns.qry.type": "1" } }, { "event_id": "evt-dbcf278bf982cb2cc03ff8e3", "kind": "dns", "frame_number": 2509, "timestamp_epoch": "1722307196.966901000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 62463, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "199.232.196.209,199.232.192.209", "dns.cname": "dualstack.sonatype.map.fastly.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "repo1.maven.org", "dns.qry.type": "1" } }, { "event_id": "evt-bc0d3fb2494a637f65b98017", "kind": "dns", "frame_number": 9106, "timestamp_epoch": "1722307206.835504000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "ip-api.com", "dns.qry.type": "1" } }, { "event_id": "evt-5de3f87014df4a3225dcd450", "kind": "dns", "frame_number": 9107, "timestamp_epoch": "1722307206.918207000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "208.95.112.1", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ip-api.com", "dns.qry.type": "1" } }, { "event_id": "evt-41c695e956b29ca0c74af41c", "kind": "dns", "frame_number": 9121, "timestamp_epoch": "1722307207.516329000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-b3c7c1e527a62533fe1c5c7f", "kind": "dns", "frame_number": 9122, "timestamp_epoch": "1722307207.516607000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 57308, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-b2090608c0552b38dec137f3", "kind": "dns", "frame_number": 9123, "timestamp_epoch": "1722307207.516647000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-f29af83bba73054d08ab4572", "kind": "dns", "frame_number": 9124, "timestamp_epoch": "1722307207.516870000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 57308, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-89ef2cf587e1906f584c5436", "kind": "dns", "frame_number": 9162, "timestamp_epoch": "1722307211.777007000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c6eb01c528b4f1bccf644dd4", "kind": "dns", "frame_number": 9163, "timestamp_epoch": "1722307211.846403000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "52.191.219.104", "dns.cname": "atm-settingsfe-prod-geo2.trafficmanager.net,settings-prod-eus-1.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f35304864852e7f5d01c8a03", "kind": "dns", "frame_number": 9177, "timestamp_epoch": "1722307212.083935000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-2716765e394cd25454404179", "kind": "dns", "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "23.198.7.177,23.198.7.169,23.198.7.168,23.198.7.176,23.198.7.174,23.198.7.170,23.198.7.172,23.198.7.175,23.198.7.186", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-cacdb6518a422092ad1bc35b", "kind": "dns", "frame_number": 9354, "timestamp_epoch": "1722307213.794020000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-4901957f7dad8e3ab1cb1bdc", "kind": "dns", "frame_number": 9355, "timestamp_epoch": "1722307213.794274000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-58ef17f27ecc51bc73c56336", "kind": "dns", "frame_number": 9500, "timestamp_epoch": "1722307214.175250000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-0fcb920d402772bec41ff6d0", "kind": "dns", "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "40.126.29.14,40.126.29.8,20.190.157.9,40.126.29.7,40.126.29.11,40.126.29.5,40.126.29.13,20.190.157.11", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-5c9553f601a54c62f061b501", "kind": "dns", "frame_number": 9539, "timestamp_epoch": "1722307225.636806000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-21327cc02665a4b7f5286edd", "kind": "dns", "frame_number": 9540, "timestamp_epoch": "1722307225.687203000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "23.48.203.203,23.48.203.210,23.48.203.205", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-9c00d87422648a1f7dd60236", "kind": "dns", "frame_number": 9730, "timestamp_epoch": "1722307241.089624000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-7b5869e3ea73a3e4212aacb4", "kind": "dns", "frame_number": 9731, "timestamp_epoch": "1722307241.089957000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-8fe81e6f25d482857dd07f06", "kind": "dns", "frame_number": 9732, "timestamp_epoch": "1722307241.090533000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-a180c1d98e9f76bd15ddc00f", "kind": "dns", "frame_number": 9733, "timestamp_epoch": "1722307241.090732000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-f5c6b811756e426d132f96a8", "kind": "dns", "frame_number": 9777, "timestamp_epoch": "1722307241.668370000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-47ef95186cb8e732e849442e", "kind": "dns", "frame_number": 9778, "timestamp_epoch": "1722307241.806813000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "msedge.api.cdp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-81a349b7d9e6bc179e7ca049", "kind": "dns", "frame_number": 9779, "timestamp_epoch": "1722307241.902092000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "20.166.2.191", "dns.cname": "api.cdp.microsoft.com,glb.api.prod.dcat.dsp.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "msedge.api.cdp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c8dabea758eeb5b45a101cd3", "kind": "dns", "frame_number": 9803, "timestamp_epoch": "1722307242.654698000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-76424e3d14cbf3669ed187ac", "kind": "dns", "frame_number": 9807, "timestamp_epoch": "1722307242.891752000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1" } }, { "event_id": "evt-7b8c6e6197de08d0ef3b4fe7", "kind": "dns", "frame_number": 9808, "timestamp_epoch": "1722307242.952354000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "13.107.42.16", "dns.cname": "config.edge.skype.com.trafficmanager.net,l-0007.config.skype.com,config-edge-skype.l-0007.l-msedge.net,l-0007.l-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1" } }, { "event_id": "evt-c1592cfc8884a33ebad5dce0", "kind": "dns", "frame_number": 9845, "timestamp_epoch": "1722307243.670450000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b5427d0dae7ad3eee2425621", "kind": "dns", "frame_number": 9850, "timestamp_epoch": "1722307245.670516000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 51396, "dst_port": 53, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c1a161a8b973315dab389e34", "kind": "dns", "frame_number": 9851, "timestamp_epoch": "1722307245.942176000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 51396, "tcp_stream": null, "udp_stream": 18, "fields": { "dns.a": "23.96.180.189", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-ncus.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-88824a5819fcea8f5b3bedb7", "kind": "dns", "frame_number": 10061, "timestamp_epoch": "1722307331.945351000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f0c862eca474a7fccea4d14a", "kind": "dns", "frame_number": 10080, "timestamp_epoch": "1722307332.135015000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "52.109.0.91", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,wus-azsc-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5147fb2ea84996bdc908c2de", "kind": "dns", "frame_number": 10130, "timestamp_epoch": "1722307332.608165000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-398d7cabb16e68bb1af3428f", "kind": "dns", "frame_number": 10131, "timestamp_epoch": "1722307332.626466000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-39493a661579d2437ce9b02b", "kind": "dns", "frame_number": 10132, "timestamp_epoch": "1722307332.666055000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-908b68843f07445aeac8d852", "kind": "dns", "frame_number": 10134, "timestamp_epoch": "1722307332.702022000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "52.109.20.47", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,scus-azsc-000.odc.officeapps.live.com,osiprod-scus-bronze-azsc-000.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-106ce5d3b35fae15482c6669", "kind": "dns", "frame_number": 10277, "timestamp_epoch": "1722307333.225395000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "autodiscover-s.outlook.com", "dns.qry.type": "1" } }, { "event_id": "evt-24e175d71129380e6a30420e", "kind": "dns", "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "40.97.199.114,40.99.169.130,52.96.57.2,52.96.121.130", "dns.cname": "outlook.office365.com,ooc-g2.tm-4.office.com,outlook.ms-acdc.office.com,SAT-efz.ms-acdc.office.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "autodiscover-s.outlook.com", "dns.qry.type": "1" } }, { "event_id": "evt-e6bbb3da62af788439a24bdd", "kind": "dns", "frame_number": 10296, "timestamp_epoch": "1722307333.584678000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-214feb7bf5024dc7b55f3cdd", "kind": "dns", "frame_number": 10297, "timestamp_epoch": "1722307333.584974000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "172.16.1.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-4051634aa7722cff92748fac", "kind": "dns", "frame_number": 10334, "timestamp_epoch": "1722307335.712534000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "autodiscover.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-d9fc1495f4254b79cc67a53d", "kind": "dns", "frame_number": 10335, "timestamp_epoch": "1722307335.712847000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "autodiscover.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-486266cb4ef4f3f3737deea6", "kind": "dns", "frame_number": 10336, "timestamp_epoch": "1722307336.345956000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e0f493d8051484e7bb239a3e", "kind": "dns", "frame_number": 10337, "timestamp_epoch": "1722307337.344826000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d881bfac7115b2ed786f4987", "kind": "dns", "frame_number": 10338, "timestamp_epoch": "1722307338.345061000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59975, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-dce1a3d7d59d9c990a9e2599", "kind": "dns", "frame_number": 10345, "timestamp_epoch": "1722307339.486871000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59975, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "20.189.173.10", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdwus09.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8e2b906c785e220914bb9e47", "kind": "dns", "frame_number": 10419, "timestamp_epoch": "1722307345.533857000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "metadata.templates.cdn.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-22fa5f36564ae32e1ad46478", "kind": "dns", "frame_number": 10420, "timestamp_epoch": "1722307345.576677000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "23.221.22.68,23.221.22.87", "dns.cname": "templatesmetadata.office.net,templatesmetadata.office.net.edgekey.net,e26769.dscb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "metadata.templates.cdn.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-9b9c10e19c6a80e6d2e01c83", "kind": "dns", "frame_number": 10448, "timestamp_epoch": "1722307355.953859000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5ea3a339fa6db0ca5f17e8cf", "kind": "dns", "frame_number": 10449, "timestamp_epoch": "1722307356.012716000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "20.189.173.26", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus19.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b465022891f8d1d91d12696b", "kind": "dns", "frame_number": 10766, "timestamp_epoch": "1722307455.627407000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-4cea73c1c96f6156554fc9cf", "kind": "dns", "frame_number": 10767, "timestamp_epoch": "1722307455.627886000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-01da7976f0965c6cbfb7157b", "kind": "dns", "frame_number": 10768, "timestamp_epoch": "1722307455.631145000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 55637, "dst_port": 53, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-65eec9c08061b79637755af6", "kind": "dns", "frame_number": 10769, "timestamp_epoch": "1722307455.631368000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 50658, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-0eb9ceb5eca63797e3f349ac", "kind": "dns", "frame_number": 10770, "timestamp_epoch": "1722307455.696863000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 55637, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-aad3c35d8edfbc78a6c19041", "kind": "dns", "frame_number": 10773, "timestamp_epoch": "1722307455.720760000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 50658, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-4655319ceb2e36c08cda5314", "kind": "dns", "frame_number": 10774, "timestamp_epoch": "1722307455.720959000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 53, "dst_port": 50658, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-b8d142da90512978a190fb82", "kind": "dns", "frame_number": 10813, "timestamp_epoch": "1722307456.394861000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 55856, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-e4b9598f9eb1df281e9ba743", "kind": "dns", "frame_number": 10814, "timestamp_epoch": "1722307456.394983000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 52530, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-cc9f8ea6eccbc9946399bd89", "kind": "dns", "frame_number": 10815, "timestamp_epoch": "1722307456.395379000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 52530, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-9fdf52b5cb84df89dcb7c4c5", "kind": "dns", "frame_number": 10816, "timestamp_epoch": "1722307456.395453000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 55856, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-7acaed702b97254bdabba7b9", "kind": "dns", "frame_number": 10824, "timestamp_epoch": "1722307456.669745000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-713f5be3c1767f5e6b12f659", "kind": "dns", "frame_number": 10825, "timestamp_epoch": "1722307456.670039000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-f57a808a721541ce93c02c1c", "kind": "dns", "frame_number": 10826, "timestamp_epoch": "1722307456.670410000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-1bdadb0686dc317153d70cad", "kind": "dns", "frame_number": 10827, "timestamp_epoch": "1722307456.670625000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIRESHARK-WS-DC.wiresharkworkshop.online", "dns.qry.type": "33" } }, { "event_id": "evt-a74e80aa786ee2d6ea309e61", "kind": "dns", "frame_number": 10882, "timestamp_epoch": "1722307457.084249000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 56529, "dst_port": 53, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-aff10ac97a612cc0e327e30b", "kind": "dns", "frame_number": 10883, "timestamp_epoch": "1722307457.084322000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 64049, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-3716ff150802c3cbea86e8e9", "kind": "dns", "frame_number": 10884, "timestamp_epoch": "1722307457.085408000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59386, "dst_port": 53, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-d0d01ce88b83506d53d01e99", "kind": "dns", "frame_number": 10885, "timestamp_epoch": "1722307457.085581000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 61940, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-8d84bb243089b787f83ca740", "kind": "dns", "frame_number": 10886, "timestamp_epoch": "1722307457.130075000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 64049, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.cname": "api-msn-com.a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-5fe02659f22ee0e2cb644726", "kind": "dns", "frame_number": 10887, "timestamp_epoch": "1722307457.151610000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 56529, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-94dacd6e008bc14c3f4f9254", "kind": "dns", "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59386, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.a": "23.53.11.166,23.53.11.164,23.53.11.165,23.53.11.179,23.53.11.176,23.53.11.178,23.53.11.177,23.53.11.175,23.53.11.174", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c76e2cff8c48e558975cad45", "kind": "dns", "frame_number": 10891, "timestamp_epoch": "1722307457.215525000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 61940, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-a9778930014adbf51c2f521c", "kind": "dns", "frame_number": 10892, "timestamp_epoch": "1722307457.215675000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 53, "dst_port": 61940, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-c4d6281e7b7878e36bfc878e", "kind": "dns", "frame_number": 10909, "timestamp_epoch": "1722307457.468275000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 58319, "dst_port": 53, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-3e4efd6e805296bc048ae2e4", "kind": "dns", "frame_number": 10910, "timestamp_epoch": "1722307457.468577000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 50142, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-0cac151c1c29b59ff5745714", "kind": "dns", "frame_number": 10911, "timestamp_epoch": "1722307457.468893000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 58319, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-9ccf4b872162bb3e4f9f83fd", "kind": "dns", "frame_number": 10912, "timestamp_epoch": "1722307457.468950000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 50142, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-e3c9246081bd128c41d98d55", "kind": "dns", "frame_number": 10949, "timestamp_epoch": "1722307457.594570000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 50831, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-adcda083fa0112d028d4f039", "kind": "dns", "frame_number": 10950, "timestamp_epoch": "1722307457.594916000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 58238, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-50d0f346e35207cef4b903f8", "kind": "dns", "frame_number": 10951, "timestamp_epoch": "1722307457.670395000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 54510, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-8bb97328a66c7a897a31696e", "kind": "dns", "frame_number": 10952, "timestamp_epoch": "1722307457.670594000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 63424, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-c6daa3dce25387e82e964f46", "kind": "dns", "frame_number": 10957, "timestamp_epoch": "1722307457.735180000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 58238, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-36aecf273bbad6d4296064f1", "kind": "dns", "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 50831, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.a": "23.198.7.168,23.198.7.183,23.198.7.167,23.198.7.172,23.198.7.169,23.198.7.182,23.198.7.170,23.198.7.175,23.198.7.174", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-9bbb63ab6daf008d34c1172a", "kind": "dns", "frame_number": 10959, "timestamp_epoch": "1722307457.735336000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 54510, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.a": "23.215.55.133,23.215.55.137", "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-0b61ab8f484dbd5501d3a1d6", "kind": "dns", "frame_number": 10972, "timestamp_epoch": "1722307457.790314000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 63424, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-c1595fac5f5c2d9e45952d52", "kind": "dns", "frame_number": 11000, "timestamp_epoch": "1722307457.919944000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 60123, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecn.dev.virtualearth.net", "dns.qry.type": "1" } }, { "event_id": "evt-b1f55ff4dd2784140b6b864c", "kind": "dns", "frame_number": 11001, "timestamp_epoch": "1722307457.920102000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 63490, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecn.dev.virtualearth.net", "dns.qry.type": "65" } }, { "event_id": "evt-a7f5d82cf1e6f255ed316778", "kind": "dns", "frame_number": 11031, "timestamp_epoch": "1722307457.990190000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 60123, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.a": "23.46.192.165", "dns.cname": "ssl2.tiles.virtualearth.net.edgekey.net,e4113.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecn.dev.virtualearth.net", "dns.qry.type": "1" } }, { "event_id": "evt-b9c12627f1ade0a30f65a1bd", "kind": "dns", "frame_number": 11039, "timestamp_epoch": "1722307458.040471000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 63490, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.cname": "ssl2.tiles.virtualearth.net.edgekey.net,e4113.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecn.dev.virtualearth.net", "dns.qry.type": "65" } }, { "event_id": "evt-0b61610a7f5f7c8844b945c8", "kind": "dns", "frame_number": 11040, "timestamp_epoch": "1722307458.040574000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 53, "dst_port": 63490, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.cname": "ssl2.tiles.virtualearth.net.edgekey.net,e4113.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecn.dev.virtualearth.net", "dns.qry.type": "65" } }, { "event_id": "evt-2f972df73fa59df4a53c708e", "kind": "dns", "frame_number": 11215, "timestamp_epoch": "1722307463.636199000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-dd70ce3b73be7424957bb445", "kind": "dns", "frame_number": 11216, "timestamp_epoch": "1722307463.636587000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.wiresharkworkshop.online", "dns.qry.type": "1" } }, { "event_id": "evt-d018ad4e9e85ee19aa81deae", "kind": "dns", "frame_number": 11231, "timestamp_epoch": "1722307469.339949000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "javadl-esd-secure.oracle.com", "dns.qry.type": "1" } }, { "event_id": "evt-6a4a045c82afefae072f001c", "kind": "dns", "frame_number": 11232, "timestamp_epoch": "1722307469.430095000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 59905, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "javadl-esd-secure.oracle.com", "dns.qry.type": "1" } }, { "event_id": "evt-0312f862ebd0035aa80e9095", "kind": "dns", "frame_number": 11233, "timestamp_epoch": "1722307469.440539000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 59905, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "23.194.164.136", "dns.cname": "javadl-esd-secure.oracle.com.edgekey.net,e13073.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "javadl-esd-secure.oracle.com", "dns.qry.type": "1" } }, { "event_id": "evt-eee620bae7ca3f91a72b5d59", "kind": "dns", "frame_number": 11474, "timestamp_epoch": "1722307639.923844000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 61316, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6a1448a905a04b22e4600ecd", "kind": "dns", "frame_number": 11475, "timestamp_epoch": "1722307640.011440000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 61316, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-15ad948dc7d21c16b21a8ff3", "kind": "dns", "frame_number": 11476, "timestamp_epoch": "1722307640.021468000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 53, "dst_port": 61316, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-e36f8ab28c433d97bbb064ae", "kind": "http_request", "frame_number": 466, "timestamp_epoch": "1722307129.634707000", "src_ip": "172.16.1.66", "dst_ip": "23.215.55.140", "src_port": 49697, "dst_port": 80, "tcp_stream": 24, "udp_stream": null, "fields": { "http.host": "www.msftconnecttest.com", "http.request.full_uri": "http://www.msftconnecttest.com/connecttest.txt", "http.request.method": "GET", "http.request.uri": "/connecttest.txt", "http.response_in": "493", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-0b316177249b723d210d955e", "kind": "http_request", "frame_number": 9111, "timestamp_epoch": "1722307206.967799000", "src_ip": "172.16.1.66", "dst_ip": "208.95.112.1", "src_port": 49755, "dst_port": 80, "tcp_stream": 84, "udp_stream": null, "fields": { "http.host": "ip-api.com", "http.request.full_uri": "http://ip-api.com/json/", "http.request.method": "GET", "http.request.uri": "/json/", "http.response_in": "9113", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" } }, { "event_id": "evt-e2020f4de32bd48a48be62af", "kind": "http_request", "frame_number": 9596, "timestamp_epoch": "1722307233.647114000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a0c7ef67a9101da8ce6c39be", "kind": "http_request", "frame_number": 9597, "timestamp_epoch": "1722307233.650010000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-0307bac1c98d84f654cbaa4e", "kind": "http_request", "frame_number": 9602, "timestamp_epoch": "1722307233.857221000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a160c023a3839a004ac7e1a6", "kind": "http_request", "frame_number": 9603, "timestamp_epoch": "1722307236.654257000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-820ae8310716872fd7fe3b17", "kind": "http_request", "frame_number": 9604, "timestamp_epoch": "1722307236.654496000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-4cdb6d8f543efd0374ea0d0b", "kind": "http_request", "frame_number": 9605, "timestamp_epoch": "1722307236.857524000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-fce7edb9895c4c92279880f1", "kind": "http_request", "frame_number": 9723, "timestamp_epoch": "1722307239.669683000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-02f24db0f4882d13dc738395", "kind": "http_request", "frame_number": 9724, "timestamp_epoch": "1722307239.669881000", "src_ip": "172.16.1.66", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } } ], "http_response": [ { "event_id": "evt-1b57567acbe3fb16b878af75", "kind": "http_response", "frame_number": 493, "timestamp_epoch": "1722307129.686046000", "src_ip": "23.215.55.140", "dst_ip": "172.16.1.66", "src_port": 80, "dst_port": 49697, "tcp_stream": 24, "udp_stream": null, "fields": { "http.content_length": "22", "http.content_type": "text/plain", "http.request_in": "466", "http.response.code": "200" } }, { "event_id": "evt-70075bcd87fea41ba0e6ddc4", "kind": "http_response", "frame_number": 9113, "timestamp_epoch": "1722307207.011053000", "src_ip": "208.95.112.1", "dst_ip": "172.16.1.66", "src_port": 80, "dst_port": 49755, "tcp_stream": 84, "udp_stream": null, "fields": { "http.content_length": "294", "http.content_type": "application/json; charset=utf-8", "http.request_in": "9111", "http.response.code": "200" } } ], "tls_client_hello": [ { "event_id": "evt-c01ce25e09ab321b4967b1f9", "kind": "tls_client_hello", "frame_number": 289, "timestamp_epoch": "1722307129.471792000", "src_ip": "172.16.1.66", "dst_ip": "20.189.173.16", "src_port": 49690, "dst_port": 443, "tcp_stream": 17, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-d56031ea8fd579943d9f7723", "kind": "tls_client_hello", "frame_number": 346, "timestamp_epoch": "1722307129.564370000", "src_ip": "172.16.1.66", "dst_ip": "20.189.173.16", "src_port": 49690, "dst_port": 443, "tcp_stream": 17, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-bea382c5720ce6d7a372f3ad", "kind": "tls_client_hello", "frame_number": 688, "timestamp_epoch": "1722307136.895006000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49708, "dst_port": 443, "tcp_stream": 36, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-3e262f18931dca1b5c353b1e", "kind": "tls_client_hello", "frame_number": 713, "timestamp_epoch": "1722307137.322327000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49709, "dst_port": 443, "tcp_stream": 37, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-587bc0558f036f5123cf267f", "kind": "tls_client_hello", "frame_number": 735, "timestamp_epoch": "1722307137.637692000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49710, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-85d424d4f10fd642162cf77d", "kind": "tls_client_hello", "frame_number": 755, "timestamp_epoch": "1722307137.971044000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49711, "dst_port": 443, "tcp_stream": 39, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-d9c5fbe79194213b07a924fe", "kind": "tls_client_hello", "frame_number": 779, "timestamp_epoch": "1722307138.289242000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49712, "dst_port": 443, "tcp_stream": 40, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-3ce793edc330f3c76abf967e", "kind": "tls_client_hello", "frame_number": 800, "timestamp_epoch": "1722307138.567199000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49713, "dst_port": 443, "tcp_stream": 41, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-56c4d4c1167080ba53a364a3", "kind": "tls_client_hello", "frame_number": 820, "timestamp_epoch": "1722307138.872773000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49714, "dst_port": 443, "tcp_stream": 42, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-e30a1b581dbaf3f79ca32556", "kind": "tls_client_hello", "frame_number": 841, "timestamp_epoch": "1722307139.164367000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49715, "dst_port": 443, "tcp_stream": 43, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-9c762c76436068a9cb0c2f1b", "kind": "tls_client_hello", "frame_number": 860, "timestamp_epoch": "1722307139.488742000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49716, "dst_port": 443, "tcp_stream": 44, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-c080432ca6d765849cca5dcb", "kind": "tls_client_hello", "frame_number": 880, "timestamp_epoch": "1722307139.782918000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49717, "dst_port": 443, "tcp_stream": 45, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-10b651a74c2c28e970ff2362", "kind": "tls_client_hello", "frame_number": 1131, "timestamp_epoch": "1722307153.954150000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.175", "src_port": 49730, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-e0efb3d9dbb6ae87eeb812ad", "kind": "tls_client_hello", "frame_number": 1162, "timestamp_epoch": "1722307154.791591000", "src_ip": "172.16.1.66", "dst_ip": "13.69.239.79", "src_port": 49731, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v20.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-928a27a8ac878b827ed55824", "kind": "tls_client_hello", "frame_number": 1171, "timestamp_epoch": "1722307154.982972000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.222", "src_port": 49732, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-405d998b402da4a10332f8ba", "kind": "tls_client_hello", "frame_number": 1190, "timestamp_epoch": "1722307155.140456000", "src_ip": "172.16.1.66", "dst_ip": "20.96.153.111", "src_port": 49733, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "arc.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ca5048467d103f57ee502fd5", "kind": "tls_client_hello", "frame_number": 1237, "timestamp_epoch": "1722307157.554762000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.175", "src_port": 49734, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-215148a0c97bf4a7ee89e231", "kind": "tls_client_hello", "frame_number": 1298, "timestamp_epoch": "1722307157.881820000", "src_ip": "172.16.1.66", "dst_ip": "52.109.6.53", "src_port": 49735, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-d958de6b57796ab583198f97", "kind": "tls_client_hello", "frame_number": 1308, "timestamp_epoch": "1722307157.885510000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49736, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-1869bbd6b37dafa4c3aeb145", "kind": "tls_client_hello", "frame_number": 1354, "timestamp_epoch": "1722307158.105130000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49736, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ec776e73114d3d2264137fa6", "kind": "tls_client_hello", "frame_number": 1418, "timestamp_epoch": "1722307158.692388000", "src_ip": "172.16.1.66", "dst_ip": "52.109.0.142", "src_port": 49737, "dst_port": 443, "tcp_stream": 65, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-f720d4b22e087ad5db498ccf", "kind": "tls_client_hello", "frame_number": 1455, "timestamp_epoch": "1722307163.381760000", "src_ip": "172.16.1.66", "dst_ip": "52.109.0.142", "src_port": 49738, "dst_port": 443, "tcp_stream": 66, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-6caf9f118d652491380a6938", "kind": "tls_client_hello", "frame_number": 1459, "timestamp_epoch": "1722307163.454624000", "src_ip": "172.16.1.66", "dst_ip": "20.241.44.114", "src_port": 49739, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "g.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-f355e8dc50141fa6ad1f41af", "kind": "tls_client_hello", "frame_number": 1498, "timestamp_epoch": "1722307163.838556000", "src_ip": "172.16.1.66", "dst_ip": "23.52.9.140", "src_port": 49740, "dst_port": 443, "tcp_stream": 68, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "oneclient.sfx.ms", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-be0aca69c1a19ca4a2bf3e3c", "kind": "tls_client_hello", "frame_number": 1523, "timestamp_epoch": "1722307164.176615000", "src_ip": "172.16.1.66", "dst_ip": "20.7.2.167", "src_port": 49741, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } }, { "event_id": "evt-628916602b53fe43345c2ebe", "kind": "tls_client_hello", "frame_number": 1527, "timestamp_epoch": "1722307164.218905000", "src_ip": "172.16.1.66", "dst_ip": "23.48.203.208", "src_port": 49742, "dst_port": 443, "tcp_stream": 70, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-cb3164f9a2b767ecd1bc2505", "kind": "tls_client_hello", "frame_number": 1531, "timestamp_epoch": "1722307164.228186000", "src_ip": "172.16.1.66", "dst_ip": "23.48.203.208", "src_port": 49743, "dst_port": 443, "tcp_stream": 71, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-14cfc8e01a8ec889cdc2a2cf", "kind": "tls_client_hello", "frame_number": 1671, "timestamp_epoch": "1722307167.718909000", "src_ip": "172.16.1.66", "dst_ip": "13.107.5.93", "src_port": 49744, "dst_port": 443, "tcp_stream": 72, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-6e8f24a415e098862a68a676", "kind": "tls_client_hello", "frame_number": 1676, "timestamp_epoch": "1722307167.802185000", "src_ip": "172.16.1.66", "dst_ip": "13.107.5.93", "src_port": 49744, "dst_port": 443, "tcp_stream": 72, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-97ee042dac0aeefa98dec0c8", "kind": "tls_client_hello", "frame_number": 1719, "timestamp_epoch": "1722307172.108531000", "src_ip": "172.16.1.66", "dst_ip": "23.48.203.208", "src_port": 49745, "dst_port": 443, "tcp_stream": 73, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-0e55fe5dfff2b373c0804f88", "kind": "tls_client_hello", "frame_number": 1729, "timestamp_epoch": "1722307172.181902000", "src_ip": "172.16.1.66", "dst_ip": "23.48.203.208", "src_port": 49746, "dst_port": 443, "tcp_stream": 74, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-a1af9f1e24b605ce73cc7991", "kind": "tls_client_hello", "frame_number": 1832, "timestamp_epoch": "1722307193.167251000", "src_ip": "172.16.1.66", "dst_ip": "140.82.113.3", "src_port": 49749, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "github.com", "tls.handshake.ja3": "026e5ca865ce1f09da3a81d8a4e3effb" } }, { "event_id": "evt-d467721b2e4f6a55ba374a7c", "kind": "tls_client_hello", "frame_number": 1862, "timestamp_epoch": "1722307193.827800000", "src_ip": "172.16.1.66", "dst_ip": "185.199.110.133", "src_port": 49750, "dst_port": 443, "tcp_stream": 79, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "objects.githubusercontent.com", "tls.handshake.ja3": "026e5ca865ce1f09da3a81d8a4e3effb" } }, { "event_id": "evt-6edab365d604e2cbe5fad020", "kind": "tls_client_hello", "frame_number": 2515, "timestamp_epoch": "1722307197.007768000", "src_ip": "172.16.1.66", "dst_ip": "199.232.196.209", "src_port": 49751, "dst_port": 443, "tcp_stream": 80, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "repo1.maven.org", "tls.handshake.ja3": "026e5ca865ce1f09da3a81d8a4e3effb" } }, { "event_id": "evt-ba9af892874c5ebb1bee704e", "kind": "tls_client_hello", "frame_number": 2521, "timestamp_epoch": "1722307197.029422000", "src_ip": "172.16.1.66", "dst_ip": "199.232.196.209", "src_port": 49752, "dst_port": 443, "tcp_stream": 81, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "repo1.maven.org", "tls.handshake.ja3": "026e5ca865ce1f09da3a81d8a4e3effb" } }, { "event_id": "evt-703836fc49ec8d6674ed1e60", "kind": "tls_client_hello", "frame_number": 2523, "timestamp_epoch": "1722307197.029904000", "src_ip": "172.16.1.66", "dst_ip": "199.232.196.209", "src_port": 49753, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "repo1.maven.org", "tls.handshake.ja3": "026e5ca865ce1f09da3a81d8a4e3effb" } }, { "event_id": "evt-a4e2fa56aad8eee711f29315", "kind": "tls_client_hello", "frame_number": 9167, "timestamp_epoch": "1722307211.928371000", "src_ip": "172.16.1.66", "dst_ip": "52.191.219.104", "src_port": 49756, "dst_port": 443, "tcp_stream": 85, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-cf9e60a57238b9c35c77a498", "kind": "tls_client_hello", "frame_number": 9215, "timestamp_epoch": "1722307212.390017000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49761, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-02af276f679f8943bf151b4a", "kind": "tls_client_hello", "frame_number": 9217, "timestamp_epoch": "1722307212.392387000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49760, "dst_port": 443, "tcp_stream": 89, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-253548daeecd9b596cb73d13", "kind": "tls_client_hello", "frame_number": 9219, "timestamp_epoch": "1722307212.399010000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49759, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-6bad3f79b795935c67a81ba8", "kind": "tls_client_hello", "frame_number": 9221, "timestamp_epoch": "1722307212.404298000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49762, "dst_port": 443, "tcp_stream": 91, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-5f41acd41684cb7e13a23cdc", "kind": "tls_client_hello", "frame_number": 9223, "timestamp_epoch": "1722307212.407017000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49758, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-2f7666c62d740cc950528b60", "kind": "tls_client_hello", "frame_number": 9225, "timestamp_epoch": "1722307212.407887000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.177", "src_port": 49757, "dst_port": 443, "tcp_stream": 86, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-5f86a6aeaf408df12fb54759", "kind": "tls_client_hello", "frame_number": 9505, "timestamp_epoch": "1722307214.368230000", "src_ip": "172.16.1.66", "dst_ip": "40.126.29.14", "src_port": 49771, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-2d13b7eeed835888e951e944", "kind": "tls_client_hello", "frame_number": 9509, "timestamp_epoch": "1722307214.423985000", "src_ip": "172.16.1.66", "dst_ip": "40.126.29.14", "src_port": 49771, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-8997033447751d988089d563", "kind": "tls_client_hello", "frame_number": 9544, "timestamp_epoch": "1722307225.773757000", "src_ip": "172.16.1.66", "dst_ip": "23.48.203.203", "src_port": 49772, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-3e8d31ff041b5d72e5496646", "kind": "tls_client_hello", "frame_number": 9705, "timestamp_epoch": "1722307239.108378000", "src_ip": "172.16.1.66", "dst_ip": "40.126.29.14", "src_port": 49782, "dst_port": 443, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-e38d25a22ba0120588640263", "kind": "tls_client_hello", "frame_number": 9709, "timestamp_epoch": "1722307239.168935000", "src_ip": "172.16.1.66", "dst_ip": "40.126.29.14", "src_port": 49782, "dst_port": 443, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-2bc375a22691e260879354d7", "kind": "tls_client_hello", "frame_number": 9783, "timestamp_epoch": "1722307242.116040000", "src_ip": "172.16.1.66", "dst_ip": "20.166.2.191", "src_port": 49786, "dst_port": 443, "tcp_stream": 112, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "msedge.api.cdp.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ec6b0c0eab43b8a7243b0328", "kind": "tls_client_hello", "frame_number": 9812, "timestamp_epoch": "1722307243.029638000", "src_ip": "172.16.1.66", "dst_ip": "13.107.42.16", "src_port": 49787, "dst_port": 443, "tcp_stream": 113, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "config.edge.skype.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-d5c481816fc6476063c990f6", "kind": "tls_client_hello", "frame_number": 9815, "timestamp_epoch": "1722307243.148706000", "src_ip": "172.16.1.66", "dst_ip": "13.107.42.16", "src_port": 49787, "dst_port": 443, "tcp_stream": 113, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "config.edge.skype.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-28ee6ce2dd2aa3126bd626be", "kind": "tls_client_hello", "frame_number": 10088, "timestamp_epoch": "1722307332.233815000", "src_ip": "172.16.1.66", "dst_ip": "52.109.0.91", "src_port": 49792, "dst_port": 443, "tcp_stream": 118, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-96f812cb133d98847d5d6767", "kind": "tls_client_hello", "frame_number": 10141, "timestamp_epoch": "1722307332.716308000", "src_ip": "172.16.1.66", "dst_ip": "52.113.194.132", "src_port": 49793, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-650eb1b674b6973a101b4bf9", "kind": "tls_client_hello", "frame_number": 10145, "timestamp_epoch": "1722307332.742141000", "src_ip": "172.16.1.66", "dst_ip": "52.109.20.47", "src_port": 49795, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-5c22660565b2cc5138f7a41f", "kind": "tls_client_hello", "frame_number": 10153, "timestamp_epoch": "1722307332.749694000", "src_ip": "172.16.1.66", "dst_ip": "52.109.20.47", "src_port": 49796, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-20cbc4030450a51ed2e9d6e4", "kind": "tls_client_hello", "frame_number": 10155, "timestamp_epoch": "1722307332.749895000", "src_ip": "172.16.1.66", "dst_ip": "52.109.20.47", "src_port": 49797, "dst_port": 443, "tcp_stream": 123, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-55fa8ad5095114e99b3bae36", "kind": "tls_client_hello", "frame_number": 10157, "timestamp_epoch": "1722307332.751197000", "src_ip": "172.16.1.66", "dst_ip": "52.109.20.47", "src_port": 49794, "dst_port": 443, "tcp_stream": 120, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-69ee4a8daf602471d9e0de88", "kind": "tls_client_hello", "frame_number": 10282, "timestamp_epoch": "1722307333.327530000", "src_ip": "172.16.1.66", "dst_ip": "40.97.199.114", "src_port": 49798, "dst_port": 443, "tcp_stream": 124, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "autodiscover-s.outlook.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-3752b7ed64fd9d7b00abefb7", "kind": "tls_client_hello", "frame_number": 10349, "timestamp_epoch": "1722307339.561440000", "src_ip": "172.16.1.66", "dst_ip": "20.189.173.10", "src_port": 49801, "dst_port": 443, "tcp_stream": 131, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-266481341383e73725309b25", "kind": "tls_client_hello", "frame_number": 10353, "timestamp_epoch": "1722307339.649879000", "src_ip": "172.16.1.66", "dst_ip": "20.189.173.10", "src_port": 49801, "dst_port": 443, "tcp_stream": 131, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-56d43bb1d65d3253b8b33ffb", "kind": "tls_client_hello", "frame_number": 10424, "timestamp_epoch": "1722307345.609036000", "src_ip": "172.16.1.66", "dst_ip": "23.221.22.68", "src_port": 49802, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "metadata.templates.cdn.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-39f10a2e63b692ab258162ab", "kind": "tls_client_hello", "frame_number": 10453, "timestamp_epoch": "1722307356.089186000", "src_ip": "172.16.1.66", "dst_ip": "20.189.173.26", "src_port": 49803, "dst_port": 443, "tcp_stream": 133, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-7724e6215faac16a6be102d5", "kind": "tls_client_hello", "frame_number": 10780, "timestamp_epoch": "1722307455.810965000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49808, "dst_port": 443, "tcp_stream": 138, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "6d162fd4fcafeafc279a32732bb583ab" } }, { "event_id": "evt-151088ec91b2161b69367d33", "kind": "tls_client_hello", "frame_number": 10784, "timestamp_epoch": "1722307455.811374000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49809, "dst_port": 443, "tcp_stream": 139, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "6764675c1ca709250abb58a1ed36b1a9" } }, { "event_id": "evt-65d791037561e9dd00bc474c", "kind": "tls_client_hello", "frame_number": 10789, "timestamp_epoch": "1722307455.931381000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49809, "dst_port": 443, "tcp_stream": 139, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "6764675c1ca709250abb58a1ed36b1a9" } }, { "event_id": "evt-e008662118328b08c85b2ab2", "kind": "tls_client_hello", "frame_number": 10791, "timestamp_epoch": "1722307455.932498000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49808, "dst_port": 443, "tcp_stream": 138, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "6d162fd4fcafeafc279a32732bb583ab" } }, { "event_id": "evt-fe13b4d0ae896a52947612b1", "kind": "tls_client_hello", "frame_number": 10821, "timestamp_epoch": "1722307456.471325000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49810, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "17e7f892bd0cb5409482f240c9ca2934" } }, { "event_id": "evt-b9c6bbcc28775786b40a6be0", "kind": "tls_client_hello", "frame_number": 10848, "timestamp_epoch": "1722307456.689392000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49810, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "17e7f892bd0cb5409482f240c9ca2934" } }, { "event_id": "evt-12bc658e798fbf2fa20d2ca6", "kind": "tls_client_hello", "frame_number": 10896, "timestamp_epoch": "1722307457.237113000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49813, "dst_port": 443, "tcp_stream": 143, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "7dcea60ae4f829abcfa00bd64ab6f937" } }, { "event_id": "evt-e0505d5b78a047836d831a95", "kind": "tls_client_hello", "frame_number": 10902, "timestamp_epoch": "1722307457.258603000", "src_ip": "172.16.1.66", "dst_ip": "23.53.11.166", "src_port": 49814, "dst_port": 443, "tcp_stream": 144, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "1541459f873df5079e5cf7ff2c951ca0" } }, { "event_id": "evt-e1eb82f9f766a36daecb37f7", "kind": "tls_client_hello", "frame_number": 10906, "timestamp_epoch": "1722307457.429375000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49813, "dst_port": 443, "tcp_stream": 143, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "7dcea60ae4f829abcfa00bd64ab6f937" } }, { "event_id": "evt-039ac8d7866fc440c96adc24", "kind": "tls_client_hello", "frame_number": 10940, "timestamp_epoch": "1722307457.583327000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49816, "dst_port": 443, "tcp_stream": 146, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "292a36e182b3281950ca910a639428ec" } }, { "event_id": "evt-e9f7878933a3fde0c7685b9b", "kind": "tls_client_hello", "frame_number": 10960, "timestamp_epoch": "1722307457.736031000", "src_ip": "172.16.1.66", "dst_ip": "204.79.197.203", "src_port": 49816, "dst_port": 443, "tcp_stream": 146, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "292a36e182b3281950ca910a639428ec" } }, { "event_id": "evt-2579694ca6d78e4643c82177", "kind": "tls_client_hello", "frame_number": 10983, "timestamp_epoch": "1722307457.808155000", "src_ip": "172.16.1.66", "dst_ip": "23.215.55.133", "src_port": 49818, "dst_port": 443, "tcp_stream": 148, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img-s-msn-com.akamaized.net", "tls.handshake.ja3": "1968767952a7e119234b43165830caaf" } }, { "event_id": "evt-8f0fa3bf8993953e17f1af8e", "kind": "tls_client_hello", "frame_number": 10987, "timestamp_epoch": "1722307457.808523000", "src_ip": "172.16.1.66", "dst_ip": "23.198.7.168", "src_port": 49817, "dst_port": 443, "tcp_stream": 147, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "930a922a3aeaa3a5590435675e8a4bb9" } }, { "event_id": "evt-f4ebf961dcfa5e5a5940c9f1", "kind": "tls_client_hello", "frame_number": 11053, "timestamp_epoch": "1722307458.078921000", "src_ip": "172.16.1.66", "dst_ip": "23.46.192.165", "src_port": 49819, "dst_port": 443, "tcp_stream": 149, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecn.dev.virtualearth.net", "tls.handshake.ja3": "54e118fb6c893793f9955efcc86a6132" } }, { "event_id": "evt-7d1126ddbf42c242aecab73e", "kind": "tls_client_hello", "frame_number": 11237, "timestamp_epoch": "1722307469.516311000", "src_ip": "172.16.1.66", "dst_ip": "23.194.164.136", "src_port": 49820, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "javadl-esd-secure.oracle.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } } ], "dhcp": [], "identity": [ { "event_id": "evt-a81caf0a1963859b2f2c1ddb", "kind": "identity", "frame_number": 1, "timestamp_epoch": "1722307128.960835000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "6", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-b2e85cfc2417e5910b564c1b", "kind": "identity", "frame_number": 2, "timestamp_epoch": "1722307128.960993000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "6", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-bd106c5ba7770edcdb44ecf8", "kind": "identity", "frame_number": 5, "timestamp_epoch": "1722307128.966985000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "6", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-d13d1b7e05c67335f8773bdc", "kind": "identity", "frame_number": 26, "timestamp_epoch": "1722307128.988144000", "src_ip": "172.16.1.66", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.qry.name": "DESKTOP-SKBR25F.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1d5b1d889707e8a71c9eb527", "kind": "identity", "frame_number": 27, "timestamp_epoch": "1722307128.988311000", "src_ip": "172.16.1.66", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0dbd54d85e18d311f766513c", "kind": "identity", "frame_number": 28, "timestamp_epoch": "1722307128.988560000", "src_ip": "172.16.1.66", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.qry.name": "DESKTOP-SKBR25F", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-4a14b0f42bf1a43bc5d401d3", "kind": "identity", "frame_number": 29, "timestamp_epoch": "1722307129.035395000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-6efd6f9091a636b05b6841c4", "kind": "identity", "frame_number": 30, "timestamp_epoch": "1722307129.035693000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-bd13b9fb5fa17cac19d56727", "kind": "identity", "frame_number": 31, "timestamp_epoch": "1722307129.035966000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-7c265d2ad241ba93ef178951", "kind": "identity", "frame_number": 58, "timestamp_epoch": "1722307129.109387000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 2, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-0fee04f01215eee543295717", "kind": "identity", "frame_number": 59, "timestamp_epoch": "1722307129.109482000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-2873bde04bfb05c0d75491f7", "kind": "identity", "frame_number": 60, "timestamp_epoch": "1722307129.109969000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-57b3a8b2b94a7156f8ee06c8", "kind": "identity", "frame_number": 61, "timestamp_epoch": "1722307129.110003000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 2, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-604a9976901e027ffac52c50", "kind": "identity", "frame_number": 71, "timestamp_epoch": "1722307129.120736000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 4, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-8d721720dbb6615cccf0192a", "kind": "identity", "frame_number": 73, "timestamp_epoch": "1722307129.121401000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 4, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "11" } }, { "event_id": "evt-e15b4bbd5578032b650984fa", "kind": "identity", "frame_number": 84, "timestamp_epoch": "1722307129.129461000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-fce1217abc4be32f0092ef10", "kind": "identity", "frame_number": 86, "timestamp_epoch": "1722307129.130126000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "11" } }, { "event_id": "evt-c8f3de0dc8658a7971a071d3", "kind": "identity", "frame_number": 98, "timestamp_epoch": "1722307129.132685000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-906421ccae1b5c061fcd1c61", "kind": "identity", "frame_number": 100, "timestamp_epoch": "1722307129.132732000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-83a311e70b76d3574c0a2486", "kind": "identity", "frame_number": 107, "timestamp_epoch": "1722307129.133682000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-8191086d96df485ab3cfb607", "kind": "identity", "frame_number": 109, "timestamp_epoch": "1722307129.133775000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-a087684879faa2e991ed73ad", "kind": "identity", "frame_number": 113, "timestamp_epoch": "1722307129.133950000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-feead52d35b633f33c0fcd72", "kind": "identity", "frame_number": 122, "timestamp_epoch": "1722307129.134778000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-51b495a1527c2c23575d5d54", "kind": "identity", "frame_number": 128, "timestamp_epoch": "1722307129.135287000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-6f85e3fea85edda91433380a", "kind": "identity", "frame_number": 130, "timestamp_epoch": "1722307129.135346000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-f727c3b9d284443a27aa85d5", "kind": "identity", "frame_number": 133, "timestamp_epoch": "1722307129.135435000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-7e9c2941a8e8ee1d50454a10", "kind": "identity", "frame_number": 136, "timestamp_epoch": "1722307129.136066000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-c8be36f58f078a0cc6bf7026", "kind": "identity", "frame_number": 137, "timestamp_epoch": "1722307129.136109000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-23444fa6c7da3297f9a3eb03", "kind": "identity", "frame_number": 138, "timestamp_epoch": "1722307129.136462000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-a7a495bc209b49b8fdd7f9b9", "kind": "identity", "frame_number": 158, "timestamp_epoch": "1722307129.228943000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-991fd859201367a095c9ddaa", "kind": "identity", "frame_number": 159, "timestamp_epoch": "1722307129.229602000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-238fbadfdfcd49553f2cee32", "kind": "identity", "frame_number": 166, "timestamp_epoch": "1722307129.240013000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "desktop-skbr25f$", "kerberos.msg_type": "10" } }, { "event_id": "evt-079834e2241db3d3d6ee485d", "kind": "identity", "frame_number": 168, "timestamp_epoch": "1722307129.240882000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "11" } }, { "event_id": "evt-06594d9e0235b4b7e98092c1", "kind": "identity", "frame_number": 179, "timestamp_epoch": "1722307129.243506000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-5ce21d2ae02f9367d20d8ed4", "kind": "identity", "frame_number": 182, "timestamp_epoch": "1722307129.244452000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-0847ebea970830b1a3a66a43", "kind": "identity", "frame_number": 188, "timestamp_epoch": "1722307129.245039000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-6c595af3fd3437ba6975c461", "kind": "identity", "frame_number": 190, "timestamp_epoch": "1722307129.245596000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-da5c37f0bff72f51b0512494", "kind": "identity", "frame_number": 191, "timestamp_epoch": "1722307129.245852000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-b2c3089c35f974961818a1ce", "kind": "identity", "frame_number": 212, "timestamp_epoch": "1722307129.261574000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-5af088d1d7fe364469330e79", "kind": "identity", "frame_number": 214, "timestamp_epoch": "1722307129.262350000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-e4710c0b0bf42e86d77caa90", "kind": "identity", "frame_number": 220, "timestamp_epoch": "1722307129.274367000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-fac93b144d914665dd466fa1", "kind": "identity", "frame_number": 223, "timestamp_epoch": "1722307129.275385000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-65bf3dde523969d772b433b0", "kind": "identity", "frame_number": 245, "timestamp_epoch": "1722307129.397204000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-f59edf34460d93e6d9f27b2b", "kind": "identity", "frame_number": 247, "timestamp_epoch": "1722307129.398343000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-c1aaf447fc576d987b87b1da", "kind": "identity", "frame_number": 260, "timestamp_epoch": "1722307129.421811000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ce660735881b44842ded78d2", "kind": "identity", "frame_number": 261, "timestamp_epoch": "1722307129.421978000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-b401062f3c719d3e63cf0248", "kind": "identity", "frame_number": 262, "timestamp_epoch": "1722307129.422257000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-d2c97513600714932c17c3d2", "kind": "identity", "frame_number": 267, "timestamp_epoch": "1722307129.423477000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-72ee3ca6cde59d7e56ed752a", "kind": "identity", "frame_number": 269, "timestamp_epoch": "1722307129.425044000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-4363c691961deda60cade6d3", "kind": "identity", "frame_number": 273, "timestamp_epoch": "1722307129.431659000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-082f29f3a52d04ee89dc6b7b", "kind": "identity", "frame_number": 274, "timestamp_epoch": "1722307129.432016000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-305b9770a38b00bf186f147d", "kind": "identity", "frame_number": 275, "timestamp_epoch": "1722307129.433463000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "WIRESHARKWORKSH", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "DESKTOP-SKBR25F$" } }, { "event_id": "evt-a0323211addf2293534a075c", "kind": "identity", "frame_number": 276, "timestamp_epoch": "1722307129.437100000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-91640072c0477ce24908f51f", "kind": "identity", "frame_number": 277, "timestamp_epoch": "1722307129.437520000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-fec35714a8c6e665377a2f65", "kind": "identity", "frame_number": 278, "timestamp_epoch": "1722307129.437687000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-afa1afbbfe2ecc8d2352c80b", "kind": "identity", "frame_number": 279, "timestamp_epoch": "1722307129.437850000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2fb7487e739cb104f2accd07", "kind": "identity", "frame_number": 280, "timestamp_epoch": "1722307129.438019000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-8c965caff7f5f3ecf3ae21ec", "kind": "identity", "frame_number": 299, "timestamp_epoch": "1722307129.554539000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-6063a34dd72949473422a712", "kind": "identity", "frame_number": 300, "timestamp_epoch": "1722307129.554725000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-dd74686f346b35da36bd4962", "kind": "identity", "frame_number": 301, "timestamp_epoch": "1722307129.555042000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-48246c8981d22e3ea8f01683", "kind": "identity", "frame_number": 306, "timestamp_epoch": "1722307129.556258000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-cebbeaaf3a179f83026e5150", "kind": "identity", "frame_number": 309, "timestamp_epoch": "1722307129.557404000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-864287664a2ff7f85482b993", "kind": "identity", "frame_number": 318, "timestamp_epoch": "1722307129.558230000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-1d24c8183c176014ac1747ff", "kind": "identity", "frame_number": 321, "timestamp_epoch": "1722307129.558803000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-b052023a488cdf423c072a27", "kind": "identity", "frame_number": 328, "timestamp_epoch": "1722307129.559349000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-f344218cd55e736e2a75e1ec", "kind": "identity", "frame_number": 330, "timestamp_epoch": "1722307129.560265000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-f945d8ce4bae4b33b79a2cab", "kind": "identity", "frame_number": 331, "timestamp_epoch": "1722307129.560605000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-991d4d3d604d82398c5e3415", "kind": "identity", "frame_number": 334, "timestamp_epoch": "1722307129.560765000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-4a7762a8eefb4cbf3121e5a0", "kind": "identity", "frame_number": 335, "timestamp_epoch": "1722307129.560946000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-e07880e94636f274c6ba67ec", "kind": "identity", "frame_number": 336, "timestamp_epoch": "1722307129.561091000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-d87068027fc2ad66b415079e", "kind": "identity", "frame_number": 337, "timestamp_epoch": "1722307129.561113000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-992fa1d57b94ebec9ead3b50", "kind": "identity", "frame_number": 338, "timestamp_epoch": "1722307129.561400000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-1d8b205d1bd38db756e91d50", "kind": "identity", "frame_number": 340, "timestamp_epoch": "1722307129.561724000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-df054a5cfa5de2a188d50d2c", "kind": "identity", "frame_number": 341, "timestamp_epoch": "1722307129.561891000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-1cd4f2a3aa052fa8bc0797bc", "kind": "identity", "frame_number": 342, "timestamp_epoch": "1722307129.562075000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-d26cc686782d2a164f2ba748", "kind": "identity", "frame_number": 343, "timestamp_epoch": "1722307129.562217000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-038c2d6d43183fc510819504", "kind": "identity", "frame_number": 344, "timestamp_epoch": "1722307129.562495000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-ab6e151c0ae5bd69bb0d0c76", "kind": "identity", "frame_number": 345, "timestamp_epoch": "1722307129.562698000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-eca51f6c3f7599d0e7b95967", "kind": "identity", "frame_number": 348, "timestamp_epoch": "1722307129.566759000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5f6a16da1b88cc2126754a0a", "kind": "identity", "frame_number": 349, "timestamp_epoch": "1722307129.567035000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b71b80f335f0e2001673e682", "kind": "identity", "frame_number": 350, "timestamp_epoch": "1722307129.567256000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-3e5e88e5102eef9a393b3228", "kind": "identity", "frame_number": 351, "timestamp_epoch": "1722307129.567462000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-6039469c1701cabf733a5366", "kind": "identity", "frame_number": 352, "timestamp_epoch": "1722307129.567669000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-a644d617d2cfeafbd0f9215f", "kind": "identity", "frame_number": 353, "timestamp_epoch": "1722307129.567843000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-2b45e796905a0093004a60a1", "kind": "identity", "frame_number": 354, "timestamp_epoch": "1722307129.568437000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6ea6313b8e381eedb2b47157", "kind": "identity", "frame_number": 355, "timestamp_epoch": "1722307129.568657000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a5715b021e350f553e3b6575", "kind": "identity", "frame_number": 356, "timestamp_epoch": "1722307129.568868000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2e3cff0d91a00fc732d1313f", "kind": "identity", "frame_number": 357, "timestamp_epoch": "1722307129.569018000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-08230e02a4acece692af4e57", "kind": "identity", "frame_number": 358, "timestamp_epoch": "1722307129.569189000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7d41a7376f90234d18ff0e42", "kind": "identity", "frame_number": 359, "timestamp_epoch": "1722307129.569348000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ee5f6f678d50810512bf38aa", "kind": "identity", "frame_number": 360, "timestamp_epoch": "1722307129.570041000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c0770f1eed0f2fb0ed46decd", "kind": "identity", "frame_number": 361, "timestamp_epoch": "1722307129.570292000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-83966b23c0a770189c581e7f", "kind": "identity", "frame_number": 362, "timestamp_epoch": "1722307129.570534000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-93c71de062295e70324fb571", "kind": "identity", "frame_number": 363, "timestamp_epoch": "1722307129.570677000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-20154c8ae3d2032937f73323", "kind": "identity", "frame_number": 364, "timestamp_epoch": "1722307129.570863000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f618d7d28d5f388a910ecd43", "kind": "identity", "frame_number": 365, "timestamp_epoch": "1722307129.571071000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-1987b21fbe6ce36901ac1b7b", "kind": "identity", "frame_number": 366, "timestamp_epoch": "1722307129.571797000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1e0348daf53c528d4793a9d5", "kind": "identity", "frame_number": 367, "timestamp_epoch": "1722307129.572041000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-03e27232576a890f32f4bbc3", "kind": "identity", "frame_number": 368, "timestamp_epoch": "1722307129.572291000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0b6055a5c95c4fa13be35344", "kind": "identity", "frame_number": 369, "timestamp_epoch": "1722307129.572457000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9edb1b6fe5de85c77a337746", "kind": "identity", "frame_number": 370, "timestamp_epoch": "1722307129.572638000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-17555b3f8287abf689d206a4", "kind": "identity", "frame_number": 371, "timestamp_epoch": "1722307129.572818000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-6855674b61913c525430237f", "kind": "identity", "frame_number": 372, "timestamp_epoch": "1722307129.573112000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-cc95f9dceedce8949d0b51c0", "kind": "identity", "frame_number": 373, "timestamp_epoch": "1722307129.573347000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-68a069c18e5364509a13cd1b", "kind": "identity", "frame_number": 374, "timestamp_epoch": "1722307129.573563000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-380a89399eab2596bed3d510", "kind": "identity", "frame_number": 375, "timestamp_epoch": "1722307129.573743000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-fb217aba3e953fabe29ebdb9", "kind": "identity", "frame_number": 376, "timestamp_epoch": "1722307129.573925000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-69e9fb60a63b5ba696884f6d", "kind": "identity", "frame_number": 377, "timestamp_epoch": "1722307129.574138000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f761857c46eb564ad9ece932", "kind": "identity", "frame_number": 378, "timestamp_epoch": "1722307129.574324000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-58b5278cf2087b138deebb4c", "kind": "identity", "frame_number": 379, "timestamp_epoch": "1722307129.574466000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-508ccda11e9bc95980a7808e", "kind": "identity", "frame_number": 380, "timestamp_epoch": "1722307129.574688000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-234c1cc0454e4e13f0cebdba", "kind": "identity", "frame_number": 381, "timestamp_epoch": "1722307129.574924000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-633a689950b2299d2ac37be3", "kind": "identity", "frame_number": 382, "timestamp_epoch": "1722307129.575116000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-9c70f890732cdccb7b09add3", "kind": "identity", "frame_number": 383, "timestamp_epoch": "1722307129.575255000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-32c6293e9a716549bf110ae6", "kind": "identity", "frame_number": 384, "timestamp_epoch": "1722307129.575438000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f1bbd1c56bc43cd41d8f9786", "kind": "identity", "frame_number": 385, "timestamp_epoch": "1722307129.575594000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-e479140f2e3617a7e51e1622", "kind": "identity", "frame_number": 386, "timestamp_epoch": "1722307129.575778000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-65f35b9f89522ecff7bc756f", "kind": "identity", "frame_number": 387, "timestamp_epoch": "1722307129.575921000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-21f6669d6240612d91079252", "kind": "identity", "frame_number": 388, "timestamp_epoch": "1722307129.576108000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1144db7639e154b26688c152", "kind": "identity", "frame_number": 389, "timestamp_epoch": "1722307129.576266000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-634c72fda1e9be75cafff3b3", "kind": "identity", "frame_number": 390, "timestamp_epoch": "1722307129.576436000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-111ccc3e3f6b8ccd9012b069", "kind": "identity", "frame_number": 391, "timestamp_epoch": "1722307129.576572000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-7b541fe98e24abb3075aeb43", "kind": "identity", "frame_number": 392, "timestamp_epoch": "1722307129.577047000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c4dd9230be6e45d34ab2dcdd", "kind": "identity", "frame_number": 393, "timestamp_epoch": "1722307129.577236000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-320a0064ec7f33843a1da548", "kind": "identity", "frame_number": 394, "timestamp_epoch": "1722307129.578126000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-63d4b60c4810b91e839c6bae", "kind": "identity", "frame_number": 395, "timestamp_epoch": "1722307129.578279000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b8adbb40059c29fc8157ab16", "kind": "identity", "frame_number": 396, "timestamp_epoch": "1722307129.578589000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-53b485dec3aa84f44073ae8b", "kind": "identity", "frame_number": 397, "timestamp_epoch": "1722307129.578812000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-41df79faf8b0f891aee57298", "kind": "identity", "frame_number": 398, "timestamp_epoch": "1722307129.579213000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2e3e3802f3753eebc14e6a52", "kind": "identity", "frame_number": 399, "timestamp_epoch": "1722307129.579387000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ff9f273596a0c0c20f2c463d", "kind": "identity", "frame_number": 400, "timestamp_epoch": "1722307129.579711000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7085fd6378708dda3239cfe8", "kind": "identity", "frame_number": 401, "timestamp_epoch": "1722307129.580034000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b61c5c7fde3be9df9c9e7161", "kind": "identity", "frame_number": 402, "timestamp_epoch": "1722307129.580253000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-93f51b323462fb575fb41a93", "kind": "identity", "frame_number": 403, "timestamp_epoch": "1722307129.580409000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-556dc545061449954f1b4e8f", "kind": "identity", "frame_number": 404, "timestamp_epoch": "1722307129.580606000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-30e4b579c44d2cb799715e9f", "kind": "identity", "frame_number": 405, "timestamp_epoch": "1722307129.580774000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-369bda963df6239dfc600e4f", "kind": "identity", "frame_number": 406, "timestamp_epoch": "1722307129.580953000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-3438d04e8f52683eb9a27e93", "kind": "identity", "frame_number": 407, "timestamp_epoch": "1722307129.581092000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-5eec2f2f2f5246066509937b", "kind": "identity", "frame_number": 408, "timestamp_epoch": "1722307129.581300000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-998d69707cff419226a3bfb4", "kind": "identity", "frame_number": 409, "timestamp_epoch": "1722307129.581525000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-3ead1064b948a41d0cd6bda8", "kind": "identity", "frame_number": 410, "timestamp_epoch": "1722307129.581729000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-b851b08f85a45c9b264faa3c", "kind": "identity", "frame_number": 411, "timestamp_epoch": "1722307129.581868000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-69b480e33ccb06d75ebe3504", "kind": "identity", "frame_number": 412, "timestamp_epoch": "1722307129.582030000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-284a95b825b883767c52e70c", "kind": "identity", "frame_number": 413, "timestamp_epoch": "1722307129.582189000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a35f317c27f49a6b19c846ee", "kind": "identity", "frame_number": 414, "timestamp_epoch": "1722307129.582353000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2aa370cff6f55a1f57a652d3", "kind": "identity", "frame_number": 415, "timestamp_epoch": "1722307129.582498000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-6d659a278fbf3a86371a6a4b", "kind": "identity", "frame_number": 416, "timestamp_epoch": "1722307129.582674000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2857ad480252f4f995665a45", "kind": "identity", "frame_number": 417, "timestamp_epoch": "1722307129.582833000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-0220820e9beaad9faa9d9f54", "kind": "identity", "frame_number": 418, "timestamp_epoch": "1722307129.583037000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f231a6fd3aa688d4081b7d73", "kind": "identity", "frame_number": 419, "timestamp_epoch": "1722307129.583180000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-e3f938a2316b53572f592778", "kind": "identity", "frame_number": 420, "timestamp_epoch": "1722307129.583549000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5685d771d84bb8d80f9f5920", "kind": "identity", "frame_number": 421, "timestamp_epoch": "1722307129.583734000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-bf5c7191e9c6c8e206397c68", "kind": "identity", "frame_number": 422, "timestamp_epoch": "1722307129.583997000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-44393144e86f39ae3a33a60e", "kind": "identity", "frame_number": 424, "timestamp_epoch": "1722307129.584182000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-4ef591bfea2d774f7c5d4982", "kind": "identity", "frame_number": 426, "timestamp_epoch": "1722307129.584605000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-bafc1e2154561041b9412c1b", "kind": "identity", "frame_number": 427, "timestamp_epoch": "1722307129.584767000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-54206bee31ee832b2ae0ab21", "kind": "identity", "frame_number": 428, "timestamp_epoch": "1722307129.585039000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-02a1b94929350b7b8082e836", "kind": "identity", "frame_number": 429, "timestamp_epoch": "1722307129.585267000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f547df9d319017777a6ec4ea", "kind": "identity", "frame_number": 430, "timestamp_epoch": "1722307129.585481000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-06b3807c465dddd98488e752", "kind": "identity", "frame_number": 431, "timestamp_epoch": "1722307129.585676000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-2f98125dcbb7f2a8f9ba49a4", "kind": "identity", "frame_number": 432, "timestamp_epoch": "1722307129.585860000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-afac8bbca9205b482e2aab99", "kind": "identity", "frame_number": 434, "timestamp_epoch": "1722307129.586069000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-7b30805bf4258b17c92946c6", "kind": "identity", "frame_number": 435, "timestamp_epoch": "1722307129.586245000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-cecd67a5b5bbf5a1b5e49687", "kind": "identity", "frame_number": 436, "timestamp_epoch": "1722307129.586421000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-280c18f89e23775babaf7845", "kind": "identity", "frame_number": 437, "timestamp_epoch": "1722307129.586675000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-fd7e1dc22d7a28ec6b1c51ae", "kind": "identity", "frame_number": 438, "timestamp_epoch": "1722307129.586829000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-72d330d9f0a36444ca2b1385", "kind": "identity", "frame_number": 439, "timestamp_epoch": "1722307129.587013000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c9bb450f86f0310ba050e1f0", "kind": "identity", "frame_number": 440, "timestamp_epoch": "1722307129.587241000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-edfdeed4cb381106249c2747", "kind": "identity", "frame_number": 441, "timestamp_epoch": "1722307129.587441000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1d9c239d1788b890ec6a9095", "kind": "identity", "frame_number": 442, "timestamp_epoch": "1722307129.587571000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a488756b36dad58fc60627ea", "kind": "identity", "frame_number": 443, "timestamp_epoch": "1722307129.587702000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-834338a6b3312e239ccdd6ca", "kind": "identity", "frame_number": 444, "timestamp_epoch": "1722307129.587828000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-86f4fb5bba5e16c60247581a", "kind": "identity", "frame_number": 445, "timestamp_epoch": "1722307129.587951000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-89aeb400d0a44917d1913814", "kind": "identity", "frame_number": 447, "timestamp_epoch": "1722307129.588080000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-7e95993ba4ecee4fa4137582", "kind": "identity", "frame_number": 448, "timestamp_epoch": "1722307129.588223000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-083139a2e78369662537278e", "kind": "identity", "frame_number": 449, "timestamp_epoch": "1722307129.588352000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-dac0af41c2414bf8112d9aca", "kind": "identity", "frame_number": 450, "timestamp_epoch": "1722307129.588489000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-55b0c3b42b61252ece299535", "kind": "identity", "frame_number": 451, "timestamp_epoch": "1722307129.588626000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ecf6173037b15c9dc0f7e073", "kind": "identity", "frame_number": 452, "timestamp_epoch": "1722307129.589084000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5ce14959d5e96a628cae960d", "kind": "identity", "frame_number": 453, "timestamp_epoch": "1722307129.589209000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-96180e5c4b04388fbaea817a", "kind": "identity", "frame_number": 454, "timestamp_epoch": "1722307129.589578000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-ffa5476597f55168f3f61a0b", "kind": "identity", "frame_number": 455, "timestamp_epoch": "1722307129.589787000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a65659824ae58f1f69acd4dd", "kind": "identity", "frame_number": 456, "timestamp_epoch": "1722307129.590247000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-adb0f30363ec1829d6497488", "kind": "identity", "frame_number": 457, "timestamp_epoch": "1722307129.590434000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-fa8c291a3a16d968b8fc664d", "kind": "identity", "frame_number": 499, "timestamp_epoch": "1722307129.784130000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-2d4e3992d5b5ec027c0b92da", "kind": "identity", "frame_number": 500, "timestamp_epoch": "1722307129.784176000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-1d615ae11f2bc675ccafa2e3", "kind": "identity", "frame_number": 501, "timestamp_epoch": "1722307129.784191000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-3297c9423a22ca81b927e2db", "kind": "identity", "frame_number": 513, "timestamp_epoch": "1722307129.956396000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-7d1451c1b9141c4b42f55a8f", "kind": "identity", "frame_number": 515, "timestamp_epoch": "1722307129.957387000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-e8bb3d2d6e3780e46ef6566a", "kind": "identity", "frame_number": 538, "timestamp_epoch": "1722307129.996553000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-75b5a25565782d497a3847a1", "kind": "identity", "frame_number": 540, "timestamp_epoch": "1722307129.997336000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-a0d2420f034ab040f6e2c12a", "kind": "identity", "frame_number": 551, "timestamp_epoch": "1722307130.000323000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-553e9eb3357b27973c34b7b9", "kind": "identity", "frame_number": 553, "timestamp_epoch": "1722307130.000976000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-194245bd46428b83c1a04d1b", "kind": "identity", "frame_number": 564, "timestamp_epoch": "1722307130.009998000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-fe360639775304c30faa4d2d", "kind": "identity", "frame_number": 566, "timestamp_epoch": "1722307130.010839000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-e6ab9f05257a92ad221c2d14", "kind": "identity", "frame_number": 572, "timestamp_epoch": "1722307130.012604000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "10" } }, { "event_id": "evt-113abd8b741ed4e12ad3d73c", "kind": "identity", "frame_number": 573, "timestamp_epoch": "1722307130.013077000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-e45187f2c1541bf359d188c4", "kind": "identity", "frame_number": 580, "timestamp_epoch": "1722307130.013677000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "10" } }, { "event_id": "evt-e9f49763f220b1d92e9f7623", "kind": "identity", "frame_number": 582, "timestamp_epoch": "1722307130.014230000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "11" } }, { "event_id": "evt-412436b6ee9e660ee8659e5c", "kind": "identity", "frame_number": 591, "timestamp_epoch": "1722307130.014925000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-0f71546806963820744468d0", "kind": "identity", "frame_number": 594, "timestamp_epoch": "1722307130.015774000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-efcc21acd0af9a2cf67fe9be", "kind": "identity", "frame_number": 613, "timestamp_epoch": "1722307130.534452000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-4f49d0b052cafe18c9f0160f", "kind": "identity", "frame_number": 614, "timestamp_epoch": "1722307130.534562000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c4a700cbe32a80b691643387", "kind": "identity", "frame_number": 615, "timestamp_epoch": "1722307130.534744000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-75240fd794851fb996f4a6d6", "kind": "identity", "frame_number": 616, "timestamp_epoch": "1722307131.299650000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<00>,WIRESHARKWORKSH<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-aaf817cb4ac986a47819e4cc", "kind": "identity", "frame_number": 617, "timestamp_epoch": "1722307131.299702000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<00>,DESKTOP-SKBR25F<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-ade87ed796300b87e378e397", "kind": "identity", "frame_number": 618, "timestamp_epoch": "1722307131.299750000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-SKBR25F<20>,DESKTOP-SKBR25F<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-32bb26403e0d25040d952270", "kind": "identity", "frame_number": 624, "timestamp_epoch": "1722307132.084215000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<1e>,WIRESHARKWORKSH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-a263c8a86bc43b1dc67c81e5", "kind": "identity", "frame_number": 627, "timestamp_epoch": "1722307132.847008000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<1e>,WIRESHARKWORKSH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-00cd47f53637acf4fb607e18", "kind": "identity", "frame_number": 648, "timestamp_epoch": "1722307133.310142000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-35432ce0b4438a4ad294a935", "kind": "identity", "frame_number": 651, "timestamp_epoch": "1722307133.311244000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-5c13b3cd95682eaeefc1a2ab", "kind": "identity", "frame_number": 657, "timestamp_epoch": "1722307133.312121000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-4634d6a77cf36e87e3255bfc", "kind": "identity", "frame_number": 659, "timestamp_epoch": "1722307133.312857000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-d87d906bb82234a31fa8d0e5", "kind": "identity", "frame_number": 660, "timestamp_epoch": "1722307133.313193000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-c7c9e77f9e8f7139b3e8df13", "kind": "identity", "frame_number": 673, "timestamp_epoch": "1722307133.597005000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<1e>,WIRESHARKWORKSH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-8438b15ff4e161eb88fddfc2", "kind": "identity", "frame_number": 679, "timestamp_epoch": "1722307134.362626000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "WIRESHARKWORKSH<1e>,WIRESHARKWORKSH<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-196508be8a29d3edcadcd08b", "kind": "identity", "frame_number": 681, "timestamp_epoch": "1722307135.129046000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-dca130042cb2d503868febda", "kind": "identity", "frame_number": 682, "timestamp_epoch": "1722307135.136488000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.server": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-23e1c75d1989c1c0fa696925", "kind": "identity", "frame_number": 897, "timestamp_epoch": "1722307140.284612000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-cd82680bb405426b082a7032", "kind": "identity", "frame_number": 900, "timestamp_epoch": "1722307140.285244000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-d490ec0e8caf2f640600070c", "kind": "identity", "frame_number": 903, "timestamp_epoch": "1722307140.285986000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6dbe57d267cf8af66470c4ac", "kind": "identity", "frame_number": 904, "timestamp_epoch": "1722307140.286511000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-60af9c581ece0402c76574f3", "kind": "identity", "frame_number": 913, "timestamp_epoch": "1722307152.512235000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "10" } }, { "event_id": "evt-3e513d7ccf41273b869845b1", "kind": "identity", "frame_number": 914, "timestamp_epoch": "1722307152.512701000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "30" } }, { "event_id": "evt-45c8ad030e8ad874602848fd", "kind": "identity", "frame_number": 921, "timestamp_epoch": "1722307152.518681000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "10" } }, { "event_id": "evt-9e7b2d8480e57205ac452e6c", "kind": "identity", "frame_number": 923, "timestamp_epoch": "1722307152.520075000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "11" } }, { "event_id": "evt-9cf8e7687d3b91579ed13ea5", "kind": "identity", "frame_number": 932, "timestamp_epoch": "1722307152.521199000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-966afd056820bd7a7c30812a", "kind": "identity", "frame_number": 935, "timestamp_epoch": "1722307152.522364000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-9c9837ace4d37beb4c28fc3c", "kind": "identity", "frame_number": 953, "timestamp_epoch": "1722307152.757237000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-a234a77851fd672b81dfd40d", "kind": "identity", "frame_number": 956, "timestamp_epoch": "1722307152.758183000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-b7ea252e6a22f65d8b0ef015", "kind": "identity", "frame_number": 962, "timestamp_epoch": "1722307152.758739000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-89b44dc1722ae924d20dc6b1", "kind": "identity", "frame_number": 964, "timestamp_epoch": "1722307152.759245000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-2d1efc99cb4677532799e0d3", "kind": "identity", "frame_number": 965, "timestamp_epoch": "1722307152.761377000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-2b372d0e66599c348f86889f", "kind": "identity", "frame_number": 998, "timestamp_epoch": "1722307152.775526000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-7148b3f159cbce033b48fe57", "kind": "identity", "frame_number": 1000, "timestamp_epoch": "1722307152.776321000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-47981594ac379de7c62992bb", "kind": "identity", "frame_number": 1007, "timestamp_epoch": "1722307152.781005000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-4cf3b8e632dcd2404663caff", "kind": "identity", "frame_number": 1013, "timestamp_epoch": "1722307152.782154000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-a5ee0080cf5aca078dc6a63f", "kind": "identity", "frame_number": 1022, "timestamp_epoch": "1722307152.782893000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-5b7e4e4882a5699d4b3fd0b9", "kind": "identity", "frame_number": 1025, "timestamp_epoch": "1722307152.783333000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-634acbbe8d0f07820d3a82a7", "kind": "identity", "frame_number": 1032, "timestamp_epoch": "1722307152.783869000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-391f1cb32dff9a0635918978", "kind": "identity", "frame_number": 1035, "timestamp_epoch": "1722307152.784007000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-8bc7f0a9667bd3567bc878a0", "kind": "identity", "frame_number": 1037, "timestamp_epoch": "1722307152.784768000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-35685274d82e72259d2984e5", "kind": "identity", "frame_number": 1038, "timestamp_epoch": "1722307152.785177000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-1e95227cb0badeb2ae71a9bd", "kind": "identity", "frame_number": 1041, "timestamp_epoch": "1722307152.785612000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1d3594875b0e9d3c627bd72c", "kind": "identity", "frame_number": 1043, "timestamp_epoch": "1722307152.785818000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-dcc4ac654e09c2e9f5d68afa", "kind": "identity", "frame_number": 1047, "timestamp_epoch": "1722307152.787780000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2bc3d1511c6a5c7f521787f6", "kind": "identity", "frame_number": 1048, "timestamp_epoch": "1722307152.788055000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-afe0a15f882b6ca1395fca7b", "kind": "identity", "frame_number": 1049, "timestamp_epoch": "1722307152.788694000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-43804f8243cb41ad38613276", "kind": "identity", "frame_number": 1050, "timestamp_epoch": "1722307152.788844000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a93668cef10d5db7a31d1aa6", "kind": "identity", "frame_number": 1051, "timestamp_epoch": "1722307152.789084000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-8e6de255c893f002587a1619", "kind": "identity", "frame_number": 1052, "timestamp_epoch": "1722307152.789243000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-7661484235b2fcf9b8b6f926", "kind": "identity", "frame_number": 1053, "timestamp_epoch": "1722307152.789390000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0fe2ee13ced1c2281813acc7", "kind": "identity", "frame_number": 1054, "timestamp_epoch": "1722307152.789525000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-06861c34ffd85d38c512645b", "kind": "identity", "frame_number": 1055, "timestamp_epoch": "1722307152.789680000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-65a86ab440c53f58e0497441", "kind": "identity", "frame_number": 1056, "timestamp_epoch": "1722307152.790024000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-d69816a20f1e048514f08929", "kind": "identity", "frame_number": 1057, "timestamp_epoch": "1722307152.790201000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-ce75b3581e78210a1faa5865", "kind": "identity", "frame_number": 1058, "timestamp_epoch": "1722307152.790513000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-94159bd2f740e69cfe245b73", "kind": "identity", "frame_number": 1059, "timestamp_epoch": "1722307152.790742000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7c53dea03e22c24a75ee017a", "kind": "identity", "frame_number": 1060, "timestamp_epoch": "1722307152.791013000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-8ae2a2ba3c4a2a7e5c42dd24", "kind": "identity", "frame_number": 1061, "timestamp_epoch": "1722307152.791162000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-d878772ca77c939745120455", "kind": "identity", "frame_number": 1062, "timestamp_epoch": "1722307152.791453000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-58e5cdacc2bb05a431d55799", "kind": "identity", "frame_number": 1063, "timestamp_epoch": "1722307152.791602000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-e62e1746c29767aba6f5723f", "kind": "identity", "frame_number": 1064, "timestamp_epoch": "1722307152.791901000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-365dd128508922276c32b89f", "kind": "identity", "frame_number": 1065, "timestamp_epoch": "1722307152.792045000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c16decd47234d47a4dc3ac37", "kind": "identity", "frame_number": 1066, "timestamp_epoch": "1722307152.792368000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f98e93a72f8ec619f3549496", "kind": "identity", "frame_number": 1067, "timestamp_epoch": "1722307152.792524000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5db7ec933d9ef56c86abea0d", "kind": "identity", "frame_number": 1068, "timestamp_epoch": "1722307152.792930000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-115bc132b58035b7e7bebd97", "kind": "identity", "frame_number": 1069, "timestamp_epoch": "1722307152.793077000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c719c999ff83c92c0fd14477", "kind": "identity", "frame_number": 1070, "timestamp_epoch": "1722307152.793528000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "samr.samr_UserInfo21.account_name": "ccollier", "samr.samr_UserInfo21.full_name": "Clark Collier" } }, { "event_id": "evt-5c330972fd5c37b2aa683709", "kind": "identity", "frame_number": 1071, "timestamp_epoch": "1722307152.793687000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-a6c39194477f8add273e5bb9", "kind": "identity", "frame_number": 1072, "timestamp_epoch": "1722307152.794009000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-19d6ecff50ebf6b33477ddc7", "kind": "identity", "frame_number": 1073, "timestamp_epoch": "1722307152.794176000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-8983672c031a57c97ffb7f51", "kind": "identity", "frame_number": 1074, "timestamp_epoch": "1722307152.794435000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-694ad01f3c32473d086d86e6", "kind": "identity", "frame_number": 1075, "timestamp_epoch": "1722307152.794582000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-85370bea0cec69ca62fdefbf", "kind": "identity", "frame_number": 1076, "timestamp_epoch": "1722307152.794826000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9f97560ec61a783e68a8ecad", "kind": "identity", "frame_number": 1077, "timestamp_epoch": "1722307152.794979000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-d718b47ed7a321422ca27f1e", "kind": "identity", "frame_number": 1078, "timestamp_epoch": "1722307152.795212000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b1e60bd374c0e6a20ef1dbd7", "kind": "identity", "frame_number": 1079, "timestamp_epoch": "1722307152.795358000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-bbd6a3484316f721a29057ca", "kind": "identity", "frame_number": 1080, "timestamp_epoch": "1722307152.795585000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-69f01cdd09e5c7f70b0b37ce", "kind": "identity", "frame_number": 1081, "timestamp_epoch": "1722307152.795749000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-ffac3805504a83347cda1430", "kind": "identity", "frame_number": 1082, "timestamp_epoch": "1722307152.795977000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-8069e25418c84e2622577098", "kind": "identity", "frame_number": 1083, "timestamp_epoch": "1722307152.796148000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-118daea3c0224c8c64929b91", "kind": "identity", "frame_number": 1084, "timestamp_epoch": "1722307152.796434000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-39e384ffd9d3f3d6df50f055", "kind": "identity", "frame_number": 1085, "timestamp_epoch": "1722307152.796609000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-e80545f0169d54040e055e3e", "kind": "identity", "frame_number": 1086, "timestamp_epoch": "1722307152.796795000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9c6177f86c483be3ec20d6ab", "kind": "identity", "frame_number": 1100, "timestamp_epoch": "1722307153.028610000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f02d18b0049a7441dd1d4cf2", "kind": "identity", "frame_number": 1101, "timestamp_epoch": "1722307153.029043000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-e18add3c24f2fdc6e7f726c7", "kind": "identity", "frame_number": 1106, "timestamp_epoch": "1722307153.030103000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 57, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-80e7b936e5ee0513c63bae88", "kind": "identity", "frame_number": 1109, "timestamp_epoch": "1722307153.031311000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 57, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-08b6128382589b51603bfa48", "kind": "identity", "frame_number": 1116, "timestamp_epoch": "1722307153.031787000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-59fbed1edb8c8fcb8a665133", "kind": "identity", "frame_number": 1118, "timestamp_epoch": "1722307153.032696000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-a56fe9817404156c0f756ab6", "kind": "identity", "frame_number": 1119, "timestamp_epoch": "1722307153.033057000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0cafc652c669c9a2f8647d9e", "kind": "identity", "frame_number": 1120, "timestamp_epoch": "1722307153.033277000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9ccba8006af844c8baf53796", "kind": "identity", "frame_number": 1121, "timestamp_epoch": "1722307153.033472000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-fc0df7ff2025116e527eba75", "kind": "identity", "frame_number": 1122, "timestamp_epoch": "1722307153.033613000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-48261e2a811ef8e9423cd716", "kind": "identity", "frame_number": 1659, "timestamp_epoch": "1722307167.496796000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f9ea27b1a22f1b6f2c71fd51", "kind": "identity", "frame_number": 1660, "timestamp_epoch": "1722307167.496996000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-412713d3c4f2e94fc9e3815a", "kind": "identity", "frame_number": 1661, "timestamp_epoch": "1722307167.497218000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7ebc0711a177649e7a14eace", "kind": "identity", "frame_number": 1662, "timestamp_epoch": "1722307167.497381000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-fda536c8267bd0084e7912a1", "kind": "identity", "frame_number": 1761, "timestamp_epoch": "1722307182.564669000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0f6ec16edac9f8641d70689d", "kind": "identity", "frame_number": 1762, "timestamp_epoch": "1722307182.565069000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-077997b99c1a568fcf0d2cd5", "kind": "identity", "frame_number": 1763, "timestamp_epoch": "1722307182.566863000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-96330ba2be6c62b80c9e6e9d", "kind": "identity", "frame_number": 1764, "timestamp_epoch": "1722307182.567110000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-4d55908d4e3f8ea559e03760", "kind": "identity", "frame_number": 1766, "timestamp_epoch": "1722307183.080608000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-59aff96b6070f88b55bbdda1", "kind": "identity", "frame_number": 1767, "timestamp_epoch": "1722307183.081118000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-1ffb99f44aa434056dca4587", "kind": "identity", "frame_number": 1768, "timestamp_epoch": "1722307183.081640000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7bf9121419a1b78a2811c41b", "kind": "identity", "frame_number": 1769, "timestamp_epoch": "1722307183.081897000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9c305b64c7e8967063905d64", "kind": "identity", "frame_number": 1770, "timestamp_epoch": "1722307183.083306000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6de80752ab94c94e72d3d4a6", "kind": "identity", "frame_number": 1771, "timestamp_epoch": "1722307183.083633000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-fdcd37f207f6de6d5d71d64a", "kind": "identity", "frame_number": 1772, "timestamp_epoch": "1722307183.083993000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-3114262accff6dccffb36ba0", "kind": "identity", "frame_number": 1773, "timestamp_epoch": "1722307183.084369000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-8c2408464284f178ec9d01f3", "kind": "identity", "frame_number": 1774, "timestamp_epoch": "1722307183.085702000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6f7ea65327039950c546b998", "kind": "identity", "frame_number": 1775, "timestamp_epoch": "1722307183.085961000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-3305bcdce3cc581b2d2e969a", "kind": "identity", "frame_number": 1776, "timestamp_epoch": "1722307183.086259000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-9704f8932e63d9e1ad477bfc", "kind": "identity", "frame_number": 1777, "timestamp_epoch": "1722307183.086480000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-61cdce0927783ff662c36fbd", "kind": "identity", "frame_number": 1778, "timestamp_epoch": "1722307183.087523000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1d69d27bcb68e6a5c134070c", "kind": "identity", "frame_number": 1779, "timestamp_epoch": "1722307183.087767000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-cb233201af4a3c6b9b24151a", "kind": "identity", "frame_number": 1780, "timestamp_epoch": "1722307183.088066000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f3d8d99f323390ac2b350b1e", "kind": "identity", "frame_number": 1781, "timestamp_epoch": "1722307183.088283000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b9c89e7cee68e4dc91114ffe", "kind": "identity", "frame_number": 1782, "timestamp_epoch": "1722307183.090392000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-a6113f238be72254022165bd", "kind": "identity", "frame_number": 1783, "timestamp_epoch": "1722307183.090635000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-e8ddcbc866d697b21ee6c0d0", "kind": "identity", "frame_number": 1784, "timestamp_epoch": "1722307183.090977000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-7bed9fda6b476111c45920bb", "kind": "identity", "frame_number": 1785, "timestamp_epoch": "1722307183.091165000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-639f172b1b65e3f912adb911", "kind": "identity", "frame_number": 1789, "timestamp_epoch": "1722307188.524257000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-d158cc34d36fb096cd27aecd", "kind": "identity", "frame_number": 1790, "timestamp_epoch": "1722307188.524646000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f2b047fc6aa26c526e204824", "kind": "identity", "frame_number": 1796, "timestamp_epoch": "1722307188.954781000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-d3b3efe4d8d31666d1f81859", "kind": "identity", "frame_number": 1799, "timestamp_epoch": "1722307188.956184000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-e7e85b5f7ba0f9a18ba3d326", "kind": "identity", "frame_number": 1808, "timestamp_epoch": "1722307188.957315000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-6136b391c3343ab529a9ee83", "kind": "identity", "frame_number": 1811, "timestamp_epoch": "1722307188.957839000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "DESKTOP-SKBR25F$", "kerberos.msg_type": "13" } }, { "event_id": "evt-8a4e42c5158fa2aa89b1a124", "kind": "identity", "frame_number": 1818, "timestamp_epoch": "1722307188.958534000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-64533eb329b05b993745bbed", "kind": "identity", "frame_number": 1820, "timestamp_epoch": "1722307188.959708000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-c82a8255c647e256257d95ee", "kind": "identity", "frame_number": 1821, "timestamp_epoch": "1722307188.960186000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6fd26d4586b34bf12d30dbf4", "kind": "identity", "frame_number": 1822, "timestamp_epoch": "1722307188.960399000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ad6e5db8951c869591f2a94e", "kind": "identity", "frame_number": 1823, "timestamp_epoch": "1722307188.960822000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-236a17e206f659711f58d2f9", "kind": "identity", "frame_number": 1824, "timestamp_epoch": "1722307188.961094000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-40ca1c8a10508c6b6a786dee", "kind": "identity", "frame_number": 9052, "timestamp_epoch": "1722307199.699662000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-9ac218cc45fa9556e3c7e441", "kind": "identity", "frame_number": 9053, "timestamp_epoch": "1722307199.700376000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b55b215609aab295ced3c5af", "kind": "identity", "frame_number": 9054, "timestamp_epoch": "1722307199.700961000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-77ae469165d3f5bc57411865", "kind": "identity", "frame_number": 9055, "timestamp_epoch": "1722307199.701470000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f249f1b97c9450f27c2533f6", "kind": "identity", "frame_number": 9069, "timestamp_epoch": "1722307206.300424000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c3813424d92e18f5198db275", "kind": "identity", "frame_number": 9070, "timestamp_epoch": "1722307206.300719000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-88894209b72c13b870bec0b0", "kind": "identity", "frame_number": 9071, "timestamp_epoch": "1722307206.301024000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-61e682eafbfeefc3d752c570", "kind": "identity", "frame_number": 9072, "timestamp_epoch": "1722307206.301218000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-9cc1d76d1c0e594c42c8aea9", "kind": "identity", "frame_number": 9073, "timestamp_epoch": "1722307206.301429000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-a78ccb848576a820a9df1d6c", "kind": "identity", "frame_number": 9074, "timestamp_epoch": "1722307206.301601000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a3f65b48b2f20373f595bab1", "kind": "identity", "frame_number": 9075, "timestamp_epoch": "1722307206.301904000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-3720840b161d6a67c98b73e4", "kind": "identity", "frame_number": 9076, "timestamp_epoch": "1722307206.302088000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-6ae7716df19e6254ca7976f6", "kind": "identity", "frame_number": 9077, "timestamp_epoch": "1722307206.302331000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-aef9cf929582bd13267d2113", "kind": "identity", "frame_number": 9078, "timestamp_epoch": "1722307206.302496000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-be14712408af4beda673463c", "kind": "identity", "frame_number": 9079, "timestamp_epoch": "1722307206.302754000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f73dade4b4590f5f84bd7e14", "kind": "identity", "frame_number": 9080, "timestamp_epoch": "1722307206.302957000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-cab93264b95c691c6cb02883", "kind": "identity", "frame_number": 9081, "timestamp_epoch": "1722307206.303216000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-1593a938d897d8084efe6a9b", "kind": "identity", "frame_number": 9082, "timestamp_epoch": "1722307206.303368000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-76993c2b9588e9fb7cf4e3fa", "kind": "identity", "frame_number": 9083, "timestamp_epoch": "1722307206.303645000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-3509288e38081be55f8a35ca", "kind": "identity", "frame_number": 9084, "timestamp_epoch": "1722307206.303834000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-7c419795c3d094947a429c6c", "kind": "identity", "frame_number": 9085, "timestamp_epoch": "1722307206.304087000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-34b0617c8185a897a52a386f", "kind": "identity", "frame_number": 9086, "timestamp_epoch": "1722307206.304241000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-a98a661f9c6e93711a8f3b04", "kind": "identity", "frame_number": 9087, "timestamp_epoch": "1722307206.304526000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-711b5742df09dbaf1742188f", "kind": "identity", "frame_number": 9088, "timestamp_epoch": "1722307206.304747000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-b8e72eb3b8b7393928b447dc", "kind": "identity", "frame_number": 9089, "timestamp_epoch": "1722307206.304980000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-133b2a4415bd998aa6b3cb8b", "kind": "identity", "frame_number": 9090, "timestamp_epoch": "1722307206.305182000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-242579990de7382bafc18545", "kind": "identity", "frame_number": 9091, "timestamp_epoch": "1722307206.305421000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2fc79e271a89f5e05d761e5d", "kind": "identity", "frame_number": 9092, "timestamp_epoch": "1722307206.305566000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-0ac18e595cca93541988341e", "kind": "identity", "frame_number": 9093, "timestamp_epoch": "1722307206.305858000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-87776c33cde77829b1e985b0", "kind": "identity", "frame_number": 9094, "timestamp_epoch": "1722307206.306016000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-c865cb92066c8e3e56031ff0", "kind": "identity", "frame_number": 9095, "timestamp_epoch": "1722307206.306414000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c7025b11b73b710e35504a8c", "kind": "identity", "frame_number": 9096, "timestamp_epoch": "1722307206.309972000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-127dea8cc9e957317177a113", "kind": "identity", "frame_number": 9098, "timestamp_epoch": "1722307206.536442000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-59e37bc63d211e71cf4276a4", "kind": "identity", "frame_number": 9099, "timestamp_epoch": "1722307206.537438000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5da6fd08b7d749f7f439dd4f", "kind": "identity", "frame_number": 9100, "timestamp_epoch": "1722307206.537786000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-0096bc3c43b1123373b21c3b", "kind": "identity", "frame_number": 9101, "timestamp_epoch": "1722307206.538215000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-aa1d04708df5eceaa6e1cd6b", "kind": "identity", "frame_number": 9102, "timestamp_epoch": "1722307206.538472000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-cd73dbb806a0a0cc4b09dfe3", "kind": "identity", "frame_number": 9103, "timestamp_epoch": "1722307206.538784000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-eb3c94a2e7e3a896b22e6aa7", "kind": "identity", "frame_number": 9104, "timestamp_epoch": "1722307206.539084000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-c57e60e280b95215f7576fd5", "kind": "identity", "frame_number": 9369, "timestamp_epoch": "1722307213.923443000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-00e8a9a4e9949dbda7a8c799", "kind": "identity", "frame_number": 9371, "timestamp_epoch": "1722307213.924245000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-7ae1eaec112e4ceb4746388b", "kind": "identity", "frame_number": 9372, "timestamp_epoch": "1722307213.924606000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-b37bea69f7d8c10603d6b471", "kind": "identity", "frame_number": 9397, "timestamp_epoch": "1722307213.935134000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-696f096f4fbf836886cf7016", "kind": "identity", "frame_number": 9399, "timestamp_epoch": "1722307213.935850000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-ba07a80f53922de33696bc91", "kind": "identity", "frame_number": 9410, "timestamp_epoch": "1722307213.939967000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-16273bf8f41d86a9d7481e27", "kind": "identity", "frame_number": 9412, "timestamp_epoch": "1722307213.940763000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-d7b54048d8797da310a5652d", "kind": "identity", "frame_number": 9441, "timestamp_epoch": "1722307214.121731000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-0183a9aab00f581e0abb5d31", "kind": "identity", "frame_number": 9443, "timestamp_epoch": "1722307214.122519000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-1fa162ed951596906ee36af1", "kind": "identity", "frame_number": 9444, "timestamp_epoch": "1722307214.122864000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-30d1793d44ce5008bc182a9c", "kind": "identity", "frame_number": 9469, "timestamp_epoch": "1722307214.131773000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-1886a7ce562a8d16853e203e", "kind": "identity", "frame_number": 9471, "timestamp_epoch": "1722307214.132379000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-ef1a358f74f59fcf04f9512d", "kind": "identity", "frame_number": 9482, "timestamp_epoch": "1722307214.136868000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-e323505637d92f34ac777682", "kind": "identity", "frame_number": 9484, "timestamp_epoch": "1722307214.137623000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-b5c0773cafd96a1216c01d88", "kind": "identity", "frame_number": 9532, "timestamp_epoch": "1722307221.216667000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-cdaf5e7de6b645e9c86ee9cb", "kind": "identity", "frame_number": 9533, "timestamp_epoch": "1722307221.217320000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-fe6684b1935c03f3fd3cd432", "kind": "identity", "frame_number": 9641, "timestamp_epoch": "1722307239.011288000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-cebd1255026fc077a8dcec59", "kind": "identity", "frame_number": 9643, "timestamp_epoch": "1722307239.012008000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-c963c3a6fca8bc5093bc919d", "kind": "identity", "frame_number": 9644, "timestamp_epoch": "1722307239.012559000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-82365d0af6d49bc9face3d41", "kind": "identity", "frame_number": 9669, "timestamp_epoch": "1722307239.021669000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-ba5ecd370ac7d12590a3f0c7", "kind": "identity", "frame_number": 9671, "timestamp_epoch": "1722307239.022400000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-566bd173d1a1af6103a8c62a", "kind": "identity", "frame_number": 9682, "timestamp_epoch": "1722307239.027774000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-36e03a87a000a00fa66735b5", "kind": "identity", "frame_number": 9684, "timestamp_epoch": "1722307239.028585000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-40ce8c3a0de5344ff107978b", "kind": "identity", "frame_number": 9746, "timestamp_epoch": "1722307241.105562000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 110, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-34e19f41b93739aa75d8ffe3", "kind": "identity", "frame_number": 9749, "timestamp_epoch": "1722307241.106569000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 110, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.CNameString": "ccollier", "kerberos.msg_type": "13" } }, { "event_id": "evt-1be80e1f3b7e20cd42e93443", "kind": "identity", "frame_number": 9755, "timestamp_epoch": "1722307241.107544000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-eb5c35a5b780ff802c625c80", "kind": "identity", "frame_number": 9757, "timestamp_epoch": "1722307241.108272000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-0051f9b37e062e39e1b24d72", "kind": "identity", "frame_number": 9768, "timestamp_epoch": "1722307241.122109000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-85297823c295bf54cb9da7df", "kind": "identity", "frame_number": 9770, "timestamp_epoch": "1722307241.122854000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-d4f4960d1b0001bc55ee3123", "kind": "identity", "frame_number": 9900, "timestamp_epoch": "1722307270.485251000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-c4a028a4e697ce9049bbb769", "kind": "identity", "frame_number": 9901, "timestamp_epoch": "1722307270.493889000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "WIRESHARK-WS-DC<20>" } }, { "event_id": "evt-2dc0d55102e4c2d8049678c6", "kind": "identity", "frame_number": 9902, "timestamp_epoch": "1722307270.494127000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 24, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "WIRESHARK-WS-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-60319b190c3ba0c41ceccd6b", "kind": "identity", "frame_number": 9909, "timestamp_epoch": "1722307270.496127000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 114, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-eb84899c797dfadc692eb894", "kind": "identity", "frame_number": 9911, "timestamp_epoch": "1722307270.496553000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 114, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-e13695eac3ec5422927f6711", "kind": "identity", "frame_number": 9913, "timestamp_epoch": "1722307270.497131000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 114, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-666c739b7bfeaab39da95e5f", "kind": "identity", "frame_number": 9919, "timestamp_epoch": "1722307270.499929000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f8d975c90d376717f2bc16bf", "kind": "identity", "frame_number": 9922, "timestamp_epoch": "1722307270.506708000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-2e8a07e33c540c8fe9e990db", "kind": "identity", "frame_number": 9988, "timestamp_epoch": "1722307300.508595000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-5a37f0db9db7ff2a8ba87b1c", "kind": "identity", "frame_number": 9990, "timestamp_epoch": "1722307300.509128000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-d0ee38bad9be794f9f0ffcca", "kind": "identity", "frame_number": 9992, "timestamp_epoch": "1722307300.509737000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-a2a814239d0d267e72f273e8", "kind": "identity", "frame_number": 9998, "timestamp_epoch": "1722307300.512178000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-92ec6bc325de9410d5f92bed", "kind": "identity", "frame_number": 10001, "timestamp_epoch": "1722307300.520305000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-e68b2fc0ba9cb56b948ea31b", "kind": "identity", "frame_number": 10046, "timestamp_epoch": "1722307330.538622000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-a58da30db6c6761856ac716e", "kind": "identity", "frame_number": 10048, "timestamp_epoch": "1722307330.539153000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-24cd81757b0cc0045b4b87ae", "kind": "identity", "frame_number": 10050, "timestamp_epoch": "1722307330.539799000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-52170f8978ef542628417a4a", "kind": "identity", "frame_number": 10056, "timestamp_epoch": "1722307330.543637000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-28aa39390e9bf736247fa9c5", "kind": "identity", "frame_number": 10059, "timestamp_epoch": "1722307330.550735000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-6bfb3e107e8e30c2118856cb", "kind": "identity", "frame_number": 10071, "timestamp_epoch": "1722307332.008959000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-5ddbe1ea7c0851a223b3ca29", "kind": "identity", "frame_number": 10073, "timestamp_epoch": "1722307332.009714000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-aa6167d80f889be33128983e", "kind": "identity", "frame_number": 10313, "timestamp_epoch": "1722307333.690910000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-c518f068d6bfbe0c94a3fc5f", "kind": "identity", "frame_number": 10315, "timestamp_epoch": "1722307333.691652000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-5303272aebec9c96a52c9dc9", "kind": "identity", "frame_number": 10581, "timestamp_epoch": "1722307360.556360000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 134, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-8165987d1e054e559d07517d", "kind": "identity", "frame_number": 10583, "timestamp_epoch": "1722307360.556875000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 134, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-4a70463268c87d07016555b1", "kind": "identity", "frame_number": 10585, "timestamp_epoch": "1722307360.557479000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 134, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-f253b84367cc914a730b98ab", "kind": "identity", "frame_number": 10591, "timestamp_epoch": "1722307360.560141000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f7f78fc9071287b12a4ae715", "kind": "identity", "frame_number": 10594, "timestamp_epoch": "1722307360.567442000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-73965bbee62cec2a117f68ac", "kind": "identity", "frame_number": 10630, "timestamp_epoch": "1722307375.139460000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-f03a8a536370d81e332f8089", "kind": "identity", "frame_number": 10631, "timestamp_epoch": "1722307375.139853000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-f9dab59d9882b7c8720a33c0", "kind": "identity", "frame_number": 10653, "timestamp_epoch": "1722307390.586889000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-0600e1347379b1ae0e9ddaca", "kind": "identity", "frame_number": 10655, "timestamp_epoch": "1722307390.587276000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-891edf5a215729238a9bf0ab", "kind": "identity", "frame_number": 10657, "timestamp_epoch": "1722307390.587695000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-SKBR25F", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-714a1f0693bc02ca51c510a0", "kind": "identity", "frame_number": 10663, "timestamp_epoch": "1722307390.589465000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-19888162516fe0dc29846de9", "kind": "identity", "frame_number": 10666, "timestamp_epoch": "1722307390.595469000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.response_computer_name": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-bdfc5a93f66db9fb5d0b91e9", "kind": "identity", "frame_number": 10749, "timestamp_epoch": "1722307453.817563000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-6f809385b9d50b7cfa7b598e", "kind": "identity", "frame_number": 10751, "timestamp_epoch": "1722307453.818246000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-81a0be35b6b0dcf2cf2da92b", "kind": "identity", "frame_number": 10752, "timestamp_epoch": "1722307453.818476000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "15" } }, { "event_id": "evt-f9c097102a301c130de9ddb9", "kind": "identity", "frame_number": 10837, "timestamp_epoch": "1722307456.678037000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-d5e6444d8c0f5a24e6395529", "kind": "identity", "frame_number": 10839, "timestamp_epoch": "1722307456.678815000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-2d2f6a3b277ca34f91834031", "kind": "identity", "frame_number": 10851, "timestamp_epoch": "1722307456.689676000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08", "kerberos.msg_type": "14" } }, { "event_id": "evt-11119042c361a2bcc6ba1312", "kind": "identity", "frame_number": 10853, "timestamp_epoch": "1722307456.690461000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35", "kerberos.msg_type": "15" } }, { "event_id": "evt-903f0cfd0b1aa7200e0fd700", "kind": "identity", "frame_number": 11435, "timestamp_epoch": "1722307612.613280000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 15, "fields": { "browser.server": "DESKTOP-SKBR25F", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-86f0482d98baa8fc70b2b40a", "kind": "identity", "frame_number": 11553, "timestamp_epoch": "1722307711.622415000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-4d6d520b4c1e3813d9524d87", "kind": "identity", "frame_number": 11554, "timestamp_epoch": "1722307711.622427000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "5c:f9:dd:8c:97:35", "eth.src": "00:1e:64:ec:f3:08" } }, { "event_id": "evt-dd8b7e769ff96efdbd7b0942", "kind": "identity", "frame_number": 11555, "timestamp_epoch": "1722307711.623099000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 56, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } }, { "event_id": "evt-ae1921a6374a2d351b1ff966", "kind": "identity", "frame_number": 11556, "timestamp_epoch": "1722307711.623272000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:1e:64:ec:f3:08", "eth.src": "5c:f9:dd:8c:97:35" } } ], "directory_service": [ { "event_id": "evt-edcd4c2bb8c885d958cbce62", "kind": "directory_service", "frame_number": 42, "timestamp_epoch": "1722307129.102370000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2d2fe18c9abacac69e0aed4a", "kind": "directory_service", "frame_number": 44, "timestamp_epoch": "1722307129.102776000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-ec5eb399fe6e91ce6e0376be", "kind": "directory_service", "frame_number": 45, "timestamp_epoch": "1722307129.102778000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-dc61fc8065daefec82206dd4", "kind": "directory_service", "frame_number": 46, "timestamp_epoch": "1722307129.102956000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-44a48218578031b534e5e1fa", "kind": "directory_service", "frame_number": 49, "timestamp_epoch": "1722307129.103313000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-7408fe566c3b3cdef8993e07", "kind": "directory_service", "frame_number": 50, "timestamp_epoch": "1722307129.103315000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-191ee3d7012f532205f8bc26", "kind": "directory_service", "frame_number": 128, "timestamp_epoch": "1722307129.135287000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-583a236fbd2dbdbe3d956f32", "kind": "directory_service", "frame_number": 130, "timestamp_epoch": "1722307129.135346000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-14f324a7e5678053d19a0fb7", "kind": "directory_service", "frame_number": 133, "timestamp_epoch": "1722307129.135435000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-708fe1a72c6332ce2e68d3fb", "kind": "directory_service", "frame_number": 136, "timestamp_epoch": "1722307129.136066000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-eaaf7b2179301b502d676102", "kind": "directory_service", "frame_number": 137, "timestamp_epoch": "1722307129.136109000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a3cf2dba7264e15d7021c995", "kind": "directory_service", "frame_number": 138, "timestamp_epoch": "1722307129.136462000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-668f193d082ade8395949375", "kind": "directory_service", "frame_number": 139, "timestamp_epoch": "1722307129.138026000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-a13ae06516030fc923d2d89b", "kind": "directory_service", "frame_number": 140, "timestamp_epoch": "1722307129.138038000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-6deb53da6f7e77d88d5d6171", "kind": "directory_service", "frame_number": 141, "timestamp_epoch": "1722307129.138134000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-13ebef577a26e32c9b88fa99", "kind": "directory_service", "frame_number": 193, "timestamp_epoch": "1722307129.246746000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4d7fc48900eaf00e13cf2f23", "kind": "directory_service", "frame_number": 194, "timestamp_epoch": "1722307129.246973000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-bc55ced60ba633a5de67ac5b", "kind": "directory_service", "frame_number": 195, "timestamp_epoch": "1722307129.247255000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-069f0966729531d417b5dca0", "kind": "directory_service", "frame_number": 196, "timestamp_epoch": "1722307129.247559000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4db2bb9927ce9637c2169020", "kind": "directory_service", "frame_number": 197, "timestamp_epoch": "1722307129.247786000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d6cd1a2c17ba30e557f92cb1", "kind": "directory_service", "frame_number": 198, "timestamp_epoch": "1722307129.248055000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f0adbdf9f51c7c995ad8ee99", "kind": "directory_service", "frame_number": 199, "timestamp_epoch": "1722307129.248238000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a00ae10fde17d8120596fdad", "kind": "directory_service", "frame_number": 200, "timestamp_epoch": "1722307129.248398000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-758bd4c62a6f78117ef2de48", "kind": "directory_service", "frame_number": 206, "timestamp_epoch": "1722307129.259995000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a19b087509dce4f674a227a8", "kind": "directory_service", "frame_number": 208, "timestamp_epoch": "1722307129.260308000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-db135d8b3198d2553c412cc1", "kind": "directory_service", "frame_number": 209, "timestamp_epoch": "1722307129.260309000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-9b9984eb2a0f53adeeeb2fb3", "kind": "directory_service", "frame_number": 212, "timestamp_epoch": "1722307129.261574000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a7bea220bc3a8aedcc8483e3", "kind": "directory_service", "frame_number": 214, "timestamp_epoch": "1722307129.262350000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-093297c8c81198750a36db5b", "kind": "directory_service", "frame_number": 228, "timestamp_epoch": "1722307129.278247000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.baseObject": "DC=wiresharkworkshop,DC=online", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-4511fc81fb7780d708630a38", "kind": "directory_service", "frame_number": 229, "timestamp_epoch": "1722307129.278847000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-9ae5104d851c0312e80735d8", "kind": "directory_service", "frame_number": 245, "timestamp_epoch": "1722307129.397204000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-faa655e9a8ae748c08dd3856", "kind": "directory_service", "frame_number": 247, "timestamp_epoch": "1722307129.398343000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-6f1cc9e211e73b887cbf209f", "kind": "directory_service", "frame_number": 248, "timestamp_epoch": "1722307129.398906000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1d4d75d5937ed4725e454701", "kind": "directory_service", "frame_number": 249, "timestamp_epoch": "1722307129.399202000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ee0fbea209595aa7c981b37f", "kind": "directory_service", "frame_number": 250, "timestamp_epoch": "1722307129.399594000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-4c24e15c88eeaf519468aa67", "kind": "directory_service", "frame_number": 251, "timestamp_epoch": "1722307129.399980000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-fba781864b65462b7ffd79d0", "kind": "directory_service", "frame_number": 252, "timestamp_epoch": "1722307129.400886000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=wiresharkworkshop,DC=online", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-aaf4acdf79e59c0573f165bf", "kind": "directory_service", "frame_number": 253, "timestamp_epoch": "1722307129.401501000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-76436ec5fad43190c6a3b1e9", "kind": "directory_service", "frame_number": 458, "timestamp_epoch": "1722307129.592428000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e6cebc2a5539940516e1635b", "kind": "directory_service", "frame_number": 460, "timestamp_epoch": "1722307129.598686000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e865451bbb94de1373ea799c", "kind": "directory_service", "frame_number": 507, "timestamp_epoch": "1722307129.952978000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-edc3302a904124f5526b9332", "kind": "directory_service", "frame_number": 509, "timestamp_epoch": "1722307129.953541000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-4640f7aef0ced2ef3bbc32e4", "kind": "directory_service", "frame_number": 510, "timestamp_epoch": "1722307129.953542000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-9e7356d5a3efae57426a1747", "kind": "directory_service", "frame_number": 513, "timestamp_epoch": "1722307129.956396000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-13ef4e2226293753a05d167e", "kind": "directory_service", "frame_number": 515, "timestamp_epoch": "1722307129.957387000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-bc0688b6c433a73f8afbe811", "kind": "directory_service", "frame_number": 516, "timestamp_epoch": "1722307129.964882000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f4c30d08e15052b47c7f4c73", "kind": "directory_service", "frame_number": 517, "timestamp_epoch": "1722307129.965149000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-3fd6e2dffbd5c99f40238211", "kind": "directory_service", "frame_number": 518, "timestamp_epoch": "1722307129.965424000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a250d9913ed016a524b754a9", "kind": "directory_service", "frame_number": 519, "timestamp_epoch": "1722307129.965639000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6a61a5c5c2ef7b4564d9db79", "kind": "directory_service", "frame_number": 520, "timestamp_epoch": "1722307129.965834000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=NTDS Settings,CN=WIRESHARK-WS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e1cee3f5620d286d14032ddf", "kind": "directory_service", "frame_number": 521, "timestamp_epoch": "1722307129.966075000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-3ee1c8692d1216fc3acd28d1", "kind": "directory_service", "frame_number": 522, "timestamp_epoch": "1722307129.966338000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-3220192215ab6ac13a49140d", "kind": "directory_service", "frame_number": 523, "timestamp_epoch": "1722307129.966623000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-8797ad325ca568884b6af8dd", "kind": "directory_service", "frame_number": 524, "timestamp_epoch": "1722307129.968377000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-884e12f6d0f40ac24658f19c", "kind": "directory_service", "frame_number": 525, "timestamp_epoch": "1722307129.968644000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-0a7144701a3fa33a64eea373", "kind": "directory_service", "frame_number": 526, "timestamp_epoch": "1722307129.969209000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-20ea8b2465b52bb116ac3be2", "kind": "directory_service", "frame_number": 527, "timestamp_epoch": "1722307129.971041000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-d65ea86732e930e5df1e2f4a", "kind": "directory_service", "frame_number": 528, "timestamp_epoch": "1722307129.971370000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-3de6c4390307a95c71850d61", "kind": "directory_service", "frame_number": 529, "timestamp_epoch": "1722307129.971641000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-5a398177fd8ca8e3837fab34", "kind": "directory_service", "frame_number": 530, "timestamp_epoch": "1722307129.973223000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e16fa567e668ebefa34cb537", "kind": "directory_service", "frame_number": 531, "timestamp_epoch": "1722307129.973462000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-8dad0fdcc0151addde075ef6", "kind": "directory_service", "frame_number": 538, "timestamp_epoch": "1722307129.996553000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d20a280b882398bc07ec0b82", "kind": "directory_service", "frame_number": 540, "timestamp_epoch": "1722307129.997336000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8cff613fdb6e43d016dd61eb", "kind": "directory_service", "frame_number": 541, "timestamp_epoch": "1722307129.997732000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5f8b2095cabb42477168be3d", "kind": "directory_service", "frame_number": 542, "timestamp_epoch": "1722307129.997914000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-2f308ed8e0ef8c0c38a081d6", "kind": "directory_service", "frame_number": 543, "timestamp_epoch": "1722307129.998321000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-c6ceda30cc26a14546409a2d", "kind": "directory_service", "frame_number": 551, "timestamp_epoch": "1722307130.000323000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-12eaf0b292b275c96c7e2b60", "kind": "directory_service", "frame_number": 553, "timestamp_epoch": "1722307130.000976000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-5ab5adaa3e4b11087e1d6a43", "kind": "directory_service", "frame_number": 554, "timestamp_epoch": "1722307130.001497000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": {} }, { "event_id": "evt-a47eac4c2c9ee17d04f5ee1d", "kind": "directory_service", "frame_number": 555, "timestamp_epoch": "1722307130.001896000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": {} }, { "event_id": "evt-96e903f84765a088ef29ab10", "kind": "directory_service", "frame_number": 556, "timestamp_epoch": "1722307130.002168000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": {} }, { "event_id": "evt-7974cda5c0e87a55e8160e3c", "kind": "directory_service", "frame_number": 564, "timestamp_epoch": "1722307130.009998000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-50bf9ca94aea5305920ca1d4", "kind": "directory_service", "frame_number": 566, "timestamp_epoch": "1722307130.010839000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a638494d2fdf76dcca6b9aa5", "kind": "directory_service", "frame_number": 567, "timestamp_epoch": "1722307130.011426000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-af3e257c765b6b27c2e756e4", "kind": "directory_service", "frame_number": 568, "timestamp_epoch": "1722307130.011683000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-77990a8125d79076899a5893", "kind": "directory_service", "frame_number": 599, "timestamp_epoch": "1722307130.016918000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-8b58c9025b790a34420a82cf", "kind": "directory_service", "frame_number": 600, "timestamp_epoch": "1722307130.017270000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-0903909e076edb103301dcae", "kind": "directory_service", "frame_number": 601, "timestamp_epoch": "1722307130.017720000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-875a00e84a99d1dae5f8b01a", "kind": "directory_service", "frame_number": 606, "timestamp_epoch": "1722307130.018429000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1317b7a1f00deea951893fe4", "kind": "directory_service", "frame_number": 662, "timestamp_epoch": "1722307133.314989000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-da073cb41ce01328a4c09f7a", "kind": "directory_service", "frame_number": 663, "timestamp_epoch": "1722307133.315265000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ac7882bca6eaaf9eb2b07260", "kind": "directory_service", "frame_number": 664, "timestamp_epoch": "1722307133.315531000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-5d5af8f022583a626a434cf5", "kind": "directory_service", "frame_number": 665, "timestamp_epoch": "1722307133.316091000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-aae2fe43e76bdb4922c93ba8", "kind": "directory_service", "frame_number": 666, "timestamp_epoch": "1722307133.316297000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-3db7c7ac71fd9c91afd09298", "kind": "directory_service", "frame_number": 667, "timestamp_epoch": "1722307133.316800000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-4aa1b362f7a601db61126913", "kind": "directory_service", "frame_number": 668, "timestamp_epoch": "1722307133.316997000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-b2ad0eeca2bcc57f60191b20", "kind": "directory_service", "frame_number": 669, "timestamp_epoch": "1722307133.317183000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-804ff7fac083b5121373be52", "kind": "directory_service", "frame_number": 967, "timestamp_epoch": "1722307152.761878000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8acce6902824956039b77cde", "kind": "directory_service", "frame_number": 968, "timestamp_epoch": "1722307152.762152000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-37d406fed53a8928d79b8eed", "kind": "directory_service", "frame_number": 969, "timestamp_epoch": "1722307152.762353000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-34d86d14f69381fffeea5777", "kind": "directory_service", "frame_number": 970, "timestamp_epoch": "1722307152.762628000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c682e1faa4d651fc9b6a19bd", "kind": "directory_service", "frame_number": 971, "timestamp_epoch": "1722307152.762778000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9eed40c536a3e518a677d1b5", "kind": "directory_service", "frame_number": 972, "timestamp_epoch": "1722307152.763020000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-42f417ad3949ef46a89d2741", "kind": "directory_service", "frame_number": 973, "timestamp_epoch": "1722307152.763190000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ea3a1676c085918ef4a3f165", "kind": "directory_service", "frame_number": 974, "timestamp_epoch": "1722307152.763351000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9c244b3697fae2e4fc3ad87c", "kind": "directory_service", "frame_number": 998, "timestamp_epoch": "1722307152.775526000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-bd29f1fab0e8f6719d0d5321", "kind": "directory_service", "frame_number": 1000, "timestamp_epoch": "1722307152.776321000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-32499fb78d6e7d544a3523dd", "kind": "directory_service", "frame_number": 1001, "timestamp_epoch": "1722307152.779506000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.baseObject": "DC=wiresharkworkshop,DC=online", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-e4fb2a00fc9182d0119467fc", "kind": "directory_service", "frame_number": 1002, "timestamp_epoch": "1722307152.779859000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-79783ca62c7a12255ba18bed", "kind": "directory_service", "frame_number": 1035, "timestamp_epoch": "1722307152.784007000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6bfead5e7ba8679ca65178b3", "kind": "directory_service", "frame_number": 1037, "timestamp_epoch": "1722307152.784768000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a7d4590050619f6f1e58a9b8", "kind": "directory_service", "frame_number": 1039, "timestamp_epoch": "1722307152.785220000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-04514654039a3f5c8ea4b659", "kind": "directory_service", "frame_number": 1040, "timestamp_epoch": "1722307152.785397000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-41053d4ef39c2cdb654d78b6", "kind": "directory_service", "frame_number": 1042, "timestamp_epoch": "1722307152.785699000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=wiresharkworkshop,DC=online", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-bcf366a571b2562bed3b47ad", "kind": "directory_service", "frame_number": 1044, "timestamp_epoch": "1722307152.785971000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e8ff1c0b5f5cfb6553c90b8a", "kind": "directory_service", "frame_number": 1045, "timestamp_epoch": "1722307152.786258000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=wiresharkworkshop,DC=online", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-f9ef209fb0445fb9f4153524", "kind": "directory_service", "frame_number": 1046, "timestamp_epoch": "1722307152.786597000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-47407fa42df3518d1b31915b", "kind": "directory_service", "frame_number": 1055, "timestamp_epoch": "1722307152.789680000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-7fbeb21fd04ae88bec79763e", "kind": "directory_service", "frame_number": 1056, "timestamp_epoch": "1722307152.790024000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-4a9e29ba322ab25337a64ac4", "kind": "directory_service", "frame_number": 1057, "timestamp_epoch": "1722307152.790201000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-4f6dd5cb59a990a02301040e", "kind": "directory_service", "frame_number": 1058, "timestamp_epoch": "1722307152.790513000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-221c4bc1cfcf0f5739e07e2e", "kind": "directory_service", "frame_number": 1059, "timestamp_epoch": "1722307152.790742000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-a5a314db729781192ec2003b", "kind": "directory_service", "frame_number": 1060, "timestamp_epoch": "1722307152.791013000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-9ea2df1030331d46f5335319", "kind": "directory_service", "frame_number": 1061, "timestamp_epoch": "1722307152.791162000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-fe56527176c9fce5413d2eb1", "kind": "directory_service", "frame_number": 1062, "timestamp_epoch": "1722307152.791453000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-461b78e4a451bfc2bef42eff", "kind": "directory_service", "frame_number": 1063, "timestamp_epoch": "1722307152.791602000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-6d82e091f1d87d161dea5f6a", "kind": "directory_service", "frame_number": 1064, "timestamp_epoch": "1722307152.791901000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-06331c37d18918c8d2369233", "kind": "directory_service", "frame_number": 1065, "timestamp_epoch": "1722307152.792045000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-a73b1c7af3b2bcbe52939863", "kind": "directory_service", "frame_number": 1066, "timestamp_epoch": "1722307152.792368000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-c74955fcbc8fab16be0f9d1e", "kind": "directory_service", "frame_number": 1067, "timestamp_epoch": "1722307152.792524000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-62c1d64460888246d47939ec", "kind": "directory_service", "frame_number": 1068, "timestamp_epoch": "1722307152.792930000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-0c0dde3c7aabe2f4b46b5893", "kind": "directory_service", "frame_number": 1069, "timestamp_epoch": "1722307152.793077000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-193e14a2b68ea3bd310fd27d", "kind": "directory_service", "frame_number": 1070, "timestamp_epoch": "1722307152.793528000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "ccollier", "samr.samr_UserInfo21.full_name": "Clark Collier" } }, { "event_id": "evt-47b9ae6cf142e938d5e0198e", "kind": "directory_service", "frame_number": 1071, "timestamp_epoch": "1722307152.793687000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-970454258d8459f2db7b39a5", "kind": "directory_service", "frame_number": 1072, "timestamp_epoch": "1722307152.794009000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-bab96862518f0cdef213e8d0", "kind": "directory_service", "frame_number": 1073, "timestamp_epoch": "1722307152.794176000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-e6109d9aa431eae7469d5eaa", "kind": "directory_service", "frame_number": 1074, "timestamp_epoch": "1722307152.794435000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-448d2bb11442c78fa97f32e0", "kind": "directory_service", "frame_number": 1075, "timestamp_epoch": "1722307152.794582000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-e84cd676b5fb9715f6502da2", "kind": "directory_service", "frame_number": 1076, "timestamp_epoch": "1722307152.794826000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-3413499e137bd41ebbd8a7ff", "kind": "directory_service", "frame_number": 1077, "timestamp_epoch": "1722307152.794979000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1c3a3de0c117c1125f222bed", "kind": "directory_service", "frame_number": 1078, "timestamp_epoch": "1722307152.795212000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-3b7c88368eed15bad5104d17", "kind": "directory_service", "frame_number": 1079, "timestamp_epoch": "1722307152.795358000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-0301a8cd1497c83ac221cf1f", "kind": "directory_service", "frame_number": 1080, "timestamp_epoch": "1722307152.795585000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-98d8ae668f008e8c5273fa78", "kind": "directory_service", "frame_number": 1081, "timestamp_epoch": "1722307152.795749000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-ae431e15f026c8433a0e921e", "kind": "directory_service", "frame_number": 1082, "timestamp_epoch": "1722307152.795977000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-5a4525ffb093afdb28d8ebaf", "kind": "directory_service", "frame_number": 1083, "timestamp_epoch": "1722307152.796148000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-53ab3c9dc202ceaa5a7e74ca", "kind": "directory_service", "frame_number": 1084, "timestamp_epoch": "1722307152.796434000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9673a66a1b2d0c0e17632439", "kind": "directory_service", "frame_number": 1087, "timestamp_epoch": "1722307152.804068000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-05018a36541bc182257cbf4e", "kind": "directory_service", "frame_number": 1089, "timestamp_epoch": "1722307152.807558000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-d9c4dfe120a79609f307c6fe", "kind": "directory_service", "frame_number": 9374, "timestamp_epoch": "1722307213.926787000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-30fb882a6d8bf1cbfcaa0a06", "kind": "directory_service", "frame_number": 9375, "timestamp_epoch": "1722307213.927329000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-700afe27856e011401f05327", "kind": "directory_service", "frame_number": 9376, "timestamp_epoch": "1722307213.927690000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-fb7c78efeb3eb3c59ffa23aa", "kind": "directory_service", "frame_number": 9377, "timestamp_epoch": "1722307213.928043000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6f3e08610d4bf8e82f666a17", "kind": "directory_service", "frame_number": 9378, "timestamp_epoch": "1722307213.928278000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-542373d745f6260f4662d79f", "kind": "directory_service", "frame_number": 9379, "timestamp_epoch": "1722307213.928462000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ba9d550c2caacc7bb8e4d5ba", "kind": "directory_service", "frame_number": 9382, "timestamp_epoch": "1722307213.930019000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5267871aa21407612044ae6d", "kind": "directory_service", "frame_number": 9383, "timestamp_epoch": "1722307213.930249000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-caf664587bd9261d98fd4780", "kind": "directory_service", "frame_number": 9384, "timestamp_epoch": "1722307213.930459000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-bbfcd65c7e74c730713c8bff", "kind": "directory_service", "frame_number": 9385, "timestamp_epoch": "1722307213.930812000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-979faaf6ff55bca13c6adb4c", "kind": "directory_service", "frame_number": 9386, "timestamp_epoch": "1722307213.931022000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-e5a6e65f55908a68cf99f3d4", "kind": "directory_service", "frame_number": 9387, "timestamp_epoch": "1722307213.931179000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ba8e21ab58caaeb01026e53c", "kind": "directory_service", "frame_number": 9391, "timestamp_epoch": "1722307213.933779000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-9e211a336ff81f907e117f66", "kind": "directory_service", "frame_number": 9393, "timestamp_epoch": "1722307213.934127000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-cd2c025dc2428e93baea171b", "kind": "directory_service", "frame_number": 9394, "timestamp_epoch": "1722307213.934128000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-c143774263d5817d5b671fd6", "kind": "directory_service", "frame_number": 9397, "timestamp_epoch": "1722307213.935134000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-97b6c6938a405141ccef9e67", "kind": "directory_service", "frame_number": 9399, "timestamp_epoch": "1722307213.935850000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-ccf56124f5a58fc892382407", "kind": "directory_service", "frame_number": 9400, "timestamp_epoch": "1722307213.936211000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-5dcedc391734ec55d2590a49", "kind": "directory_service", "frame_number": 9401, "timestamp_epoch": "1722307213.936492000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-2bd36d08edf2ef6526b0c22d", "kind": "directory_service", "frame_number": 9402, "timestamp_epoch": "1722307213.936772000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-d8687db1779b77ee4f7360e7", "kind": "directory_service", "frame_number": 9403, "timestamp_epoch": "1722307213.936976000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-933b97459995012ff44fa374", "kind": "directory_service", "frame_number": 9404, "timestamp_epoch": "1722307213.937219000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-86c853f2b6914a9c702c619d", "kind": "directory_service", "frame_number": 9405, "timestamp_epoch": "1722307213.937466000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-0b1b5782275d4af9cac0c0f2", "kind": "directory_service", "frame_number": 9410, "timestamp_epoch": "1722307213.939967000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-bbd788eb93f55902151a65b7", "kind": "directory_service", "frame_number": 9412, "timestamp_epoch": "1722307213.940763000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1faa8b8664a75ebcd4d01ab1", "kind": "directory_service", "frame_number": 9413, "timestamp_epoch": "1722307213.941093000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": {} }, { "event_id": "evt-fc740d3bd6b81551e50cd751", "kind": "directory_service", "frame_number": 9416, "timestamp_epoch": "1722307213.941390000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": {} }, { "event_id": "evt-caf17d9303a18fbe8b794906", "kind": "directory_service", "frame_number": 9418, "timestamp_epoch": "1722307213.941687000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": {} }, { "event_id": "evt-941b6c79d2f8351c812f70eb", "kind": "directory_service", "frame_number": 9419, "timestamp_epoch": "1722307213.941975000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": {} }, { "event_id": "evt-d949f3f8c932243e7cb84458", "kind": "directory_service", "frame_number": 9420, "timestamp_epoch": "1722307213.942194000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": {} }, { "event_id": "evt-2155b50fd0a8582b196b6f14", "kind": "directory_service", "frame_number": 9424, "timestamp_epoch": "1722307213.942672000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": {} }, { "event_id": "evt-10110c38cef8c35ff30350d0", "kind": "directory_service", "frame_number": 9446, "timestamp_epoch": "1722307214.124770000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-056f3d6cc86cf495b788d253", "kind": "directory_service", "frame_number": 9447, "timestamp_epoch": "1722307214.124973000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-500443aafebe11ca22fec34a", "kind": "directory_service", "frame_number": 9448, "timestamp_epoch": "1722307214.125171000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d5d7b1617e1daa43c5b8cdd7", "kind": "directory_service", "frame_number": 9449, "timestamp_epoch": "1722307214.125474000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-15270516fa6ae81f85c51fb8", "kind": "directory_service", "frame_number": 9450, "timestamp_epoch": "1722307214.125681000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ca188c0c2a59f18d9f8f1d83", "kind": "directory_service", "frame_number": 9451, "timestamp_epoch": "1722307214.125867000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-aeb53352041a51641a991134", "kind": "directory_service", "frame_number": 9454, "timestamp_epoch": "1722307214.127543000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7c2542b4d87648c1a9eac81f", "kind": "directory_service", "frame_number": 9455, "timestamp_epoch": "1722307214.127721000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-32834ac58efd4506c73ac96f", "kind": "directory_service", "frame_number": 9456, "timestamp_epoch": "1722307214.127932000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-22a959db56333b6e6975adae", "kind": "directory_service", "frame_number": 9457, "timestamp_epoch": "1722307214.128183000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-79e45b27c0b4fb40894314a9", "kind": "directory_service", "frame_number": 9458, "timestamp_epoch": "1722307214.128334000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6d9ee69cf10929b8fd32ce19", "kind": "directory_service", "frame_number": 9459, "timestamp_epoch": "1722307214.128499000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-21d5d2dac00e8e00d63d0ef7", "kind": "directory_service", "frame_number": 9463, "timestamp_epoch": "1722307214.130677000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1fd5b4e2e7ee16fece403f9f", "kind": "directory_service", "frame_number": 9465, "timestamp_epoch": "1722307214.130941000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-bee22003aa91a5c06b9df8de", "kind": "directory_service", "frame_number": 9466, "timestamp_epoch": "1722307214.130941000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-279df98b7f4c0ddd991061a6", "kind": "directory_service", "frame_number": 9469, "timestamp_epoch": "1722307214.131773000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-7fd5866f57ea71e36a17ee9b", "kind": "directory_service", "frame_number": 9471, "timestamp_epoch": "1722307214.132379000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-691d480a34661df9c2ed5b08", "kind": "directory_service", "frame_number": 9472, "timestamp_epoch": "1722307214.132703000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-3bb90557626ec8069e90b33a", "kind": "directory_service", "frame_number": 9473, "timestamp_epoch": "1722307214.132918000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-feadd814d2bd066720ed249f", "kind": "directory_service", "frame_number": 9474, "timestamp_epoch": "1722307214.133112000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-b3a69e19bd67a87e3235b493", "kind": "directory_service", "frame_number": 9475, "timestamp_epoch": "1722307214.133348000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-6696006accbf99930e291bab", "kind": "directory_service", "frame_number": 9476, "timestamp_epoch": "1722307214.133526000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-03375a6d0becea71bf9610d6", "kind": "directory_service", "frame_number": 9477, "timestamp_epoch": "1722307214.133709000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-534dc3a238762d2722b4db72", "kind": "directory_service", "frame_number": 9482, "timestamp_epoch": "1722307214.136868000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-3b122b430b3a397c2a9dcad5", "kind": "directory_service", "frame_number": 9484, "timestamp_epoch": "1722307214.137623000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-619540e25fc02fc5c0aa0d68", "kind": "directory_service", "frame_number": 9485, "timestamp_epoch": "1722307214.138108000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": {} }, { "event_id": "evt-df8343b55aa5f0cf7b423738", "kind": "directory_service", "frame_number": 9488, "timestamp_epoch": "1722307214.138416000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": {} }, { "event_id": "evt-3cbedbc628e48a66a41896d5", "kind": "directory_service", "frame_number": 9490, "timestamp_epoch": "1722307214.138869000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": {} }, { "event_id": "evt-00e687bfddf2c0a2ff609005", "kind": "directory_service", "frame_number": 9491, "timestamp_epoch": "1722307214.139245000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": {} }, { "event_id": "evt-68767882758b8edaf5fa1cc5", "kind": "directory_service", "frame_number": 9492, "timestamp_epoch": "1722307214.139492000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 99, "udp_stream": null, "fields": {} }, { "event_id": "evt-8cdecc4778d872126ae3d365", "kind": "directory_service", "frame_number": 9494, "timestamp_epoch": "1722307214.139922000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": {} }, { "event_id": "evt-b3f215a9018cac0b3c03bf5f", "kind": "directory_service", "frame_number": 9646, "timestamp_epoch": "1722307239.014493000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-922950b3a76708abbc9a30c7", "kind": "directory_service", "frame_number": 9647, "timestamp_epoch": "1722307239.014724000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-78a4fc919707964d853f4aef", "kind": "directory_service", "frame_number": 9648, "timestamp_epoch": "1722307239.014930000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c2562f4440a04aa3156e8b4c", "kind": "directory_service", "frame_number": 9649, "timestamp_epoch": "1722307239.015229000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-d211646de193486af3373313", "kind": "directory_service", "frame_number": 9650, "timestamp_epoch": "1722307239.015399000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-4edaf5a9e21029f0677b6276", "kind": "directory_service", "frame_number": 9651, "timestamp_epoch": "1722307239.015542000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7103232eff35b539fcc34e68", "kind": "directory_service", "frame_number": 9654, "timestamp_epoch": "1722307239.017225000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-347da5b7c3fa2e31e83df647", "kind": "directory_service", "frame_number": 9655, "timestamp_epoch": "1722307239.017430000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-191a3e84074e6e7d7222d066", "kind": "directory_service", "frame_number": 9656, "timestamp_epoch": "1722307239.017609000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a1db038501ca17c90c843e1e", "kind": "directory_service", "frame_number": 9657, "timestamp_epoch": "1722307239.017947000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9dba33b3d6571e56ffe08fb6", "kind": "directory_service", "frame_number": 9658, "timestamp_epoch": "1722307239.018110000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1b819b78e82331d15b8e974b", "kind": "directory_service", "frame_number": 9659, "timestamp_epoch": "1722307239.018251000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 105, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c2ab15d5cfbdc093847381e4", "kind": "directory_service", "frame_number": 9663, "timestamp_epoch": "1722307239.020504000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-9e285bc1c0ce3231ac7d32e7", "kind": "directory_service", "frame_number": 9665, "timestamp_epoch": "1722307239.020762000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-05045ea25a8f8684e2940c83", "kind": "directory_service", "frame_number": 9666, "timestamp_epoch": "1722307239.020763000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-f42ecbd34d48b9c2ecebf23c", "kind": "directory_service", "frame_number": 9669, "timestamp_epoch": "1722307239.021669000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-abfacd7a714d2a097556ec90", "kind": "directory_service", "frame_number": 9671, "timestamp_epoch": "1722307239.022400000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b5ba253eb7c90dee641c63a2", "kind": "directory_service", "frame_number": 9672, "timestamp_epoch": "1722307239.022794000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-740166cce37c6ac1f3083a91", "kind": "directory_service", "frame_number": 9673, "timestamp_epoch": "1722307239.023036000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-0ca7b9b7dc3ae95156c88010", "kind": "directory_service", "frame_number": 9674, "timestamp_epoch": "1722307239.023265000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-897e3d9f16259402bf31faca", "kind": "directory_service", "frame_number": 9675, "timestamp_epoch": "1722307239.023524000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-2859426441f2f32ed8c30614", "kind": "directory_service", "frame_number": 9676, "timestamp_epoch": "1722307239.023729000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-547951508252a008de13bb62", "kind": "directory_service", "frame_number": 9677, "timestamp_epoch": "1722307239.024066000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-7d993ad9073a3b4b2f16ebbc", "kind": "directory_service", "frame_number": 9682, "timestamp_epoch": "1722307239.027774000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-bd4b6e344d4be96b455be2d3", "kind": "directory_service", "frame_number": 9684, "timestamp_epoch": "1722307239.028585000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-eaa9fdc0724ab273423bdfd2", "kind": "directory_service", "frame_number": 9685, "timestamp_epoch": "1722307239.028962000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": {} }, { "event_id": "evt-da5c4e941f1a7e07eae18ae8", "kind": "directory_service", "frame_number": 9688, "timestamp_epoch": "1722307239.029285000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": {} }, { "event_id": "evt-48cfa4eb7cbd6d84deaaee40", "kind": "directory_service", "frame_number": 9690, "timestamp_epoch": "1722307239.029914000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": {} }, { "event_id": "evt-59b9bf709571f241e14d58c9", "kind": "directory_service", "frame_number": 9691, "timestamp_epoch": "1722307239.030195000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": {} }, { "event_id": "evt-ae2fc1cee919442b3f667b0e", "kind": "directory_service", "frame_number": 9692, "timestamp_epoch": "1722307239.030373000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 107, "udp_stream": null, "fields": {} }, { "event_id": "evt-c1342f393b71ebd0657035c2", "kind": "directory_service", "frame_number": 9696, "timestamp_epoch": "1722307239.030796000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 106, "udp_stream": null, "fields": {} }, { "event_id": "evt-76fb1c5d3e3e9626c493932a", "kind": "directory_service", "frame_number": 9737, "timestamp_epoch": "1722307241.103539000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-737924d20251eac155f20a9f", "kind": "directory_service", "frame_number": 9739, "timestamp_epoch": "1722307241.103863000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-8e007214b4b44749c28dbe00", "kind": "directory_service", "frame_number": 9740, "timestamp_epoch": "1722307241.103864000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-39cdfb44b912e1f23cf4de86", "kind": "directory_service", "frame_number": 9755, "timestamp_epoch": "1722307241.107544000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-ae30f16f964c9bc71936dae3", "kind": "directory_service", "frame_number": 9757, "timestamp_epoch": "1722307241.108272000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-40854729b0cba15e6a02630b", "kind": "directory_service", "frame_number": 9758, "timestamp_epoch": "1722307241.110307000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Clark Collier,CN=Users,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-638d21ba8306d67ed10c2b72", "kind": "directory_service", "frame_number": 9759, "timestamp_epoch": "1722307241.110601000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-29ed8da217198540389565b2", "kind": "directory_service", "frame_number": 9760, "timestamp_epoch": "1722307241.111024000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 109, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-aee677c85c9de0767300e8bf", "kind": "directory_service", "frame_number": 9768, "timestamp_epoch": "1722307241.122109000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-90fbed9fcbca8c80dc32a449", "kind": "directory_service", "frame_number": 9770, "timestamp_epoch": "1722307241.122854000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1ef9416f1d4571ddd6cd273b", "kind": "directory_service", "frame_number": 9771, "timestamp_epoch": "1722307241.123191000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Clark Collier,CN=Users,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-248617a008910a30503a4c93", "kind": "directory_service", "frame_number": 9772, "timestamp_epoch": "1722307241.123466000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a525d679d080cb00e677f533", "kind": "directory_service", "frame_number": 9773, "timestamp_epoch": "1722307241.123737000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 111, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-78073be3117d0da4658b7400", "kind": "directory_service", "frame_number": 10065, "timestamp_epoch": "1722307332.007314000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-b433b6bfc896f65081526545", "kind": "directory_service", "frame_number": 10067, "timestamp_epoch": "1722307332.007614000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-ad45a39b55880cb0428fb662", "kind": "directory_service", "frame_number": 10068, "timestamp_epoch": "1722307332.007615000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-67a60bd5264e5dbc9f653740", "kind": "directory_service", "frame_number": 10071, "timestamp_epoch": "1722307332.008959000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-de4f1a6c790db7aad4b7b602", "kind": "directory_service", "frame_number": 10073, "timestamp_epoch": "1722307332.009714000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-548510978b85b11ea594f35f", "kind": "directory_service", "frame_number": 10074, "timestamp_epoch": "1722307332.012660000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-233c6019ee1268a0fdd40dcd", "kind": "directory_service", "frame_number": 10075, "timestamp_epoch": "1722307332.012910000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-d84243f98efa4feb36688be6", "kind": "directory_service", "frame_number": 10076, "timestamp_epoch": "1722307332.013159000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-185d80a33c2a5178c2890b2e", "kind": "directory_service", "frame_number": 10077, "timestamp_epoch": "1722307332.013602000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-45a5dc0f2e30dbcab15cd1c6", "kind": "directory_service", "frame_number": 10078, "timestamp_epoch": "1722307332.014246000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-a4d33f1dc0e40dd029f07260", "kind": "directory_service", "frame_number": 10307, "timestamp_epoch": "1722307333.689571000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-97fb4e1d4c39a2e351c08a7e", "kind": "directory_service", "frame_number": 10309, "timestamp_epoch": "1722307333.689878000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-36f7afe633684dce1c1fd049", "kind": "directory_service", "frame_number": 10310, "timestamp_epoch": "1722307333.689879000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-1c4eb522f562551725fb3f38", "kind": "directory_service", "frame_number": 10313, "timestamp_epoch": "1722307333.690910000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-345654b828c97b6031487e5f", "kind": "directory_service", "frame_number": 10315, "timestamp_epoch": "1722307333.691652000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-9ba5a045676291fef713e679", "kind": "directory_service", "frame_number": 10316, "timestamp_epoch": "1722307333.692019000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-fb78cd76f5f2a6e8f332d048", "kind": "directory_service", "frame_number": 10317, "timestamp_epoch": "1722307333.694115000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e3ad4a4ecd1781229a0594fc", "kind": "directory_service", "frame_number": 10318, "timestamp_epoch": "1722307333.695675000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 126, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-5470ba7c286490240117dafa", "kind": "directory_service", "frame_number": 10754, "timestamp_epoch": "1722307453.818929000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4ab5d5f62ae7d7f22ce8d181", "kind": "directory_service", "frame_number": 10755, "timestamp_epoch": "1722307453.819169000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-11b34d26dd43bfa3d8f3db8c", "kind": "directory_service", "frame_number": 10756, "timestamp_epoch": "1722307453.819436000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-57846f242bb7b79aafcb5b53", "kind": "directory_service", "frame_number": 10757, "timestamp_epoch": "1722307453.819752000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ee99af1362a7db2cc2493398", "kind": "directory_service", "frame_number": 10758, "timestamp_epoch": "1722307453.820003000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-bc8013013309430ff2c5d07c", "kind": "directory_service", "frame_number": 10759, "timestamp_epoch": "1722307453.820156000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-569e4142de02b8368750d7cc", "kind": "directory_service", "frame_number": 10831, "timestamp_epoch": "1722307456.676444000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-172106260464ab21ab9aee53", "kind": "directory_service", "frame_number": 10833, "timestamp_epoch": "1722307456.676737000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "4" } }, { "event_id": "evt-fab1c965adcd70fb9f3455bb", "kind": "directory_service", "frame_number": 10834, "timestamp_epoch": "1722307456.676738000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-3f27270cf32e08700fba94f1", "kind": "directory_service", "frame_number": 10837, "timestamp_epoch": "1722307456.678037000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6a2e565b137034efc9a8b6dc", "kind": "directory_service", "frame_number": 10839, "timestamp_epoch": "1722307456.678815000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-0bb03ae1d329fb8d819cbb80", "kind": "directory_service", "frame_number": 10840, "timestamp_epoch": "1722307456.680260000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Clark Collier,CN=Users,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-15a4c0f3e6a07a4afee61d14", "kind": "directory_service", "frame_number": 10841, "timestamp_epoch": "1722307456.680544000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1e41f121fd22540afd762797", "kind": "directory_service", "frame_number": 10842, "timestamp_epoch": "1722307456.680828000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 141, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-55f8650dd8dd7122994fd08e", "kind": "directory_service", "frame_number": 10851, "timestamp_epoch": "1722307456.689676000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-0348f8b20b2580af75ea36a0", "kind": "directory_service", "frame_number": 10853, "timestamp_epoch": "1722307456.690461000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-51f6e14b8eb31854d7420c98", "kind": "directory_service", "frame_number": 10854, "timestamp_epoch": "1722307456.690871000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Clark Collier,CN=Users,DC=wiresharkworkshop,DC=online", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-2e2f3e4a63159b497842a527", "kind": "directory_service", "frame_number": 10855, "timestamp_epoch": "1722307456.691141000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bcc97f14a9c15811426c391e", "kind": "directory_service", "frame_number": 10856, "timestamp_epoch": "1722307456.691458000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": null, "dst_port": null, "tcp_stream": 142, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-82d29e6d7b19922648a46e60", "kind": "unclassified_tcp", "frame_number": 9117, "timestamp_epoch": "1722307207.026826000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133360d0a0d0a" } }, { "event_id": "evt-bcb7396aec4ebe9ab4a244f5", "kind": "unclassified_tcp", "frame_number": 9119, "timestamp_epoch": "1722307207.027145000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3120536563" } }, { "event_id": "evt-a6a3175e5d23b7c3839a0eb9", "kind": "unclassified_tcp", "frame_number": 9350, "timestamp_epoch": "1722307213.638873000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133360d0a0d0a" } }, { "event_id": "evt-d680cd340eab391cc03d5169", "kind": "unclassified_tcp", "frame_number": 9352, "timestamp_epoch": "1722307213.639146000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3720536563" } }, { "event_id": "evt-c80e0b8dd4d98c3068f3fe3b", "kind": "unclassified_tcp", "frame_number": 9528, "timestamp_epoch": "1722307218.639393000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-05cf8b0fb7684ba9950f8b81", "kind": "unclassified_tcp", "frame_number": 9530, "timestamp_epoch": "1722307218.639963000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c313220536563" } }, { "event_id": "evt-5dc3718b756e0ec8957f17fd", "kind": "unclassified_tcp", "frame_number": 9535, "timestamp_epoch": "1722307223.655154000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-83b2b872e3ab794a3bcddec4", "kind": "unclassified_tcp", "frame_number": 9537, "timestamp_epoch": "1722307223.655701000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c313720536563" } }, { "event_id": "evt-f8a10a724c0c3f622a5f4afb", "kind": "unclassified_tcp", "frame_number": 9561, "timestamp_epoch": "1722307228.655360000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-4360782b9e6051353a5687ca", "kind": "unclassified_tcp", "frame_number": 9563, "timestamp_epoch": "1722307228.655923000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c323220536563" } }, { "event_id": "evt-f5d59e1752ee0551197d9c12", "kind": "unclassified_tcp", "frame_number": 9565, "timestamp_epoch": "1722307229.716826000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4ed60b1ee96c43b0b632bf51", "kind": "unclassified_tcp", "frame_number": 9598, "timestamp_epoch": "1722307233.670369000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-29f1f7320d935c99b6b1c6f7", "kind": "unclassified_tcp", "frame_number": 9600, "timestamp_epoch": "1722307233.670802000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c323720536563" } }, { "event_id": "evt-7f8545f1cdf1f23cf7efa920", "kind": "unclassified_tcp", "frame_number": 9626, "timestamp_epoch": "1722307238.689002000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-e1c17d5726d679cd2628f154", "kind": "unclassified_tcp", "frame_number": 9628, "timestamp_epoch": "1722307238.689465000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c333220536563" } }, { "event_id": "evt-93eefecefd27b2117ba6055f", "kind": "unclassified_tcp", "frame_number": 9846, "timestamp_epoch": "1722307243.686220000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-d0dbf16cb27e63ea34718d2a", "kind": "unclassified_tcp", "frame_number": 9848, "timestamp_epoch": "1722307243.686663000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c333720536563" } }, { "event_id": "evt-3e17fd178142dd065c67454a", "kind": "unclassified_tcp", "frame_number": 9852, "timestamp_epoch": "1722307248.686863000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-81ad5508cbfea0eddffb5ba1", "kind": "unclassified_tcp", "frame_number": 9854, "timestamp_epoch": "1722307248.687387000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c343220536563" } }, { "event_id": "evt-127be381fe3ad6d4b33e1512", "kind": "unclassified_tcp", "frame_number": 9856, "timestamp_epoch": "1722307251.232704000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4894c5bd13b70f3e35a7c924", "kind": "unclassified_tcp", "frame_number": 9866, "timestamp_epoch": "1722307253.702712000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-322915de3e0b4c312dc9e84e", "kind": "unclassified_tcp", "frame_number": 9868, "timestamp_epoch": "1722307253.703161000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c343720536563" } }, { "event_id": "evt-3549a43075ce74639047634f", "kind": "unclassified_tcp", "frame_number": 9870, "timestamp_epoch": "1722307258.718155000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-0b126c9de2dad22ee3c43987", "kind": "unclassified_tcp", "frame_number": 9872, "timestamp_epoch": "1722307258.718573000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c353220536563" } }, { "event_id": "evt-c8cb92ee2dfbfe12c968d13d", "kind": "unclassified_tcp", "frame_number": 9874, "timestamp_epoch": "1722307259.748592000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-20a4ed96c496d0d4b16c4635", "kind": "unclassified_tcp", "frame_number": 9876, "timestamp_epoch": "1722307263.733990000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3133370d0a0d0a" } }, { "event_id": "evt-fe309271542f8333d3cc6415", "kind": "unclassified_tcp", "frame_number": 9878, "timestamp_epoch": "1722307263.734502000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c353720536563" } }, { "event_id": "evt-c107fa6f8f4c9c8977239be1", "kind": "unclassified_tcp", "frame_number": 9896, "timestamp_epoch": "1722307268.751924000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134320d0a0d0a" } }, { "event_id": "evt-73d5c1a66c42c18b73f69d15", "kind": "unclassified_tcp", "frame_number": 9898, "timestamp_epoch": "1722307268.752428000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e203220736563" } }, { "event_id": "evt-e2acea81a73ee3362896315d", "kind": "unclassified_tcp", "frame_number": 9934, "timestamp_epoch": "1722307273.750141000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134320d0a0d0a" } }, { "event_id": "evt-e3ce7dfdfef566abe0412e75", "kind": "unclassified_tcp", "frame_number": 9936, "timestamp_epoch": "1722307273.750641000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e203720736563" } }, { "event_id": "evt-9e92fa903efa3df233c17334", "kind": "unclassified_tcp", "frame_number": 9938, "timestamp_epoch": "1722307278.750370000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-b0539288f7343076d087ca15", "kind": "unclassified_tcp", "frame_number": 9940, "timestamp_epoch": "1722307278.750755000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20313220736563" } }, { "event_id": "evt-582da7a4d403143ac08acd30", "kind": "unclassified_tcp", "frame_number": 9942, "timestamp_epoch": "1722307281.249504000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b9d2846c939edd4628b26932", "kind": "unclassified_tcp", "frame_number": 9944, "timestamp_epoch": "1722307283.750562000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-d01603b62b2948c9c825445a", "kind": "unclassified_tcp", "frame_number": 9946, "timestamp_epoch": "1722307283.751067000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20313720736563" } }, { "event_id": "evt-dff79cbca90e31061bb863c3", "kind": "unclassified_tcp", "frame_number": 9964, "timestamp_epoch": "1722307288.766165000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-fc07eea55086af80897f73ee", "kind": "unclassified_tcp", "frame_number": 9966, "timestamp_epoch": "1722307288.766569000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20323220736563" } }, { "event_id": "evt-ae8d65d36f9b3cea684b0bc2", "kind": "unclassified_tcp", "frame_number": 9968, "timestamp_epoch": "1722307289.765466000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e82004f2e76f78c841fb365c", "kind": "unclassified_tcp", "frame_number": 9974, "timestamp_epoch": "1722307293.781415000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-74ca0a8b4743b7a4cf797a94", "kind": "unclassified_tcp", "frame_number": 9976, "timestamp_epoch": "1722307293.781736000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20323720736563" } }, { "event_id": "evt-7340385564ba197bf36f3731", "kind": "unclassified_tcp", "frame_number": 9978, "timestamp_epoch": "1722307298.797659000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-a9add0d254a124a1d2168ee8", "kind": "unclassified_tcp", "frame_number": 9980, "timestamp_epoch": "1722307298.798229000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20333220736563" } }, { "event_id": "evt-5dc93a3daef00d1d906de915", "kind": "unclassified_tcp", "frame_number": 10003, "timestamp_epoch": "1722307303.797330000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-928e3f39cc6384338c4ad24b", "kind": "unclassified_tcp", "frame_number": 10005, "timestamp_epoch": "1722307303.797738000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20333720736563" } }, { "event_id": "evt-68eaadee8aa95deee49ef38a", "kind": "unclassified_tcp", "frame_number": 10007, "timestamp_epoch": "1722307308.813657000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-d323d0fc4c02d14c53fcc8cb", "kind": "unclassified_tcp", "frame_number": 10009, "timestamp_epoch": "1722307308.814125000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20343220736563" } }, { "event_id": "evt-e45124ecebdd0cc47eac77f8", "kind": "unclassified_tcp", "frame_number": 10011, "timestamp_epoch": "1722307311.265685000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5f7f3cc8e1ae0dcfbc16877a", "kind": "unclassified_tcp", "frame_number": 10020, "timestamp_epoch": "1722307313.829233000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-f165b818bea8fce79c61e971", "kind": "unclassified_tcp", "frame_number": 10022, "timestamp_epoch": "1722307313.829783000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20343720736563" } }, { "event_id": "evt-c64000197004ee27689af22c", "kind": "unclassified_tcp", "frame_number": 10024, "timestamp_epoch": "1722307318.845096000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134330d0a0d0a" } }, { "event_id": "evt-a61b99141abcc922c71bae15", "kind": "unclassified_tcp", "frame_number": 10026, "timestamp_epoch": "1722307318.845553000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20353320736563" } }, { "event_id": "evt-a4b1666108bff6386a396df4", "kind": "unclassified_tcp", "frame_number": 10028, "timestamp_epoch": "1722307319.750261000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49694, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7743cbc82ce5f8fbf87e3947", "kind": "unclassified_tcp", "frame_number": 10030, "timestamp_epoch": "1722307319.796561000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1805dd7eb336238d7838badb", "kind": "unclassified_tcp", "frame_number": 10032, "timestamp_epoch": "1722307323.858865000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134370d0a0d0a" } }, { "event_id": "evt-00b43698c8ac616498ca1a58", "kind": "unclassified_tcp", "frame_number": 10034, "timestamp_epoch": "1722307323.859221000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c534739745a513d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-6871b05f6ec2206fdfc7c68a", "kind": "unclassified_tcp", "frame_number": 10036, "timestamp_epoch": "1722307328.860394000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-32f7947c34d332924b168ace", "kind": "unclassified_tcp", "frame_number": 10038, "timestamp_epoch": "1722307328.860897000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c5247396a6457316c626e527a7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-7f784585b5801bcdcb9276cd", "kind": "unclassified_tcp", "frame_number": 10322, "timestamp_epoch": "1722307333.874439000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230300d0a0d0a" } }, { "event_id": "evt-e897300f633ada9361e612a4", "kind": "unclassified_tcp", "frame_number": 10324, "timestamp_epoch": "1722307333.874718000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3220536563" } }, { "event_id": "evt-05fc3583fd87ad0d9be8845f", "kind": "unclassified_tcp", "frame_number": 10339, "timestamp_epoch": "1722307338.861265000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230330d0a0d0a" } }, { "event_id": "evt-fa50ed95e14e1b6f765ae07e", "kind": "unclassified_tcp", "frame_number": 10341, "timestamp_epoch": "1722307338.861786000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-632d13de94f19dbeab769bab", "kind": "unclassified_tcp", "frame_number": 10404, "timestamp_epoch": "1722307341.282566000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49728, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8836816b10c750f6e6cfb285", "kind": "unclassified_tcp", "frame_number": 10405, "timestamp_epoch": "1722307341.282575000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3ad4da8c7706e2aec2869ee1", "kind": "unclassified_tcp", "frame_number": 10408, "timestamp_epoch": "1722307343.862692000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230330d0a0d0a" } }, { "event_id": "evt-28bf1f0ecab65c4684de7f25", "kind": "unclassified_tcp", "frame_number": 10410, "timestamp_epoch": "1722307343.863235000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-37550b5a9857f158c11b3606", "kind": "unclassified_tcp", "frame_number": 10438, "timestamp_epoch": "1722307348.862675000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230330d0a0d0a" } }, { "event_id": "evt-5260d660de61f227b604eaf1", "kind": "unclassified_tcp", "frame_number": 10440, "timestamp_epoch": "1722307348.863221000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-da2ca166689aa975b40452b5", "kind": "unclassified_tcp", "frame_number": 10442, "timestamp_epoch": "1722307349.799678000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9d2918aa3d2b00cc9a37d66f", "kind": "unclassified_tcp", "frame_number": 10444, "timestamp_epoch": "1722307353.881578000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230330d0a0d0a" } }, { "event_id": "evt-7961e11ac823f7bc385be79f", "kind": "unclassified_tcp", "frame_number": 10446, "timestamp_epoch": "1722307353.881984000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-2ffa81cf393e453b313f622a", "kind": "unclassified_tcp", "frame_number": 10571, "timestamp_epoch": "1722307358.896363000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3230330d0a0d0a" } }, { "event_id": "evt-19a24942343c8b0cc5dec4f7", "kind": "unclassified_tcp", "frame_number": 10573, "timestamp_epoch": "1722307358.896658000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c63473931626d527a4c575a76636d31316247456757304e766258426864476c696157787064486b675457396b5a5630674c5342516233646c636c4276615735307c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-9047673c39e16ad98b690098", "kind": "unclassified_tcp", "frame_number": 10596, "timestamp_epoch": "1722307363.919115000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-8701c3b34547f6cbc388b418", "kind": "unclassified_tcp", "frame_number": 10598, "timestamp_epoch": "1722307363.919570000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c5247396a6457316c626e527a7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-dc32377a0e89c01bf0e78e73", "kind": "unclassified_tcp", "frame_number": 10609, "timestamp_epoch": "1722307368.926218000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-1f68e6fd9cfd0548ad8bdfb2", "kind": "unclassified_tcp", "frame_number": 10611, "timestamp_epoch": "1722307368.926738000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c5247396a6457316c626e527a7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-bfb20f77aa6ebfec128af5bd", "kind": "unclassified_tcp", "frame_number": 10613, "timestamp_epoch": "1722307371.284368000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e3a889266069ca7e914690e0", "kind": "unclassified_tcp", "frame_number": 10626, "timestamp_epoch": "1722307373.941242000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-048e7b8cb161ef6ea501a41b", "kind": "unclassified_tcp", "frame_number": 10628, "timestamp_epoch": "1722307373.941649000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55476c6a644856795a584d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-7ed88becf2f9dcf20f3baa3a", "kind": "unclassified_tcp", "frame_number": 10633, "timestamp_epoch": "1722307378.957257000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3134380d0a0d0a" } }, { "event_id": "evt-8e1293f85318ba27d9ea68f0", "kind": "unclassified_tcp", "frame_number": 10635, "timestamp_epoch": "1722307378.957744000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55476c6a644856795a584d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3120536563" } }, { "event_id": "evt-bded4dea9bdf03c75a79860a", "kind": "unclassified_tcp", "frame_number": 10637, "timestamp_epoch": "1722307379.800383000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-481358edde66a6494b3bce4b", "kind": "unclassified_tcp", "frame_number": 10639, "timestamp_epoch": "1722307383.957391000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-23e9635559ab0e5b5e1673a4", "kind": "unclassified_tcp", "frame_number": 10641, "timestamp_epoch": "1722307383.957867000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55476c6a644856795a584d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-b5a4b7d3cc4b0de596a73ba4", "kind": "unclassified_tcp", "frame_number": 10643, "timestamp_epoch": "1722307388.973118000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-17768611155228ecab13d4b1", "kind": "unclassified_tcp", "frame_number": 10645, "timestamp_epoch": "1722307388.973605000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55476c6a644856795a584d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-9ab7d90e559a4d0f399ff45a", "kind": "unclassified_tcp", "frame_number": 10668, "timestamp_epoch": "1722307393.995347000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3137390d0a0d0a" } }, { "event_id": "evt-0229578c94631398960d8aed", "kind": "unclassified_tcp", "frame_number": 10670, "timestamp_epoch": "1722307393.995675000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c526d467559575167534756685a43424d6157646f6447687664584e6c4943306755474670626e513d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-e870d1a5b9ba6cc3af3afa64", "kind": "unclassified_tcp", "frame_number": 10672, "timestamp_epoch": "1722307399.004100000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135310d0a0d0a" } }, { "event_id": "evt-18b1f2056677aa2de5a4ee09", "kind": "unclassified_tcp", "frame_number": 10674, "timestamp_epoch": "1722307399.004521000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55476c6a644856795a584d3d7c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-7bc346c859c5b162347f1856", "kind": "unclassified_tcp", "frame_number": 10683, "timestamp_epoch": "1722307404.019965000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135390d0a0d0a" } }, { "event_id": "evt-98132052f5d7d90b1eab9f64", "kind": "unclassified_tcp", "frame_number": 10685, "timestamp_epoch": "1722307404.020389000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c4e6f742049646c65" } }, { "event_id": "evt-3a826b1706c3e14557394be8", "kind": "unclassified_tcp", "frame_number": 10687, "timestamp_epoch": "1722307405.144228000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d607011e8a840046828c84b4", "kind": "unclassified_tcp", "frame_number": 10689, "timestamp_epoch": "1722307409.030731000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135360d0a0d0a" } }, { "event_id": "evt-34b2ec6ec4c8035c8a3d254b", "kind": "unclassified_tcp", "frame_number": 10691, "timestamp_epoch": "1722307409.031263000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3420536563" } }, { "event_id": "evt-a0407ec281282b2c80455ebf", "kind": "unclassified_tcp", "frame_number": 10693, "timestamp_epoch": "1722307409.815112000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7f36ac7ab466319a76d415f6", "kind": "unclassified_tcp", "frame_number": 10695, "timestamp_epoch": "1722307412.736559000", "src_ip": "172.16.1.66", "dst_ip": "20.7.2.167", "src_port": 49741, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b193bc752c7f90ce11a7d77a", "kind": "unclassified_tcp", "frame_number": 10696, "timestamp_epoch": "1722307414.035808000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135360d0a0d0a" } }, { "event_id": "evt-19200b252ee8ab7dce9dcaae", "kind": "unclassified_tcp", "frame_number": 10698, "timestamp_epoch": "1722307414.036292000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c3920536563" } }, { "event_id": "evt-2bb89f4173ca7d7fede98dfd", "kind": "unclassified_tcp", "frame_number": 10700, "timestamp_epoch": "1722307415.753277000", "src_ip": "172.16.1.66", "dst_ip": "20.7.2.167", "src_port": 49741, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f250ef437141e30015dc8ba0", "kind": "unclassified_tcp", "frame_number": 10702, "timestamp_epoch": "1722307419.052153000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-7ac5bb2178a9d5eb70dcdebd", "kind": "unclassified_tcp", "frame_number": 10704, "timestamp_epoch": "1722307419.052502000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c313420536563" } }, { "event_id": "evt-3763848791d0b1b0bd798fab", "kind": "unclassified_tcp", "frame_number": 10706, "timestamp_epoch": "1722307424.053640000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-37b9528e6cd820193fd9eb23", "kind": "unclassified_tcp", "frame_number": 10708, "timestamp_epoch": "1722307424.054124000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c313920536563" } }, { "event_id": "evt-3789957ee8d8a9e8f3168715", "kind": "unclassified_tcp", "frame_number": 10710, "timestamp_epoch": "1722307429.069745000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-0bd40a3f6b223bde377072bd", "kind": "unclassified_tcp", "frame_number": 10714, "timestamp_epoch": "1722307429.070650000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c323420536563" } }, { "event_id": "evt-3187af2fcd6af9c70e035765", "kind": "unclassified_tcp", "frame_number": 10716, "timestamp_epoch": "1722307434.085099000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-366fbc6fea778d7baa499241", "kind": "unclassified_tcp", "frame_number": 10718, "timestamp_epoch": "1722307434.085404000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c323920536563" } }, { "event_id": "evt-c946f4668659488a42b9777b", "kind": "unclassified_tcp", "frame_number": 10720, "timestamp_epoch": "1722307435.163011000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a26a93be5e42f61c73efcc44", "kind": "unclassified_tcp", "frame_number": 10722, "timestamp_epoch": "1722307439.086077000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-e53fe4b4527d28a84f3e8b0e", "kind": "unclassified_tcp", "frame_number": 10724, "timestamp_epoch": "1722307439.086546000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c333420536563" } }, { "event_id": "evt-74a4d8bec001ddeb43ac748e", "kind": "unclassified_tcp", "frame_number": 10726, "timestamp_epoch": "1722307439.771472000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49694, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-adf47333c5c7a6a7df11efa0", "kind": "unclassified_tcp", "frame_number": 10728, "timestamp_epoch": "1722307439.834253000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-60731779e45a96cda0bd08b5", "kind": "unclassified_tcp", "frame_number": 10730, "timestamp_epoch": "1722307444.086634000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-c098057b2d90d60ba8e99e93", "kind": "unclassified_tcp", "frame_number": 10732, "timestamp_epoch": "1722307444.087181000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c333920536563" } }, { "event_id": "evt-7cc1272ab87ee15d8dda4e58", "kind": "unclassified_tcp", "frame_number": 10734, "timestamp_epoch": "1722307449.102211000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-8c8946dd687922e6931199fb", "kind": "unclassified_tcp", "frame_number": 10736, "timestamp_epoch": "1722307449.102690000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c343420536563" } }, { "event_id": "evt-a3a159d719301625d93423c8", "kind": "unclassified_tcp", "frame_number": 10762, "timestamp_epoch": "1722307454.102355000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-b64777b7a6bd6d9a5c1c6df6", "kind": "unclassified_tcp", "frame_number": 10764, "timestamp_epoch": "1722307454.102881000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c343920536563" } }, { "event_id": "evt-24602f92cfd706ea2f55da88", "kind": "unclassified_tcp", "frame_number": 11178, "timestamp_epoch": "1722307459.117790000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-0be8755bb96064ec85e73b7b", "kind": "unclassified_tcp", "frame_number": 11180, "timestamp_epoch": "1722307459.118143000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c353420536563" } }, { "event_id": "evt-548b86f7ea836b96d24c85a7", "kind": "unclassified_tcp", "frame_number": 11217, "timestamp_epoch": "1722307464.134137000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3135370d0a0d0a" } }, { "event_id": "evt-8d61246424f864d604f1bb26", "kind": "unclassified_tcp", "frame_number": 11219, "timestamp_epoch": "1722307464.134675000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c353920536563" } }, { "event_id": "evt-d013e4844f49f4bbc0dbe941", "kind": "unclassified_tcp", "frame_number": 11221, "timestamp_epoch": "1722307465.179842000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1fcc406be969d75faf03198d", "kind": "unclassified_tcp", "frame_number": 11227, "timestamp_epoch": "1722307469.149880000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-f2804ba4bd47160e57ac57b8", "kind": "unclassified_tcp", "frame_number": 11229, "timestamp_epoch": "1722307469.150403000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e203420736563" } }, { "event_id": "evt-4defc503f37bc7c8ea3eed6d", "kind": "unclassified_tcp", "frame_number": 11266, "timestamp_epoch": "1722307469.839069000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f4530d8b1fd1a6949be2eba5", "kind": "unclassified_tcp", "frame_number": 11287, "timestamp_epoch": "1722307474.165549000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-f764dbd1830204474bd5e464", "kind": "unclassified_tcp", "frame_number": 11289, "timestamp_epoch": "1722307474.166073000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e203920736563" } }, { "event_id": "evt-7aa45bf21a7454ea347a5c06", "kind": "unclassified_tcp", "frame_number": 11291, "timestamp_epoch": "1722307479.180812000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-59c52c5ab7476376ab6a9ccb", "kind": "unclassified_tcp", "frame_number": 11293, "timestamp_epoch": "1722307479.181285000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20313420736563" } }, { "event_id": "evt-b0f465e5f9d574e70acd87f4", "kind": "unclassified_tcp", "frame_number": 11295, "timestamp_epoch": "1722307484.186873000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-02dbc92c18cf0b2989ae7a17", "kind": "unclassified_tcp", "frame_number": 11297, "timestamp_epoch": "1722307484.187370000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20313920736563" } }, { "event_id": "evt-a8771e414b72d59ca479d6ba", "kind": "unclassified_tcp", "frame_number": 11303, "timestamp_epoch": "1722307489.196437000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-da1decc0719ae5df8d88f895", "kind": "unclassified_tcp", "frame_number": 11305, "timestamp_epoch": "1722307489.196917000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20323420736563" } }, { "event_id": "evt-2a4d36fb161afb434ed237a8", "kind": "unclassified_tcp", "frame_number": 11307, "timestamp_epoch": "1722307494.211461000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-028c6f39d8737fde45147e7d", "kind": "unclassified_tcp", "frame_number": 11309, "timestamp_epoch": "1722307494.211813000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20323920736563" } }, { "event_id": "evt-f2d50cdb78c9f58387a140c5", "kind": "unclassified_tcp", "frame_number": 11311, "timestamp_epoch": "1722307495.195361000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-07da1a2e51e02da8c8adfb7c", "kind": "unclassified_tcp", "frame_number": 11313, "timestamp_epoch": "1722307495.210209000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49728, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5fe4194ef45cf8ea925d6d46", "kind": "unclassified_tcp", "frame_number": 11315, "timestamp_epoch": "1722307499.211830000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-a3ba271d53b82b1f2504515f", "kind": "unclassified_tcp", "frame_number": 11317, "timestamp_epoch": "1722307499.212360000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20333420736563" } }, { "event_id": "evt-c64979fc969020189d6a9428", "kind": "unclassified_tcp", "frame_number": 11319, "timestamp_epoch": "1722307499.850354000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-29558e0aee94bfe2e22a64fa", "kind": "unclassified_tcp", "frame_number": 11321, "timestamp_epoch": "1722307504.227810000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-cfd702fbc48d463d91bc1920", "kind": "unclassified_tcp", "frame_number": 11323, "timestamp_epoch": "1722307504.228199000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20333920736563" } }, { "event_id": "evt-0a8793bcc31e0a4dd57b0cb6", "kind": "unclassified_tcp", "frame_number": 11325, "timestamp_epoch": "1722307509.243797000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-4d1c3b25c4cc2d7154b8e405", "kind": "unclassified_tcp", "frame_number": 11327, "timestamp_epoch": "1722307509.244303000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20343420736563" } }, { "event_id": "evt-5af690135570a0efcb60eeb0", "kind": "unclassified_tcp", "frame_number": 11331, "timestamp_epoch": "1722307514.258871000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-a64aef2a694afc18f59c3ad1", "kind": "unclassified_tcp", "frame_number": 11333, "timestamp_epoch": "1722307514.259231000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20343920736563" } }, { "event_id": "evt-7492cbce94ae3788cab168f6", "kind": "unclassified_tcp", "frame_number": 11335, "timestamp_epoch": "1722307519.274783000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-96b0b759ea5e442a29e635ae", "kind": "unclassified_tcp", "frame_number": 11337, "timestamp_epoch": "1722307519.275350000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20353420736563" } }, { "event_id": "evt-9c197ccf2c3b34ef0a50d5e9", "kind": "unclassified_tcp", "frame_number": 11339, "timestamp_epoch": "1722307524.275381000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-9d8aafb42d25d167b7665ff5", "kind": "unclassified_tcp", "frame_number": 11341, "timestamp_epoch": "1722307524.275832000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c31206d696e20353920736563" } }, { "event_id": "evt-39abf90cc30799f696c94a72", "kind": "unclassified_tcp", "frame_number": 11343, "timestamp_epoch": "1722307525.211904000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-73ef7fface58f68a4d8431e0", "kind": "unclassified_tcp", "frame_number": 11345, "timestamp_epoch": "1722307529.290967000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-8104d78764a30742cc2e369f", "kind": "unclassified_tcp", "frame_number": 11347, "timestamp_epoch": "1722307529.291501000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e203420736563" } }, { "event_id": "evt-4695a2099c30b961081a68c8", "kind": "unclassified_tcp", "frame_number": 11349, "timestamp_epoch": "1722307529.867330000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-db1c9fb3c0015f61a1b8f449", "kind": "unclassified_tcp", "frame_number": 11353, "timestamp_epoch": "1722307534.306918000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-8b25bc4bb9f8926a1f8ea3bd", "kind": "unclassified_tcp", "frame_number": 11355, "timestamp_epoch": "1722307534.307413000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e203920736563" } }, { "event_id": "evt-30f21319b679bd6f52408226", "kind": "unclassified_tcp", "frame_number": 11357, "timestamp_epoch": "1722307539.322561000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-c2b64ca7b824f1d8fde558e1", "kind": "unclassified_tcp", "frame_number": 11359, "timestamp_epoch": "1722307539.323069000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20313420736563" } }, { "event_id": "evt-3077ad1cfd45b18e4e9428ce", "kind": "unclassified_tcp", "frame_number": 11361, "timestamp_epoch": "1722307544.338383000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-046900e43f983af4ec1c7582", "kind": "unclassified_tcp", "frame_number": 11363, "timestamp_epoch": "1722307544.338888000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20313920736563" } }, { "event_id": "evt-948da0b1fafebf42d1384134", "kind": "unclassified_tcp", "frame_number": 11365, "timestamp_epoch": "1722307549.354133000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-201b7fb15f47c9b998926c39", "kind": "unclassified_tcp", "frame_number": 11367, "timestamp_epoch": "1722307549.354667000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20323420736563" } }, { "event_id": "evt-cf8f1afbb96388b442c894e0", "kind": "unclassified_tcp", "frame_number": 11369, "timestamp_epoch": "1722307554.354143000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-5b19f62ec1d21d9caf172d61", "kind": "unclassified_tcp", "frame_number": 11371, "timestamp_epoch": "1722307554.354605000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20323920736563" } }, { "event_id": "evt-121249c2dc773c87f15dbceb", "kind": "unclassified_tcp", "frame_number": 11373, "timestamp_epoch": "1722307555.228158000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9331585d81041db92e526438", "kind": "unclassified_tcp", "frame_number": 11377, "timestamp_epoch": "1722307559.354232000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-77758cf510348d68383f9ab1", "kind": "unclassified_tcp", "frame_number": 11379, "timestamp_epoch": "1722307559.354706000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20333420736563" } }, { "event_id": "evt-f6db4c017e3facee605c241e", "kind": "unclassified_tcp", "frame_number": 11381, "timestamp_epoch": "1722307559.789834000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49694, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7a4eb2532ffa3c775cfa4069", "kind": "unclassified_tcp", "frame_number": 11383, "timestamp_epoch": "1722307559.869045000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8686e122ae7a156d5b29800d", "kind": "unclassified_tcp", "frame_number": 11385, "timestamp_epoch": "1722307564.369960000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-c83017d14f0974ba394bff9a", "kind": "unclassified_tcp", "frame_number": 11387, "timestamp_epoch": "1722307564.370482000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20333920736563" } }, { "event_id": "evt-42376287ef976ab17d30d93b", "kind": "unclassified_tcp", "frame_number": 11389, "timestamp_epoch": "1722307569.369907000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-3bfb8d6ef09e0bf86b6697e4", "kind": "unclassified_tcp", "frame_number": 11391, "timestamp_epoch": "1722307569.370380000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20343420736563" } }, { "event_id": "evt-113f6e28820a926085931615", "kind": "unclassified_tcp", "frame_number": 11393, "timestamp_epoch": "1722307574.370167000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-0f1c09bf4fbfd72e0fdcb21a", "kind": "unclassified_tcp", "frame_number": 11395, "timestamp_epoch": "1722307574.370651000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20343920736563" } }, { "event_id": "evt-d79e5f85787d54b38f6ae96f", "kind": "unclassified_tcp", "frame_number": 11399, "timestamp_epoch": "1722307579.369892000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-5a6263a6676fd7a1e28c3475", "kind": "unclassified_tcp", "frame_number": 11401, "timestamp_epoch": "1722307579.370379000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20353420736563" } }, { "event_id": "evt-0fdf975e5c23c8d29f1b0eae", "kind": "unclassified_tcp", "frame_number": 11405, "timestamp_epoch": "1722307584.385916000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-add5e8ad1e992114e0bda23e", "kind": "unclassified_tcp", "frame_number": 11407, "timestamp_epoch": "1722307584.386421000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c32206d696e20353920736563" } }, { "event_id": "evt-430006e34f477329b41ac300", "kind": "unclassified_tcp", "frame_number": 11409, "timestamp_epoch": "1722307585.244426000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-95e14a68c1dfc1d82f6667b0", "kind": "unclassified_tcp", "frame_number": 11411, "timestamp_epoch": "1722307589.401376000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-2edec2ebd358b13f2c667036", "kind": "unclassified_tcp", "frame_number": 11413, "timestamp_epoch": "1722307589.401900000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e203420736563" } }, { "event_id": "evt-46f587146be3cdacded18e59", "kind": "unclassified_tcp", "frame_number": 11415, "timestamp_epoch": "1722307589.883995000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a5b8b9ab0e275f0988ed2dde", "kind": "unclassified_tcp", "frame_number": 11419, "timestamp_epoch": "1722307594.401833000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-bbe3f79299f10c2aabddd9e4", "kind": "unclassified_tcp", "frame_number": 11421, "timestamp_epoch": "1722307594.402322000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e203920736563" } }, { "event_id": "evt-a5c3b1f99620d55b0b3ae519", "kind": "unclassified_tcp", "frame_number": 11423, "timestamp_epoch": "1722307599.401997000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-3f089ca90adc51edfb7976cd", "kind": "unclassified_tcp", "frame_number": 11425, "timestamp_epoch": "1722307599.402520000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20313420736563" } }, { "event_id": "evt-76ecf0c827c53d2647fc9cf6", "kind": "unclassified_tcp", "frame_number": 11427, "timestamp_epoch": "1722307604.417088000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-90186a511802c76aaf69a95f", "kind": "unclassified_tcp", "frame_number": 11429, "timestamp_epoch": "1722307604.417425000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20313920736563" } }, { "event_id": "evt-62ef1dc0d0f139c96922920e", "kind": "unclassified_tcp", "frame_number": 11431, "timestamp_epoch": "1722307609.433177000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-af02d76f58ea150a9332300a", "kind": "unclassified_tcp", "frame_number": 11433, "timestamp_epoch": "1722307609.433632000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20323420736563" } }, { "event_id": "evt-6537dbf8396af5cbf0077576", "kind": "unclassified_tcp", "frame_number": 11436, "timestamp_epoch": "1722307614.449056000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-efcd650ba1a049714342d095", "kind": "unclassified_tcp", "frame_number": 11438, "timestamp_epoch": "1722307614.449540000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20333020736563" } }, { "event_id": "evt-12479175801963e5469ee56f", "kind": "unclassified_tcp", "frame_number": 11440, "timestamp_epoch": "1722307615.229007000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49728, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4d092cae3f2b2735d903f3b0", "kind": "unclassified_tcp", "frame_number": 11442, "timestamp_epoch": "1722307615.260799000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e2c45e74964aef1578dd116e", "kind": "unclassified_tcp", "frame_number": 11444, "timestamp_epoch": "1722307619.465061000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-93ae06ab75458e35905dde49", "kind": "unclassified_tcp", "frame_number": 11446, "timestamp_epoch": "1722307619.465394000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20333520736563" } }, { "event_id": "evt-8ce1113943bff1b3a40c6e29", "kind": "unclassified_tcp", "frame_number": 11448, "timestamp_epoch": "1722307619.885994000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bdf4603f82b6982372674312", "kind": "unclassified_tcp", "frame_number": 11452, "timestamp_epoch": "1722307624.464628000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-824bb7505c2ee50d776fd960", "kind": "unclassified_tcp", "frame_number": 11454, "timestamp_epoch": "1722307624.465005000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20343020736563" } }, { "event_id": "evt-fde738562207b7c498f770ba", "kind": "unclassified_tcp", "frame_number": 11456, "timestamp_epoch": "1722307629.464979000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-96a9ca7ad562e9cd7a128f89", "kind": "unclassified_tcp", "frame_number": 11458, "timestamp_epoch": "1722307629.465451000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20343520736563" } }, { "event_id": "evt-adba75d6b5d7944e1d19a147", "kind": "unclassified_tcp", "frame_number": 11460, "timestamp_epoch": "1722307634.465177000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-6e0aecaf844fa5b231a7e73d", "kind": "unclassified_tcp", "frame_number": 11462, "timestamp_epoch": "1722307634.465668000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20353020736563" } }, { "event_id": "evt-ba2c258b7a42c4495d4e398a", "kind": "unclassified_tcp", "frame_number": 11464, "timestamp_epoch": "1722307639.465149000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-999bbdc3c8f0384c688475dc", "kind": "unclassified_tcp", "frame_number": 11466, "timestamp_epoch": "1722307639.465698000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c33206d696e20353520736563" } }, { "event_id": "evt-dcf98ac34bdc0390f8bf62eb", "kind": "unclassified_tcp", "frame_number": 11477, "timestamp_epoch": "1722307644.481303000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-268edd912ac3854a82334b67", "kind": "unclassified_tcp", "frame_number": 11479, "timestamp_epoch": "1722307644.481768000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e203020736563" } }, { "event_id": "evt-c8862fe7f856a8e301a872f2", "kind": "unclassified_tcp", "frame_number": 11483, "timestamp_epoch": "1722307645.277031000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-34aabd6937640409472dc18b", "kind": "unclassified_tcp", "frame_number": 11485, "timestamp_epoch": "1722307649.481278000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-5117756ce5ab28164750b6bf", "kind": "unclassified_tcp", "frame_number": 11487, "timestamp_epoch": "1722307649.481781000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e203520736563" } }, { "event_id": "evt-1ad4e502e4628ad177534b7a", "kind": "unclassified_tcp", "frame_number": 11489, "timestamp_epoch": "1722307649.916751000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5b0d02ceae62f06ff748a388", "kind": "unclassified_tcp", "frame_number": 11491, "timestamp_epoch": "1722307654.496582000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-73530e9c5bb91efbce4ed39a", "kind": "unclassified_tcp", "frame_number": 11493, "timestamp_epoch": "1722307654.497140000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20313020736563" } }, { "event_id": "evt-a053056871f92f49b81a2c1c", "kind": "unclassified_tcp", "frame_number": 11495, "timestamp_epoch": "1722307659.512552000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-73f70500bec4fc0a160ab9eb", "kind": "unclassified_tcp", "frame_number": 11497, "timestamp_epoch": "1722307659.513012000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20313520736563" } }, { "event_id": "evt-a9c4ef4da3abc28023e551ce", "kind": "unclassified_tcp", "frame_number": 11499, "timestamp_epoch": "1722307664.527950000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-2dae30950fe2bb44b06167cd", "kind": "unclassified_tcp", "frame_number": 11501, "timestamp_epoch": "1722307664.528534000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20323020736563" } }, { "event_id": "evt-3600c32f0e309087a19cdb7c", "kind": "unclassified_tcp", "frame_number": 11503, "timestamp_epoch": "1722307669.528487000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-38af48b802435766061f4b3a", "kind": "unclassified_tcp", "frame_number": 11505, "timestamp_epoch": "1722307669.528988000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20323520736563" } }, { "event_id": "evt-35ca42cf7ea765fc2f9f26b3", "kind": "unclassified_tcp", "frame_number": 11507, "timestamp_epoch": "1722307674.544171000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-8dac10b91cc6fe8df1c982fa", "kind": "unclassified_tcp", "frame_number": 11509, "timestamp_epoch": "1722307674.544693000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20333020736563" } }, { "event_id": "evt-b3235ee31eb1c7df19cb8da7", "kind": "unclassified_tcp", "frame_number": 11511, "timestamp_epoch": "1722307675.293212000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e3f024d9ce375249547eaa90", "kind": "unclassified_tcp", "frame_number": 11513, "timestamp_epoch": "1722307679.559930000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-d483e08fc9853dca32648511", "kind": "unclassified_tcp", "frame_number": 11515, "timestamp_epoch": "1722307679.560410000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20333520736563" } }, { "event_id": "evt-80c17315a1896c74ed41ddba", "kind": "unclassified_tcp", "frame_number": 11517, "timestamp_epoch": "1722307679.808060000", "src_ip": "172.16.1.4", "dst_ip": "172.16.1.66", "src_port": 445, "dst_port": 49694, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6dc35660d781719796e98fc8", "kind": "unclassified_tcp", "frame_number": 11519, "timestamp_epoch": "1722307679.933029000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c6f53db3923607fdee6edbd5", "kind": "unclassified_tcp", "frame_number": 11523, "timestamp_epoch": "1722307684.575049000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-73db5ac73868fdf79aa25c6f", "kind": "unclassified_tcp", "frame_number": 11525, "timestamp_epoch": "1722307684.575346000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20343020736563" } }, { "event_id": "evt-c83e9ecb3e9eb01816029282", "kind": "unclassified_tcp", "frame_number": 11527, "timestamp_epoch": "1722307689.591180000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-b609298430f12ff6fabe7218", "kind": "unclassified_tcp", "frame_number": 11529, "timestamp_epoch": "1722307689.591650000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20343520736563" } }, { "event_id": "evt-a63bfcf68aa636de23d6304c", "kind": "unclassified_tcp", "frame_number": 11531, "timestamp_epoch": "1722307694.591360000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-9c54ba9f605eca8411f04708", "kind": "unclassified_tcp", "frame_number": 11533, "timestamp_epoch": "1722307694.591832000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20353020736563" } }, { "event_id": "evt-35ef2e1f21aac6abf80671c3", "kind": "unclassified_tcp", "frame_number": 11535, "timestamp_epoch": "1722307699.591604000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-fee374f45461ece5cb140ccf", "kind": "unclassified_tcp", "frame_number": 11537, "timestamp_epoch": "1722307699.592098000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c34206d696e20353520736563" } }, { "event_id": "evt-5173129c1f687287199b6dde", "kind": "unclassified_tcp", "frame_number": 11539, "timestamp_epoch": "1722307704.607190000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-355fb1311b66c24da6d75d9b", "kind": "unclassified_tcp", "frame_number": 11541, "timestamp_epoch": "1722307704.607645000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c35206d696e203020736563" } }, { "event_id": "evt-8eab869ce979c8cec5f6f666", "kind": "unclassified_tcp", "frame_number": 11543, "timestamp_epoch": "1722307705.309514000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49728, "dst_port": 445, "tcp_stream": 56, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6e4f82675417bd8fa48546cf", "kind": "unclassified_tcp", "frame_number": 11545, "timestamp_epoch": "1722307709.607501000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136320d0a0d0a" } }, { "event_id": "evt-cac1796bef69f5e8b078195a", "kind": "unclassified_tcp", "frame_number": 11547, "timestamp_epoch": "1722307709.607976000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c35206d696e203520736563" } }, { "event_id": "evt-023ffc8b7db22011e9bdee7b", "kind": "unclassified_tcp", "frame_number": 11549, "timestamp_epoch": "1722307709.948859000", "src_ip": "172.16.1.66", "dst_ip": "172.16.1.4", "src_port": 49694, "dst_port": 445, "tcp_stream": 21, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-202bb3554b4c152df4bc0b42", "kind": "unclassified_tcp", "frame_number": 11559, "timestamp_epoch": "1722307714.622613000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "3136330d0a0d0a" } }, { "event_id": "evt-4b114fabc3741758ad7536df", "kind": "unclassified_tcp", "frame_number": 11561, "timestamp_epoch": "1722307714.623093000", "src_ip": "172.16.1.66", "dst_ip": "141.98.10.79", "src_port": 49754, "dst_port": 12132, "tcp_stream": 83, "udp_stream": null, "fields": { "tcp.payload": "70696e677c5354525241547c31424538323932437c4445534b544f502d534b42523235467c63636f6c6c6965727c4d6963726f736f66742057696e646f77732031312050726f7c36342d6269747c57696e646f777320446566656e6465727c55484a765a334a686253424e595735685a3256797c312e367c55533a556e69746564205374617465737c4e6f7420496e7374616c6c65647c35206d696e20313020736563" } } ] }, "artifacts": [ { "artifact_id": "artifact-0029b7a19d1171e3349a999d", "type": "http-exported-object", "filename": "json", "filenames": [ "json" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 294, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 294, "sha256": "47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f9f6d98fa9175099b7940acb", "type": "http-exported-object", "filename": "connecttest.txt", "filenames": [ "connecttest.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 22, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 22, "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-ad0175a882dec75ed4efde42", "type": "domain", "value": "a1834.dscg2.akamai.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1722307457.735336000", "last_seen_epoch": "1722307457.790314000", "evidence": [ { "frame_number": 10959, "timestamp_epoch": "1722307457.735336000", "display_filter": "frame.number == 10959", "udp_stream": 39 }, { "frame_number": 10972, "timestamp_epoch": "1722307457.790314000", "display_filter": "frame.number == 10972", "udp_stream": 40 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8dc493a0eb2c6df97c8140bb", "type": "domain", "value": "api-msn-com.a-0003.a-msedge.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1722307457.130075000", "last_seen_epoch": "1722307457.130075000", "evidence": [ { "frame_number": 10886, "timestamp_epoch": "1722307457.130075000", "display_filter": "frame.number == 10886", "udp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7604e40ec5c5d7fcad0ccdb8", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307457.084249000", "last_seen_epoch": "1722307457.429375000", "evidence": [ { "frame_number": 10882, "timestamp_epoch": "1722307457.084249000", "display_filter": "frame.number == 10882", "udp_stream": 31 }, { "frame_number": 10883, "timestamp_epoch": "1722307457.084322000", "display_filter": "frame.number == 10883", "udp_stream": 32 }, { "frame_number": 10886, "timestamp_epoch": "1722307457.130075000", "display_filter": "frame.number == 10886", "udp_stream": 32 }, { "frame_number": 10887, "timestamp_epoch": "1722307457.151610000", "display_filter": "frame.number == 10887", "udp_stream": 31 }, { "frame_number": 10896, "timestamp_epoch": "1722307457.237113000", "display_filter": "frame.number == 10896", "tcp_stream": 143 }, { "frame_number": 10906, "timestamp_epoch": "1722307457.429375000", "display_filter": "frame.number == 10906", "tcp_stream": 143 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-90ccd6f0b3e9770a1be15dcc", "type": "domain", "value": "arc.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307154.986927000", "last_seen_epoch": "1722307155.140456000", "evidence": [ { "frame_number": 1173, "timestamp_epoch": "1722307154.986927000", "display_filter": "frame.number == 1173", "udp_stream": 12 }, { "frame_number": 1176, "timestamp_epoch": "1722307155.052038000", "display_filter": "frame.number == 1176", "udp_stream": 12 }, { "frame_number": 1190, "timestamp_epoch": "1722307155.140456000", "display_filter": "frame.number == 1190", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e4cd9627477c5f5f7ec86f78", "type": "domain", "value": "assets.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307156.640743000", "last_seen_epoch": "1722307457.258603000", "evidence": [ { "frame_number": 1232, "timestamp_epoch": "1722307156.640743000", "display_filter": "frame.number == 1232", "udp_stream": 17 }, { "frame_number": 1255, "timestamp_epoch": "1722307157.667160000", "display_filter": "frame.number == 1255", "udp_stream": 17 }, { "frame_number": 1415, "timestamp_epoch": "1722307158.672779000", "display_filter": "frame.number == 1415", "udp_stream": 17 }, { "frame_number": 1448, "timestamp_epoch": "1722307160.673169000", "display_filter": "frame.number == 1448", "udp_stream": 17 }, { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 }, { "frame_number": 9539, "timestamp_epoch": "1722307225.636806000", "display_filter": "frame.number == 9539", "udp_stream": 18 }, { "frame_number": 9540, "timestamp_epoch": "1722307225.687203000", "display_filter": "frame.number == 9540", "udp_stream": 18 }, { "frame_number": 10884, "timestamp_epoch": "1722307457.085408000", "display_filter": "frame.number == 10884", "udp_stream": 33 }, { "frame_number": 10885, "timestamp_epoch": "1722307457.085581000", "display_filter": "frame.number == 10885", "udp_stream": 34 }, { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 }, { "frame_number": 10891, "timestamp_epoch": "1722307457.215525000", "display_filter": "frame.number == 10891", "udp_stream": 34 }, { "frame_number": 10892, "timestamp_epoch": "1722307457.215675000", "display_filter": "frame.number == 10892", "udp_stream": 34 }, { "frame_number": 1527, "timestamp_epoch": "1722307164.218905000", "display_filter": "frame.number == 1527", "tcp_stream": 70 }, { "frame_number": 1531, "timestamp_epoch": "1722307164.228186000", "display_filter": "frame.number == 1531", "tcp_stream": 71 }, { "frame_number": 1719, "timestamp_epoch": "1722307172.108531000", "display_filter": "frame.number == 1719", "tcp_stream": 73 }, { "frame_number": 1729, "timestamp_epoch": "1722307172.181902000", "display_filter": "frame.number == 1729", "tcp_stream": 74 }, { "frame_number": 9544, "timestamp_epoch": "1722307225.773757000", "display_filter": "frame.number == 9544", "tcp_stream": 101 }, { "frame_number": 10902, "timestamp_epoch": "1722307457.258603000", "display_filter": "frame.number == 10902", "tcp_stream": 144 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a4632b679f568e1a9529994", "type": "domain", "value": "autodiscover-s.outlook.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307333.225395000", "last_seen_epoch": "1722307333.327530000", "evidence": [ { "frame_number": 10277, "timestamp_epoch": "1722307333.225395000", "display_filter": "frame.number == 10277", "udp_stream": 25 }, { "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "display_filter": "frame.number == 10278", "udp_stream": 25 }, { "frame_number": 10282, "timestamp_epoch": "1722307333.327530000", "display_filter": "frame.number == 10282", "tcp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce97a1f225aa26308f0ccf57", "type": "domain", "value": "autodiscover.wiresharkworkshop.online", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307335.712534000", "last_seen_epoch": "1722307335.712847000", "evidence": [ { "frame_number": 10334, "timestamp_epoch": "1722307335.712534000", "display_filter": "frame.number == 10334", "udp_stream": 25 }, { "frame_number": 10335, "timestamp_epoch": "1722307335.712847000", "display_filter": "frame.number == 10335", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-458ccb494e05efa63ba5df82", "type": "domain", "value": "client.wns.windows.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307156.006600000", "last_seen_epoch": "1722307164.176615000", "evidence": [ { "frame_number": 1231, "timestamp_epoch": "1722307156.006600000", "display_filter": "frame.number == 1231", "udp_stream": 12 }, { "frame_number": 1233, "timestamp_epoch": "1722307157.021273000", "display_filter": "frame.number == 1233", "udp_stream": 12 }, { "frame_number": 1356, "timestamp_epoch": "1722307158.105546000", "display_filter": "frame.number == 1356", "udp_stream": 12 }, { "frame_number": 1447, "timestamp_epoch": "1722307160.110624000", "display_filter": "frame.number == 1447", "udp_stream": 12 }, { "frame_number": 1504, "timestamp_epoch": "1722307164.012919000", "display_filter": "frame.number == 1504", "udp_stream": 12 }, { "frame_number": 1505, "timestamp_epoch": "1722307164.014160000", "display_filter": "frame.number == 1505", "udp_stream": 9 }, { "frame_number": 1512, "timestamp_epoch": "1722307164.090128000", "display_filter": "frame.number == 1512", "udp_stream": 9 }, { "frame_number": 1523, "timestamp_epoch": "1722307164.176615000", "display_filter": "frame.number == 1523", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6d726dae904755c5cc5204f5", "type": "domain", "value": "config.edge.skype.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307242.891752000", "last_seen_epoch": "1722307243.148706000", "evidence": [ { "frame_number": 9807, "timestamp_epoch": "1722307242.891752000", "display_filter": "frame.number == 9807", "udp_stream": 23 }, { "frame_number": 9808, "timestamp_epoch": "1722307242.952354000", "display_filter": "frame.number == 9808", "udp_stream": 23 }, { "frame_number": 9812, "timestamp_epoch": "1722307243.029638000", "display_filter": "frame.number == 9812", "tcp_stream": 113 }, { "frame_number": 9815, "timestamp_epoch": "1722307243.148706000", "display_filter": "frame.number == 9815", "tcp_stream": 113 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-92fb4daa98cb7a3e07e874b8", "type": "domain", "value": "default.exp-tas.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307167.566283000", "last_seen_epoch": "1722307167.802185000", "evidence": [ { "frame_number": 1664, "timestamp_epoch": "1722307167.566283000", "display_filter": "frame.number == 1664", "udp_stream": 18 }, { "frame_number": 1665, "timestamp_epoch": "1722307167.626543000", "display_filter": "frame.number == 1665", "udp_stream": 18 }, { "frame_number": 1671, "timestamp_epoch": "1722307167.718909000", "display_filter": "frame.number == 1671", "tcp_stream": 72 }, { "frame_number": 1676, "timestamp_epoch": "1722307167.802185000", "display_filter": "frame.number == 1676", "tcp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c31849019716036a4fafb73f", "type": "domain", "value": "desktop-skbr25f.wiresharkworkshop.online", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307133.973694000", "last_seen_epoch": "1722307133.974139000", "evidence": [ { "frame_number": 674, "timestamp_epoch": "1722307133.973694000", "display_filter": "frame.number == 674", "udp_stream": 12 }, { "frame_number": 675, "timestamp_epoch": "1722307133.974139000", "display_filter": "frame.number == 675", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fd8f75e923e41e581161e401", "type": "domain", "value": "dualstack.sonatype.map.fastly.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1722307196.966901000", "last_seen_epoch": "1722307196.966901000", "evidence": [ { "frame_number": 2509, "timestamp_epoch": "1722307196.966901000", "display_filter": "frame.number == 2509", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-60be94db18ebf8a020e3eb49", "type": "domain", "value": "ecn.dev.virtualearth.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307457.919944000", "last_seen_epoch": "1722307458.078921000", "evidence": [ { "frame_number": 11000, "timestamp_epoch": "1722307457.919944000", "display_filter": "frame.number == 11000", "udp_stream": 41 }, { "frame_number": 11001, "timestamp_epoch": "1722307457.920102000", "display_filter": "frame.number == 11001", "udp_stream": 42 }, { "frame_number": 11031, "timestamp_epoch": "1722307457.990190000", "display_filter": "frame.number == 11031", "udp_stream": 41 }, { "frame_number": 11039, "timestamp_epoch": "1722307458.040471000", "display_filter": "frame.number == 11039", "udp_stream": 42 }, { "frame_number": 11040, "timestamp_epoch": "1722307458.040574000", "display_filter": "frame.number == 11040", "udp_stream": 42 }, { "frame_number": 11053, "timestamp_epoch": "1722307458.078921000", "display_filter": "frame.number == 11053", "tcp_stream": 149 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cc1eb5786f7787abe9de9ea6", "type": "domain", "value": "ecs.office.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307332.626466000", "last_seen_epoch": "1722307332.716308000", "evidence": [ { "frame_number": 10131, "timestamp_epoch": "1722307332.626466000", "display_filter": "frame.number == 10131", "udp_stream": 25 }, { "frame_number": 10132, "timestamp_epoch": "1722307332.666055000", "display_filter": "frame.number == 10132", "udp_stream": 25 }, { "frame_number": 10141, "timestamp_epoch": "1722307332.716308000", "display_filter": "frame.number == 10141", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5b0c98966edefd17bd4e1829", "type": "domain", "value": "fd.api.iris.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307241.668370000", "last_seen_epoch": "1722307245.942176000", "evidence": [ { "frame_number": 9777, "timestamp_epoch": "1722307241.668370000", "display_filter": "frame.number == 9777", "udp_stream": 18 }, { "frame_number": 9803, "timestamp_epoch": "1722307242.654698000", "display_filter": "frame.number == 9803", "udp_stream": 18 }, { "frame_number": 9845, "timestamp_epoch": "1722307243.670450000", "display_filter": "frame.number == 9845", "udp_stream": 18 }, { "frame_number": 9850, "timestamp_epoch": "1722307245.670516000", "display_filter": "frame.number == 9850", "udp_stream": 18 }, { "frame_number": 9851, "timestamp_epoch": "1722307245.942176000", "display_filter": "frame.number == 9851", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-229d338bab1c687f59173bc3", "type": "domain", "value": "g.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307163.203736000", "last_seen_epoch": "1722307163.454624000", "evidence": [ { "frame_number": 1449, "timestamp_epoch": "1722307163.203736000", "display_filter": "frame.number == 1449", "udp_stream": 18 }, { "frame_number": 1453, "timestamp_epoch": "1722307163.374312000", "display_filter": "frame.number == 1453", "udp_stream": 18 }, { "frame_number": 1459, "timestamp_epoch": "1722307163.454624000", "display_filter": "frame.number == 1459", "tcp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-95a85a131273320c7993a62d", "type": "domain", "value": "github.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307192.925833000", "last_seen_epoch": "1722307193.167251000", "evidence": [ { "frame_number": 1826, "timestamp_epoch": "1722307192.925833000", "display_filter": "frame.number == 1826", "udp_stream": 18 }, { "frame_number": 1828, "timestamp_epoch": "1722307193.006441000", "display_filter": "frame.number == 1828", "udp_stream": 18 }, { "frame_number": 1832, "timestamp_epoch": "1722307193.167251000", "display_filter": "frame.number == 1832", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70259c673f8b00bb4d4fbbf3", "type": "domain", "value": "go.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307132.536031000", "last_seen_epoch": "1722307154.982972000", "evidence": [ { "frame_number": 626, "timestamp_epoch": "1722307132.536031000", "display_filter": "frame.number == 626", "udp_stream": 6 }, { "frame_number": 672, "timestamp_epoch": "1722307133.534420000", "display_filter": "frame.number == 672", "udp_stream": 6 }, { "frame_number": 680, "timestamp_epoch": "1722307134.550047000", "display_filter": "frame.number == 680", "udp_stream": 6 }, { "frame_number": 683, "timestamp_epoch": "1722307136.565828000", "display_filter": "frame.number == 683", "udp_stream": 6 }, { "frame_number": 684, "timestamp_epoch": "1722307136.806788000", "display_filter": "frame.number == 684", "udp_stream": 6 }, { "frame_number": 688, "timestamp_epoch": "1722307136.895006000", "display_filter": "frame.number == 688", "tcp_stream": 36 }, { "frame_number": 713, "timestamp_epoch": "1722307137.322327000", "display_filter": "frame.number == 713", "tcp_stream": 37 }, { "frame_number": 735, "timestamp_epoch": "1722307137.637692000", "display_filter": "frame.number == 735", "tcp_stream": 38 }, { "frame_number": 755, "timestamp_epoch": "1722307137.971044000", "display_filter": "frame.number == 755", "tcp_stream": 39 }, { "frame_number": 779, "timestamp_epoch": "1722307138.289242000", "display_filter": "frame.number == 779", "tcp_stream": 40 }, { "frame_number": 800, "timestamp_epoch": "1722307138.567199000", "display_filter": "frame.number == 800", "tcp_stream": 41 }, { "frame_number": 820, "timestamp_epoch": "1722307138.872773000", "display_filter": "frame.number == 820", "tcp_stream": 42 }, { "frame_number": 841, "timestamp_epoch": "1722307139.164367000", "display_filter": "frame.number == 841", "tcp_stream": 43 }, { "frame_number": 860, "timestamp_epoch": "1722307139.488742000", "display_filter": "frame.number == 860", "tcp_stream": 44 }, { "frame_number": 880, "timestamp_epoch": "1722307139.782918000", "display_filter": "frame.number == 880", "tcp_stream": 45 }, { "frame_number": 1171, "timestamp_epoch": "1722307154.982972000", "display_filter": "frame.number == 1171", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-853d81541f93e5b38b2e5a8f", "type": "domain", "value": "img-s-msn-com.akamaized.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307457.670395000", "last_seen_epoch": "1722307457.808155000", "evidence": [ { "frame_number": 10951, "timestamp_epoch": "1722307457.670395000", "display_filter": "frame.number == 10951", "udp_stream": 39 }, { "frame_number": 10952, "timestamp_epoch": "1722307457.670594000", "display_filter": "frame.number == 10952", "udp_stream": 40 }, { "frame_number": 10959, "timestamp_epoch": "1722307457.735336000", "display_filter": "frame.number == 10959", "udp_stream": 39 }, { "frame_number": 10972, "timestamp_epoch": "1722307457.790314000", "display_filter": "frame.number == 10972", "udp_stream": 40 }, { "frame_number": 10983, "timestamp_epoch": "1722307457.808155000", "display_filter": "frame.number == 10983", "tcp_stream": 148 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-38d46cd6d10dc68aeeed597c", "type": "domain", "value": "ip-api.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1722307206.835504000", "last_seen_epoch": "1722307206.967799000", "evidence": [ { "frame_number": 9106, "timestamp_epoch": "1722307206.835504000", "display_filter": "frame.number == 9106", "udp_stream": 18 }, { "frame_number": 9107, "timestamp_epoch": "1722307206.918207000", "display_filter": "frame.number == 9107", "udp_stream": 18 }, { "frame_number": 9111, "timestamp_epoch": "1722307206.967799000", "display_filter": "frame.number == 9111", "tcp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a083f74a027e431cb4aa4c89", "type": "domain", "value": "javadl-esd-secure.oracle.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307469.339949000", "last_seen_epoch": "1722307469.516311000", "evidence": [ { "frame_number": 11231, "timestamp_epoch": "1722307469.339949000", "display_filter": "frame.number == 11231", "udp_stream": 25 }, { "frame_number": 11232, "timestamp_epoch": "1722307469.430095000", "display_filter": "frame.number == 11232", "udp_stream": 25 }, { "frame_number": 11233, "timestamp_epoch": "1722307469.440539000", "display_filter": "frame.number == 11233", "udp_stream": 25 }, { "frame_number": 11237, "timestamp_epoch": "1722307469.516311000", "display_filter": "frame.number == 11237", "tcp_stream": 150 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3b15bf116ddbc54150fd4e2e", "type": "domain", "value": "login.microsoftonline.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307214.175250000", "last_seen_epoch": "1722307239.168935000", "evidence": [ { "frame_number": 9500, "timestamp_epoch": "1722307214.175250000", "display_filter": "frame.number == 9500", "udp_stream": 18 }, { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 }, { "frame_number": 9505, "timestamp_epoch": "1722307214.368230000", "display_filter": "frame.number == 9505", "tcp_stream": 100 }, { "frame_number": 9509, "timestamp_epoch": "1722307214.423985000", "display_filter": "frame.number == 9509", "tcp_stream": 100 }, { "frame_number": 9705, "timestamp_epoch": "1722307239.108378000", "display_filter": "frame.number == 9705", "tcp_stream": 108 }, { "frame_number": 9709, "timestamp_epoch": "1722307239.168935000", "display_filter": "frame.number == 9709", "tcp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d4b4f16e8906f70059823cc", "type": "domain", "value": "metadata.templates.cdn.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307345.533857000", "last_seen_epoch": "1722307345.609036000", "evidence": [ { "frame_number": 10419, "timestamp_epoch": "1722307345.533857000", "display_filter": "frame.number == 10419", "udp_stream": 25 }, { "frame_number": 10420, "timestamp_epoch": "1722307345.576677000", "display_filter": "frame.number == 10420", "udp_stream": 25 }, { "frame_number": 10424, "timestamp_epoch": "1722307345.609036000", "display_filter": "frame.number == 10424", "tcp_stream": 132 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dbb87b24fc2013215ed93e0d", "type": "domain", "value": "mobile.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307129.303735000", "last_seen_epoch": "1722307339.649879000", "evidence": [ { "frame_number": 235, "timestamp_epoch": "1722307129.303735000", "display_filter": "frame.number == 235", "udp_stream": 6 }, { "frame_number": 239, "timestamp_epoch": "1722307129.366654000", "display_filter": "frame.number == 239", "udp_stream": 6 }, { "frame_number": 10336, "timestamp_epoch": "1722307336.345956000", "display_filter": "frame.number == 10336", "udp_stream": 23 }, { "frame_number": 10337, "timestamp_epoch": "1722307337.344826000", "display_filter": "frame.number == 10337", "udp_stream": 23 }, { "frame_number": 10338, "timestamp_epoch": "1722307338.345061000", "display_filter": "frame.number == 10338", "udp_stream": 23 }, { "frame_number": 10345, "timestamp_epoch": "1722307339.486871000", "display_filter": "frame.number == 10345", "udp_stream": 23 }, { "frame_number": 289, "timestamp_epoch": "1722307129.471792000", "display_filter": "frame.number == 289", "tcp_stream": 17 }, { "frame_number": 346, "timestamp_epoch": "1722307129.564370000", "display_filter": "frame.number == 346", "tcp_stream": 17 }, { "frame_number": 10349, "timestamp_epoch": "1722307339.561440000", "display_filter": "frame.number == 10349", "tcp_stream": 131 }, { "frame_number": 10353, "timestamp_epoch": "1722307339.649879000", "display_filter": "frame.number == 10353", "tcp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5164e512436f26f6974d3651", "type": "domain", "value": "msedge.api.cdp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307241.806813000", "last_seen_epoch": "1722307242.116040000", "evidence": [ { "frame_number": 9778, "timestamp_epoch": "1722307241.806813000", "display_filter": "frame.number == 9778", "udp_stream": 23 }, { "frame_number": 9779, "timestamp_epoch": "1722307241.902092000", "display_filter": "frame.number == 9779", "udp_stream": 23 }, { "frame_number": 9783, "timestamp_epoch": "1722307242.116040000", "display_filter": "frame.number == 9783", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fb206d15ba13df3c0fe88029", "type": "domain", "value": "objects.githubusercontent.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307193.733807000", "last_seen_epoch": "1722307193.827800000", "evidence": [ { "frame_number": 1855, "timestamp_epoch": "1722307193.733807000", "display_filter": "frame.number == 1855", "udp_stream": 18 }, { "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "display_filter": "frame.number == 1856", "udp_stream": 18 }, { "frame_number": 1862, "timestamp_epoch": "1722307193.827800000", "display_filter": "frame.number == 1862", "tcp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b176ac41e44a5b7fc2438fad", "type": "domain", "value": "odc.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307158.359295000", "last_seen_epoch": "1722307332.751197000", "evidence": [ { "frame_number": 1402, "timestamp_epoch": "1722307158.359295000", "display_filter": "frame.number == 1402", "udp_stream": 19 }, { "frame_number": 1413, "timestamp_epoch": "1722307158.584984000", "display_filter": "frame.number == 1413", "udp_stream": 19 }, { "frame_number": 10130, "timestamp_epoch": "1722307332.608165000", "display_filter": "frame.number == 10130", "udp_stream": 23 }, { "frame_number": 10134, "timestamp_epoch": "1722307332.702022000", "display_filter": "frame.number == 10134", "udp_stream": 23 }, { "frame_number": 1418, "timestamp_epoch": "1722307158.692388000", "display_filter": "frame.number == 1418", "tcp_stream": 65 }, { "frame_number": 1455, "timestamp_epoch": "1722307163.381760000", "display_filter": "frame.number == 1455", "tcp_stream": 66 }, { "frame_number": 10145, "timestamp_epoch": "1722307332.742141000", "display_filter": "frame.number == 10145", "tcp_stream": 121 }, { "frame_number": 10153, "timestamp_epoch": "1722307332.749694000", "display_filter": "frame.number == 10153", "tcp_stream": 122 }, { "frame_number": 10155, "timestamp_epoch": "1722307332.749895000", "display_filter": "frame.number == 10155", "tcp_stream": 123 }, { "frame_number": 10157, "timestamp_epoch": "1722307332.751197000", "display_filter": "frame.number == 10157", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f03013b6f98ad9d46d32d108", "type": "domain", "value": "officeclient.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307157.557179000", "last_seen_epoch": "1722307332.233815000", "evidence": [ { "frame_number": 1239, "timestamp_epoch": "1722307157.557179000", "display_filter": "frame.number == 1239", "udp_stream": 18 }, { "frame_number": 1252, "timestamp_epoch": "1722307157.665911000", "display_filter": "frame.number == 1252", "udp_stream": 18 }, { "frame_number": 10061, "timestamp_epoch": "1722307331.945351000", "display_filter": "frame.number == 10061", "udp_stream": 23 }, { "frame_number": 10080, "timestamp_epoch": "1722307332.135015000", "display_filter": "frame.number == 10080", "udp_stream": 23 }, { "frame_number": 1298, "timestamp_epoch": "1722307157.881820000", "display_filter": "frame.number == 1298", "tcp_stream": 63 }, { "frame_number": 10088, "timestamp_epoch": "1722307332.233815000", "display_filter": "frame.number == 10088", "tcp_stream": 118 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ccc92df9153e2fc90aa4fe1c", "type": "domain", "value": "oneclient.sfx.ms", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307163.708422000", "last_seen_epoch": "1722307163.838556000", "evidence": [ { "frame_number": 1493, "timestamp_epoch": "1722307163.708422000", "display_filter": "frame.number == 1493", "udp_stream": 19 }, { "frame_number": 1494, "timestamp_epoch": "1722307163.752638000", "display_filter": "frame.number == 1494", "udp_stream": 19 }, { "frame_number": 1498, "timestamp_epoch": "1722307163.838556000", "display_filter": "frame.number == 1498", "tcp_stream": 68 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6f4b21363ed0b0e16d1cdc3c", "type": "domain", "value": "pti.store.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307639.923844000", "last_seen_epoch": "1722307640.021468000", "evidence": [ { "frame_number": 11474, "timestamp_epoch": "1722307639.923844000", "display_filter": "frame.number == 11474", "udp_stream": 43 }, { "frame_number": 11475, "timestamp_epoch": "1722307640.011440000", "display_filter": "frame.number == 11475", "udp_stream": 43 }, { "frame_number": 11476, "timestamp_epoch": "1722307640.021468000", "display_filter": "frame.number == 11476", "udp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c4c77b90c4478621dd3d16da", "type": "domain", "value": "repo1.maven.org", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307192.925870000", "last_seen_epoch": "1722307197.029904000", "evidence": [ { "frame_number": 1827, "timestamp_epoch": "1722307192.925870000", "display_filter": "frame.number == 1827", "udp_stream": 19 }, { "frame_number": 1874, "timestamp_epoch": "1722307193.919107000", "display_filter": "frame.number == 1874", "udp_stream": 19 }, { "frame_number": 2507, "timestamp_epoch": "1722307194.919271000", "display_filter": "frame.number == 2507", "udp_stream": 19 }, { "frame_number": 2508, "timestamp_epoch": "1722307196.934703000", "display_filter": "frame.number == 2508", "udp_stream": 19 }, { "frame_number": 2509, "timestamp_epoch": "1722307196.966901000", "display_filter": "frame.number == 2509", "udp_stream": 19 }, { "frame_number": 2515, "timestamp_epoch": "1722307197.007768000", "display_filter": "frame.number == 2515", "tcp_stream": 80 }, { "frame_number": 2521, "timestamp_epoch": "1722307197.029422000", "display_filter": "frame.number == 2521", "tcp_stream": 81 }, { "frame_number": 2523, "timestamp_epoch": "1722307197.029904000", "display_filter": "frame.number == 2523", "tcp_stream": 82 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7fe8ab0f262714edf78d0d75", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307211.777007000", "last_seen_epoch": "1722307211.928371000", "evidence": [ { "frame_number": 9162, "timestamp_epoch": "1722307211.777007000", "display_filter": "frame.number == 9162", "udp_stream": 18 }, { "frame_number": 9163, "timestamp_epoch": "1722307211.846403000", "display_filter": "frame.number == 9163", "udp_stream": 18 }, { "frame_number": 9167, "timestamp_epoch": "1722307211.928371000", "display_filter": "frame.number == 9167", "tcp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b20c373f3fe910213f028b66", "type": "domain", "value": "srtb.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307457.468275000", "last_seen_epoch": "1722307457.736031000", "evidence": [ { "frame_number": 10909, "timestamp_epoch": "1722307457.468275000", "display_filter": "frame.number == 10909", "udp_stream": 35 }, { "frame_number": 10910, "timestamp_epoch": "1722307457.468577000", "display_filter": "frame.number == 10910", "udp_stream": 36 }, { "frame_number": 10911, "timestamp_epoch": "1722307457.468893000", "display_filter": "frame.number == 10911", "udp_stream": 35 }, { "frame_number": 10912, "timestamp_epoch": "1722307457.468950000", "display_filter": "frame.number == 10912", "udp_stream": 36 }, { "frame_number": 10940, "timestamp_epoch": "1722307457.583327000", "display_filter": "frame.number == 10940", "tcp_stream": 146 }, { "frame_number": 10960, "timestamp_epoch": "1722307457.736031000", "display_filter": "frame.number == 10960", "tcp_stream": 146 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-96c9df7dc08ee6467c898c6d", "type": "domain", "value": "th.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307212.083935000", "last_seen_epoch": "1722307457.808523000", "evidence": [ { "frame_number": 9177, "timestamp_epoch": "1722307212.083935000", "display_filter": "frame.number == 9177", "udp_stream": 18 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10949, "timestamp_epoch": "1722307457.594570000", "display_filter": "frame.number == 10949", "udp_stream": 37 }, { "frame_number": 10950, "timestamp_epoch": "1722307457.594916000", "display_filter": "frame.number == 10950", "udp_stream": 38 }, { "frame_number": 10957, "timestamp_epoch": "1722307457.735180000", "display_filter": "frame.number == 10957", "udp_stream": 38 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 }, { "frame_number": 9215, "timestamp_epoch": "1722307212.390017000", "display_filter": "frame.number == 9215", "tcp_stream": 90 }, { "frame_number": 9217, "timestamp_epoch": "1722307212.392387000", "display_filter": "frame.number == 9217", "tcp_stream": 89 }, { "frame_number": 9219, "timestamp_epoch": "1722307212.399010000", "display_filter": "frame.number == 9219", "tcp_stream": 88 }, { "frame_number": 9221, "timestamp_epoch": "1722307212.404298000", "display_filter": "frame.number == 9221", "tcp_stream": 91 }, { "frame_number": 9223, "timestamp_epoch": "1722307212.407017000", "display_filter": "frame.number == 9223", "tcp_stream": 87 }, { "frame_number": 9225, "timestamp_epoch": "1722307212.407887000", "display_filter": "frame.number == 9225", "tcp_stream": 86 }, { "frame_number": 10987, "timestamp_epoch": "1722307457.808523000", "display_filter": "frame.number == 10987", "tcp_stream": 147 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-85d355d5e59b6cda265d6c33", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307355.953859000", "last_seen_epoch": "1722307356.089186000", "evidence": [ { "frame_number": 10448, "timestamp_epoch": "1722307355.953859000", "display_filter": "frame.number == 10448", "udp_stream": 25 }, { "frame_number": 10449, "timestamp_epoch": "1722307356.012716000", "display_filter": "frame.number == 10449", "udp_stream": 25 }, { "frame_number": 10453, "timestamp_epoch": "1722307356.089186000", "display_filter": "frame.number == 10453", "tcp_stream": 133 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-77699bfb8992a9ac6571584e", "type": "domain", "value": "v20.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307154.533981000", "last_seen_epoch": "1722307154.791591000", "evidence": [ { "frame_number": 1157, "timestamp_epoch": "1722307154.533981000", "display_filter": "frame.number == 1157", "udp_stream": 12 }, { "frame_number": 1158, "timestamp_epoch": "1722307154.585802000", "display_filter": "frame.number == 1158", "udp_stream": 12 }, { "frame_number": 1162, "timestamp_epoch": "1722307154.791591000", "display_filter": "frame.number == 1162", "tcp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-40383fe3905a6ea736d33375", "type": "domain", "value": "windows.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307455.631145000", "last_seen_epoch": "1722307455.932498000", "evidence": [ { "frame_number": 10768, "timestamp_epoch": "1722307455.631145000", "display_filter": "frame.number == 10768", "udp_stream": 27 }, { "frame_number": 10769, "timestamp_epoch": "1722307455.631368000", "display_filter": "frame.number == 10769", "udp_stream": 28 }, { "frame_number": 10770, "timestamp_epoch": "1722307455.696863000", "display_filter": "frame.number == 10770", "udp_stream": 27 }, { "frame_number": 10773, "timestamp_epoch": "1722307455.720760000", "display_filter": "frame.number == 10773", "udp_stream": 28 }, { "frame_number": 10774, "timestamp_epoch": "1722307455.720959000", "display_filter": "frame.number == 10774", "udp_stream": 28 }, { "frame_number": 10780, "timestamp_epoch": "1722307455.810965000", "display_filter": "frame.number == 10780", "tcp_stream": 138 }, { "frame_number": 10784, "timestamp_epoch": "1722307455.811374000", "display_filter": "frame.number == 10784", "tcp_stream": 139 }, { "frame_number": 10789, "timestamp_epoch": "1722307455.931381000", "display_filter": "frame.number == 10789", "tcp_stream": 139 }, { "frame_number": 10791, "timestamp_epoch": "1722307455.932498000", "display_filter": "frame.number == 10791", "tcp_stream": 138 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-701955e655fb97bea5a52bb2", "type": "domain", "value": "wireshark-ws-dc.wiresharkworkshop.online", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307128.983844000", "last_seen_epoch": "1722307129.254902000", "evidence": [ { "frame_number": 14, "timestamp_epoch": "1722307128.983844000", "display_filter": "frame.number == 14", "udp_stream": 1 }, { "frame_number": 15, "timestamp_epoch": "1722307128.984075000", "display_filter": "frame.number == 15", "udp_stream": 1 }, { "frame_number": 201, "timestamp_epoch": "1722307129.254606000", "display_filter": "frame.number == 201", "udp_stream": 6 }, { "frame_number": 202, "timestamp_epoch": "1722307129.254902000", "display_filter": "frame.number == 202", "udp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a1fe40b04c692b6eaf9eb6d5", "type": "domain", "value": "wiresharkworkshop.online", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307129.415741000", "last_seen_epoch": "1722307133.976648000", "evidence": [ { "frame_number": 254, "timestamp_epoch": "1722307129.415741000", "display_filter": "frame.number == 254", "udp_stream": 6 }, { "frame_number": 255, "timestamp_epoch": "1722307129.415994000", "display_filter": "frame.number == 255", "udp_stream": 6 }, { "frame_number": 676, "timestamp_epoch": "1722307133.975534000", "display_filter": "frame.number == 676", "udp_stream": 12 }, { "frame_number": 677, "timestamp_epoch": "1722307133.976648000", "display_filter": "frame.number == 677", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7ad94a76ec906a30016043de", "type": "domain", "value": "wns.notify.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1722307164.012919000", "last_seen_epoch": "1722307164.090128000", "evidence": [ { "frame_number": 1504, "timestamp_epoch": "1722307164.012919000", "display_filter": "frame.number == 1504", "udp_stream": 12 }, { "frame_number": 1512, "timestamp_epoch": "1722307164.090128000", "display_filter": "frame.number == 1512", "udp_stream": 9 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9cad6e5eb191ad164fd18a65", "type": "domain", "value": "wpad.wiresharkworkshop.online", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1722307129.530130000", "last_seen_epoch": "1722307463.636587000", "evidence": [ { "frame_number": 293, "timestamp_epoch": "1722307129.530130000", "display_filter": "frame.number == 293", "udp_stream": 10 }, { "frame_number": 294, "timestamp_epoch": "1722307129.530426000", "display_filter": "frame.number == 294", "udp_stream": 10 }, { "frame_number": 532, "timestamp_epoch": "1722307129.987384000", "display_filter": "frame.number == 532", "udp_stream": 11 }, { "frame_number": 533, "timestamp_epoch": "1722307129.987691000", "display_filter": "frame.number == 533", "udp_stream": 11 }, { "frame_number": 906, "timestamp_epoch": "1722307147.508287000", "display_filter": "frame.number == 906", "udp_stream": 10 }, { "frame_number": 907, "timestamp_epoch": "1722307147.508334000", "display_filter": "frame.number == 907", "udp_stream": 12 }, { "frame_number": 908, "timestamp_epoch": "1722307147.508687000", "display_filter": "frame.number == 908", "udp_stream": 10 }, { "frame_number": 909, "timestamp_epoch": "1722307147.508788000", "display_filter": "frame.number == 909", "udp_stream": 12 }, { "frame_number": 9121, "timestamp_epoch": "1722307207.516329000", "display_filter": "frame.number == 9121", "udp_stream": 18 }, { "frame_number": 9122, "timestamp_epoch": "1722307207.516607000", "display_filter": "frame.number == 9122", "udp_stream": 10 }, { "frame_number": 9123, "timestamp_epoch": "1722307207.516647000", "display_filter": "frame.number == 9123", "udp_stream": 18 }, { "frame_number": 9124, "timestamp_epoch": "1722307207.516870000", "display_filter": "frame.number == 9124", "udp_stream": 10 }, { "frame_number": 10766, "timestamp_epoch": "1722307455.627407000", "display_filter": "frame.number == 10766", "udp_stream": 25 }, { "frame_number": 10767, "timestamp_epoch": "1722307455.627886000", "display_filter": "frame.number == 10767", "udp_stream": 25 }, { "frame_number": 11215, "timestamp_epoch": "1722307463.636199000", "display_filter": "frame.number == 11215", "udp_stream": 25 }, { "frame_number": 11216, "timestamp_epoch": "1722307463.636587000", "display_filter": "frame.number == 11216", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7afdd159c4707a285b76bcd5", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307153.826352000", "last_seen_epoch": "1722307157.554762000", "evidence": [ { "frame_number": 1125, "timestamp_epoch": "1722307153.826352000", "display_filter": "frame.number == 1125", "udp_stream": 12 }, { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 1131, "timestamp_epoch": "1722307153.954150000", "display_filter": "frame.number == 1131", "tcp_stream": 58 }, { "frame_number": 1237, "timestamp_epoch": "1722307157.554762000", "display_filter": "frame.number == 1237", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-82612392c2ddcf673905a143", "type": "domain", "value": "www.msftconnecttest.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1722307129.530082000", "last_seen_epoch": "1722307129.634707000", "evidence": [ { "frame_number": 292, "timestamp_epoch": "1722307129.530082000", "display_filter": "frame.number == 292", "udp_stream": 9 }, { "frame_number": 433, "timestamp_epoch": "1722307129.585895000", "display_filter": "frame.number == 433", "udp_stream": 9 }, { "frame_number": 466, "timestamp_epoch": "1722307129.634707000", "display_filter": "frame.number == 466", "tcp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c842f60269179e1e17d9044f", "type": "domain", "value": "www.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1722307157.666117000", "last_seen_epoch": "1722307456.689392000", "evidence": [ { "frame_number": 1253, "timestamp_epoch": "1722307157.666117000", "display_filter": "frame.number == 1253", "udp_stream": 19 }, { "frame_number": 1254, "timestamp_epoch": "1722307157.666329000", "display_filter": "frame.number == 1254", "udp_stream": 19 }, { "frame_number": 10813, "timestamp_epoch": "1722307456.394861000", "display_filter": "frame.number == 10813", "udp_stream": 29 }, { "frame_number": 10814, "timestamp_epoch": "1722307456.394983000", "display_filter": "frame.number == 10814", "udp_stream": 30 }, { "frame_number": 10815, "timestamp_epoch": "1722307456.395379000", "display_filter": "frame.number == 10815", "udp_stream": 30 }, { "frame_number": 10816, "timestamp_epoch": "1722307456.395453000", "display_filter": "frame.number == 10816", "udp_stream": 29 }, { "frame_number": 1308, "timestamp_epoch": "1722307157.885510000", "display_filter": "frame.number == 1308", "tcp_stream": 64 }, { "frame_number": 1354, "timestamp_epoch": "1722307158.105130000", "display_filter": "frame.number == 1354", "tcp_stream": 64 }, { "frame_number": 10821, "timestamp_epoch": "1722307456.471325000", "display_filter": "frame.number == 10821", "tcp_stream": 140 }, { "frame_number": 10848, "timestamp_epoch": "1722307456.689392000", "display_filter": "frame.number == 10848", "tcp_stream": 140 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6a8900ea94407dc717fef8c2", "type": "ipv4", "value": "13.107.42.16", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307242.952354000", "last_seen_epoch": "1722307242.952354000", "evidence": [ { "frame_number": 9808, "timestamp_epoch": "1722307242.952354000", "display_filter": "frame.number == 9808", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e16f91d31d1539e04d48c77f", "type": "ipv4", "value": "13.107.5.93", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307167.626543000", "last_seen_epoch": "1722307167.626543000", "evidence": [ { "frame_number": 1665, "timestamp_epoch": "1722307167.626543000", "display_filter": "frame.number == 1665", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a5f603cc0137936899385735", "type": "ipv4", "value": "13.69.239.79", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307154.585802000", "last_seen_epoch": "1722307154.585802000", "evidence": [ { "frame_number": 1158, "timestamp_epoch": "1722307154.585802000", "display_filter": "frame.number == 1158", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b9f6aac91db5ffcea7623dab", "type": "ipv4", "value": "140.82.113.3", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307193.006441000", "last_seen_epoch": "1722307193.006441000", "evidence": [ { "frame_number": 1828, "timestamp_epoch": "1722307193.006441000", "display_filter": "frame.number == 1828", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9d8153fd936cff4e7b0c741f", "type": "ipv4", "value": "141.98.10.79", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c75852e14f795d2afc04debb", "type": "ipv4", "value": "172.16.1.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0704ba442fa69e1ac7a7ff5d", "type": "ipv4", "value": "172.16.1.4", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1722307128.981686000", "last_seen_epoch": "1722307333.584974000", "evidence": [ { "frame_number": 13, "timestamp_epoch": "1722307128.981686000", "display_filter": "frame.number == 13", "udp_stream": 1 }, { "frame_number": 15, "timestamp_epoch": "1722307128.984075000", "display_filter": "frame.number == 15", "udp_stream": 1 }, { "frame_number": 33, "timestamp_epoch": "1722307129.100520000", "display_filter": "frame.number == 33", "udp_stream": 5 }, { "frame_number": 202, "timestamp_epoch": "1722307129.254902000", "display_filter": "frame.number == 202", "udp_stream": 6 }, { "frame_number": 231, "timestamp_epoch": "1722307129.280355000", "display_filter": "frame.number == 231", "udp_stream": 6 }, { "frame_number": 255, "timestamp_epoch": "1722307129.415994000", "display_filter": "frame.number == 255", "udp_stream": 6 }, { "frame_number": 282, "timestamp_epoch": "1722307129.438970000", "display_filter": "frame.number == 282", "udp_stream": 6 }, { "frame_number": 629, "timestamp_epoch": "1722307133.083161000", "display_filter": "frame.number == 629", "udp_stream": 12 }, { "frame_number": 675, "timestamp_epoch": "1722307133.974139000", "display_filter": "frame.number == 675", "udp_stream": 12 }, { "frame_number": 9355, "timestamp_epoch": "1722307213.794274000", "display_filter": "frame.number == 9355", "udp_stream": 18 }, { "frame_number": 10297, "timestamp_epoch": "1722307333.584974000", "display_filter": "frame.number == 10297", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-653a78181331384f4c67ac25", "type": "ipv4", "value": "172.16.1.66", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1722307133.975534000", "last_seen_epoch": "1722307133.976648000", "evidence": [ { "frame_number": 676, "timestamp_epoch": "1722307133.975534000", "display_filter": "frame.number == 676", "udp_stream": 12 }, { "frame_number": 677, "timestamp_epoch": "1722307133.976648000", "display_filter": "frame.number == 677", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-708e8766deeed6437dd5e7b9", "type": "ipv4", "value": "185.199.108.133", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307193.786652000", "last_seen_epoch": "1722307193.786652000", "evidence": [ { "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "display_filter": "frame.number == 1856", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-114fd08674238817ef338a6e", "type": "ipv4", "value": "185.199.109.133", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307193.786652000", "last_seen_epoch": "1722307193.786652000", "evidence": [ { "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "display_filter": "frame.number == 1856", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2fefa299fd4ce95ff219686", "type": "ipv4", "value": "185.199.110.133", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307193.786652000", "last_seen_epoch": "1722307193.786652000", "evidence": [ { "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "display_filter": "frame.number == 1856", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-949fcc2ae7a8b25813dba018", "type": "ipv4", "value": "185.199.111.133", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307193.786652000", "last_seen_epoch": "1722307193.786652000", "evidence": [ { "frame_number": 1856, "timestamp_epoch": "1722307193.786652000", "display_filter": "frame.number == 1856", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1bf31487fb03509cc714ebab", "type": "ipv4", "value": "199.232.192.209", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307196.966901000", "last_seen_epoch": "1722307196.966901000", "evidence": [ { "frame_number": 2509, "timestamp_epoch": "1722307196.966901000", "display_filter": "frame.number == 2509", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e0795b276068b8419ab390ee", "type": "ipv4", "value": "199.232.196.209", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307196.966901000", "last_seen_epoch": "1722307196.966901000", "evidence": [ { "frame_number": 2509, "timestamp_epoch": "1722307196.966901000", "display_filter": "frame.number == 2509", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9804037c5d6a1ead4a6afd45", "type": "ipv4", "value": "20.166.2.191", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307241.902092000", "last_seen_epoch": "1722307241.902092000", "evidence": [ { "frame_number": 9779, "timestamp_epoch": "1722307241.902092000", "display_filter": "frame.number == 9779", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d83c37d756d96b340794bd50", "type": "ipv4", "value": "20.189.173.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307339.486871000", "last_seen_epoch": "1722307339.486871000", "evidence": [ { "frame_number": 10345, "timestamp_epoch": "1722307339.486871000", "display_filter": "frame.number == 10345", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6c44e5c53e2d48f700dac0e6", "type": "ipv4", "value": "20.189.173.16", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307129.366654000", "last_seen_epoch": "1722307129.366654000", "evidence": [ { "frame_number": 239, "timestamp_epoch": "1722307129.366654000", "display_filter": "frame.number == 239", "udp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a62d47232fd9d59521dd2190", "type": "ipv4", "value": "20.189.173.26", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307356.012716000", "last_seen_epoch": "1722307356.012716000", "evidence": [ { "frame_number": 10449, "timestamp_epoch": "1722307356.012716000", "display_filter": "frame.number == 10449", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-16f9fea4cd7b4986c732af3c", "type": "ipv4", "value": "20.190.157.11", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-05d108e38fa42c48294788f0", "type": "ipv4", "value": "20.190.157.9", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-183e0815db0dba818b84a32d", "type": "ipv4", "value": "20.241.44.114", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307163.374312000", "last_seen_epoch": "1722307163.374312000", "evidence": [ { "frame_number": 1453, "timestamp_epoch": "1722307163.374312000", "display_filter": "frame.number == 1453", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-02be98037971b1fac2346219", "type": "ipv4", "value": "20.7.1.246", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-c1682d6ea60e6ef00fcdabbc", "type": "ipv4", "value": "20.7.2.167", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307164.090128000", "last_seen_epoch": "1722307164.090128000", "evidence": [ { "frame_number": 1512, "timestamp_epoch": "1722307164.090128000", "display_filter": "frame.number == 1512", "udp_stream": 9 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-655b67add0450979c9043367", "type": "ipv4", "value": "20.96.153.111", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307155.052038000", "last_seen_epoch": "1722307155.052038000", "evidence": [ { "frame_number": 1176, "timestamp_epoch": "1722307155.052038000", "display_filter": "frame.number == 1176", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cfdb43044e67738616460c7b", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307157.666329000", "last_seen_epoch": "1722307457.468893000", "evidence": [ { "frame_number": 1254, "timestamp_epoch": "1722307157.666329000", "display_filter": "frame.number == 1254", "udp_stream": 19 }, { "frame_number": 10770, "timestamp_epoch": "1722307455.696863000", "display_filter": "frame.number == 10770", "udp_stream": 27 }, { "frame_number": 10816, "timestamp_epoch": "1722307456.395453000", "display_filter": "frame.number == 10816", "udp_stream": 29 }, { "frame_number": 10887, "timestamp_epoch": "1722307457.151610000", "display_filter": "frame.number == 10887", "udp_stream": 31 }, { "frame_number": 10911, "timestamp_epoch": "1722307457.468893000", "display_filter": "frame.number == 10911", "udp_stream": 35 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ca7e0fe4850a226f8d2a032d", "type": "ipv4", "value": "208.95.112.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307206.918207000", "last_seen_epoch": "1722307206.918207000", "evidence": [ { "frame_number": 9107, "timestamp_epoch": "1722307206.918207000", "display_filter": "frame.number == 9107", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c19cd1f6b201608b42397a83", "type": "ipv4", "value": "224.0.0.22", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-592c61c37c0c72cb07b920b5", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a2bd0ee731ef04d111f56a92", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4bfe45850df8c75d366894b3", "type": "ipv4", "value": "23.194.164.136", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307469.440539000", "last_seen_epoch": "1722307469.440539000", "evidence": [ { "frame_number": 11233, "timestamp_epoch": "1722307469.440539000", "display_filter": "frame.number == 11233", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-32c4b7be3f9b3b3d1b0990ae", "type": "ipv4", "value": "23.198.7.167", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-24397f9c65c092dcffb99ca7", "type": "ipv4", "value": "23.198.7.168", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7218b0f3d68e797f925a36ff", "type": "ipv4", "value": "23.198.7.169", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-09227903876fd5bcdfd73231", "type": "ipv4", "value": "23.198.7.170", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307212.141093000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c7e195eb2b149a94db1fbdc6", "type": "ipv4", "value": "23.198.7.172", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-522d7546c15484449e18ec2b", "type": "ipv4", "value": "23.198.7.173", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307153.900784000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e811d5a5fc005f3ca7274e2b", "type": "ipv4", "value": "23.198.7.174", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e19db1ca65de08841619496e", "type": "ipv4", "value": "23.198.7.175", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 }, { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cfb5caa4594cb88b62e51850", "type": "ipv4", "value": "23.198.7.176", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307212.141093000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-325522d273025b43a9aa4b2c", "type": "ipv4", "value": "23.198.7.177", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307153.900784000", "last_seen_epoch": "1722307212.141093000", "evidence": [ { "frame_number": 1127, "timestamp_epoch": "1722307153.900784000", "display_filter": "frame.number == 1127", "udp_stream": 12 }, { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8906bd0f443a63907728d124", "type": "ipv4", "value": "23.198.7.182", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.735297000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-132af0acf0b20f5a728e7a7d", "type": "ipv4", "value": "23.198.7.183", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.735297000", "last_seen_epoch": "1722307457.735297000", "evidence": [ { "frame_number": 10958, "timestamp_epoch": "1722307457.735297000", "display_filter": "frame.number == 10958", "udp_stream": 37 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e698445a8821ff8869776bc4", "type": "ipv4", "value": "23.198.7.186", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307212.141093000", "last_seen_epoch": "1722307212.141093000", "evidence": [ { "frame_number": 9189, "timestamp_epoch": "1722307212.141093000", "display_filter": "frame.number == 9189", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-df4ee23b81d4c8c7d8a301d0", "type": "ipv4", "value": "23.215.55.133", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307457.735336000", "last_seen_epoch": "1722307457.735336000", "evidence": [ { "frame_number": 10959, "timestamp_epoch": "1722307457.735336000", "display_filter": "frame.number == 10959", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3c6a71e51fbf736c520a8fbe", "type": "ipv4", "value": "23.215.55.137", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.735336000", "last_seen_epoch": "1722307457.735336000", "evidence": [ { "frame_number": 10959, "timestamp_epoch": "1722307457.735336000", "display_filter": "frame.number == 10959", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ec6ea0d001fdd5bfac03cb9b", "type": "ipv4", "value": "23.215.55.140", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307129.585895000", "last_seen_epoch": "1722307129.585895000", "evidence": [ { "frame_number": 433, "timestamp_epoch": "1722307129.585895000", "display_filter": "frame.number == 433", "udp_stream": 9 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8b77b7d1157ae0b2a6fab765", "type": "ipv4", "value": "23.215.55.144", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307129.585895000", "last_seen_epoch": "1722307129.585895000", "evidence": [ { "frame_number": 433, "timestamp_epoch": "1722307129.585895000", "display_filter": "frame.number == 433", "udp_stream": 9 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bdae8ae618b19c46cf6c831f", "type": "ipv4", "value": "23.221.22.68", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307345.576677000", "last_seen_epoch": "1722307345.576677000", "evidence": [ { "frame_number": 10420, "timestamp_epoch": "1722307345.576677000", "display_filter": "frame.number == 10420", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-12750b5ccf2ccc506f9445f3", "type": "ipv4", "value": "23.221.22.87", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307345.576677000", "last_seen_epoch": "1722307345.576677000", "evidence": [ { "frame_number": 10420, "timestamp_epoch": "1722307345.576677000", "display_filter": "frame.number == 10420", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b73ea057560a7c0b60d8d36", "type": "ipv4", "value": "23.46.192.165", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307457.990190000", "last_seen_epoch": "1722307457.990190000", "evidence": [ { "frame_number": 11031, "timestamp_epoch": "1722307457.990190000", "display_filter": "frame.number == 11031", "udp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-28c3888c184b59f9a43bbdb7", "type": "ipv4", "value": "23.48.203.199", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-616d99693a2bde8b1d633acd", "type": "ipv4", "value": "23.48.203.200", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a84ce7a009394fa495eb548", "type": "ipv4", "value": "23.48.203.201", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d1ee1eea1137013fe3851559", "type": "ipv4", "value": "23.48.203.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307225.687203000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 }, { "frame_number": 9540, "timestamp_epoch": "1722307225.687203000", "display_filter": "frame.number == 9540", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-567c110cf54461487876aa91", "type": "ipv4", "value": "23.48.203.204", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9123bb71a0b10afd087be1f9", "type": "ipv4", "value": "23.48.203.205", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307225.687203000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 }, { "frame_number": 9540, "timestamp_epoch": "1722307225.687203000", "display_filter": "frame.number == 9540", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2166b4ce12e88fbac25ee04", "type": "ipv4", "value": "23.48.203.206", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d9a4fdf136e670938bd2ecd4", "type": "ipv4", "value": "23.48.203.207", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-47104f00a09abf3c48687623", "type": "ipv4", "value": "23.48.203.208", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307164.121276000", "last_seen_epoch": "1722307164.121276000", "evidence": [ { "frame_number": 1514, "timestamp_epoch": "1722307164.121276000", "display_filter": "frame.number == 1514", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cf1845e0d78ddca53a194033", "type": "ipv4", "value": "23.48.203.210", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307225.687203000", "last_seen_epoch": "1722307225.687203000", "evidence": [ { "frame_number": 9540, "timestamp_epoch": "1722307225.687203000", "display_filter": "frame.number == 9540", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-537583df78108d4257f578d6", "type": "ipv4", "value": "23.52.9.140", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307163.752638000", "last_seen_epoch": "1722307163.752638000", "evidence": [ { "frame_number": 1494, "timestamp_epoch": "1722307163.752638000", "display_filter": "frame.number == 1494", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-223a1a953e949fc04414378a", "type": "ipv4", "value": "23.52.9.222", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307136.806788000", "last_seen_epoch": "1722307136.806788000", "evidence": [ { "frame_number": 684, "timestamp_epoch": "1722307136.806788000", "display_filter": "frame.number == 684", "udp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3d1f7df845d3cfaacae40e2", "type": "ipv4", "value": "23.53.11.164", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e9a6de1ff06316d42db38fe9", "type": "ipv4", "value": "23.53.11.165", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3b711472e39b8fa22937ea47", "type": "ipv4", "value": "23.53.11.166", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-da7f8e14b5bcad728ba38c10", "type": "ipv4", "value": "23.53.11.174", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3127d81beec37dfdac76546b", "type": "ipv4", "value": "23.53.11.175", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-704653f6089b19f42ccf4068", "type": "ipv4", "value": "23.53.11.176", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c51d438d85caff49cf43363f", "type": "ipv4", "value": "23.53.11.177", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-37184680d8ba6428ccb2c8b5", "type": "ipv4", "value": "23.53.11.178", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-18729fbaf3919cf7826acebe", "type": "ipv4", "value": "23.53.11.179", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307457.151764000", "last_seen_epoch": "1722307457.151764000", "evidence": [ { "frame_number": 10888, "timestamp_epoch": "1722307457.151764000", "display_filter": "frame.number == 10888", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f3de90b116f88a5beef5f86d", "type": "ipv4", "value": "23.96.180.189", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307245.942176000", "last_seen_epoch": "1722307245.942176000", "evidence": [ { "frame_number": 9851, "timestamp_epoch": "1722307245.942176000", "display_filter": "frame.number == 9851", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a5093ede2baf575999c53c57", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307233.647114000", "last_seen_epoch": "1722307239.669881000", "evidence": [ { "frame_number": 9596, "timestamp_epoch": "1722307233.647114000", "display_filter": "frame.number == 9596" }, { "frame_number": 9597, "timestamp_epoch": "1722307233.650010000", "display_filter": "frame.number == 9597" }, { "frame_number": 9602, "timestamp_epoch": "1722307233.857221000", "display_filter": "frame.number == 9602" }, { "frame_number": 9603, "timestamp_epoch": "1722307236.654257000", "display_filter": "frame.number == 9603" }, { "frame_number": 9604, "timestamp_epoch": "1722307236.654496000", "display_filter": "frame.number == 9604" }, { "frame_number": 9605, "timestamp_epoch": "1722307236.857524000", "display_filter": "frame.number == 9605" }, { "frame_number": 9723, "timestamp_epoch": "1722307239.669683000", "display_filter": "frame.number == 9723" }, { "frame_number": 9724, "timestamp_epoch": "1722307239.669881000", "display_filter": "frame.number == 9724" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3ad19b09bc182b18f22abc80", "type": "ipv4", "value": "40.126.29.11", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab5e115c9b31e1525b730671", "type": "ipv4", "value": "40.126.29.13", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b7de1576bf0cad1c8f7ec408", "type": "ipv4", "value": "40.126.29.14", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fc57751066fe284a56c80486", "type": "ipv4", "value": "40.126.29.5", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6cec44ae61945aa7bf5542b9", "type": "ipv4", "value": "40.126.29.7", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-26ed293995d3512ae1b8d33e", "type": "ipv4", "value": "40.126.29.8", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307214.266215000", "last_seen_epoch": "1722307214.266215000", "evidence": [ { "frame_number": 9501, "timestamp_epoch": "1722307214.266215000", "display_filter": "frame.number == 9501", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2b8d94696a9e8fdc8e8e719", "type": "ipv4", "value": "40.97.199.114", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307333.286989000", "last_seen_epoch": "1722307333.286989000", "evidence": [ { "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "display_filter": "frame.number == 10278", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e0929cbc4b6e26c519bc74e8", "type": "ipv4", "value": "40.99.169.130", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307333.286989000", "last_seen_epoch": "1722307333.286989000", "evidence": [ { "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "display_filter": "frame.number == 10278", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dadd6e7fae1d4b8ae1a49498", "type": "ipv4", "value": "52.109.0.142", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307158.584984000", "last_seen_epoch": "1722307158.584984000", "evidence": [ { "frame_number": 1413, "timestamp_epoch": "1722307158.584984000", "display_filter": "frame.number == 1413", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1a0182844607495b622b91c7", "type": "ipv4", "value": "52.109.0.91", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307332.135015000", "last_seen_epoch": "1722307332.135015000", "evidence": [ { "frame_number": 10080, "timestamp_epoch": "1722307332.135015000", "display_filter": "frame.number == 10080", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dfc8be81b45afc0f36c769f8", "type": "ipv4", "value": "52.109.20.47", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307332.702022000", "last_seen_epoch": "1722307332.702022000", "evidence": [ { "frame_number": 10134, "timestamp_epoch": "1722307332.702022000", "display_filter": "frame.number == 10134", "udp_stream": 23 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5730266b4942e9a6d4700fd7", "type": "ipv4", "value": "52.109.6.53", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307157.665911000", "last_seen_epoch": "1722307157.665911000", "evidence": [ { "frame_number": 1252, "timestamp_epoch": "1722307157.665911000", "display_filter": "frame.number == 1252", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-687b6dcedf12c30aa576d777", "type": "ipv4", "value": "52.113.194.132", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307332.666055000", "last_seen_epoch": "1722307332.666055000", "evidence": [ { "frame_number": 10132, "timestamp_epoch": "1722307332.666055000", "display_filter": "frame.number == 10132", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1779a7f3b170ca5d3d7695d9", "type": "ipv4", "value": "52.191.219.104", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1722307211.846403000", "last_seen_epoch": "1722307211.846403000", "evidence": [ { "frame_number": 9163, "timestamp_epoch": "1722307211.846403000", "display_filter": "frame.number == 9163", "udp_stream": 18 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d8f67024e57ac32002311fff", "type": "ipv4", "value": "52.96.121.130", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307333.286989000", "last_seen_epoch": "1722307333.286989000", "evidence": [ { "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "display_filter": "frame.number == 10278", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1b1e53cd2a64aa0b49bf68c8", "type": "ipv4", "value": "52.96.57.2", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1722307333.286989000", "last_seen_epoch": "1722307333.286989000", "evidence": [ { "frame_number": 10278, "timestamp_epoch": "1722307333.286989000", "display_filter": "frame.number == 10278", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3d980d02dc79442189ef5ead", "type": "ja3", "value": "026e5ca865ce1f09da3a81d8a4e3effb", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307193.167251000", "last_seen_epoch": "1722307197.029904000", "evidence": [ { "frame_number": 1832, "timestamp_epoch": "1722307193.167251000", "display_filter": "frame.number == 1832", "tcp_stream": 78 }, { "frame_number": 1862, "timestamp_epoch": "1722307193.827800000", "display_filter": "frame.number == 1862", "tcp_stream": 79 }, { "frame_number": 2515, "timestamp_epoch": "1722307197.007768000", "display_filter": "frame.number == 2515", "tcp_stream": 80 }, { "frame_number": 2521, "timestamp_epoch": "1722307197.029422000", "display_filter": "frame.number == 2521", "tcp_stream": 81 }, { "frame_number": 2523, "timestamp_epoch": "1722307197.029904000", "display_filter": "frame.number == 2523", "tcp_stream": 82 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7cc3c31f082e38235474d7be", "type": "ja3", "value": "091f51a7a1c3a4504a224cc081ce9cee", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307154.791591000", "last_seen_epoch": "1722307356.089186000", "evidence": [ { "frame_number": 1162, "timestamp_epoch": "1722307154.791591000", "display_filter": "frame.number == 1162", "tcp_stream": 59 }, { "frame_number": 9167, "timestamp_epoch": "1722307211.928371000", "display_filter": "frame.number == 9167", "tcp_stream": 85 }, { "frame_number": 10453, "timestamp_epoch": "1722307356.089186000", "display_filter": "frame.number == 10453", "tcp_stream": 133 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6f419eea451936ee5d666048", "type": "ja3", "value": "1541459f873df5079e5cf7ff2c951ca0", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307457.258603000", "last_seen_epoch": "1722307457.258603000", "evidence": [ { "frame_number": 10902, "timestamp_epoch": "1722307457.258603000", "display_filter": "frame.number == 10902", "tcp_stream": 144 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0e4f9402ef5f29029fe69ef4", "type": "ja3", "value": "17e7f892bd0cb5409482f240c9ca2934", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307456.471325000", "last_seen_epoch": "1722307456.689392000", "evidence": [ { "frame_number": 10821, "timestamp_epoch": "1722307456.471325000", "display_filter": "frame.number == 10821", "tcp_stream": 140 }, { "frame_number": 10848, "timestamp_epoch": "1722307456.689392000", "display_filter": "frame.number == 10848", "tcp_stream": 140 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf0f4144d4b5cbc602d45714", "type": "ja3", "value": "1968767952a7e119234b43165830caaf", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307457.808155000", "last_seen_epoch": "1722307457.808155000", "evidence": [ { "frame_number": 10983, "timestamp_epoch": "1722307457.808155000", "display_filter": "frame.number == 10983", "tcp_stream": 148 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b05e7e3a8ffdae9dcb0d92a3", "type": "ja3", "value": "258a5a1e95b8a911872bae9081526644", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307332.233815000", "last_seen_epoch": "1722307345.609036000", "evidence": [ { "frame_number": 10088, "timestamp_epoch": "1722307332.233815000", "display_filter": "frame.number == 10088", "tcp_stream": 118 }, { "frame_number": 10141, "timestamp_epoch": "1722307332.716308000", "display_filter": "frame.number == 10141", "tcp_stream": 119 }, { "frame_number": 10153, "timestamp_epoch": "1722307332.749694000", "display_filter": "frame.number == 10153", "tcp_stream": 122 }, { "frame_number": 10155, "timestamp_epoch": "1722307332.749895000", "display_filter": "frame.number == 10155", "tcp_stream": 123 }, { "frame_number": 10282, "timestamp_epoch": "1722307333.327530000", "display_filter": "frame.number == 10282", "tcp_stream": 124 }, { "frame_number": 10424, "timestamp_epoch": "1722307345.609036000", "display_filter": "frame.number == 10424", "tcp_stream": 132 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1cf8f72883e04c230556653d", "type": "ja3", "value": "292a36e182b3281950ca910a639428ec", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307457.583327000", "last_seen_epoch": "1722307457.736031000", "evidence": [ { "frame_number": 10940, "timestamp_epoch": "1722307457.583327000", "display_filter": "frame.number == 10940", "tcp_stream": 146 }, { "frame_number": 10960, "timestamp_epoch": "1722307457.736031000", "display_filter": "frame.number == 10960", "tcp_stream": 146 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d72dbd239a25c36ce857ed68", "type": "ja3", "value": "3c293bdf2a25c07559b560ba86debc77", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307129.471792000", "last_seen_epoch": "1722307469.516311000", "evidence": [ { "frame_number": 289, "timestamp_epoch": "1722307129.471792000", "display_filter": "frame.number == 289", "tcp_stream": 17 }, { "frame_number": 346, "timestamp_epoch": "1722307129.564370000", "display_filter": "frame.number == 346", "tcp_stream": 17 }, { "frame_number": 1455, "timestamp_epoch": "1722307163.381760000", "display_filter": "frame.number == 1455", "tcp_stream": 66 }, { "frame_number": 1459, "timestamp_epoch": "1722307163.454624000", "display_filter": "frame.number == 1459", "tcp_stream": 67 }, { "frame_number": 1498, "timestamp_epoch": "1722307163.838556000", "display_filter": "frame.number == 1498", "tcp_stream": 68 }, { "frame_number": 1527, "timestamp_epoch": "1722307164.218905000", "display_filter": "frame.number == 1527", "tcp_stream": 70 }, { "frame_number": 1719, "timestamp_epoch": "1722307172.108531000", "display_filter": "frame.number == 1719", "tcp_stream": 73 }, { "frame_number": 1729, "timestamp_epoch": "1722307172.181902000", "display_filter": "frame.number == 1729", "tcp_stream": 74 }, { "frame_number": 9544, "timestamp_epoch": "1722307225.773757000", "display_filter": "frame.number == 9544", "tcp_stream": 101 }, { "frame_number": 10145, "timestamp_epoch": "1722307332.742141000", "display_filter": "frame.number == 10145", "tcp_stream": 121 }, { "frame_number": 10157, "timestamp_epoch": "1722307332.751197000", "display_filter": "frame.number == 10157", "tcp_stream": 120 }, { "frame_number": 10349, "timestamp_epoch": "1722307339.561440000", "display_filter": "frame.number == 10349", "tcp_stream": 131 }, { "frame_number": 10353, "timestamp_epoch": "1722307339.649879000", "display_filter": "frame.number == 10353", "tcp_stream": 131 }, { "frame_number": 11237, "timestamp_epoch": "1722307469.516311000", "display_filter": "frame.number == 11237", "tcp_stream": 150 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1c2cde1be60d6f5fc805877a", "type": "ja3", "value": "3c4eb72b882d4d1442c67ce73f1292a9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307167.718909000", "last_seen_epoch": "1722307167.802185000", "evidence": [ { "frame_number": 1671, "timestamp_epoch": "1722307167.718909000", "display_filter": "frame.number == 1671", "tcp_stream": 72 }, { "frame_number": 1676, "timestamp_epoch": "1722307167.802185000", "display_filter": "frame.number == 1676", "tcp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-49899ea8ab24aca4717f5f10", "type": "ja3", "value": "46f5131e766d248db0248a86c494b71c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307137.322327000", "last_seen_epoch": "1722307154.982972000", "evidence": [ { "frame_number": 713, "timestamp_epoch": "1722307137.322327000", "display_filter": "frame.number == 713", "tcp_stream": 37 }, { "frame_number": 735, "timestamp_epoch": "1722307137.637692000", "display_filter": "frame.number == 735", "tcp_stream": 38 }, { "frame_number": 755, "timestamp_epoch": "1722307137.971044000", "display_filter": "frame.number == 755", "tcp_stream": 39 }, { "frame_number": 779, "timestamp_epoch": "1722307138.289242000", "display_filter": "frame.number == 779", "tcp_stream": 40 }, { "frame_number": 800, "timestamp_epoch": "1722307138.567199000", "display_filter": "frame.number == 800", "tcp_stream": 41 }, { "frame_number": 820, "timestamp_epoch": "1722307138.872773000", "display_filter": "frame.number == 820", "tcp_stream": 42 }, { "frame_number": 841, "timestamp_epoch": "1722307139.164367000", "display_filter": "frame.number == 841", "tcp_stream": 43 }, { "frame_number": 860, "timestamp_epoch": "1722307139.488742000", "display_filter": "frame.number == 860", "tcp_stream": 44 }, { "frame_number": 880, "timestamp_epoch": "1722307139.782918000", "display_filter": "frame.number == 880", "tcp_stream": 45 }, { "frame_number": 1171, "timestamp_epoch": "1722307154.982972000", "display_filter": "frame.number == 1171", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a03d418d84a667045d7f7862", "type": "ja3", "value": "54e118fb6c893793f9955efcc86a6132", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307458.078921000", "last_seen_epoch": "1722307458.078921000", "evidence": [ { "frame_number": 11053, "timestamp_epoch": "1722307458.078921000", "display_filter": "frame.number == 11053", "tcp_stream": 149 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f5dfbc11be5810a0f632ceef", "type": "ja3", "value": "65005c9d9ae0f0ebeaf22c210571d482", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307136.895006000", "last_seen_epoch": "1722307243.148706000", "evidence": [ { "frame_number": 688, "timestamp_epoch": "1722307136.895006000", "display_filter": "frame.number == 688", "tcp_stream": 36 }, { "frame_number": 1131, "timestamp_epoch": "1722307153.954150000", "display_filter": "frame.number == 1131", "tcp_stream": 58 }, { "frame_number": 1190, "timestamp_epoch": "1722307155.140456000", "display_filter": "frame.number == 1190", "tcp_stream": 61 }, { "frame_number": 1237, "timestamp_epoch": "1722307157.554762000", "display_filter": "frame.number == 1237", "tcp_stream": 62 }, { "frame_number": 1298, "timestamp_epoch": "1722307157.881820000", "display_filter": "frame.number == 1298", "tcp_stream": 63 }, { "frame_number": 1308, "timestamp_epoch": "1722307157.885510000", "display_filter": "frame.number == 1308", "tcp_stream": 64 }, { "frame_number": 1354, "timestamp_epoch": "1722307158.105130000", "display_filter": "frame.number == 1354", "tcp_stream": 64 }, { "frame_number": 1418, "timestamp_epoch": "1722307158.692388000", "display_filter": "frame.number == 1418", "tcp_stream": 65 }, { "frame_number": 1531, "timestamp_epoch": "1722307164.228186000", "display_filter": "frame.number == 1531", "tcp_stream": 71 }, { "frame_number": 9215, "timestamp_epoch": "1722307212.390017000", "display_filter": "frame.number == 9215", "tcp_stream": 90 }, { "frame_number": 9217, "timestamp_epoch": "1722307212.392387000", "display_filter": "frame.number == 9217", "tcp_stream": 89 }, { "frame_number": 9219, "timestamp_epoch": "1722307212.399010000", "display_filter": "frame.number == 9219", "tcp_stream": 88 }, { "frame_number": 9221, "timestamp_epoch": "1722307212.404298000", "display_filter": "frame.number == 9221", "tcp_stream": 91 }, { "frame_number": 9223, "timestamp_epoch": "1722307212.407017000", "display_filter": "frame.number == 9223", "tcp_stream": 87 }, { "frame_number": 9225, "timestamp_epoch": "1722307212.407887000", "display_filter": "frame.number == 9225", "tcp_stream": 86 }, { "frame_number": 9505, "timestamp_epoch": "1722307214.368230000", "display_filter": "frame.number == 9505", "tcp_stream": 100 }, { "frame_number": 9509, "timestamp_epoch": "1722307214.423985000", "display_filter": "frame.number == 9509", "tcp_stream": 100 }, { "frame_number": 9705, "timestamp_epoch": "1722307239.108378000", "display_filter": "frame.number == 9705", "tcp_stream": 108 }, { "frame_number": 9709, "timestamp_epoch": "1722307239.168935000", "display_filter": "frame.number == 9709", "tcp_stream": 108 }, { "frame_number": 9783, "timestamp_epoch": "1722307242.116040000", "display_filter": "frame.number == 9783", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9d3c475c5d0156451a146bad", "type": "ja3", "value": "6764675c1ca709250abb58a1ed36b1a9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307455.811374000", "last_seen_epoch": "1722307455.931381000", "evidence": [ { "frame_number": 10784, "timestamp_epoch": "1722307455.811374000", "display_filter": "frame.number == 10784", "tcp_stream": 139 }, { "frame_number": 10789, "timestamp_epoch": "1722307455.931381000", "display_filter": "frame.number == 10789", "tcp_stream": 139 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-281e7983fedb3770fab97bbe", "type": "ja3", "value": "6a5d235ee78c6aede6a61448b4e9ff1e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307164.176615000", "last_seen_epoch": "1722307164.176615000", "evidence": [ { "frame_number": 1523, "timestamp_epoch": "1722307164.176615000", "display_filter": "frame.number == 1523", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f5c40cfdbce244f7ee962d6", "type": "ja3", "value": "6d162fd4fcafeafc279a32732bb583ab", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307455.810965000", "last_seen_epoch": "1722307455.932498000", "evidence": [ { "frame_number": 10780, "timestamp_epoch": "1722307455.810965000", "display_filter": "frame.number == 10780", "tcp_stream": 138 }, { "frame_number": 10791, "timestamp_epoch": "1722307455.932498000", "display_filter": "frame.number == 10791", "tcp_stream": 138 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2dddf2c2a7c0a4730622dbb0", "type": "ja3", "value": "7dcea60ae4f829abcfa00bd64ab6f937", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307457.237113000", "last_seen_epoch": "1722307457.429375000", "evidence": [ { "frame_number": 10896, "timestamp_epoch": "1722307457.237113000", "display_filter": "frame.number == 10896", "tcp_stream": 143 }, { "frame_number": 10906, "timestamp_epoch": "1722307457.429375000", "display_filter": "frame.number == 10906", "tcp_stream": 143 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fbd4de8e87cb1844ef86996e", "type": "ja3", "value": "930a922a3aeaa3a5590435675e8a4bb9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1722307457.808523000", "last_seen_epoch": "1722307457.808523000", "evidence": [ { "frame_number": 10987, "timestamp_epoch": "1722307457.808523000", "display_filter": "frame.number == 10987", "tcp_stream": 147 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2e869ffebc2bf86a6b868494", "type": "sha256", "value": "47729774d301b648e888dee3b5e215d63adabb069700e1d81671fcbdfb80e4bb", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-e2ba3e086de029fc27c3bec7", "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4e3ad5b224b045b5f33a83e8", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1722307233.647114000", "last_seen_epoch": "1722307239.669881000", "evidence": [ { "frame_number": 9596, "timestamp_epoch": "1722307233.647114000", "display_filter": "frame.number == 9596" }, { "frame_number": 9597, "timestamp_epoch": "1722307233.650010000", "display_filter": "frame.number == 9597" }, { "frame_number": 9602, "timestamp_epoch": "1722307233.857221000", "display_filter": "frame.number == 9602" }, { "frame_number": 9603, "timestamp_epoch": "1722307236.654257000", "display_filter": "frame.number == 9603" }, { "frame_number": 9604, "timestamp_epoch": "1722307236.654496000", "display_filter": "frame.number == 9604" }, { "frame_number": 9605, "timestamp_epoch": "1722307236.857524000", "display_filter": "frame.number == 9605" }, { "frame_number": 9723, "timestamp_epoch": "1722307239.669683000", "display_filter": "frame.number == 9723" }, { "frame_number": 9724, "timestamp_epoch": "1722307239.669881000", "display_filter": "frame.number == 9724" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-49e50bd557079ed4ba2861ea", "type": "url", "value": "http://ip-api.com/json/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1722307206.967799000", "last_seen_epoch": "1722307206.967799000", "evidence": [ { "frame_number": 9111, "timestamp_epoch": "1722307206.967799000", "display_filter": "frame.number == 9111", "tcp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8257e78b91b683281159e324", "type": "url", "value": "http://www.msftconnecttest.com/connecttest.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1722307129.634707000", "last_seen_epoch": "1722307129.634707000", "evidence": [ { "frame_number": 466, "timestamp_epoch": "1722307129.634707000", "display_filter": "frame.number == 466", "tcp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-177157b356b0e939ea79968a", "type": "user_agent", "value": "Microsoft NCSI", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1722307129.634707000", "last_seen_epoch": "1722307129.634707000", "evidence": [ { "frame_number": 466, "timestamp_epoch": "1722307129.634707000", "display_filter": "frame.number == 466", "tcp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-434a16af3e52cf8bae576207", "type": "user_agent", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1722307206.967799000", "last_seen_epoch": "1722307206.967799000", "evidence": [ { "frame_number": 9111, "timestamp_epoch": "1722307206.967799000", "display_filter": "frame.number == 9111", "tcp_stream": 84 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-82359a038f0aa2693e2743de", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 194, "timestamp_epoch": "1722307129.246973000", "display_filter": "frame.number == 194", "tcp_stream": 11 }, { "frame_number": 196, "timestamp_epoch": "1722307129.247559000", "display_filter": "frame.number == 196", "tcp_stream": 11 }, { "frame_number": 198, "timestamp_epoch": "1722307129.248055000", "display_filter": "frame.number == 198", "tcp_stream": 11 }, { "frame_number": 200, "timestamp_epoch": "1722307129.248398000", "display_filter": "frame.number == 200", "tcp_stream": 11 }, { "frame_number": 663, "timestamp_epoch": "1722307133.315265000", "display_filter": "frame.number == 663", "tcp_stream": 34 }, { "frame_number": 665, "timestamp_epoch": "1722307133.316091000", "display_filter": "frame.number == 665", "tcp_stream": 34 }, { "frame_number": 667, "timestamp_epoch": "1722307133.316800000", "display_filter": "frame.number == 667", "tcp_stream": 34 }, { "frame_number": 669, "timestamp_epoch": "1722307133.317183000", "display_filter": "frame.number == 669", "tcp_stream": 34 }, { "frame_number": 968, "timestamp_epoch": "1722307152.762152000", "display_filter": "frame.number == 968", "tcp_stream": 11 }, { "frame_number": 970, "timestamp_epoch": "1722307152.762628000", "display_filter": "frame.number == 970", "tcp_stream": 11 }, { "frame_number": 972, "timestamp_epoch": "1722307152.763020000", "display_filter": "frame.number == 972", "tcp_stream": 11 }, { "frame_number": 974, "timestamp_epoch": "1722307152.763351000", "display_filter": "frame.number == 974", "tcp_stream": 11 }, { "frame_number": 9375, "timestamp_epoch": "1722307213.927329000", "display_filter": "frame.number == 9375", "tcp_stream": 93 }, { "frame_number": 9377, "timestamp_epoch": "1722307213.928043000", "display_filter": "frame.number == 9377", "tcp_stream": 93 }, { "frame_number": 9379, "timestamp_epoch": "1722307213.928462000", "display_filter": "frame.number == 9379", "tcp_stream": 93 }, { "frame_number": 9383, "timestamp_epoch": "1722307213.930249000", "display_filter": "frame.number == 9383", "tcp_stream": 93 }, { "frame_number": 9385, "timestamp_epoch": "1722307213.930812000", "display_filter": "frame.number == 9385", "tcp_stream": 93 }, { "frame_number": 9387, "timestamp_epoch": "1722307213.931179000", "display_filter": "frame.number == 9387", "tcp_stream": 93 }, { "frame_number": 9447, "timestamp_epoch": "1722307214.124973000", "display_filter": "frame.number == 9447", "tcp_stream": 97 }, { "frame_number": 9449, "timestamp_epoch": "1722307214.125474000", "display_filter": "frame.number == 9449", "tcp_stream": 97 }, { "frame_number": 9451, "timestamp_epoch": "1722307214.125867000", "display_filter": "frame.number == 9451", "tcp_stream": 97 }, { "frame_number": 9455, "timestamp_epoch": "1722307214.127721000", "display_filter": "frame.number == 9455", "tcp_stream": 97 }, { "frame_number": 9457, "timestamp_epoch": "1722307214.128183000", "display_filter": "frame.number == 9457", "tcp_stream": 97 }, { "frame_number": 9459, "timestamp_epoch": "1722307214.128499000", "display_filter": "frame.number == 9459", "tcp_stream": 97 }, { "frame_number": 9647, "timestamp_epoch": "1722307239.014724000", "display_filter": "frame.number == 9647", "tcp_stream": 105 }, { "frame_number": 9649, "timestamp_epoch": "1722307239.015229000", "display_filter": "frame.number == 9649", "tcp_stream": 105 }, { "frame_number": 9651, "timestamp_epoch": "1722307239.015542000", "display_filter": "frame.number == 9651", "tcp_stream": 105 }, { "frame_number": 9655, "timestamp_epoch": "1722307239.017430000", "display_filter": "frame.number == 9655", "tcp_stream": 105 }, { "frame_number": 9657, "timestamp_epoch": "1722307239.017947000", "display_filter": "frame.number == 9657", "tcp_stream": 105 }, { "frame_number": 9659, "timestamp_epoch": "1722307239.018251000", "display_filter": "frame.number == 9659", "tcp_stream": 105 }, { "frame_number": 10755, "timestamp_epoch": "1722307453.819169000", "display_filter": "frame.number == 10755", "tcp_stream": 137 }, { "frame_number": 10757, "timestamp_epoch": "1722307453.819752000", "display_filter": "frame.number == 10757", "tcp_stream": 137 }, { "frame_number": 10759, "timestamp_epoch": "1722307453.820156000", "display_filter": "frame.number == 10759", "tcp_stream": 137 } ], "metrics": { "source": "172.16.1.4", "destination": "172.16.1.66", "protocol": "drsuapi", "event_count": 33, "operation_numbers": [ "0", "1", "12", "13" ] } }, { "finding_id": "finding-ed5d49f794128836c17da20d", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 44, "timestamp_epoch": "1722307129.102776000", "display_filter": "frame.number == 44", "tcp_stream": 0 }, { "frame_number": 45, "timestamp_epoch": "1722307129.102778000", "display_filter": "frame.number == 45", "tcp_stream": 0 }, { "frame_number": 49, "timestamp_epoch": "1722307129.103313000", "display_filter": "frame.number == 49", "tcp_stream": 1 }, { "frame_number": 50, "timestamp_epoch": "1722307129.103315000", "display_filter": "frame.number == 50", "tcp_stream": 1 }, { "frame_number": 136, "timestamp_epoch": "1722307129.136066000", "display_filter": "frame.number == 136", "tcp_stream": 1 }, { "frame_number": 137, "timestamp_epoch": "1722307129.136109000", "display_filter": "frame.number == 137", "tcp_stream": 5 }, { "frame_number": 138, "timestamp_epoch": "1722307129.136462000", "display_filter": "frame.number == 138", "tcp_stream": 0 }, { "frame_number": 208, "timestamp_epoch": "1722307129.260308000", "display_filter": "frame.number == 208", "tcp_stream": 15 }, { "frame_number": 209, "timestamp_epoch": "1722307129.260309000", "display_filter": "frame.number == 209", "tcp_stream": 15 }, { "frame_number": 214, "timestamp_epoch": "1722307129.262350000", "display_filter": "frame.number == 214", "tcp_stream": 15 }, { "frame_number": 229, "timestamp_epoch": "1722307129.278847000", "display_filter": "frame.number == 229", "tcp_stream": 15 }, { "frame_number": 247, "timestamp_epoch": "1722307129.398343000", "display_filter": "frame.number == 247", "tcp_stream": 18 }, { "frame_number": 249, "timestamp_epoch": "1722307129.399202000", "display_filter": "frame.number == 249", "tcp_stream": 18 }, { "frame_number": 251, "timestamp_epoch": "1722307129.399980000", "display_filter": "frame.number == 251", "tcp_stream": 18 }, { "frame_number": 253, "timestamp_epoch": "1722307129.401501000", "display_filter": "frame.number == 253", "tcp_stream": 15 }, { "frame_number": 509, "timestamp_epoch": "1722307129.953541000", "display_filter": "frame.number == 509", "tcp_stream": 25 }, { "frame_number": 510, "timestamp_epoch": "1722307129.953542000", "display_filter": "frame.number == 510", "tcp_stream": 25 }, { "frame_number": 515, "timestamp_epoch": "1722307129.957387000", "display_filter": "frame.number == 515", "tcp_stream": 25 }, { "frame_number": 517, "timestamp_epoch": "1722307129.965149000", "display_filter": "frame.number == 517", "tcp_stream": 25 }, { "frame_number": 519, "timestamp_epoch": "1722307129.965639000", "display_filter": "frame.number == 519", "tcp_stream": 25 }, { "frame_number": 521, "timestamp_epoch": "1722307129.966075000", "display_filter": "frame.number == 521", "tcp_stream": 25 }, { "frame_number": 523, "timestamp_epoch": "1722307129.966623000", "display_filter": "frame.number == 523", "tcp_stream": 25 }, { "frame_number": 525, "timestamp_epoch": "1722307129.968644000", "display_filter": "frame.number == 525", "tcp_stream": 25 }, { "frame_number": 527, "timestamp_epoch": "1722307129.971041000", "display_filter": "frame.number == 527", "tcp_stream": 25 }, { "frame_number": 529, "timestamp_epoch": "1722307129.971641000", "display_filter": "frame.number == 529", "tcp_stream": 25 }, { "frame_number": 531, "timestamp_epoch": "1722307129.973462000", "display_filter": "frame.number == 531", "tcp_stream": 25 }, { "frame_number": 540, "timestamp_epoch": "1722307129.997336000", "display_filter": "frame.number == 540", "tcp_stream": 26 }, { "frame_number": 542, "timestamp_epoch": "1722307129.997914000", "display_filter": "frame.number == 542", "tcp_stream": 26 }, { "frame_number": 553, "timestamp_epoch": "1722307130.000976000", "display_filter": "frame.number == 553", "tcp_stream": 27 }, { "frame_number": 555, "timestamp_epoch": "1722307130.001896000", "display_filter": "frame.number == 555", "tcp_stream": 27 }, { "frame_number": 566, "timestamp_epoch": "1722307130.010839000", "display_filter": "frame.number == 566", "tcp_stream": 28 }, { "frame_number": 568, "timestamp_epoch": "1722307130.011683000", "display_filter": "frame.number == 568", "tcp_stream": 28 }, { "frame_number": 600, "timestamp_epoch": "1722307130.017270000", "display_filter": "frame.number == 600", "tcp_stream": 28 }, { "frame_number": 1000, "timestamp_epoch": "1722307152.776321000", "display_filter": "frame.number == 1000", "tcp_stream": 52 }, { "frame_number": 1002, "timestamp_epoch": "1722307152.779859000", "display_filter": "frame.number == 1002", "tcp_stream": 52 }, { "frame_number": 1037, "timestamp_epoch": "1722307152.784768000", "display_filter": "frame.number == 1037", "tcp_stream": 54 }, { "frame_number": 1040, "timestamp_epoch": "1722307152.785397000", "display_filter": "frame.number == 1040", "tcp_stream": 54 }, { "frame_number": 1044, "timestamp_epoch": "1722307152.785971000", "display_filter": "frame.number == 1044", "tcp_stream": 54 }, { "frame_number": 1046, "timestamp_epoch": "1722307152.786597000", "display_filter": "frame.number == 1046", "tcp_stream": 52 }, { "frame_number": 9393, "timestamp_epoch": "1722307213.934127000", "display_filter": "frame.number == 9393", "tcp_stream": 94 }, { "frame_number": 9394, "timestamp_epoch": "1722307213.934128000", "display_filter": "frame.number == 9394", "tcp_stream": 94 }, { "frame_number": 9399, "timestamp_epoch": "1722307213.935850000", "display_filter": "frame.number == 9399", "tcp_stream": 94 }, { "frame_number": 9401, "timestamp_epoch": "1722307213.936492000", "display_filter": "frame.number == 9401", "tcp_stream": 94 }, { "frame_number": 9403, "timestamp_epoch": "1722307213.936976000", "display_filter": "frame.number == 9403", "tcp_stream": 94 }, { "frame_number": 9405, "timestamp_epoch": "1722307213.937466000", "display_filter": "frame.number == 9405", "tcp_stream": 94 }, { "frame_number": 9412, "timestamp_epoch": "1722307213.940763000", "display_filter": "frame.number == 9412", "tcp_stream": 95 }, { "frame_number": 9416, "timestamp_epoch": "1722307213.941390000", "display_filter": "frame.number == 9416", "tcp_stream": 95 }, { "frame_number": 9419, "timestamp_epoch": "1722307213.941975000", "display_filter": "frame.number == 9419", "tcp_stream": 95 }, { "frame_number": 9465, "timestamp_epoch": "1722307214.130941000", "display_filter": "frame.number == 9465", "tcp_stream": 98 }, { "frame_number": 9466, "timestamp_epoch": "1722307214.130941000", "display_filter": "frame.number == 9466", "tcp_stream": 98 }, { "frame_number": 9471, "timestamp_epoch": "1722307214.132379000", "display_filter": "frame.number == 9471", "tcp_stream": 98 }, { "frame_number": 9473, "timestamp_epoch": "1722307214.132918000", "display_filter": "frame.number == 9473", "tcp_stream": 98 }, { "frame_number": 9475, "timestamp_epoch": "1722307214.133348000", "display_filter": "frame.number == 9475", "tcp_stream": 98 }, { "frame_number": 9477, "timestamp_epoch": "1722307214.133709000", "display_filter": "frame.number == 9477", "tcp_stream": 98 }, { "frame_number": 9484, "timestamp_epoch": "1722307214.137623000", "display_filter": "frame.number == 9484", "tcp_stream": 99 }, { "frame_number": 9488, "timestamp_epoch": "1722307214.138416000", "display_filter": "frame.number == 9488", "tcp_stream": 99 }, { "frame_number": 9491, "timestamp_epoch": "1722307214.139245000", "display_filter": "frame.number == 9491", "tcp_stream": 99 }, { "frame_number": 9665, "timestamp_epoch": "1722307239.020762000", "display_filter": "frame.number == 9665", "tcp_stream": 106 }, { "frame_number": 9666, "timestamp_epoch": "1722307239.020763000", "display_filter": "frame.number == 9666", "tcp_stream": 106 }, { "frame_number": 9671, "timestamp_epoch": "1722307239.022400000", "display_filter": "frame.number == 9671", "tcp_stream": 106 }, { "frame_number": 9673, "timestamp_epoch": "1722307239.023036000", "display_filter": "frame.number == 9673", "tcp_stream": 106 }, { "frame_number": 9675, "timestamp_epoch": "1722307239.023524000", "display_filter": "frame.number == 9675", "tcp_stream": 106 }, { "frame_number": 9677, "timestamp_epoch": "1722307239.024066000", "display_filter": "frame.number == 9677", "tcp_stream": 106 }, { "frame_number": 9684, "timestamp_epoch": "1722307239.028585000", "display_filter": "frame.number == 9684", "tcp_stream": 107 }, { "frame_number": 9688, "timestamp_epoch": "1722307239.029285000", "display_filter": "frame.number == 9688", "tcp_stream": 107 }, { "frame_number": 9691, "timestamp_epoch": "1722307239.030195000", "display_filter": "frame.number == 9691", "tcp_stream": 107 }, { "frame_number": 9739, "timestamp_epoch": "1722307241.103863000", "display_filter": "frame.number == 9739", "tcp_stream": 109 }, { "frame_number": 9740, "timestamp_epoch": "1722307241.103864000", "display_filter": "frame.number == 9740", "tcp_stream": 109 }, { "frame_number": 9757, "timestamp_epoch": "1722307241.108272000", "display_filter": "frame.number == 9757", "tcp_stream": 109 }, { "frame_number": 9759, "timestamp_epoch": "1722307241.110601000", "display_filter": "frame.number == 9759", "tcp_stream": 109 }, { "frame_number": 9770, "timestamp_epoch": "1722307241.122854000", "display_filter": "frame.number == 9770", "tcp_stream": 111 }, { "frame_number": 9772, "timestamp_epoch": "1722307241.123466000", "display_filter": "frame.number == 9772", "tcp_stream": 111 }, { "frame_number": 10067, "timestamp_epoch": "1722307332.007614000", "display_filter": "frame.number == 10067", "tcp_stream": 117 }, { "frame_number": 10068, "timestamp_epoch": "1722307332.007615000", "display_filter": "frame.number == 10068", "tcp_stream": 117 }, { "frame_number": 10073, "timestamp_epoch": "1722307332.009714000", "display_filter": "frame.number == 10073", "tcp_stream": 117 }, { "frame_number": 10075, "timestamp_epoch": "1722307332.012910000", "display_filter": "frame.number == 10075", "tcp_stream": 117 }, { "frame_number": 10077, "timestamp_epoch": "1722307332.013602000", "display_filter": "frame.number == 10077", "tcp_stream": 117 }, { "frame_number": 10309, "timestamp_epoch": "1722307333.689878000", "display_filter": "frame.number == 10309", "tcp_stream": 126 }, { "frame_number": 10310, "timestamp_epoch": "1722307333.689879000", "display_filter": "frame.number == 10310", "tcp_stream": 126 }, { "frame_number": 10315, "timestamp_epoch": "1722307333.691652000", "display_filter": "frame.number == 10315", "tcp_stream": 126 }, { "frame_number": 10317, "timestamp_epoch": "1722307333.694115000", "display_filter": "frame.number == 10317", "tcp_stream": 126 }, { "frame_number": 10833, "timestamp_epoch": "1722307456.676737000", "display_filter": "frame.number == 10833", "tcp_stream": 141 }, { "frame_number": 10834, "timestamp_epoch": "1722307456.676738000", "display_filter": "frame.number == 10834", "tcp_stream": 141 }, { "frame_number": 10839, "timestamp_epoch": "1722307456.678815000", "display_filter": "frame.number == 10839", "tcp_stream": 141 }, { "frame_number": 10841, "timestamp_epoch": "1722307456.680544000", "display_filter": "frame.number == 10841", "tcp_stream": 141 }, { "frame_number": 10853, "timestamp_epoch": "1722307456.690461000", "display_filter": "frame.number == 10853", "tcp_stream": 142 }, { "frame_number": 10855, "timestamp_epoch": "1722307456.691141000", "display_filter": "frame.number == 10855", "tcp_stream": 142 } ], "metrics": { "source": "172.16.1.4", "destination": "172.16.1.66", "protocol": "ldap", "event_count": 87, "operation_numbers": [ "", "1", "4", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-56e85f947dd181e8fe9789e2", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 1056, "timestamp_epoch": "1722307152.790024000", "display_filter": "frame.number == 1056", "tcp_stream": 21 }, { "frame_number": 1058, "timestamp_epoch": "1722307152.790513000", "display_filter": "frame.number == 1058", "tcp_stream": 21 }, { "frame_number": 1060, "timestamp_epoch": "1722307152.791013000", "display_filter": "frame.number == 1060", "tcp_stream": 21 }, { "frame_number": 1062, "timestamp_epoch": "1722307152.791453000", "display_filter": "frame.number == 1062", "tcp_stream": 21 }, { "frame_number": 1064, "timestamp_epoch": "1722307152.791901000", "display_filter": "frame.number == 1064", "tcp_stream": 21 }, { "frame_number": 1066, "timestamp_epoch": "1722307152.792368000", "display_filter": "frame.number == 1066", "tcp_stream": 21 }, { "frame_number": 1068, "timestamp_epoch": "1722307152.792930000", "display_filter": "frame.number == 1068", "tcp_stream": 21 }, { "frame_number": 1070, "timestamp_epoch": "1722307152.793528000", "display_filter": "frame.number == 1070", "tcp_stream": 21 }, { "frame_number": 1072, "timestamp_epoch": "1722307152.794009000", "display_filter": "frame.number == 1072", "tcp_stream": 21 }, { "frame_number": 1074, "timestamp_epoch": "1722307152.794435000", "display_filter": "frame.number == 1074", "tcp_stream": 21 }, { "frame_number": 1076, "timestamp_epoch": "1722307152.794826000", "display_filter": "frame.number == 1076", "tcp_stream": 21 }, { "frame_number": 1078, "timestamp_epoch": "1722307152.795212000", "display_filter": "frame.number == 1078", "tcp_stream": 21 }, { "frame_number": 1080, "timestamp_epoch": "1722307152.795585000", "display_filter": "frame.number == 1080", "tcp_stream": 21 }, { "frame_number": 1082, "timestamp_epoch": "1722307152.795977000", "display_filter": "frame.number == 1082", "tcp_stream": 21 }, { "frame_number": 1084, "timestamp_epoch": "1722307152.796434000", "display_filter": "frame.number == 1084", "tcp_stream": 21 } ], "metrics": { "source": "172.16.1.4", "destination": "172.16.1.66", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-11d97e1ef303eb536d925670", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 193, "timestamp_epoch": "1722307129.246746000", "display_filter": "frame.number == 193", "tcp_stream": 11 }, { "frame_number": 195, "timestamp_epoch": "1722307129.247255000", "display_filter": "frame.number == 195", "tcp_stream": 11 }, { "frame_number": 197, "timestamp_epoch": "1722307129.247786000", "display_filter": "frame.number == 197", "tcp_stream": 11 }, { "frame_number": 199, "timestamp_epoch": "1722307129.248238000", "display_filter": "frame.number == 199", "tcp_stream": 11 }, { "frame_number": 662, "timestamp_epoch": "1722307133.314989000", "display_filter": "frame.number == 662", "tcp_stream": 34 }, { "frame_number": 664, "timestamp_epoch": "1722307133.315531000", "display_filter": "frame.number == 664", "tcp_stream": 34 }, { "frame_number": 666, "timestamp_epoch": "1722307133.316297000", "display_filter": "frame.number == 666", "tcp_stream": 34 }, { "frame_number": 668, "timestamp_epoch": "1722307133.316997000", "display_filter": "frame.number == 668", "tcp_stream": 34 }, { "frame_number": 967, "timestamp_epoch": "1722307152.761878000", "display_filter": "frame.number == 967", "tcp_stream": 11 }, { "frame_number": 969, "timestamp_epoch": "1722307152.762353000", "display_filter": "frame.number == 969", "tcp_stream": 11 }, { "frame_number": 971, "timestamp_epoch": "1722307152.762778000", "display_filter": "frame.number == 971", "tcp_stream": 11 }, { "frame_number": 973, "timestamp_epoch": "1722307152.763190000", "display_filter": "frame.number == 973", "tcp_stream": 11 }, { "frame_number": 9374, "timestamp_epoch": "1722307213.926787000", "display_filter": "frame.number == 9374", "tcp_stream": 93 }, { "frame_number": 9376, "timestamp_epoch": "1722307213.927690000", "display_filter": "frame.number == 9376", "tcp_stream": 93 }, { "frame_number": 9378, "timestamp_epoch": "1722307213.928278000", "display_filter": "frame.number == 9378", "tcp_stream": 93 }, { "frame_number": 9382, "timestamp_epoch": "1722307213.930019000", "display_filter": "frame.number == 9382", "tcp_stream": 93 }, { "frame_number": 9384, "timestamp_epoch": "1722307213.930459000", "display_filter": "frame.number == 9384", "tcp_stream": 93 }, { "frame_number": 9386, "timestamp_epoch": "1722307213.931022000", "display_filter": "frame.number == 9386", "tcp_stream": 93 }, { "frame_number": 9446, "timestamp_epoch": "1722307214.124770000", "display_filter": "frame.number == 9446", "tcp_stream": 97 }, { "frame_number": 9448, "timestamp_epoch": "1722307214.125171000", "display_filter": "frame.number == 9448", "tcp_stream": 97 }, { "frame_number": 9450, "timestamp_epoch": "1722307214.125681000", "display_filter": "frame.number == 9450", "tcp_stream": 97 }, { "frame_number": 9454, "timestamp_epoch": "1722307214.127543000", "display_filter": "frame.number == 9454", "tcp_stream": 97 }, { "frame_number": 9456, "timestamp_epoch": "1722307214.127932000", "display_filter": "frame.number == 9456", "tcp_stream": 97 }, { "frame_number": 9458, "timestamp_epoch": "1722307214.128334000", "display_filter": "frame.number == 9458", "tcp_stream": 97 }, { "frame_number": 9646, "timestamp_epoch": "1722307239.014493000", "display_filter": "frame.number == 9646", "tcp_stream": 105 }, { "frame_number": 9648, "timestamp_epoch": "1722307239.014930000", "display_filter": "frame.number == 9648", "tcp_stream": 105 }, { "frame_number": 9650, "timestamp_epoch": "1722307239.015399000", "display_filter": "frame.number == 9650", "tcp_stream": 105 }, { "frame_number": 9654, "timestamp_epoch": "1722307239.017225000", "display_filter": "frame.number == 9654", "tcp_stream": 105 }, { "frame_number": 9656, "timestamp_epoch": "1722307239.017609000", "display_filter": "frame.number == 9656", "tcp_stream": 105 }, { "frame_number": 9658, "timestamp_epoch": "1722307239.018110000", "display_filter": "frame.number == 9658", "tcp_stream": 105 }, { "frame_number": 10754, "timestamp_epoch": "1722307453.818929000", "display_filter": "frame.number == 10754", "tcp_stream": 137 }, { "frame_number": 10756, "timestamp_epoch": "1722307453.819436000", "display_filter": "frame.number == 10756", "tcp_stream": 137 }, { "frame_number": 10758, "timestamp_epoch": "1722307453.820003000", "display_filter": "frame.number == 10758", "tcp_stream": 137 } ], "metrics": { "source": "172.16.1.66", "destination": "172.16.1.4", "protocol": "drsuapi", "event_count": 33, "operation_numbers": [ "0", "1", "12", "13" ] } }, { "finding_id": "finding-1dc05e684d9113bd775c1e86", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 42, "timestamp_epoch": "1722307129.102370000", "display_filter": "frame.number == 42", "tcp_stream": 0 }, { "frame_number": 46, "timestamp_epoch": "1722307129.102956000", "display_filter": "frame.number == 46", "tcp_stream": 1 }, { "frame_number": 128, "timestamp_epoch": "1722307129.135287000", "display_filter": "frame.number == 128", "tcp_stream": 5 }, { "frame_number": 130, "timestamp_epoch": "1722307129.135346000", "display_filter": "frame.number == 130", "tcp_stream": 1 }, { "frame_number": 133, "timestamp_epoch": "1722307129.135435000", "display_filter": "frame.number == 133", "tcp_stream": 0 }, { "frame_number": 139, "timestamp_epoch": "1722307129.138026000", "display_filter": "frame.number == 139", "tcp_stream": 5 }, { "frame_number": 140, "timestamp_epoch": "1722307129.138038000", "display_filter": "frame.number == 140", "tcp_stream": 0 }, { "frame_number": 141, "timestamp_epoch": "1722307129.138134000", "display_filter": "frame.number == 141", "tcp_stream": 1 }, { "frame_number": 206, "timestamp_epoch": "1722307129.259995000", "display_filter": "frame.number == 206", "tcp_stream": 15 }, { "frame_number": 212, "timestamp_epoch": "1722307129.261574000", "display_filter": "frame.number == 212", "tcp_stream": 15 }, { "frame_number": 228, "timestamp_epoch": "1722307129.278247000", "display_filter": "frame.number == 228", "tcp_stream": 15 }, { "frame_number": 245, "timestamp_epoch": "1722307129.397204000", "display_filter": "frame.number == 245", "tcp_stream": 18 }, { "frame_number": 248, "timestamp_epoch": "1722307129.398906000", "display_filter": "frame.number == 248", "tcp_stream": 18 }, { "frame_number": 250, "timestamp_epoch": "1722307129.399594000", "display_filter": "frame.number == 250", "tcp_stream": 18 }, { "frame_number": 252, "timestamp_epoch": "1722307129.400886000", "display_filter": "frame.number == 252", "tcp_stream": 15 }, { "frame_number": 458, "timestamp_epoch": "1722307129.592428000", "display_filter": "frame.number == 458", "tcp_stream": 18 }, { "frame_number": 460, "timestamp_epoch": "1722307129.598686000", "display_filter": "frame.number == 460", "tcp_stream": 15 }, { "frame_number": 507, "timestamp_epoch": "1722307129.952978000", "display_filter": "frame.number == 507", "tcp_stream": 25 }, { "frame_number": 513, "timestamp_epoch": "1722307129.956396000", "display_filter": "frame.number == 513", "tcp_stream": 25 }, { "frame_number": 516, "timestamp_epoch": "1722307129.964882000", "display_filter": "frame.number == 516", "tcp_stream": 25 }, { "frame_number": 518, "timestamp_epoch": "1722307129.965424000", "display_filter": "frame.number == 518", "tcp_stream": 25 }, { "frame_number": 520, "timestamp_epoch": "1722307129.965834000", "display_filter": "frame.number == 520", "tcp_stream": 25 }, { "frame_number": 522, "timestamp_epoch": "1722307129.966338000", "display_filter": "frame.number == 522", "tcp_stream": 25 }, { "frame_number": 524, "timestamp_epoch": "1722307129.968377000", "display_filter": "frame.number == 524", "tcp_stream": 25 }, { "frame_number": 526, "timestamp_epoch": "1722307129.969209000", "display_filter": "frame.number == 526", "tcp_stream": 25 }, { "frame_number": 528, "timestamp_epoch": "1722307129.971370000", "display_filter": "frame.number == 528", "tcp_stream": 25 }, { "frame_number": 530, "timestamp_epoch": "1722307129.973223000", "display_filter": "frame.number == 530", "tcp_stream": 25 }, { "frame_number": 538, "timestamp_epoch": "1722307129.996553000", "display_filter": "frame.number == 538", "tcp_stream": 26 }, { "frame_number": 541, "timestamp_epoch": "1722307129.997732000", "display_filter": "frame.number == 541", "tcp_stream": 26 }, { "frame_number": 543, "timestamp_epoch": "1722307129.998321000", "display_filter": "frame.number == 543", "tcp_stream": 26 }, { "frame_number": 551, "timestamp_epoch": "1722307130.000323000", "display_filter": "frame.number == 551", "tcp_stream": 27 }, { "frame_number": 554, "timestamp_epoch": "1722307130.001497000", "display_filter": "frame.number == 554", "tcp_stream": 27 }, { "frame_number": 556, "timestamp_epoch": "1722307130.002168000", "display_filter": "frame.number == 556", "tcp_stream": 27 }, { "frame_number": 564, "timestamp_epoch": "1722307130.009998000", "display_filter": "frame.number == 564", "tcp_stream": 28 }, { "frame_number": 567, "timestamp_epoch": "1722307130.011426000", "display_filter": "frame.number == 567", "tcp_stream": 28 }, { "frame_number": 599, "timestamp_epoch": "1722307130.016918000", "display_filter": "frame.number == 599", "tcp_stream": 28 }, { "frame_number": 601, "timestamp_epoch": "1722307130.017720000", "display_filter": "frame.number == 601", "tcp_stream": 28 }, { "frame_number": 606, "timestamp_epoch": "1722307130.018429000", "display_filter": "frame.number == 606", "tcp_stream": 25 }, { "frame_number": 998, "timestamp_epoch": "1722307152.775526000", "display_filter": "frame.number == 998", "tcp_stream": 52 }, { "frame_number": 1001, "timestamp_epoch": "1722307152.779506000", "display_filter": "frame.number == 1001", "tcp_stream": 52 }, { "frame_number": 1035, "timestamp_epoch": "1722307152.784007000", "display_filter": "frame.number == 1035", "tcp_stream": 54 }, { "frame_number": 1039, "timestamp_epoch": "1722307152.785220000", "display_filter": "frame.number == 1039", "tcp_stream": 54 }, { "frame_number": 1042, "timestamp_epoch": "1722307152.785699000", "display_filter": "frame.number == 1042", "tcp_stream": 54 }, { "frame_number": 1045, "timestamp_epoch": "1722307152.786258000", "display_filter": "frame.number == 1045", "tcp_stream": 52 }, { "frame_number": 1087, "timestamp_epoch": "1722307152.804068000", "display_filter": "frame.number == 1087", "tcp_stream": 54 }, { "frame_number": 1089, "timestamp_epoch": "1722307152.807558000", "display_filter": "frame.number == 1089", "tcp_stream": 52 }, { "frame_number": 9391, "timestamp_epoch": "1722307213.933779000", "display_filter": "frame.number == 9391", "tcp_stream": 94 }, { "frame_number": 9397, "timestamp_epoch": "1722307213.935134000", "display_filter": "frame.number == 9397", "tcp_stream": 94 }, { "frame_number": 9400, "timestamp_epoch": "1722307213.936211000", "display_filter": "frame.number == 9400", "tcp_stream": 94 }, { "frame_number": 9402, "timestamp_epoch": "1722307213.936772000", "display_filter": "frame.number == 9402", "tcp_stream": 94 }, { "frame_number": 9404, "timestamp_epoch": "1722307213.937219000", "display_filter": "frame.number == 9404", "tcp_stream": 94 }, { "frame_number": 9410, "timestamp_epoch": "1722307213.939967000", "display_filter": "frame.number == 9410", "tcp_stream": 95 }, { "frame_number": 9413, "timestamp_epoch": "1722307213.941093000", "display_filter": "frame.number == 9413", "tcp_stream": 95 }, { "frame_number": 9418, "timestamp_epoch": "1722307213.941687000", "display_filter": "frame.number == 9418", "tcp_stream": 95 }, { "frame_number": 9420, "timestamp_epoch": "1722307213.942194000", "display_filter": "frame.number == 9420", "tcp_stream": 95 }, { "frame_number": 9424, "timestamp_epoch": "1722307213.942672000", "display_filter": "frame.number == 9424", "tcp_stream": 94 }, { "frame_number": 9463, "timestamp_epoch": "1722307214.130677000", "display_filter": "frame.number == 9463", "tcp_stream": 98 }, { "frame_number": 9469, "timestamp_epoch": "1722307214.131773000", "display_filter": "frame.number == 9469", "tcp_stream": 98 }, { "frame_number": 9472, "timestamp_epoch": "1722307214.132703000", "display_filter": "frame.number == 9472", "tcp_stream": 98 }, { "frame_number": 9474, "timestamp_epoch": "1722307214.133112000", "display_filter": "frame.number == 9474", "tcp_stream": 98 }, { "frame_number": 9476, "timestamp_epoch": "1722307214.133526000", "display_filter": "frame.number == 9476", "tcp_stream": 98 }, { "frame_number": 9482, "timestamp_epoch": "1722307214.136868000", "display_filter": "frame.number == 9482", "tcp_stream": 99 }, { "frame_number": 9485, "timestamp_epoch": "1722307214.138108000", "display_filter": "frame.number == 9485", "tcp_stream": 99 }, { "frame_number": 9490, "timestamp_epoch": "1722307214.138869000", "display_filter": "frame.number == 9490", "tcp_stream": 99 }, { "frame_number": 9492, "timestamp_epoch": "1722307214.139492000", "display_filter": "frame.number == 9492", "tcp_stream": 99 }, { "frame_number": 9494, "timestamp_epoch": "1722307214.139922000", "display_filter": "frame.number == 9494", "tcp_stream": 98 }, { "frame_number": 9663, "timestamp_epoch": "1722307239.020504000", "display_filter": "frame.number == 9663", "tcp_stream": 106 }, { "frame_number": 9669, "timestamp_epoch": "1722307239.021669000", "display_filter": "frame.number == 9669", "tcp_stream": 106 }, { "frame_number": 9672, "timestamp_epoch": "1722307239.022794000", "display_filter": "frame.number == 9672", "tcp_stream": 106 }, { "frame_number": 9674, "timestamp_epoch": "1722307239.023265000", "display_filter": "frame.number == 9674", "tcp_stream": 106 }, { "frame_number": 9676, "timestamp_epoch": "1722307239.023729000", "display_filter": "frame.number == 9676", "tcp_stream": 106 }, { "frame_number": 9682, "timestamp_epoch": "1722307239.027774000", "display_filter": "frame.number == 9682", "tcp_stream": 107 }, { "frame_number": 9685, "timestamp_epoch": "1722307239.028962000", "display_filter": "frame.number == 9685", "tcp_stream": 107 }, { "frame_number": 9690, "timestamp_epoch": "1722307239.029914000", "display_filter": "frame.number == 9690", "tcp_stream": 107 }, { "frame_number": 9692, "timestamp_epoch": "1722307239.030373000", "display_filter": "frame.number == 9692", "tcp_stream": 107 }, { "frame_number": 9696, "timestamp_epoch": "1722307239.030796000", "display_filter": "frame.number == 9696", "tcp_stream": 106 }, { "frame_number": 9737, "timestamp_epoch": "1722307241.103539000", "display_filter": "frame.number == 9737", "tcp_stream": 109 }, { "frame_number": 9755, "timestamp_epoch": "1722307241.107544000", "display_filter": "frame.number == 9755", "tcp_stream": 109 }, { "frame_number": 9758, "timestamp_epoch": "1722307241.110307000", "display_filter": "frame.number == 9758", "tcp_stream": 109 }, { "frame_number": 9760, "timestamp_epoch": "1722307241.111024000", "display_filter": "frame.number == 9760", "tcp_stream": 109 }, { "frame_number": 9768, "timestamp_epoch": "1722307241.122109000", "display_filter": "frame.number == 9768", "tcp_stream": 111 }, { "frame_number": 9771, "timestamp_epoch": "1722307241.123191000", "display_filter": "frame.number == 9771", "tcp_stream": 111 }, { "frame_number": 9773, "timestamp_epoch": "1722307241.123737000", "display_filter": "frame.number == 9773", "tcp_stream": 111 }, { "frame_number": 10065, "timestamp_epoch": "1722307332.007314000", "display_filter": "frame.number == 10065", "tcp_stream": 117 }, { "frame_number": 10071, "timestamp_epoch": "1722307332.008959000", "display_filter": "frame.number == 10071", "tcp_stream": 117 }, { "frame_number": 10074, "timestamp_epoch": "1722307332.012660000", "display_filter": "frame.number == 10074", "tcp_stream": 117 }, { "frame_number": 10076, "timestamp_epoch": "1722307332.013159000", "display_filter": "frame.number == 10076", "tcp_stream": 117 }, { "frame_number": 10078, "timestamp_epoch": "1722307332.014246000", "display_filter": "frame.number == 10078", "tcp_stream": 117 }, { "frame_number": 10307, "timestamp_epoch": "1722307333.689571000", "display_filter": "frame.number == 10307", "tcp_stream": 126 }, { "frame_number": 10313, "timestamp_epoch": "1722307333.690910000", "display_filter": "frame.number == 10313", "tcp_stream": 126 }, { "frame_number": 10316, "timestamp_epoch": "1722307333.692019000", "display_filter": "frame.number == 10316", "tcp_stream": 126 }, { "frame_number": 10318, "timestamp_epoch": "1722307333.695675000", "display_filter": "frame.number == 10318", "tcp_stream": 126 }, { "frame_number": 10831, "timestamp_epoch": "1722307456.676444000", "display_filter": "frame.number == 10831", "tcp_stream": 141 }, { "frame_number": 10837, "timestamp_epoch": "1722307456.678037000", "display_filter": "frame.number == 10837", "tcp_stream": 141 }, { "frame_number": 10840, "timestamp_epoch": "1722307456.680260000", "display_filter": "frame.number == 10840", "tcp_stream": 141 }, { "frame_number": 10842, "timestamp_epoch": "1722307456.680828000", "display_filter": "frame.number == 10842", "tcp_stream": 141 }, { "frame_number": 10851, "timestamp_epoch": "1722307456.689676000", "display_filter": "frame.number == 10851", "tcp_stream": 142 }, { "frame_number": 10854, "timestamp_epoch": "1722307456.690871000", "display_filter": "frame.number == 10854", "tcp_stream": 142 }, { "frame_number": 10856, "timestamp_epoch": "1722307456.691458000", "display_filter": "frame.number == 10856", "tcp_stream": 142 } ], "metrics": { "source": "172.16.1.66", "destination": "172.16.1.4", "protocol": "ldap", "event_count": 99, "operation_numbers": [ "", "0", "2", "3" ] } }, { "finding_id": "finding-81b169139b646fc4aa7b50f9", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 1055, "timestamp_epoch": "1722307152.789680000", "display_filter": "frame.number == 1055", "tcp_stream": 21 }, { "frame_number": 1057, "timestamp_epoch": "1722307152.790201000", "display_filter": "frame.number == 1057", "tcp_stream": 21 }, { "frame_number": 1059, "timestamp_epoch": "1722307152.790742000", "display_filter": "frame.number == 1059", "tcp_stream": 21 }, { "frame_number": 1061, "timestamp_epoch": "1722307152.791162000", "display_filter": "frame.number == 1061", "tcp_stream": 21 }, { "frame_number": 1063, "timestamp_epoch": "1722307152.791602000", "display_filter": "frame.number == 1063", "tcp_stream": 21 }, { "frame_number": 1065, "timestamp_epoch": "1722307152.792045000", "display_filter": "frame.number == 1065", "tcp_stream": 21 }, { "frame_number": 1067, "timestamp_epoch": "1722307152.792524000", "display_filter": "frame.number == 1067", "tcp_stream": 21 }, { "frame_number": 1069, "timestamp_epoch": "1722307152.793077000", "display_filter": "frame.number == 1069", "tcp_stream": 21 }, { "frame_number": 1071, "timestamp_epoch": "1722307152.793687000", "display_filter": "frame.number == 1071", "tcp_stream": 21 }, { "frame_number": 1073, "timestamp_epoch": "1722307152.794176000", "display_filter": "frame.number == 1073", "tcp_stream": 21 }, { "frame_number": 1075, "timestamp_epoch": "1722307152.794582000", "display_filter": "frame.number == 1075", "tcp_stream": 21 }, { "frame_number": 1077, "timestamp_epoch": "1722307152.794979000", "display_filter": "frame.number == 1077", "tcp_stream": 21 }, { "frame_number": 1079, "timestamp_epoch": "1722307152.795358000", "display_filter": "frame.number == 1079", "tcp_stream": 21 }, { "frame_number": 1081, "timestamp_epoch": "1722307152.795749000", "display_filter": "frame.number == 1081", "tcp_stream": 21 }, { "frame_number": 1083, "timestamp_epoch": "1722307152.796148000", "display_filter": "frame.number == 1083", "tcp_stream": 21 } ], "metrics": { "source": "172.16.1.66", "destination": "172.16.1.4", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-bc47e86541b34769f7b80758", "rule_id": "cleartext-tool-self-identification", "rule_version": "pcap-rules-v3", "severity": "high", "title": "Client announces a software label and host identity", "explanation": "An otherwise unclassified TCP payload contains a structured ping, software label, client identifier, hostname and account. These are literal self-reported values, not authenticated identity or independent malware-family attribution.", "confidence": 0.98, "status": "candidate", "evidence": [ { "frame_number": 9119, "timestamp_epoch": "1722307207.027145000", "display_filter": "frame.number == 9119", "tcp_stream": 83 }, { "frame_number": 9352, "timestamp_epoch": "1722307213.639146000", "display_filter": "frame.number == 9352", "tcp_stream": 83 }, { "frame_number": 9530, "timestamp_epoch": "1722307218.639963000", "display_filter": "frame.number == 9530", "tcp_stream": 83 }, { "frame_number": 9537, "timestamp_epoch": "1722307223.655701000", "display_filter": "frame.number == 9537", "tcp_stream": 83 }, { "frame_number": 9563, "timestamp_epoch": "1722307228.655923000", "display_filter": "frame.number == 9563", "tcp_stream": 83 }, { "frame_number": 9600, "timestamp_epoch": "1722307233.670802000", "display_filter": "frame.number == 9600", "tcp_stream": 83 }, { "frame_number": 9628, "timestamp_epoch": "1722307238.689465000", "display_filter": "frame.number == 9628", "tcp_stream": 83 }, { "frame_number": 9848, "timestamp_epoch": "1722307243.686663000", "display_filter": "frame.number == 9848", "tcp_stream": 83 }, { "frame_number": 9854, "timestamp_epoch": "1722307248.687387000", "display_filter": "frame.number == 9854", "tcp_stream": 83 }, { "frame_number": 9868, "timestamp_epoch": "1722307253.703161000", "display_filter": "frame.number == 9868", "tcp_stream": 83 }, { "frame_number": 9872, "timestamp_epoch": "1722307258.718573000", "display_filter": "frame.number == 9872", "tcp_stream": 83 }, { "frame_number": 9878, "timestamp_epoch": "1722307263.734502000", "display_filter": "frame.number == 9878", "tcp_stream": 83 }, { "frame_number": 9898, "timestamp_epoch": "1722307268.752428000", "display_filter": "frame.number == 9898", "tcp_stream": 83 }, { "frame_number": 9936, "timestamp_epoch": "1722307273.750641000", "display_filter": "frame.number == 9936", "tcp_stream": 83 }, { "frame_number": 9940, "timestamp_epoch": "1722307278.750755000", "display_filter": "frame.number == 9940", "tcp_stream": 83 }, { "frame_number": 9946, "timestamp_epoch": "1722307283.751067000", "display_filter": "frame.number == 9946", "tcp_stream": 83 }, { "frame_number": 9966, "timestamp_epoch": "1722307288.766569000", "display_filter": "frame.number == 9966", "tcp_stream": 83 }, { "frame_number": 9976, "timestamp_epoch": "1722307293.781736000", "display_filter": "frame.number == 9976", "tcp_stream": 83 }, { "frame_number": 9980, "timestamp_epoch": "1722307298.798229000", "display_filter": "frame.number == 9980", "tcp_stream": 83 }, { "frame_number": 10005, "timestamp_epoch": "1722307303.797738000", "display_filter": "frame.number == 10005", "tcp_stream": 83 }, { "frame_number": 10009, "timestamp_epoch": "1722307308.814125000", "display_filter": "frame.number == 10009", "tcp_stream": 83 }, { "frame_number": 10022, "timestamp_epoch": "1722307313.829783000", "display_filter": "frame.number == 10022", "tcp_stream": 83 }, { "frame_number": 10026, "timestamp_epoch": "1722307318.845553000", "display_filter": "frame.number == 10026", "tcp_stream": 83 }, { "frame_number": 10034, "timestamp_epoch": "1722307323.859221000", "display_filter": "frame.number == 10034", "tcp_stream": 83 }, { "frame_number": 10038, "timestamp_epoch": "1722307328.860897000", "display_filter": "frame.number == 10038", "tcp_stream": 83 }, { "frame_number": 10324, "timestamp_epoch": "1722307333.874718000", "display_filter": "frame.number == 10324", "tcp_stream": 83 }, { "frame_number": 10341, "timestamp_epoch": "1722307338.861786000", "display_filter": "frame.number == 10341", "tcp_stream": 83 }, { "frame_number": 10410, "timestamp_epoch": "1722307343.863235000", "display_filter": "frame.number == 10410", "tcp_stream": 83 }, { "frame_number": 10440, "timestamp_epoch": "1722307348.863221000", "display_filter": "frame.number == 10440", "tcp_stream": 83 }, { "frame_number": 10446, "timestamp_epoch": "1722307353.881984000", "display_filter": "frame.number == 10446", "tcp_stream": 83 }, { "frame_number": 10573, "timestamp_epoch": "1722307358.896658000", "display_filter": "frame.number == 10573", "tcp_stream": 83 }, { "frame_number": 10598, "timestamp_epoch": "1722307363.919570000", "display_filter": "frame.number == 10598", "tcp_stream": 83 }, { "frame_number": 10611, "timestamp_epoch": "1722307368.926738000", "display_filter": "frame.number == 10611", "tcp_stream": 83 }, { "frame_number": 10628, "timestamp_epoch": "1722307373.941649000", "display_filter": "frame.number == 10628", "tcp_stream": 83 }, { "frame_number": 10635, "timestamp_epoch": "1722307378.957744000", "display_filter": "frame.number == 10635", "tcp_stream": 83 }, { "frame_number": 10641, "timestamp_epoch": "1722307383.957867000", "display_filter": "frame.number == 10641", "tcp_stream": 83 }, { "frame_number": 10645, "timestamp_epoch": "1722307388.973605000", "display_filter": "frame.number == 10645", "tcp_stream": 83 }, { "frame_number": 10670, "timestamp_epoch": "1722307393.995675000", "display_filter": "frame.number == 10670", "tcp_stream": 83 }, { "frame_number": 10674, "timestamp_epoch": "1722307399.004521000", "display_filter": "frame.number == 10674", "tcp_stream": 83 }, { "frame_number": 10685, "timestamp_epoch": "1722307404.020389000", "display_filter": "frame.number == 10685", "tcp_stream": 83 }, { "frame_number": 10691, "timestamp_epoch": "1722307409.031263000", "display_filter": "frame.number == 10691", "tcp_stream": 83 }, { "frame_number": 10698, "timestamp_epoch": "1722307414.036292000", "display_filter": "frame.number == 10698", "tcp_stream": 83 }, { "frame_number": 10704, "timestamp_epoch": "1722307419.052502000", "display_filter": "frame.number == 10704", "tcp_stream": 83 }, { "frame_number": 10708, "timestamp_epoch": "1722307424.054124000", "display_filter": "frame.number == 10708", "tcp_stream": 83 }, { "frame_number": 10714, "timestamp_epoch": "1722307429.070650000", "display_filter": "frame.number == 10714", "tcp_stream": 83 }, { "frame_number": 10718, "timestamp_epoch": "1722307434.085404000", "display_filter": "frame.number == 10718", "tcp_stream": 83 }, { "frame_number": 10724, "timestamp_epoch": "1722307439.086546000", "display_filter": "frame.number == 10724", "tcp_stream": 83 }, { "frame_number": 10732, "timestamp_epoch": "1722307444.087181000", "display_filter": "frame.number == 10732", "tcp_stream": 83 }, { "frame_number": 10736, "timestamp_epoch": "1722307449.102690000", "display_filter": "frame.number == 10736", "tcp_stream": 83 }, { "frame_number": 10764, "timestamp_epoch": "1722307454.102881000", "display_filter": "frame.number == 10764", "tcp_stream": 83 }, { "frame_number": 11180, "timestamp_epoch": "1722307459.118143000", "display_filter": "frame.number == 11180", "tcp_stream": 83 }, { "frame_number": 11219, "timestamp_epoch": "1722307464.134675000", "display_filter": "frame.number == 11219", "tcp_stream": 83 }, { "frame_number": 11229, "timestamp_epoch": "1722307469.150403000", "display_filter": "frame.number == 11229", "tcp_stream": 83 }, { "frame_number": 11289, "timestamp_epoch": "1722307474.166073000", "display_filter": "frame.number == 11289", "tcp_stream": 83 }, { "frame_number": 11293, "timestamp_epoch": "1722307479.181285000", "display_filter": "frame.number == 11293", "tcp_stream": 83 }, { "frame_number": 11297, "timestamp_epoch": "1722307484.187370000", "display_filter": "frame.number == 11297", "tcp_stream": 83 }, { "frame_number": 11305, "timestamp_epoch": "1722307489.196917000", "display_filter": "frame.number == 11305", "tcp_stream": 83 }, { "frame_number": 11309, "timestamp_epoch": "1722307494.211813000", "display_filter": "frame.number == 11309", "tcp_stream": 83 }, { "frame_number": 11317, "timestamp_epoch": "1722307499.212360000", "display_filter": "frame.number == 11317", "tcp_stream": 83 }, { "frame_number": 11323, "timestamp_epoch": "1722307504.228199000", "display_filter": "frame.number == 11323", "tcp_stream": 83 }, { "frame_number": 11327, "timestamp_epoch": "1722307509.244303000", "display_filter": "frame.number == 11327", "tcp_stream": 83 }, { "frame_number": 11333, "timestamp_epoch": "1722307514.259231000", "display_filter": "frame.number == 11333", "tcp_stream": 83 }, { "frame_number": 11337, "timestamp_epoch": "1722307519.275350000", "display_filter": "frame.number == 11337", "tcp_stream": 83 }, { "frame_number": 11341, "timestamp_epoch": "1722307524.275832000", "display_filter": "frame.number == 11341", "tcp_stream": 83 }, { "frame_number": 11347, "timestamp_epoch": "1722307529.291501000", "display_filter": "frame.number == 11347", "tcp_stream": 83 }, { "frame_number": 11355, "timestamp_epoch": "1722307534.307413000", "display_filter": "frame.number == 11355", "tcp_stream": 83 }, { "frame_number": 11359, "timestamp_epoch": "1722307539.323069000", "display_filter": "frame.number == 11359", "tcp_stream": 83 }, { "frame_number": 11363, "timestamp_epoch": "1722307544.338888000", "display_filter": "frame.number == 11363", "tcp_stream": 83 }, { "frame_number": 11367, "timestamp_epoch": "1722307549.354667000", "display_filter": "frame.number == 11367", "tcp_stream": 83 }, { "frame_number": 11371, "timestamp_epoch": "1722307554.354605000", "display_filter": "frame.number == 11371", "tcp_stream": 83 }, { "frame_number": 11379, "timestamp_epoch": "1722307559.354706000", "display_filter": "frame.number == 11379", "tcp_stream": 83 }, { "frame_number": 11387, "timestamp_epoch": "1722307564.370482000", "display_filter": "frame.number == 11387", "tcp_stream": 83 }, { "frame_number": 11391, "timestamp_epoch": "1722307569.370380000", "display_filter": "frame.number == 11391", "tcp_stream": 83 }, { "frame_number": 11395, "timestamp_epoch": "1722307574.370651000", "display_filter": "frame.number == 11395", "tcp_stream": 83 }, { "frame_number": 11401, "timestamp_epoch": "1722307579.370379000", "display_filter": "frame.number == 11401", "tcp_stream": 83 }, { "frame_number": 11407, "timestamp_epoch": "1722307584.386421000", "display_filter": "frame.number == 11407", "tcp_stream": 83 }, { "frame_number": 11413, "timestamp_epoch": "1722307589.401900000", "display_filter": "frame.number == 11413", "tcp_stream": 83 }, { "frame_number": 11421, "timestamp_epoch": "1722307594.402322000", "display_filter": "frame.number == 11421", "tcp_stream": 83 }, { "frame_number": 11425, "timestamp_epoch": "1722307599.402520000", "display_filter": "frame.number == 11425", "tcp_stream": 83 }, { "frame_number": 11429, "timestamp_epoch": "1722307604.417425000", "display_filter": "frame.number == 11429", "tcp_stream": 83 }, { "frame_number": 11433, "timestamp_epoch": "1722307609.433632000", "display_filter": "frame.number == 11433", "tcp_stream": 83 }, { "frame_number": 11438, "timestamp_epoch": "1722307614.449540000", "display_filter": "frame.number == 11438", "tcp_stream": 83 }, { "frame_number": 11446, "timestamp_epoch": "1722307619.465394000", "display_filter": "frame.number == 11446", "tcp_stream": 83 }, { "frame_number": 11454, "timestamp_epoch": "1722307624.465005000", "display_filter": "frame.number == 11454", "tcp_stream": 83 }, { "frame_number": 11458, "timestamp_epoch": "1722307629.465451000", "display_filter": "frame.number == 11458", "tcp_stream": 83 }, { "frame_number": 11462, "timestamp_epoch": "1722307634.465668000", "display_filter": "frame.number == 11462", "tcp_stream": 83 }, { "frame_number": 11466, "timestamp_epoch": "1722307639.465698000", "display_filter": "frame.number == 11466", "tcp_stream": 83 }, { "frame_number": 11479, "timestamp_epoch": "1722307644.481768000", "display_filter": "frame.number == 11479", "tcp_stream": 83 }, { "frame_number": 11487, "timestamp_epoch": "1722307649.481781000", "display_filter": "frame.number == 11487", "tcp_stream": 83 }, { "frame_number": 11493, "timestamp_epoch": "1722307654.497140000", "display_filter": "frame.number == 11493", "tcp_stream": 83 }, { "frame_number": 11497, "timestamp_epoch": "1722307659.513012000", "display_filter": "frame.number == 11497", "tcp_stream": 83 }, { "frame_number": 11501, "timestamp_epoch": "1722307664.528534000", "display_filter": "frame.number == 11501", "tcp_stream": 83 }, { "frame_number": 11505, "timestamp_epoch": "1722307669.528988000", "display_filter": "frame.number == 11505", "tcp_stream": 83 }, { "frame_number": 11509, "timestamp_epoch": "1722307674.544693000", "display_filter": "frame.number == 11509", "tcp_stream": 83 }, { "frame_number": 11515, "timestamp_epoch": "1722307679.560410000", "display_filter": "frame.number == 11515", "tcp_stream": 83 }, { "frame_number": 11525, "timestamp_epoch": "1722307684.575346000", "display_filter": "frame.number == 11525", "tcp_stream": 83 }, { "frame_number": 11529, "timestamp_epoch": "1722307689.591650000", "display_filter": "frame.number == 11529", "tcp_stream": 83 }, { "frame_number": 11533, "timestamp_epoch": "1722307694.591832000", "display_filter": "frame.number == 11533", "tcp_stream": 83 }, { "frame_number": 11537, "timestamp_epoch": "1722307699.592098000", "display_filter": "frame.number == 11537", "tcp_stream": 83 }, { "frame_number": 11541, "timestamp_epoch": "1722307704.607645000", "display_filter": "frame.number == 11541", "tcp_stream": 83 } ], "metrics": { "source": "172.16.1.66", "destination": "141.98.10.79", "destination_port": 12132, "software_label": "STRRAT", "client_id": "1BE8292C", "claimed_hostname": "DESKTOP-SKBR25F", "claimed_account": "ccollier", "message_count": 102 } }, { "finding_id": "finding-dff75f3c13106191119b2a9f", "rule_id": "unclassified-external-tcp", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Sustained external TCP conversation outside decoded application coverage", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "confidence": 0.7, "status": "candidate", "evidence": [ { "frame_number": 9066, "tcp_stream": 83, "timestamp_epoch": "1722307205.953226", "display_filter": "tcp.stream == 83" } ], "metrics": { "source": "172.16.1.66", "destination": "141.98.10.79", "destination_port": 12132, "duration_seconds": 508.67, "packets": 411, "wire_bytes": 39064 } } ], "attack_candidates": [], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 174, "truncated": false }, "http_request": { "returned": 10, "truncated": false }, "http_response": { "returned": 2, "truncated": false }, "tls_client_hello": { "returned": 77, "truncated": false }, "dhcp": { "returned": 0, "truncated": false }, "identity": { "returned": 449, "truncated": false }, "directory_service": { "returned": 282, "truncated": false }, "unclassified_tcp": { "returned": 246, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 2, "hashed_objects": 2, "unique_hashes": 2, "returned_unique_hashes": 2, "detailed_objects": 2, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 316, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 11562 packets across 45 IP endpoints and 199 transport flows. Observed 174 DNS events, 10 HTTP requests, 77 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 1 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:09:03.146463+00:00", "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1", "source_semantic_sha256": "58e5064c997e69544c60ecc184cfd57339f05da2cfc2b75e8bf8ed7582621e64", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 157, "observables_checked": 157, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 157, "prior_cases_checked": 9, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [], "cross_case_correlations": [ { "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "default.exp-tas.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "go.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.5.93" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.215.55.144" }, { "type": "ipv4", "value": "23.96.180.189" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.13" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 45, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "arc.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "20.189.173.26" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.109.0.91" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 33, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "default.exp-tas.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.5.93" }, { "type": "ipv4", "value": "20.189.173.16" }, { "type": "ipv4", "value": "20.189.173.26" }, { "type": "ipv4", "value": "20.7.1.246" }, { "type": "ipv4", "value": "20.7.2.167" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "52.109.20.47" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 33, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.14" } ], "shared_count": 11, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 27, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "20.190.157.11" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.13" }, { "type": "ipv4", "value": "40.126.29.14" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 37, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "20.190.157.11" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 31, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.42.16" }, { "type": "ipv4", "value": "20.190.157.11" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.198.7.167" }, { "type": "ipv4", "value": "23.198.7.168" }, { "type": "ipv4", "value": "23.198.7.182" }, { "type": "ipv4", "value": "23.198.7.183" }, { "type": "ipv4", "value": "23.198.7.186" }, { "type": "ipv4", "value": "23.96.180.189" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.13" }, { "type": "ipv4", "value": "40.126.29.14" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 35, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api-msn-com.a-0003.a-msedge.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "config.edge.skype.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.42.16" }, { "type": "ipv4", "value": "20.189.173.16" }, { "type": "ipv4", "value": "20.190.157.11" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.96.180.189" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.14" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.109.0.91" }, { "type": "ipv4", "value": "52.109.20.47" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "ipv4", "value": "52.191.219.104" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 48, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "32e9d5fcf77c5a465a8b3ffc21d77a172a52a6eb0c40ad986ced99d0994dd0d3" }, "techniques": [], "apt_matches": [] }