{ "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "status": "completed", "filename": "2024-11-26-traffic-analysis-exercise.pcap", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "source_size_bytes": 21281925, "schema_version": "pcap-analysis-v1", "semantic_sha256": "4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 26922 packets across 61 IP endpoints and 276 transport flows. Observed 343 DNS events, 74 HTTP requests, 109 TLS ClientHello events, and 11 exported HTTP object(s). Deterministic rules produced 12 finding(s): 2 high, 2 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-11-26-traffic-analysis-exercise.pcap\nCapture SHA-256: `a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50`\nSemantic result SHA-256: `4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 26922 packets across 61 IP endpoints and 276 transport flows. Observed 343 DNS events, 74 HTTP requests, 109 TLS ClientHello events, and 11 exported HTTP object(s). Deterministic rules produced 12 finding(s): 2 high, 2 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 26922\n- Duration: 3259.651349 seconds\n- Captured bytes: 20851149\n- Endpoints: 61\n- Flows: 276\n\n## Deterministic findings\n\n### MEDIUM — Cleartext HTTP observed on TCP/443\n\nThe decoded application protocol is HTTP despite use of the conventional TLS port.\n\nRule: `http-on-tls-port@pcap-rules-v3`; confidence: 0.98; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v3`; confidence: 0.88; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"median_absolute_deviation\":0.091,\"median_interval_seconds\":60.154,\"method\":\"POST\",\"port\":443,\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### HIGH — Remote-access software network signature\n\nAn HTTP User-Agent explicitly identifies remote-access software. Validate authorization and endpoint ownership.\n\nRule: `remote-access-user-agent@pcap-rules-v3`; confidence: 0.95; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"destination\":\"194.180.191.64\",\"request_count\":58,\"source\":\"10.11.26.183\",\"user_agent\":\"NetSupport Manager/1.3\"}`\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v3`; confidence: 0.72; evidence: frame 20340 / TCP stream 77, frame 20342 / TCP stream 77, frame 20348 / TCP stream 77, frame 20350 / TCP stream 77, frame 20572 / TCP stream 77.\n\nMetrics: `{\"declared_body_bytes\":2624,\"destination\":\"194.180.191.64\",\"host\":\"194.180.191.64\",\"port\":443,\"request_count\":58,\"source\":\"10.11.26.183\",\"uri\":\"http://194.180.191.64/fakeurl.htm\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 23, frame 25, frame 189, frame 190, frame 902.\n\nMetrics: `{\"domain\":\"wpad.mshome.net\",\"response_count\":24,\"source\":\"10.11.26.183\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 19, frame 20, frame 185, frame 186, frame 898.\n\nMetrics: `{\"domain\":\"wpad.nemotoads.health\",\"response_count\":24,\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 304 / TCP stream 11, frame 309 / TCP stream 11, frame 312 / TCP stream 11, frame 315 / TCP stream 11, frame 486 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 36 / TCP stream 1, frame 43 / TCP stream 1, frame 46 / TCP stream 1, frame 359 / TCP stream 16, frame 371 / TCP stream 16.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":64,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 330 / TCP stream 10, frame 334 / TCP stream 10, frame 340 / TCP stream 10, frame 344 / TCP stream 10, frame 346 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.11.26.3\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.11.26.183\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 305 / TCP stream 11, frame 311 / TCP stream 11, frame 313 / TCP stream 11, frame 316 / TCP stream 11, frame 487 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.11.26.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 40 / TCP stream 1, frame 45 / TCP stream 1, frame 363 / TCP stream 16, frame 379 / TCP stream 16, frame 383 / TCP stream 16.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":49,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.11.26.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 333 / TCP stream 10, frame 337 / TCP stream 10, frame 342 / TCP stream 10, frame 345 / TCP stream 10, frame 348 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.11.26.183\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.11.26.3\"}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n- T1219 Remote Access Software (command-and-control), confidence=0.9, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `oboomwald`; client IPs: 10.11.26.183; frames: 213, 221, 223, 235, 275\n- full-name: `Oliver Q. Boomwald`; client IPs: 10.11.26.183; frames: 355\n- hostname: `DESKTOP-B8TQK49`; client IPs: 10.11.26.183; frames: 69, 70, 145, 146, 174\n- netbios-group: `NEMOTODES`; client IPs: unbound subject; frames: 71, 144, 176, 180, 191\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `armmf.adobe.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `classicgrand.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `code.jquery.com`; roles: dns-query, tls-sni\n- domain: `confirmsubscription.com`; roles: dns-query, tls-sni\n- domain: `css.createsend1.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `d33w6v2v5ta015.cloudfront.net`; roles: dns-cname\n- domain: `data-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `displaycatalog.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `edge-microsoft-com.dual-a-0036.a-msedge.net`; roles: dns-cname\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fa000000002.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000005.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000116.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000128.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fa000000163.resources.office.net`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fonts.googleapis.com`; roles: dns-query, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, tls-sni\n- domain: `geo.netsupportsoftware.com`; roles: dns-query, http-host\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `inputsuggestions.msdxcdn.microsoft.com`; roles: dns-query, tls-sni\n- domain: `js.createsend1.com`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: tls-sni\n- domain: `maps.googleapis.com`; roles: dns-query, tls-sni\n- domain: `maps.gstatic.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `modandcrackedapk.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nav.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nemotodes-dc.nemotoads.health`; roles: dns-query\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `r10.o.lencr.org`; roles: dns-query, http-host\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.mshome.net`; roles: dns-query\n- domain: `wpad.nemotoads.health`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.google.com`; roles: dns-query, tls-sni\n- domain: `www.gstatic.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `10.11.26.183`; roles: network-endpoint\n- ipv4: `10.11.26.255`; roles: network-endpoint\n- ipv4: `10.11.26.3`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.104`; roles: dns-answer\n- ipv4: `104.117.244.105`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.106`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.107`; roles: dns-answer\n- ipv4: `104.117.244.112`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.114`; roles: dns-answer\n- ipv4: `104.117.244.72`; roles: dns-answer\n- ipv4: `104.117.244.74`; roles: dns-answer\n- ipv4: `104.117.244.81`; roles: dns-answer\n- ipv4: `104.117.244.82`; roles: dns-answer\n- ipv4: `104.117.244.88`; roles: dns-answer\n- ipv4: `104.117.244.89`; roles: dns-answer\n- ipv4: `104.117.244.91`; roles: dns-answer\n- ipv4: `104.117.244.96`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.244.97`; roles: dns-answer\n- ipv4: `104.117.244.99`; roles: dns-answer\n- ipv4: `104.117.247.139`; roles: dns-answer\n- ipv4: `104.117.247.144`; roles: dns-answer\n- ipv4: `104.117.247.162`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.247.184`; roles: dns-answer, network-endpoint\n- ipv4: `104.117.247.186`; roles: dns-answer\n- ipv4: `104.117.247.67`; roles: dns-answer\n- ipv4: `104.117.247.99`; roles: dns-answer, network-endpoint\n- ipv4: `104.26.0.231`; roles: dns-answer\n- ipv4: `104.26.1.231`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.56.30.207`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `142.250.113.120`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.113.94`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.113.95`; roles: dns-answer\n- ipv4: `142.250.114.95`; roles: dns-answer\n- ipv4: `142.250.115.95`; roles: dns-answer, network-endpoint\n- ipv4: `142.250.138.94`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.116.95`; roles: dns-answer\n- ipv4: `142.251.186.103`; roles: dns-answer\n- ipv4: `142.251.186.104`; roles: dns-answer\n- ipv4: `142.251.186.105`; roles: dns-answer\n- ipv4: `142.251.186.106`; roles: dns-answer\n- ipv4: `142.251.186.147`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.186.95`; roles: dns-answer, network-endpoint\n- ipv4: `142.251.186.99`; roles: dns-answer\n- ipv4: `151.101.130.137`; roles: dns-answer\n- ipv4: `151.101.194.137`; roles: dns-answer\n- ipv4: `151.101.2.137`; roles: dns-answer\n- ipv4: `151.101.66.137`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.68.212`; roles: dns-answer\n- ipv4: `173.222.49.101`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.103`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.61`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.77`; roles: dns-answer\n- ipv4: `18.160.156.92`; roles: dns-answer\n- ipv4: `193.42.38.139`; roles: dns-answer, network-endpoint\n- ipv4: `194.180.191.64`; roles: http-host, network-endpoint\n- ipv4: `20.189.173.16`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.23`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.26`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.6`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.135.2`; roles: dns-answer\n- ipv4: `20.190.135.3`; roles: dns-answer\n- ipv4: `20.190.135.6`; roles: dns-answer\n- ipv4: `20.190.135.7`; roles: dns-answer\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.73.28`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.1.246`; roles: dns-answer, network-endpoint\n- ipv4: `20.7.2.167`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `20.99.184.37`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.239`; roles: dns-answer, network-endpoint\n- ipv4: `213.246.109.5`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.201.68.167`; roles: dns-answer, network-endpoint\n- ipv4: `23.204.171.61`; roles: dns-answer, network-endpoint\n- ipv4: `23.219.87.81`; roles: dns-answer\n- ipv4: `23.221.22.196`; roles: dns-answer\n- ipv4: `23.221.22.205`; roles: dns-answer\n- ipv4: `23.221.22.206`; roles: dns-answer\n- ipv4: `23.221.22.207`; roles: dns-answer\n- ipv4: `23.221.22.208`; roles: dns-answer\n- ipv4: `23.221.22.209`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.217`; roles: dns-answer\n- ipv4: `23.221.22.218`; roles: dns-answer\n- ipv4: `23.221.22.219`; roles: dns-answer\n- ipv4: `23.221.22.46`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.22.57`; roles: dns-answer\n- ipv4: `23.53.127.105`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.127.114`; roles: dns-answer\n- ipv4: `23.53.127.200`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `4.149.227.78`; roles: dns-answer, network-endpoint\n- ipv4: `4.150.155.223`; roles: dns-answer, network-endpoint\n- ipv4: `40.118.171.167`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.11`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.14`; roles: dns-answer\n- ipv4: `40.126.28.22`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: network-endpoint\n- ipv4: `40.126.7.32`; roles: dns-answer\n- ipv4: `52.109.0.136`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.47`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.89`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.165.164.15`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.112.67`; roles: dns-answer, network-endpoint\n- ipv4: `52.8.34.0`; roles: dns-answer, network-endpoint\n- ja3: `0652c09be13a164e73c3c66e2d5cd600`; roles: tls-client-fingerprint\n- ja3: `089117d8abb9d0685ac2756412f44d8c`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `0d7e324cc471d537395a5a84963ff4c0`; roles: tls-client-fingerprint\n- ja3: `10b3abe91219287930575e96187aab46`; roles: tls-client-fingerprint\n- ja3: `129a4a4460936a7d35cf0b4a876c02c5`; roles: tls-client-fingerprint\n- ja3: `1a41c18f74e0a1125e7eb86dc20da423`; roles: tls-client-fingerprint\n- ja3: `1aef2a0442d1535b67c961be49fbd9b0`; roles: tls-client-fingerprint\n- ja3: `1d2c110dc93a519d4c14a15898f20f6c`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `2800f914a7a4ba98aa9df62d316a460c`; roles: tls-client-fingerprint\n- ja3: `2dd32544ddd46095f157e79a028dcda9`; roles: tls-client-fingerprint\n- ja3: `2ef63960b5419ce0be770acb72a1e6d5`; roles: tls-client-fingerprint\n- ja3: `34578b889dbdfd86b5a0639eb869f9c5`; roles: tls-client-fingerprint\n- ja3: `39a2db8b2473a3d4cfe7cb23a26e03d6`; roles: tls-client-fingerprint\n- ja3: `46181092bc7467ccd870ec99523f7113`; roles: tls-client-fingerprint\n- ja3: `488f29e13a0873e296eb2dcca6ec38d0`; roles: tls-client-fingerprint\n- ja3: `4c24b4903c9a3c9b3c46306472bda896`; roles: tls-client-fingerprint\n- ja3: `53e42f80bc48a39739f5221b803b1f70`; roles: tls-client-fingerprint\n- ja3: `5c0851e1f7c97a5fdf8ee34bd73a8ff4`; roles: tls-client-fingerprint\n- ja3: `6634ba84945fce7cc2d7864edc49b103`; roles: tls-client-fingerprint\n- ja3: `68b3ecfaf0034bb9fcbecd518b5ab8d4`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `7117eb033929b913d5dbbef620c9ca24`; roles: tls-client-fingerprint\n- ja3: `7230db75fbd5472f76d02c10787af505`; roles: tls-client-fingerprint\n- ja3: `82fc3feb7b73141563a581cb3a02b9e2`; roles: tls-client-fingerprint\n- ja3: `893fda16143345fbd7d6384fd5f69a44`; roles: tls-client-fingerprint\n- ja3: `8f08a45cb17ce5d331bb4a861f26181f`; roles: tls-client-fingerprint\n- ja3: `910d5ef16eeb9c556a6f011876c16d38`; roles: tls-client-fingerprint\n- ja3: `9763df22d3de0549862e28d0f1103365`; roles: tls-client-fingerprint\n- ja3: `97cdfdfb6ce55b090e5070647c73305e`; roles: tls-client-fingerprint\n- ja3: `996d810fbaded0fd221205ee7a391364`; roles: tls-client-fingerprint\n- ja3: `9c5ffd0e64cc58a2ad1806964fe2da4e`; roles: tls-client-fingerprint\n- ja3: `a702db92a1dad8b0a7ddf9ef0fcf3d68`; roles: tls-client-fingerprint\n- ja3: `ab617a1bfb55ac132b8893703d7cfec3`; roles: tls-client-fingerprint\n- ja3: `af5ca235cbec16c4b5ad43da2bd9b40a`; roles: tls-client-fingerprint\n- ja3: `b13922eb23a33bd76cd8442814f25cb5`; roles: tls-client-fingerprint\n- ja3: `b6b910fa2621ea444621910f5e10aa4a`; roles: tls-client-fingerprint\n- ja3: `b8f7a95293e0d02d297ecef1efcc79d5`; roles: tls-client-fingerprint\n- ja3: `c73376907efd66947a8978eacfd15135`; roles: tls-client-fingerprint\n- ja3: `c806504b9d641f3b26d1af269ed474ab`; roles: tls-client-fingerprint\n- ja3: `c86423ffed1add9d50dccf646bd7fdbd`; roles: tls-client-fingerprint\n- ja3: `cbcf96af03d431db8e0fd90215b03309`; roles: tls-client-fingerprint\n- ja3: `d7268fba5c8ebdc86121861931c04402`; roles: tls-client-fingerprint\n- ja3: `e544273138fcf6e7dc137dd4f74d6fd0`; roles: tls-client-fingerprint\n- ja3: `e71e6cff682837413473fd63dc10f5d4`; roles: tls-client-fingerprint\n- ja3: `f24a7ea8a60779966dc83806405c4091`; roles: tls-client-fingerprint\n- ja3: `f82158b828f02d82f1f70fbb0f1d6145`; roles: tls-client-fingerprint\n- ja3: `fae0e5d973c96ae1888b99538efa0363`; roles: tls-client-fingerprint\n- sha256: `2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9`; roles: exported-object\n- sha256: `59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00`; roles: exported-object\n- sha256: `839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d`; roles: exported-object\n- sha256: `975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff`; roles: exported-object\n- sha256: `a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956`; roles: exported-object\n- sha256: `af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983`; roles: exported-object\n- sha256: `cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7`; roles: exported-object\n- sha256: `f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245`; roles: exported-object\n- url: `http://194.180.191.64/fakeurl.htm`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?778a0928305752e9`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce02e9976e1239e1`; roles: http-request\n- url: `http://geo.netsupportsoftware.com/location/loca.asp`; roles: http-request\n- url: `http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)`; roles: http-client\n- user_agent: `NetSupport Manager/1.3`; roles: http-client\n- exported object `MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D`; SHA-256 `cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7`; size 504 bytes\n- exported object `fakeurl(2).htm`; SHA-256 `839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d`; size 250 bytes\n- exported object `fakeurl(3).htm`; SHA-256 `a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956`; size 152 bytes\n- exported object `fakeurl(5).htm`; SHA-256 `59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752`; size 84 bytes\n- exported object `fakeurl(4).htm`; SHA-256 `f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245`; size 76 bytes\n- exported object `fakeurl(1).htm`; SHA-256 `79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00`; size 61 bytes\n- exported object `fakeurl(10).htm`; SHA-256 `975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff`; size 36 bytes\n- exported object `fakeurl(54).htm`; SHA-256 `2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9`; size 22 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `loca.asp`; SHA-256 `af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983`; size 16 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 33% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 20% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 17% TTP overlap. This is an investigation lead, not attribution.\n- Carbanak (G0008): 10% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 10% TTP overlap. This is an investigation lead, not attribution.\n- GOLD SOUTHFIELD (G0115): 10% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 10% TTP overlap. This is an investigation lead, not attribution.\n- DarkVishnya (G0105): 9% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 8% TTP overlap. This is an investigation lead, not attribution.\n- FIN4 (G0085): 8% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `82f0a542eadbd91c1d0554cf45b8bd4f69607e372cf96649bcd6ec9cab5fafb8`; recorded 2026-09-19T12:08:41.573203+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":243,\"observable_limit\":5000,\"observables_checked\":243,\"observables_total\":243,\"prior_case_limit_reached\":false,\"prior_cases_checked\":6,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Catalog T1219: https://attack.mitre.org/techniques/T1219; detection strategies: [{\"attack_id\":\"DET0496\",\"name\":\"Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)\",\"stix_id\":\"x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0\"}]\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 30 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 46 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 54 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":11,\"exported_objects\":66,\"hashed_bytes\":3596,\"hashed_objects\":66,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":11,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":11}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 12/12, identities 4/4, observables 243/243, artifacts 11/11. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 26922, "captured_bytes": 20851149, "first_packet_epoch": "1732596578.458138", "last_packet_epoch": "1732599838.109487", "duration_seconds": 3259.651349, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "source_size_bytes": 21281925, "protocol_counts": { "eth": 26922, "ethertype": 26922, "ip": 26544, "tcp": 25864, "tls": 4948, "x509sat": 861, "x509ce": 769, "udp": 680, "nbss": 388, "arp": 378, "dns": 343, "smb2": 292, "quic": 253, "spnego-krb5": 233, "dcerpc": 140, "gss-api": 136, "ldap": 120, "data": 104, "smb": 103, "spnego": 98, "http": 74, "pkix1implicit": 72, "urlencoded-form": 62, "ocsp": 48, "pkix1explicit": 32, "ntlmssp": 25, "pkcs-1": 22, "cldap": 20, "nbns": 20, "browser": 17, "nbdgm": 17, "kerberos": 16, "ssdp": 10, "ntp": 8, "mdns": 7, "data-text-lines": 3, "llmnr": 2 } }, "endpoints": [ { "endpoint_id": "endpoint-dddd3258e31c4299ae68e5b1", "ip": "10.11.26.183", "ip_version": 4, "is_private": true, "mac_addresses": [ "d0:57:7b:ce:fc:8b" ], "packets_sent": 11116, "packets_received": 15428, "bytes_sent": 1137636, "bytes_received": 19690833, "first_seen_epoch": "1732596578.458138", "last_seen_epoch": "1732599838.109487", "evidence_frames": [ 1, 2, 3, 4, 5 ] }, { "endpoint_id": "endpoint-fe2ff376f0ca8a29d25c63f9", "ip": "10.11.26.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 35, "bytes_sent": 0, "bytes_received": 5895, "first_seen_epoch": "1732596581.324171", "last_seen_epoch": "1732599467.2273", "evidence_frames": [ 69, 70, 71, 144, 145 ] }, { "endpoint_id": "endpoint-38f3eefe279572588c0433f6", "ip": "10.11.26.3", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:24:e8:7f:09:5d" ], "packets_sent": 710, "packets_received": 798, "bytes_sent": 165241, "bytes_received": 178123, "first_seen_epoch": "1732596578.458138", "last_seen_epoch": "1732599838.109487", "evidence_frames": [ 1, 2, 13, 14, 15 ] }, { "endpoint_id": "endpoint-902cdebaa8a7b04e1cd35289", "ip": "104.117.244.105", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 102, "packets_received": 58, "bytes_sent": 112045, "bytes_received": 7740, "first_seen_epoch": "1732596718.64304", "last_seen_epoch": "1732596719.305231", "evidence_frames": [ 20701, 20702, 20719, 20720, 20721 ] }, { "endpoint_id": "endpoint-18f161980de42f894d1a0328", "ip": "104.117.244.106", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 15, "packets_received": 11, "bytes_sent": 7076, "bytes_received": 3360, "first_seen_epoch": "1732596718.634025", "last_seen_epoch": "1732596748.724948", "evidence_frames": [ 20698, 20699, 20711, 20712, 20713 ] }, { "endpoint_id": "endpoint-46bab21d98fd1be40dc2da5d", "ip": "104.117.244.112", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 26, "packets_received": 27, "bytes_sent": 21818, "bytes_received": 2643, "first_seen_epoch": "1732596597.339791", "last_seen_epoch": "1732596717.610569", "evidence_frames": [ 448, 453, 454, 457, 492 ] }, { "endpoint_id": "endpoint-aea6644ecb7130a74e6067df", "ip": "104.117.244.96", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 16, "packets_received": 15, "bytes_sent": 6632, "bytes_received": 3422, "first_seen_epoch": "1732596623.053567", "last_seen_epoch": "1732596623.336309", "evidence_frames": [ 11974, 11985, 11986, 11987, 11988 ] }, { "endpoint_id": "endpoint-240961fca796de46304639ad", "ip": "104.117.247.162", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 26, "packets_received": 25, "bytes_sent": 10060, "bytes_received": 4492, "first_seen_epoch": "1732596718.631623", "last_seen_epoch": "1732596721.391269", "evidence_frames": [ 20695, 20703, 20704, 20705, 20706 ] }, { "endpoint_id": "endpoint-a828999f2b370dc49b796e49", "ip": "104.117.247.184", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 5, "packets_received": 5, "bytes_sent": 487, "bytes_received": 411, "first_seen_epoch": "1732596578.487823", "last_seen_epoch": "1732596578.613975", "evidence_frames": [ 3, 4, 5, 6, 7 ] }, { "endpoint_id": "endpoint-499bfbe92359dc4baad62ba2", "ip": "104.117.247.99", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 3, "packets_received": 5, "bytes_sent": 1070, "bytes_received": 540, "first_seen_epoch": "1732596640.794044", "last_seen_epoch": "1732596645.634232", "evidence_frames": [ 12781, 12786, 12787, 12788, 12789 ] }, { "endpoint_id": "endpoint-f8ccc683a6227f1cd7ac2fbe", "ip": "104.26.1.231", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 1416, "bytes_received": 478, "first_seen_epoch": "1732596645.687354", "last_seen_epoch": "1732596755.683244", "evidence_frames": [ 20333, 20334, 20335, 20336, 20337 ] }, { "endpoint_id": "endpoint-f2f3624abcf18fce253b6763", "ip": "13.107.21.239", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 40, "packets_received": 32, "bytes_sent": 16965, "bytes_received": 7564, "first_seen_epoch": "1732596611.334492", "last_seen_epoch": "1732596623.254432", "evidence_frames": [ 1183, 1185, 1186, 1187, 1188 ] }, { "endpoint_id": "endpoint-240692f3d1dc4113e54b3505", "ip": "13.107.246.57", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 20, "packets_received": 22, "bytes_sent": 8530, "bytes_received": 2427, "first_seen_epoch": "1732596606.79667", "last_seen_epoch": "1732596707.096145", "evidence_frames": [ 1055, 1056, 1057, 1058, 1059 ] }, { "endpoint_id": "endpoint-7ab5b949e58ec6df217ab622", "ip": "13.107.5.93", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 39, "packets_received": 24, "bytes_sent": 24967, "bytes_received": 4024, "first_seen_epoch": "1732596601.009913", "last_seen_epoch": "1732596671.497841", "evidence_frames": [ 946, 951, 952, 953, 963 ] }, { "endpoint_id": "endpoint-1c77dd8d3dc4b53f425ae841", "ip": "13.56.30.207", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 19, "packets_received": 17, "bytes_sent": 11101, "bytes_received": 3530, "first_seen_epoch": "1732596615.760262", "last_seen_epoch": "1732596623.273478", "evidence_frames": [ 2688, 3065, 3066, 3067, 3068 ] }, { "endpoint_id": "endpoint-8a04c48695152fe0368d3ee3", "ip": "142.250.113.120", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 59, "packets_received": 40, "bytes_sent": 75398, "bytes_received": 4799, "first_seen_epoch": "1732596615.341655", "last_seen_epoch": "1732596623.238174", "evidence_frames": [ 2111, 2146, 2147, 2148, 2149 ] }, { "endpoint_id": "endpoint-ae9551ea12e139ac333793f7", "ip": "142.250.113.94", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 176, "packets_received": 107, "bytes_sent": 241084, "bytes_received": 8868, "first_seen_epoch": "1732596616.528451", "last_seen_epoch": "1732596623.238364", "evidence_frames": [ 3791, 3805, 3807, 3809, 3810 ] }, { "endpoint_id": "endpoint-6bb93232b59e65c64c74f072", "ip": "142.250.115.95", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 256, "packets_received": 174, "bytes_sent": 317916, "bytes_received": 16239, "first_seen_epoch": "1732596615.346596", "last_seen_epoch": "1732596623.238736", "evidence_frames": [ 2115, 2150, 2151, 2152, 2153 ] }, { "endpoint_id": "endpoint-9f45821d37866e6d51f8b8cb", "ip": "142.250.138.94", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 135, "packets_received": 109, "bytes_sent": 156707, "bytes_received": 15251, "first_seen_epoch": "1732596614.805297", "last_seen_epoch": "1732596623.23839", "evidence_frames": [ 1758, 1762, 1764, 1769, 1770 ] }, { "endpoint_id": "endpoint-7171bf5a093e211bcdb36cee", "ip": "142.251.186.147", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 38, "packets_received": 33, "bytes_sent": 18458, "bytes_received": 7099, "first_seen_epoch": "1732596614.854072", "last_seen_epoch": "1732596623.247859", "evidence_frames": [ 1774, 1775, 1815, 1816, 1821 ] }, { "endpoint_id": "endpoint-95fb9d3aee7ee06c2b40b02b", "ip": "142.251.186.95", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 43, "packets_received": 35, "bytes_sent": 20016, "bytes_received": 7166, "first_seen_epoch": "1732596614.76669", "last_seen_epoch": "1732596623.238804", "evidence_frames": [ 1756, 1765, 1766, 1767, 1768 ] }, { "endpoint_id": "endpoint-420ca3f69e506a2e5fc62261", "ip": "151.101.66.137", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 38, "packets_received": 36, "bytes_sent": 38058, "bytes_received": 4563, "first_seen_epoch": "1732596616.783718", "last_seen_epoch": "1732596623.228345", "evidence_frames": [ 4023, 4115, 4116, 4119, 4120 ] }, { "endpoint_id": "endpoint-3cb71a61edcff972e7e591c2", "ip": "173.222.49.101", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 2283, "packets_received": 1159, "bytes_sent": 3233560, "bytes_received": 73445, "first_seen_epoch": "1732597499.635314", "last_seen_epoch": "1732597519.520604", "evidence_frames": [ 22388, 22389, 22390, 22391, 22392 ] }, { "endpoint_id": "endpoint-d13794ee3d4c84b5e551320e", "ip": "18.160.156.103", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 18, "packets_received": 16, "bytes_sent": 11289, "bytes_received": 3394, "first_seen_epoch": "1732596616.233957", "last_seen_epoch": "1732596623.228325", "evidence_frames": [ 3605, 3607, 3609, 3610, 3611 ] }, { "endpoint_id": "endpoint-e6f0c40aa079368101f140ae", "ip": "18.160.156.61", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 68, "packets_received": 54, "bytes_sent": 83202, "bytes_received": 5745, "first_seen_epoch": "1732596616.22375", "last_seen_epoch": "1732596623.228109", "evidence_frames": [ 3603, 3606, 3608, 3612, 3613 ] }, { "endpoint_id": "endpoint-40a896f593d946da38110167", "ip": "193.42.38.139", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 7600, "packets_received": 5648, "bytes_sent": 10782235, "bytes_received": 357829, "first_seen_epoch": "1732596614.320269", "last_seen_epoch": "1732596645.634119", "evidence_frames": [ 1378, 1400, 1404, 1405, 1406 ] }, { "endpoint_id": "endpoint-2c128e90faab83404c0d98fa", "ip": "194.180.191.64", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 59, "packets_received": 73, "bytes_sent": 4570, "bytes_received": 19976, "first_seen_epoch": "1732596645.642382", "last_seen_epoch": "1732599809.941747", "evidence_frames": [ 20330, 20338, 20339, 20340, 20341 ] }, { "endpoint_id": "endpoint-bdec53a11c4017494c66bc61", "ip": "20.189.173.16", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 12, "packets_received": 18, "bytes_sent": 7724, "bytes_received": 4387, "first_seen_epoch": "1732597789.028481", "last_seen_epoch": "1732597899.089646", "evidence_frames": [ 25978, 25979, 25980, 25981, 25982 ] }, { "endpoint_id": "endpoint-046af27172f33713a1526777", "ip": "20.189.173.23", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 33, "packets_received": 37, "bytes_sent": 21315, "bytes_received": 3715, "first_seen_epoch": "1732597328.413494", "last_seen_epoch": "1732597669.290192", "evidence_frames": [ 21759, 21760, 21761, 21762, 21763 ] }, { "endpoint_id": "endpoint-53cb514d17b48ccd5cde6d07", "ip": "20.189.173.26", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 22, "packets_received": 32, "bytes_sent": 15476, "bytes_received": 5756, "first_seen_epoch": "1732597494.150391", "last_seen_epoch": "1732599404.379613", "evidence_frames": [ 21829, 21830, 21831, 21832, 21833 ] }, { "endpoint_id": "endpoint-9aa86092f51cc5ef279d7f3d", "ip": "20.189.173.6", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 16, "packets_received": 19, "bytes_sent": 5732, "bytes_received": 7587, "first_seen_epoch": "1732597162.368648", "last_seen_epoch": "1732597163.120297", "evidence_frames": [ 21378, 21379, 21380, 21381, 21382 ] }, { "endpoint_id": "endpoint-b935ca904b6b7cd9b549adf4", "ip": "20.42.73.25", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 18, "packets_received": 22, "bytes_sent": 5952, "bytes_received": 7738, "first_seen_epoch": "1732598406.275405", "last_seen_epoch": "1732598407.038807", "evidence_frames": [ 26141, 26142, 26143, 26144, 26145 ] }, { "endpoint_id": "endpoint-6503787033c9958dcad22aeb", "ip": "20.42.73.28", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 13, "packets_received": 15, "bytes_sent": 5452, "bytes_received": 3110, "first_seen_epoch": "1732597249.500351", "last_seen_epoch": "1732597250.084444", "evidence_frames": [ 21612, 21613, 21614, 21615, 21616 ] }, { "endpoint_id": "endpoint-c6edcd774e21c24dbb797488", "ip": "20.7.1.246", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 14, "packets_received": 14, "bytes_sent": 5751, "bytes_received": 3347, "first_seen_epoch": "1732599747.554005", "last_seen_epoch": "1732599747.998083", "evidence_frames": [ 26871, 26872, 26873, 26874, 26875 ] }, { "endpoint_id": "endpoint-a8d536c59a71e663a4d255c9", "ip": "20.7.2.167", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 27, "packets_received": 43, "bytes_sent": 7734, "bytes_received": 5692, "first_seen_epoch": "1732596582.156201", "last_seen_epoch": "1732599746.888598", "evidence_frames": [ 149, 150, 151, 152, 153 ] }, { "endpoint_id": "endpoint-0eddba0875dd7bb3cd77b48e", "ip": "20.96.153.111", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 14, "packets_received": 16, "bytes_sent": 7727, "bytes_received": 3124, "first_seen_epoch": "1732596828.369897", "last_seen_epoch": "1732596954.730602", "evidence_frames": [ 21203, 21204, 21205, 21206, 21207 ] }, { "endpoint_id": "endpoint-44f91de09f12f8ad815f1c0c", "ip": "20.99.184.37", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 12, "packets_received": 12, "bytes_sent": 7263, "bytes_received": 2725, "first_seen_epoch": "1732597237.688816", "last_seen_epoch": "1732597238.15384", "evidence_frames": [ 21421, 21435, 21436, 21437, 21441 ] }, { "endpoint_id": "endpoint-12b49349dc0c565fe7876447", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 147, "packets_received": 121, "bytes_sent": 80282, "bytes_received": 22959, "first_seen_epoch": "1732596597.230836", "last_seen_epoch": "1732597726.769185", "evidence_frames": [ 441, 442, 443, 444, 449 ] }, { "endpoint_id": "endpoint-8a80b4e5dce30030389ac604", "ip": "204.79.197.239", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 45, "packets_received": 43, "bytes_sent": 20567, "bytes_received": 9309, "first_seen_epoch": "1732596615.747036", "last_seen_epoch": "1732596632.907691", "evidence_frames": [ 2572, 2735, 2737, 2738, 2739 ] }, { "endpoint_id": "endpoint-05d968b0b910b2948bdf7a5b", "ip": "213.246.109.5", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 2492, "packets_received": 1504, "bytes_sent": 3437553, "bytes_received": 112802, "first_seen_epoch": "1732596611.354223", "last_seen_epoch": "1732596632.992929", "evidence_frames": [ 1184, 1203, 1204, 1205, 1206 ] }, { "endpoint_id": "endpoint-8f576916d6fbc2a62cf8aa7c", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 7, "bytes_sent": 0, "bytes_received": 590, "first_seen_epoch": "1732596580.112726", "last_seen_epoch": "1732596626.289799", "evidence_frames": [ 51, 52, 63, 64, 12112 ] }, { "endpoint_id": "endpoint-05e1f8cc9742364fbbf0f79c", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 150, "first_seen_epoch": "1732596580.113038", "last_seen_epoch": "1732596581.248179", "evidence_frames": [ 53, 65 ] }, { "endpoint_id": "endpoint-aeedd40207249cf1e646628f", "ip": "23.201.68.167", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 8, "packets_received": 11, "bytes_sent": 4857, "bytes_received": 1459, "first_seen_epoch": "1732597316.914216", "last_seen_epoch": "1732597317.136573", "evidence_frames": [ 21725, 21726, 21727, 21728, 21729 ] }, { "endpoint_id": "endpoint-d09b84a523756efb2cb9bd0e", "ip": "23.204.171.61", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 11, "packets_received": 10, "bytes_sent": 7179, "bytes_received": 1263, "first_seen_epoch": "1732597237.707382", "last_seen_epoch": "1732597237.991651", "evidence_frames": [ 21424, 21425, 21426, 21427, 21428 ] }, { "endpoint_id": "endpoint-ef21be6bd059c089072e1c6d", "ip": "23.221.22.209", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 38, "packets_received": 29, "bytes_sent": 14133, "bytes_received": 10015, "first_seen_epoch": "1732596718.733467", "last_seen_epoch": "1732596719.45086", "evidence_frames": [ 20751, 20752, 20760, 20762, 20763 ] }, { "endpoint_id": "endpoint-d229900fed4384e82a5f806f", "ip": "23.221.22.46", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 65, "packets_received": 65, "bytes_sent": 76227, "bytes_received": 5583, "first_seen_epoch": "1732596598.26825", "last_seen_epoch": "1732596707.211552", "evidence_frames": [ 754, 755, 756, 757, 758 ] }, { "endpoint_id": "endpoint-38f97a28b424347765fba15e", "ip": "23.53.127.105", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 3, "packets_received": 5, "bytes_sent": 520, "bytes_received": 623, "first_seen_epoch": "1732597316.700471", "last_seen_epoch": "1732597317.032729", "evidence_frames": [ 21716, 21717, 21718, 21719, 21720 ] }, { "endpoint_id": "endpoint-d425336fc9254f62e625c3f0", "ip": "23.53.127.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 6, "packets_received": 7, "bytes_sent": 887, "bytes_received": 981, "first_seen_epoch": "1732599354.434358", "last_seen_epoch": "1732599414.645214", "evidence_frames": [ 26512, 26513, 26514, 26515, 26516 ] }, { "endpoint_id": "endpoint-2719b356348368ba8dd7527e", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 10, "bytes_sent": 0, "bytes_received": 1790, "first_seen_epoch": "1732596581.464546", "last_seen_epoch": "1732597253.847522", "evidence_frames": [ 82, 161, 192, 194, 198 ] }, { "endpoint_id": "endpoint-2201a2b8ceaf583f61dc0d01", "ip": "4.149.227.78", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 35, "packets_received": 34, "bytes_sent": 22628, "bytes_received": 7548, "first_seen_epoch": "1732596581.196918", "last_seen_epoch": "1732596582.060033", "evidence_frames": [ 61, 66, 67, 68, 72 ] }, { "endpoint_id": "endpoint-efbb88922866cd8919b02443", "ip": "4.150.155.223", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 22, "packets_received": 21, "bytes_sent": 16426, "bytes_received": 4399, "first_seen_epoch": "1732596600.273443", "last_seen_epoch": "1732596601.153303", "evidence_frames": [ 906, 907, 908, 909, 910 ] }, { "endpoint_id": "endpoint-736dea765077e855b701f14b", "ip": "40.118.171.167", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 12, "packets_received": 11, "bytes_sent": 7560, "bytes_received": 2965, "first_seen_epoch": "1732596638.045631", "last_seen_epoch": "1732596638.492931", "evidence_frames": [ 12722, 12723, 12724, 12725, 12726 ] }, { "endpoint_id": "endpoint-69d038ccf75f053d25395724", "ip": "40.126.28.11", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 11, "packets_received": 17, "bytes_sent": 7384, "bytes_received": 9818, "first_seen_epoch": "1732596601.039432", "last_seen_epoch": "1732596711.050858", "evidence_frames": [ 950, 960, 961, 962, 969 ] }, { "endpoint_id": "endpoint-704411e91cb47ebf524f2f00", "ip": "40.126.29.9", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 13, "packets_received": 20, "bytes_sent": 7436, "bytes_received": 2552, "first_seen_epoch": "1732596597.504413", "last_seen_epoch": "1732596611.693678", "evidence_frames": [ 565, 585, 587, 588, 621 ] }, { "endpoint_id": "endpoint-391119c528ad19a1334a68d3", "ip": "52.109.0.136", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 29, "packets_received": 22, "bytes_sent": 33941, "bytes_received": 7070, "first_seen_epoch": "1732597498.259145", "last_seen_epoch": "1732597519.520715", "evidence_frames": [ 22278, 22312, 22313, 22314, 22334 ] }, { "endpoint_id": "endpoint-e4184e1b12122e81eff9b8bd", "ip": "52.109.20.47", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 13, "packets_received": 15, "bytes_sent": 7724, "bytes_received": 1579, "first_seen_epoch": "1732596597.880121", "last_seen_epoch": "1732596721.990896", "evidence_frames": [ 692, 712, 714, 715, 717 ] }, { "endpoint_id": "endpoint-c725adb8c7510219876dbde4", "ip": "52.109.8.89", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 17, "packets_received": 21, "bytes_sent": 9355, "bytes_received": 2037, "first_seen_epoch": "1732596597.375027", "last_seen_epoch": "1732596730.390869", "evidence_frames": [ 456, 526, 527, 530, 574 ] }, { "endpoint_id": "endpoint-b25afddee8a9b871d9f60091", "ip": "52.113.194.132", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 382, "packets_received": 232, "bytes_sent": 429861, "bytes_received": 33420, "first_seen_epoch": "1732596662.928467", "last_seen_epoch": "1732598613.825647", "evidence_frames": [ 20498, 20499, 20500, 20501, 20502 ] }, { "endpoint_id": "endpoint-5fea0d1ff280bf754442b478", "ip": "52.165.164.15", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 57, "packets_received": 74, "bytes_sent": 27656, "bytes_received": 80615, "first_seen_epoch": "1732597242.95615", "last_seen_epoch": "1732597247.964095", "evidence_frames": [ 21476, 21477, 21478, 21479, 21480 ] }, { "endpoint_id": "endpoint-8b1338b5bc5268969389171d", "ip": "52.168.112.67", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 22, "packets_received": 25, "bytes_sent": 5995, "bytes_received": 18469, "first_seen_epoch": "1732596648.381812", "last_seen_epoch": "1732596648.987336", "evidence_frames": [ 20354, 20355, 20356, 20357, 20358 ] }, { "endpoint_id": "endpoint-1b3554e41891e4c142b0ad35", "ip": "52.8.34.0", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:17:e0:b8:29:5e" ], "packets_sent": 20, "packets_received": 18, "bytes_sent": 12635, "bytes_received": 3436, "first_seen_epoch": "1732596614.236894", "last_seen_epoch": "1732596623.273238", "evidence_frames": [ 1338, 1363, 1364, 1365, 1366 ] } ], "identities": [ { "identity_id": "identity-fd47d673fd5747084676d0a3", "type": "account", "value": "oboomwald", "ip_addresses": [ "10.11.26.183" ], "mac_addresses": [ "d0:57:7b:ce:fc:8b" ], "evidence": [ { "frame_number": 213, "timestamp_epoch": "1732596595.423123000", "display_filter": "frame.number == 213", "tcp_stream": 6 }, { "frame_number": 221, "timestamp_epoch": "1732596595.429067000", "display_filter": "frame.number == 221", "tcp_stream": 7 }, { "frame_number": 223, "timestamp_epoch": "1732596595.431118000", "display_filter": "frame.number == 223", "tcp_stream": 7 }, { "frame_number": 235, "timestamp_epoch": "1732596595.434581000", "display_filter": "frame.number == 235", "tcp_stream": 8 }, { "frame_number": 275, "timestamp_epoch": "1732596595.584724000", "display_filter": "frame.number == 275", "tcp_stream": 13 }, { "frame_number": 279, "timestamp_epoch": "1732596595.584902000", "display_filter": "frame.number == 279", "tcp_stream": 12 }, { "frame_number": 298, "timestamp_epoch": "1732596595.586603000", "display_filter": "frame.number == 298", "tcp_stream": 14 }, { "frame_number": 355, "timestamp_epoch": "1732596595.594089000", "display_filter": "frame.number == 355", "tcp_stream": 10 }, { "frame_number": 421, "timestamp_epoch": "1732596595.833972000", "display_filter": "frame.number == 421", "tcp_stream": 19 }, { "frame_number": 21173, "timestamp_epoch": "1732596827.744857000", "display_filter": "frame.number == 21173", "tcp_stream": 94 } ], "bindings": [ { "frame_number": 213, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.3", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 221, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.3", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 223, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 235, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 275, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 279, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 298, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 355, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "oboomwald", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 421, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 21173, "relationship": "kerberos-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "oboomwald" ] }, { "identity_id": "identity-c0280ad99582cbbb7ad5d540", "type": "full-name", "value": "Oliver Q. Boomwald", "ip_addresses": [ "10.11.26.183" ], "mac_addresses": [], "evidence": [ { "frame_number": 355, "timestamp_epoch": "1732596595.594089000", "display_filter": "frame.number == 355", "tcp_stream": 10 } ], "bindings": [ { "frame_number": 355, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.3", "conversation_dst": "10.11.26.183", "account": "oboomwald", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Oliver Q. Boomwald" ] }, { "identity_id": "identity-485ba9018a9ace8de5f9b397", "type": "hostname", "value": "DESKTOP-B8TQK49", "ip_addresses": [ "10.11.26.183" ], "mac_addresses": [ "d0:57:7b:ce:fc:8b" ], "evidence": [ { "frame_number": 69, "timestamp_epoch": "1732596581.324171000", "display_filter": "frame.number == 69", "udp_stream": 12 }, { "frame_number": 70, "timestamp_epoch": "1732596581.324270000", "display_filter": "frame.number == 70", "udp_stream": 12 }, { "frame_number": 145, "timestamp_epoch": "1732596582.087011000", "display_filter": "frame.number == 145", "udp_stream": 12 }, { "frame_number": 146, "timestamp_epoch": "1732596582.087011000", "display_filter": "frame.number == 146", "udp_stream": 12 }, { "frame_number": 174, "timestamp_epoch": "1732596582.863956000", "display_filter": "frame.number == 174", "udp_stream": 12 }, { "frame_number": 175, "timestamp_epoch": "1732596582.863956000", "display_filter": "frame.number == 175", "udp_stream": 12 }, { "frame_number": 181, "timestamp_epoch": "1732596583.619885000", "display_filter": "frame.number == 181", "udp_stream": 12 }, { "frame_number": 182, "timestamp_epoch": "1732596583.620016000", "display_filter": "frame.number == 182", "udp_stream": 12 }, { "frame_number": 200, "timestamp_epoch": "1732596587.487349000", "display_filter": "frame.number == 200", "udp_stream": 18 }, { "frame_number": 201, "timestamp_epoch": "1732596587.491453000", "display_filter": "frame.number == 201", "udp_stream": 18 }, { "frame_number": 1092, "timestamp_epoch": "1732596610.399200000", "display_filter": "frame.number == 1092", "udp_stream": 18 }, { "frame_number": 1103, "timestamp_epoch": "1732596610.419229000", "display_filter": "frame.number == 1103", "tcp_stream": 37 }, { "frame_number": 1109, "timestamp_epoch": "1732596610.422359000", "display_filter": "frame.number == 1109", "udp_stream": 18 }, { "frame_number": 1112, "timestamp_epoch": "1732596610.434887000", "display_filter": "frame.number == 1112", "udp_stream": 18 }, { "frame_number": 12755, "timestamp_epoch": "1732596640.456514000", "display_filter": "frame.number == 12755", "tcp_stream": 74 }, { "frame_number": 12761, "timestamp_epoch": "1732596640.459523000", "display_filter": "frame.number == 12761", "udp_stream": 18 }, { "frame_number": 12764, "timestamp_epoch": "1732596640.476277000", "display_filter": "frame.number == 12764", "udp_stream": 18 }, { "frame_number": 20528, "timestamp_epoch": "1732596670.484518000", "display_filter": "frame.number == 20528", "tcp_stream": 85 }, { "frame_number": 20534, "timestamp_epoch": "1732596670.489238000", "display_filter": "frame.number == 20534", "udp_stream": 18 }, { "frame_number": 20537, "timestamp_epoch": "1732596670.509451000", "display_filter": "frame.number == 20537", "udp_stream": 18 } ], "bindings": [ { "frame_number": 69, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 70, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 145, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 146, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 174, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 175, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 181, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 182, "relationship": "netbios-registration", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 200, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 201, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.server" }, { "frame_number": 1092, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 1103, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.3", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 1109, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 1112, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 12755, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.3", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 12761, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 12764, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 20528, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.3", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 20534, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 20537, "relationship": "client-asserted", "owner_ip": "10.11.26.183", "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "browser.response_computer_name" } ], "raw_values": [ "DESKTOP-B8TQK49", "DESKTOP-B8TQK49<00>,DESKTOP-B8TQK49<00> (Workstation/Redirector)", "DESKTOP-B8TQK49<20>,DESKTOP-B8TQK49<20> (Server service)" ] }, { "identity_id": "identity-daeac9de21ccaa814c532d97", "type": "netbios-group", "value": "NEMOTODES", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 71, "timestamp_epoch": "1732596581.324341000", "display_filter": "frame.number == 71", "udp_stream": 12 }, { "frame_number": 144, "timestamp_epoch": "1732596582.086915000", "display_filter": "frame.number == 144", "udp_stream": 12 }, { "frame_number": 176, "timestamp_epoch": "1732596582.864083000", "display_filter": "frame.number == 176", "udp_stream": 12 }, { "frame_number": 180, "timestamp_epoch": "1732596583.619885000", "display_filter": "frame.number == 180", "udp_stream": 12 }, { "frame_number": 191, "timestamp_epoch": "1732596584.407629000", "display_filter": "frame.number == 191", "udp_stream": 12 }, { "frame_number": 193, "timestamp_epoch": "1732596585.167073000", "display_filter": "frame.number == 193", "udp_stream": 12 }, { "frame_number": 197, "timestamp_epoch": "1732596585.940378000", "display_filter": "frame.number == 197", "udp_stream": 12 }, { "frame_number": 199, "timestamp_epoch": "1732596586.702380000", "display_filter": "frame.number == 199", "udp_stream": 12 } ], "bindings": [ { "frame_number": 71, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 144, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 176, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 180, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 191, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 193, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 197, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 199, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.11.26.183", "conversation_dst": "10.11.26.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "NEMOTODES<00>,NEMOTODES<00> (Workstation/Redirector)", "NEMOTODES<1e>,NEMOTODES<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-f901a01d1e8e966477a1758e", "transport": "udp", "stream": 0, "initiator_ip": "10.11.26.183", "initiator_port": 65460, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1, "last_frame": 2, "first_seen_epoch": "1732596578.458138", "last_seen_epoch": "1732596578.487199", "packets": 2, "bytes": 310, "initiator_bytes": 83, "responder_bytes": 227 }, { "flow_id": "flow-eda4675831bcea4f5beb47d2", "transport": "tcp", "stream": 0, "initiator_ip": "10.11.26.183", "initiator_port": 53279, "responder_ip": "104.117.247.184", "responder_port": 80, "first_frame": 3, "last_frame": 12, "first_seen_epoch": "1732596578.487823", "last_seen_epoch": "1732596578.613975", "packets": 10, "bytes": 898, "initiator_bytes": 411, "responder_bytes": 487 }, { "flow_id": "flow-728020a7ff30dda3a80d8eec", "transport": "udp", "stream": 1, "initiator_ip": "10.11.26.183", "initiator_port": 55542, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 13, "last_frame": 18, "first_seen_epoch": "1732596578.918598", "last_seen_epoch": "1732596578.919107", "packets": 2, "bytes": 301, "initiator_bytes": 118, "responder_bytes": 183 }, { "flow_id": "flow-4beb8e5f82f1603b1e251576", "transport": "udp", "stream": 2, "initiator_ip": "10.11.26.183", "initiator_port": 49685, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 14, "last_frame": 17, "first_seen_epoch": "1732596578.918662", "last_seen_epoch": "1732596578.919063", "packets": 2, "bytes": 301, "initiator_bytes": 118, "responder_bytes": 183 }, { "flow_id": "flow-d081531e32797eec610238df", "transport": "udp", "stream": 3, "initiator_ip": "10.11.26.183", "initiator_port": 56341, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 15, "last_frame": 25, "first_seen_epoch": "1732596578.91879", "last_seen_epoch": "1732596578.919535", "packets": 4, "bytes": 474, "initiator_bytes": 156, "responder_bytes": 318 }, { "flow_id": "flow-6cee7092f4e8963e01730c1a", "transport": "udp", "stream": 4, "initiator_ip": "10.11.26.183", "initiator_port": 63714, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 16, "last_frame": 23, "first_seen_epoch": "1732596578.918835", "last_seen_epoch": "1732596578.919448", "packets": 4, "bytes": 474, "initiator_bytes": 156, "responder_bytes": 318 }, { "flow_id": "flow-45439a6bc84d75907e0915c6", "transport": "udp", "stream": 5, "initiator_ip": "10.11.26.183", "initiator_port": 63716, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 24, "last_frame": 28, "first_seen_epoch": "1732596578.91949", "last_seen_epoch": "1732596578.920755", "packets": 4, "bytes": 1000, "initiator_bytes": 538, "responder_bytes": 462 }, { "flow_id": "flow-e4b1edf06f53da77eb06f755", "transport": "tcp", "stream": 1, "initiator_ip": "10.11.26.183", "initiator_port": 53280, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 29, "last_frame": 49, "first_seen_epoch": "1732596579.028802", "last_seen_epoch": "1732596579.034837", "packets": 15, "bytes": 6394, "initiator_bytes": 2976, "responder_bytes": 3418 }, { "flow_id": "flow-e4b8e5940b9970e7d07f9e1f", "transport": "tcp", "stream": 2, "initiator_ip": "10.11.26.183", "initiator_port": 53281, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 30, "last_frame": 38, "first_seen_epoch": "1732596579.028854", "last_seen_epoch": "1732596579.02966", "packets": 6, "bytes": 372, "initiator_bytes": 186, "responder_bytes": 186 }, { "flow_id": "flow-e3fa9e434c1ec25fced674e6", "transport": "udp", "stream": 6, "initiator_ip": "10.11.26.183", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 51, "last_frame": 12371, "first_seen_epoch": "1732596580.112726", "last_seen_epoch": "1732596626.289799", "packets": 7, "bytes": 590, "initiator_bytes": 590, "responder_bytes": 0 }, { "flow_id": "flow-9294926681a2981cf1a95bc5", "transport": "udp", "stream": 7, "initiator_ip": "10.11.26.183", "initiator_port": 64388, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 53, "last_frame": 53, "first_seen_epoch": "1732596580.113038", "last_seen_epoch": "1732596580.113038", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-f14443279afabee99f577c67", "transport": "udp", "stream": 8, "initiator_ip": "10.11.26.183", "initiator_port": 59980, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 55, "last_frame": 56, "first_seen_epoch": "1732596580.633212", "last_seen_epoch": "1732596580.654972", "packets": 2, "bytes": 330, "initiator_bytes": 122, "responder_bytes": 208 }, { "flow_id": "flow-a36c2a8c3a06f3cccb2ab9fb", "transport": "udp", "stream": 9, "initiator_ip": "10.11.26.183", "initiator_port": 56066, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 57, "last_frame": 58, "first_seen_epoch": "1732596580.680041", "last_seen_epoch": "1732596580.699884", "packets": 2, "bytes": 268, "initiator_bytes": 91, "responder_bytes": 177 }, { "flow_id": "flow-1b6de99dbbb9739cee155ef8", "transport": "udp", "stream": 10, "initiator_ip": "10.11.26.183", "initiator_port": 59726, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 59, "last_frame": 60, "first_seen_epoch": "1732596581.134947", "last_seen_epoch": "1732596581.194894", "packets": 2, "bytes": 370, "initiator_bytes": 86, "responder_bytes": 284 }, { "flow_id": "flow-27b5e2eff5f5e841039d8f74", "transport": "tcp", "stream": 3, "initiator_ip": "10.11.26.183", "initiator_port": 53282, "responder_ip": "4.149.227.78", "responder_port": 443, "first_frame": 61, "last_frame": 106, "first_seen_epoch": "1732596581.196918", "last_seen_epoch": "1732596581.682785", "packets": 35, "bytes": 15106, "initiator_bytes": 3774, "responder_bytes": 11332 }, { "flow_id": "flow-c6f1db943c328f20a1619816", "transport": "udp", "stream": 11, "initiator_ip": "10.11.26.183", "initiator_port": 52601, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 65, "last_frame": 65, "first_seen_epoch": "1732596581.248179", "last_seen_epoch": "1732596581.248179", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-60c037d4d82417d4b338b3d0", "transport": "udp", "stream": 12, "initiator_ip": "10.11.26.183", "initiator_port": 137, "responder_ip": "10.11.26.255", "responder_port": 137, "first_frame": 69, "last_frame": 12745, "first_seen_epoch": "1732596581.324171", "last_seen_epoch": "1732596640.453185", "packets": 18, "bytes": 1944, "initiator_bytes": 1944, "responder_bytes": 0 }, { "flow_id": "flow-29ec5d7050a6fd847d406326", "transport": "udp", "stream": 13, "initiator_ip": "10.11.26.183", "initiator_port": 53800, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 80, "last_frame": 81, "first_seen_epoch": "1732596581.401527", "last_seen_epoch": "1732596581.401879", "packets": 2, "bytes": 330, "initiator_bytes": 122, "responder_bytes": 208 }, { "flow_id": "flow-d1fdce43def4fedbd5317da4", "transport": "udp", "stream": 14, "initiator_ip": "10.11.26.183", "initiator_port": 52603, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 82, "last_frame": 21661, "first_seen_epoch": "1732596581.464546", "last_seen_epoch": "1732597253.847522", "packets": 10, "bytes": 1790, "initiator_bytes": 1790, "responder_bytes": 0 }, { "flow_id": "flow-c9700af7f1c961120da722d6", "transport": "tcp", "stream": 4, "initiator_ip": "10.11.26.183", "initiator_port": 53283, "responder_ip": "4.149.227.78", "responder_port": 443, "first_frame": 104, "last_frame": 143, "first_seen_epoch": "1732596581.597608", "last_seen_epoch": "1732596582.060033", "packets": 34, "bytes": 15070, "initiator_bytes": 3774, "responder_bytes": 11296 }, { "flow_id": "flow-51705e4a18ef833de3c5f08d", "transport": "udp", "stream": 15, "initiator_ip": "10.11.26.183", "initiator_port": 50534, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 110, "last_frame": 148, "first_seen_epoch": "1732596581.705829", "last_seen_epoch": "1732596582.155551", "packets": 6, "bytes": 821, "initiator_bytes": 295, "responder_bytes": 526 }, { "flow_id": "flow-08ee8b9f3ed49c20d4c59e96", "transport": "tcp", "stream": 5, "initiator_ip": "10.11.26.183", "initiator_port": 53284, "responder_ip": "20.7.2.167", "responder_port": 443, "first_frame": 149, "last_frame": 26868, "first_seen_epoch": "1732596582.156201", "last_seen_epoch": "1732599746.888598", "packets": 70, "bytes": 13426, "initiator_bytes": 5692, "responder_bytes": 7734 }, { "flow_id": "flow-b6d5539ef7141a6819b558dc", "transport": "udp", "stream": 16, "initiator_ip": "10.11.26.183", "initiator_port": 50366, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 183, "last_frame": 440, "first_seen_epoch": "1732596584.2522", "last_seen_epoch": "1732596597.228818", "packets": 6, "bytes": 699, "initiator_bytes": 231, "responder_bytes": 468 }, { "flow_id": "flow-7450262231fdf7b04e52f4b1", "transport": "udp", "stream": 17, "initiator_ip": "10.11.26.183", "initiator_port": 61048, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 184, "last_frame": 21375, "first_seen_epoch": "1732596584.2522", "last_seen_epoch": "1732597158.422564", "packets": 14, "bytes": 1590, "initiator_bytes": 544, "responder_bytes": 1046 }, { "flow_id": "flow-4655a663686263653df755a5", "transport": "udp", "stream": 18, "initiator_ip": "10.11.26.183", "initiator_port": 138, "responder_ip": "10.11.26.255", "responder_port": 138, "first_frame": 200, "last_frame": 26550, "first_seen_epoch": "1732596587.487349", "last_seen_epoch": "1732599467.2273", "packets": 17, "bytes": 3951, "initiator_bytes": 3951, "responder_bytes": 0 }, { "flow_id": "flow-56e2ee6df921b39513d8f6c1", "transport": "udp", "stream": 19, "initiator_ip": "10.11.26.183", "initiator_port": 50367, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 206, "last_frame": 209, "first_seen_epoch": "1732596595.311729", "last_seen_epoch": "1732596595.322106", "packets": 4, "bytes": 1000, "initiator_bytes": 538, "responder_bytes": 462 }, { "flow_id": "flow-a20007ae481f76ed2f4f3d7d", "transport": "tcp", "stream": 6, "initiator_ip": "10.11.26.183", "initiator_port": 53286, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 210, "last_frame": 217, "first_seen_epoch": "1732596595.422595", "last_seen_epoch": "1732596595.424406", "packets": 8, "bytes": 898, "initiator_bytes": 467, "responder_bytes": 431 }, { "flow_id": "flow-711e3ca6784c7ae6329d10a9", "transport": "tcp", "stream": 7, "initiator_ip": "10.11.26.183", "initiator_port": 53287, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 218, "last_frame": 227, "first_seen_epoch": "1732596595.428676", "last_seen_epoch": "1732596595.431301", "packets": 10, "bytes": 2647, "initiator_bytes": 607, "responder_bytes": 2040 }, { "flow_id": "flow-f01eb05091a77a2f80238aa3", "transport": "tcp", "stream": 8, "initiator_ip": "10.11.26.183", "initiator_port": 53288, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 228, "last_frame": 240, "first_seen_epoch": "1732596595.431489", "last_seen_epoch": "1732596595.434907", "packets": 13, "bytes": 4109, "initiator_bytes": 2014, "responder_bytes": 2095 }, { "flow_id": "flow-6bb8689a5e1f5099128b48fb", "transport": "udp", "stream": 20, "initiator_ip": "10.11.26.183", "initiator_port": 50368, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 241, "last_frame": 244, "first_seen_epoch": "1732596595.476252", "last_seen_epoch": "1732596595.477246", "packets": 4, "bytes": 999, "initiator_bytes": 537, "responder_bytes": 462 }, { "flow_id": "flow-99b5b499f4f7a5c3e81635cc", "transport": "tcp", "stream": 9, "initiator_ip": "10.11.26.183", "initiator_port": 53289, "responder_ip": "10.11.26.3", "responder_port": 135, "first_frame": 245, "last_frame": 1091, "first_seen_epoch": "1732596595.579414", "last_seen_epoch": "1732596609.076559", "packets": 14, "bytes": 2052, "initiator_bytes": 964, "responder_bytes": 1088 }, { "flow_id": "flow-354a43d0f5598d292de3e706", "transport": "tcp", "stream": 10, "initiator_ip": "10.11.26.183", "initiator_port": 53290, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 250, "last_frame": 1051, "first_seen_epoch": "1732596595.580147", "last_seen_epoch": "1732596606.289079", "packets": 63, "bytes": 17329, "initiator_bytes": 10100, "responder_bytes": 7229 }, { "flow_id": "flow-e525da9b625e6d03bd57f5c7", "transport": "tcp", "stream": 11, "initiator_ip": "10.11.26.183", "initiator_port": 53291, "responder_ip": "10.11.26.3", "responder_port": 49671, "first_frame": 257, "last_frame": 12591, "first_seen_epoch": "1732596595.581014", "last_seen_epoch": "1732596629.070414", "packets": 22, "bytes": 6060, "initiator_bytes": 3996, "responder_bytes": 2064 }, { "flow_id": "flow-aaf56902aa0505daa00b840a", "transport": "tcp", "stream": 12, "initiator_ip": "10.11.26.183", "initiator_port": 53292, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 262, "last_frame": 285, "first_seen_epoch": "1732596595.582494", "last_seen_epoch": "1732596595.585066", "packets": 12, "bytes": 4301, "initiator_bytes": 2166, "responder_bytes": 2135 }, { "flow_id": "flow-10f4c6a3913e639e12be7643", "transport": "tcp", "stream": 13, "initiator_ip": "10.11.26.183", "initiator_port": 53293, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 264, "last_frame": 281, "first_seen_epoch": "1732596595.582707", "last_seen_epoch": "1732596595.584923", "packets": 12, "bytes": 4339, "initiator_bytes": 2184, "responder_bytes": 2155 }, { "flow_id": "flow-1c8363310dbb09d2bd15aa41", "transport": "tcp", "stream": 14, "initiator_ip": "10.11.26.183", "initiator_port": 53294, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 288, "last_frame": 303, "first_seen_epoch": "1732596595.58532", "last_seen_epoch": "1732596595.586753", "packets": 12, "bytes": 3952, "initiator_bytes": 1962, "responder_bytes": 1990 }, { "flow_id": "flow-7c89b80964aca6f49acb4548", "transport": "tcp", "stream": 15, "initiator_ip": "10.11.26.183", "initiator_port": 53295, "responder_ip": "10.11.26.3", "responder_port": 49693, "first_frame": 335, "last_frame": 1090, "first_seen_epoch": "1732596595.59087", "last_seen_epoch": "1732596609.076539", "packets": 12, "bytes": 3121, "initiator_bytes": 1667, "responder_bytes": 1454 }, { "flow_id": "flow-929a1adc4dcdf7dc8ea91a34", "transport": "tcp", "stream": 16, "initiator_ip": "10.11.26.183", "initiator_port": 53296, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 354, "last_frame": 404, "first_seen_epoch": "1732596595.593984", "last_seen_epoch": "1732596595.615223", "packets": 19, "bytes": 7901, "initiator_bytes": 3831, "responder_bytes": 4070 }, { "flow_id": "flow-bce18da7e1e066ce6f7bb15a", "transport": "tcp", "stream": 17, "initiator_ip": "10.11.26.183", "initiator_port": 53297, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 384, "last_frame": 400, "first_seen_epoch": "1732596595.602348", "last_seen_epoch": "1732596595.612728", "packets": 15, "bytes": 3853, "initiator_bytes": 2924, "responder_bytes": 929 }, { "flow_id": "flow-8c0ca6324b06a62d3e928bc7", "transport": "tcp", "stream": 18, "initiator_ip": "10.11.26.183", "initiator_port": 53298, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 409, "last_frame": 26910, "first_seen_epoch": "1732596595.828836", "last_seen_epoch": "1732599786.817725", "packets": 153, "bytes": 22382, "initiator_bytes": 12733, "responder_bytes": 9649 }, { "flow_id": "flow-3f65269250e1de1c3515440d", "transport": "tcp", "stream": 19, "initiator_ip": "10.11.26.183", "initiator_port": 53299, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 414, "last_frame": 425, "first_seen_epoch": "1732596595.830381", "last_seen_epoch": "1732596595.834196", "packets": 12, "bytes": 4250, "initiator_bytes": 2149, "responder_bytes": 2101 }, { "flow_id": "flow-3f18df3e8bc89c62f36d0925", "transport": "tcp", "stream": 20, "initiator_ip": "10.11.26.183", "initiator_port": 53300, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 441, "last_frame": 20589, "first_seen_epoch": "1732596597.230836", "last_seen_epoch": "1732596707.226447", "packets": 37, "bytes": 10741, "initiator_bytes": 2166, "responder_bytes": 8575 }, { "flow_id": "flow-5999e8adb0cd83fdee2e60a1", "transport": "udp", "stream": 21, "initiator_ip": "10.11.26.183", "initiator_port": 54361, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 445, "last_frame": 455, "first_seen_epoch": "1732596597.32033", "last_seen_epoch": "1732596597.374256", "packets": 2, "bytes": 316, "initiator_bytes": 86, "responder_bytes": 230 }, { "flow_id": "flow-0199f1c7c7e7552a4b83003b", "transport": "udp", "stream": 22, "initiator_ip": "10.11.26.183", "initiator_port": 53021, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 446, "last_frame": 447, "first_seen_epoch": "1732596597.320399", "last_seen_epoch": "1732596597.339044", "packets": 2, "bytes": 393, "initiator_bytes": 72, "responder_bytes": 321 }, { "flow_id": "flow-80eba76072a76b5d786a7aa8", "transport": "tcp", "stream": 21, "initiator_ip": "10.11.26.183", "initiator_port": 53301, "responder_ip": "104.117.244.112", "responder_port": 443, "first_frame": 448, "last_frame": 20610, "first_seen_epoch": "1732596597.339791", "last_seen_epoch": "1732596717.610569", "packets": 53, "bytes": 24461, "initiator_bytes": 2643, "responder_bytes": 21818 }, { "flow_id": "flow-727c5e015a45a44790728465", "transport": "tcp", "stream": 22, "initiator_ip": "10.11.26.183", "initiator_port": 53302, "responder_ip": "52.109.8.89", "responder_port": 443, "first_frame": 456, "last_frame": 21100, "first_seen_epoch": "1732596597.375027", "last_seen_epoch": "1732596730.390869", "packets": 38, "bytes": 11392, "initiator_bytes": 2037, "responder_bytes": 9355 }, { "flow_id": "flow-29185727f8e1c7645fc02f29", "transport": "tcp", "stream": 23, "initiator_ip": "10.11.26.183", "initiator_port": 53303, "responder_ip": "10.11.26.3", "responder_port": 135, "first_frame": 459, "last_frame": 1230, "first_seen_epoch": "1732596597.423232", "last_seen_epoch": "1732596611.693471", "packets": 16, "bytes": 2924, "initiator_bytes": 1408, "responder_bytes": 1516 }, { "flow_id": "flow-18d993a9444667f9f834bd96", "transport": "tcp", "stream": 24, "initiator_ip": "10.11.26.183", "initiator_port": 53304, "responder_ip": "10.11.26.3", "responder_port": 49671, "first_frame": 472, "last_frame": 1231, "first_seen_epoch": "1732596597.425871", "last_seen_epoch": "1732596611.693497", "packets": 36, "bytes": 10260, "initiator_bytes": 6028, "responder_bytes": 4232 }, { "flow_id": "flow-d84bc983bf39dce9b577d452", "transport": "tcp", "stream": 25, "initiator_ip": "10.11.26.183", "initiator_port": 53305, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 507, "last_frame": 552, "first_seen_epoch": "1732596597.437559", "last_seen_epoch": "1732596597.469053", "packets": 21, "bytes": 7831, "initiator_bytes": 3667, "responder_bytes": 4164 }, { "flow_id": "flow-4514ee9be2a3fa29eca35308", "transport": "tcp", "stream": 26, "initiator_ip": "10.11.26.183", "initiator_port": 53306, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 531, "last_frame": 549, "first_seen_epoch": "1732596597.464458", "last_seen_epoch": "1732596597.468962", "packets": 18, "bytes": 7181, "initiator_bytes": 3035, "responder_bytes": 4146 }, { "flow_id": "flow-d73cb770f289b05250f9a7b6", "transport": "tcp", "stream": 27, "initiator_ip": "10.11.26.183", "initiator_port": 53307, "responder_ip": "40.126.29.9", "responder_port": 443, "first_frame": 565, "last_frame": 1232, "first_seen_epoch": "1732596597.504413", "last_seen_epoch": "1732596611.693678", "packets": 33, "bytes": 9988, "initiator_bytes": 2552, "responder_bytes": 7436 }, { "flow_id": "flow-5886efe01af9d7bf2a4fbb39", "transport": "udp", "stream": 23, "initiator_ip": "10.11.26.183", "initiator_port": 52444, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 612, "last_frame": 619, "first_seen_epoch": "1732596597.587503", "last_seen_epoch": "1732596597.598735", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-61f25b752bf36deaa950b891", "transport": "tcp", "stream": 28, "initiator_ip": "10.11.26.183", "initiator_port": 53308, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 620, "last_frame": 20592, "first_seen_epoch": "1732596597.599129", "last_seen_epoch": "1732596707.23143", "packets": 50, "bytes": 19500, "initiator_bytes": 2689, "responder_bytes": 16811 }, { "flow_id": "flow-b598669c52e7aac54e1ffa28", "transport": "udp", "stream": 24, "initiator_ip": "10.11.26.183", "initiator_port": 61053, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 681, "last_frame": 691, "first_seen_epoch": "1732596597.846695", "last_seen_epoch": "1732596597.879751", "packets": 2, "bytes": 346, "initiator_bytes": 83, "responder_bytes": 263 }, { "flow_id": "flow-baf645807b7f4edb5bd457c6", "transport": "tcp", "stream": 29, "initiator_ip": "10.11.26.183", "initiator_port": 53309, "responder_ip": "52.109.20.47", "responder_port": 443, "first_frame": 692, "last_frame": 21088, "first_seen_epoch": "1732596597.880121", "last_seen_epoch": "1732596721.990896", "packets": 28, "bytes": 9303, "initiator_bytes": 1579, "responder_bytes": 7724 }, { "flow_id": "flow-603de79e8bebdfc8a9e086c7", "transport": "udp", "stream": 25, "initiator_ip": "10.11.26.183", "initiator_port": 56845, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 752, "last_frame": 753, "first_seen_epoch": "1732596598.238793", "last_seen_epoch": "1732596598.267834", "packets": 2, "bytes": 254, "initiator_bytes": 74, "responder_bytes": 180 }, { "flow_id": "flow-42aaa913a74744573515444f", "transport": "tcp", "stream": 30, "initiator_ip": "10.11.26.183", "initiator_port": 53310, "responder_ip": "23.221.22.46", "responder_port": 443, "first_frame": 754, "last_frame": 20586, "first_seen_epoch": "1732596598.26825", "last_seen_epoch": "1732596707.211552", "packets": 130, "bytes": 81810, "initiator_bytes": 5583, "responder_bytes": 76227 }, { "flow_id": "flow-26d568dcd5b57a8767aa05d9", "transport": "udp", "stream": 26, "initiator_ip": "10.11.26.183", "initiator_port": 50058, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 897, "last_frame": 905, "first_seen_epoch": "1732596599.778525", "last_seen_epoch": "1732596600.21891", "packets": 6, "bytes": 771, "initiator_bytes": 245, "responder_bytes": 526 }, { "flow_id": "flow-6171a87f628f38f29e316609", "transport": "tcp", "stream": 31, "initiator_ip": "10.11.26.183", "initiator_port": 53311, "responder_ip": "4.150.155.223", "responder_port": 443, "first_frame": 906, "last_frame": 928, "first_seen_epoch": "1732596600.273443", "last_seen_epoch": "1732596600.702903", "packets": 21, "bytes": 9875, "initiator_bytes": 2124, "responder_bytes": 7751 }, { "flow_id": "flow-b09f91d24689433446613366", "transport": "udp", "stream": 27, "initiator_ip": "10.11.26.183", "initiator_port": 60943, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 924, "last_frame": 925, "first_seen_epoch": "1732596600.65045", "last_seen_epoch": "1732596600.688712", "packets": 2, "bytes": 310, "initiator_bytes": 95, "responder_bytes": 215 }, { "flow_id": "flow-17e4a2ef5abd66d0b7bff6c5", "transport": "tcp", "stream": 32, "initiator_ip": "10.11.26.183", "initiator_port": 53312, "responder_ip": "4.150.155.223", "responder_port": 443, "first_frame": 929, "last_frame": 968, "first_seen_epoch": "1732596600.744726", "last_seen_epoch": "1732596601.153303", "packets": 22, "bytes": 10950, "initiator_bytes": 2275, "responder_bytes": 8675 }, { "flow_id": "flow-6f6f1cb89dc1ff7a9f32d007", "transport": "udp", "stream": 28, "initiator_ip": "10.11.26.183", "initiator_port": 53070, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 942, "last_frame": 945, "first_seen_epoch": "1732596600.995682", "last_seen_epoch": "1732596601.007532", "packets": 2, "bytes": 240, "initiator_bytes": 79, "responder_bytes": 161 }, { "flow_id": "flow-bf347df031828f6e67fdb78e", "transport": "tcp", "stream": 33, "initiator_ip": "10.11.26.183", "initiator_port": 53313, "responder_ip": "13.107.5.93", "responder_port": 443, "first_frame": 946, "last_frame": 20519, "first_seen_epoch": "1732596601.009913", "last_seen_epoch": "1732596668.046481", "packets": 38, "bytes": 18644, "initiator_bytes": 2158, "responder_bytes": 16486 }, { "flow_id": "flow-481c635b773688f888a09014", "transport": "udp", "stream": 29, "initiator_ip": "10.11.26.183", "initiator_port": 60596, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 947, "last_frame": 949, "first_seen_epoch": "1732596601.011261", "last_seen_epoch": "1732596601.038842", "packets": 2, "bytes": 426, "initiator_bytes": 74, "responder_bytes": 352 }, { "flow_id": "flow-783d4cb8fa427c75692eee13", "transport": "tcp", "stream": 34, "initiator_ip": "10.11.26.183", "initiator_port": 53314, "responder_ip": "40.126.28.11", "responder_port": 443, "first_frame": 950, "last_frame": 20595, "first_seen_epoch": "1732596601.039432", "last_seen_epoch": "1732596711.050858", "packets": 28, "bytes": 17202, "initiator_bytes": 9818, "responder_bytes": 7384 }, { "flow_id": "flow-979fa7d1f888ad21d91bcce1", "transport": "tcp", "stream": 35, "initiator_ip": "10.11.26.183", "initiator_port": 53315, "responder_ip": "13.107.5.93", "responder_port": 443, "first_frame": 1016, "last_frame": 20539, "first_seen_epoch": "1732596602.735489", "last_seen_epoch": "1732596671.497841", "packets": 25, "bytes": 10347, "initiator_bytes": 1866, "responder_bytes": 8481 }, { "flow_id": "flow-3cc253f2e1c55982529d026e", "transport": "udp", "stream": 30, "initiator_ip": "10.11.26.183", "initiator_port": 54573, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1052, "last_frame": 1054, "first_seen_epoch": "1732596606.742134", "last_seen_epoch": "1732596606.794448", "packets": 3, "bytes": 511, "initiator_bytes": 196, "responder_bytes": 315 }, { "flow_id": "flow-063b51139a850df683e33780", "transport": "tcp", "stream": 36, "initiator_ip": "10.11.26.183", "initiator_port": 53317, "responder_ip": "13.107.246.57", "responder_port": 443, "first_frame": 1055, "last_frame": 20578, "first_seen_epoch": "1732596606.79667", "last_seen_epoch": "1732596707.096145", "packets": 42, "bytes": 10957, "initiator_bytes": 2427, "responder_bytes": 8530 }, { "flow_id": "flow-c5b4a0ed43843d79f0ce175e", "transport": "udp", "stream": 31, "initiator_ip": "10.11.26.3", "initiator_port": 137, "responder_ip": "10.11.26.183", "responder_port": 137, "first_frame": 1094, "last_frame": 12746, "first_seen_epoch": "1732596610.41649", "last_seen_epoch": "1732596640.453405", "packets": 2, "bytes": 208, "initiator_bytes": 208, "responder_bytes": 0 }, { "flow_id": "flow-911de4a916cbb03a58600354", "transport": "tcp", "stream": 37, "initiator_ip": "10.11.26.183", "initiator_port": 53318, "responder_ip": "10.11.26.3", "responder_port": 139, "first_frame": 1095, "last_frame": 11470, "first_seen_epoch": "1732596610.416659", "last_seen_epoch": "1732596621.117958", "packets": 24, "bytes": 3552, "initiator_bytes": 1743, "responder_bytes": 1809 }, { "flow_id": "flow-3d678c672a42afc16492c4d1", "transport": "udp", "stream": 32, "initiator_ip": "10.11.26.183", "initiator_port": 60075, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1114, "last_frame": 12721, "first_seen_epoch": "1732596610.94179", "last_seen_epoch": "1732596638.033346", "packets": 10, "bytes": 1239, "initiator_bytes": 398, "responder_bytes": 841 }, { "flow_id": "flow-0be2d31403fd66a7b252074b", "transport": "tcp", "stream": 38, "initiator_ip": "10.11.26.183", "initiator_port": 53319, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 1134, "last_frame": 1168, "first_seen_epoch": "1732596611.01047", "last_seen_epoch": "1732596611.023583", "packets": 17, "bytes": 4460, "initiator_bytes": 3203, "responder_bytes": 1257 }, { "flow_id": "flow-c5034c47aac8e6aa047ee0f2", "transport": "tcp", "stream": 39, "initiator_ip": "10.11.26.183", "initiator_port": 53320, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 1147, "last_frame": 1166, "first_seen_epoch": "1732596611.017438", "last_seen_epoch": "1732596611.023442", "packets": 18, "bytes": 7181, "initiator_bytes": 3035, "responder_bytes": 4146 }, { "flow_id": "flow-36a1f8bab5e5417a5daa82b2", "transport": "udp", "stream": 33, "initiator_ip": "10.11.26.183", "initiator_port": 64395, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1173, "last_frame": 1181, "first_seen_epoch": "1732596611.288227", "last_seen_epoch": "1732596611.333665", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-58391b2f5563da4ba099ea69", "transport": "udp", "stream": 34, "initiator_ip": "10.11.26.183", "initiator_port": 51749, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1174, "last_frame": 1190, "first_seen_epoch": "1732596611.288325", "last_seen_epoch": "1732596611.444524", "packets": 2, "bytes": 210, "initiator_bytes": 76, "responder_bytes": 134 }, { "flow_id": "flow-72e4ddb173e1854694156ab1", "transport": "udp", "stream": 35, "initiator_ip": "10.11.26.183", "initiator_port": 61339, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1175, "last_frame": 1182, "first_seen_epoch": "1732596611.288517", "last_seen_epoch": "1732596611.333799", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-8fa90319daf40948c26ec9c8", "transport": "udp", "stream": 36, "initiator_ip": "10.11.26.183", "initiator_port": 63354, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1176, "last_frame": 1180, "first_seen_epoch": "1732596611.28858", "last_seen_epoch": "1732596611.333665", "packets": 2, "bytes": 213, "initiator_bytes": 78, "responder_bytes": 135 }, { "flow_id": "flow-1e7f10bf0870d3e9b55f1b66", "transport": "udp", "stream": 37, "initiator_ip": "10.11.26.183", "initiator_port": 63222, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1177, "last_frame": 1179, "first_seen_epoch": "1732596611.291652", "last_seen_epoch": "1732596611.333612", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-e074aa8e29ccf2c2087ca68d", "transport": "udp", "stream": 38, "initiator_ip": "10.11.26.183", "initiator_port": 60876, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1178, "last_frame": 1189, "first_seen_epoch": "1732596611.291741", "last_seen_epoch": "1732596611.444471", "packets": 2, "bytes": 210, "initiator_bytes": 76, "responder_bytes": 134 }, { "flow_id": "flow-03a5190f6b6ed0acbb3c5ab2", "transport": "tcp", "stream": 40, "initiator_ip": "10.11.26.183", "initiator_port": 53321, "responder_ip": "13.107.21.239", "responder_port": 443, "first_frame": 1183, "last_frame": 12084, "first_seen_epoch": "1732596611.334492", "last_seen_epoch": "1732596623.254432", "packets": 40, "bytes": 13211, "initiator_bytes": 4343, "responder_bytes": 8868 }, { "flow_id": "flow-a35b39d4326f13babf377736", "transport": "tcp", "stream": 41, "initiator_ip": "10.11.26.183", "initiator_port": 53322, "responder_ip": "213.246.109.5", "responder_port": 443, "first_frame": 1184, "last_frame": 12367, "first_seen_epoch": "1732596611.354223", "last_seen_epoch": "1732596623.992784", "packets": 3689, "bytes": 3269072, "initiator_bytes": 103454, "responder_bytes": 3165618 }, { "flow_id": "flow-0530ab0e291afbb0ee5e5df3", "transport": "udp", "stream": 39, "initiator_ip": "10.11.26.183", "initiator_port": 52957, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1332, "last_frame": 1374, "first_seen_epoch": "1732596614.145454", "last_seen_epoch": "1732596614.315055", "packets": 2, "bytes": 176, "initiator_bytes": 80, "responder_bytes": 96 }, { "flow_id": "flow-6bdde0f41e7e92d06ae72d21", "transport": "udp", "stream": 40, "initiator_ip": "10.11.26.183", "initiator_port": 65406, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1333, "last_frame": 1377, "first_seen_epoch": "1732596614.145534", "last_seen_epoch": "1732596614.319904", "packets": 2, "bytes": 226, "initiator_bytes": 80, "responder_bytes": 146 }, { "flow_id": "flow-fb627cdd3c726fcfd16d8c1e", "transport": "udp", "stream": 41, "initiator_ip": "10.11.26.183", "initiator_port": 63950, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1334, "last_frame": 1337, "first_seen_epoch": "1732596614.150461", "last_seen_epoch": "1732596614.236416", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-6e9ef8fa3c97d57b73ebfd50", "transport": "udp", "stream": 42, "initiator_ip": "10.11.26.183", "initiator_port": 60694, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1335, "last_frame": 1336, "first_seen_epoch": "1732596614.150571", "last_seen_epoch": "1732596614.234653", "packets": 2, "bytes": 222, "initiator_bytes": 83, "responder_bytes": 139 }, { "flow_id": "flow-bd7509285e5ceda146fba82c", "transport": "tcp", "stream": 42, "initiator_ip": "10.11.26.183", "initiator_port": 53325, "responder_ip": "52.8.34.0", "responder_port": 443, "first_frame": 1338, "last_frame": 12102, "first_seen_epoch": "1732596614.236894", "last_seen_epoch": "1732596623.273238", "packets": 38, "bytes": 16071, "initiator_bytes": 3436, "responder_bytes": 12635 }, { "flow_id": "flow-bebcb60a4711634388ba90a0", "transport": "tcp", "stream": 43, "initiator_ip": "10.11.26.183", "initiator_port": 53326, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 1378, "last_frame": 11982, "first_seen_epoch": "1732596614.320269", "last_seen_epoch": "1732596623.064003", "packets": 31, "bytes": 13441, "initiator_bytes": 3288, "responder_bytes": 10153 }, { "flow_id": "flow-20c6b1c75d71cf076a3a5b04", "transport": "tcp", "stream": 44, "initiator_ip": "10.11.26.183", "initiator_port": 53327, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 1400, "last_frame": 12077, "first_seen_epoch": "1732596614.39613", "last_seen_epoch": "1732596623.254013", "packets": 20, "bytes": 6263, "initiator_bytes": 2382, "responder_bytes": 3881 }, { "flow_id": "flow-eede723485d6ec1e6927e909", "transport": "udp", "stream": 43, "initiator_ip": "10.11.26.183", "initiator_port": 49611, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1718, "last_frame": 1755, "first_seen_epoch": "1732596614.714156", "last_seen_epoch": "1732596614.766334", "packets": 2, "bytes": 176, "initiator_bytes": 80, "responder_bytes": 96 }, { "flow_id": "flow-6f23047f570e612a381aa186", "transport": "udp", "stream": 44, "initiator_ip": "10.11.26.183", "initiator_port": 55111, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1719, "last_frame": 1754, "first_seen_epoch": "1732596614.714254", "last_seen_epoch": "1732596614.763708", "packets": 2, "bytes": 217, "initiator_bytes": 80, "responder_bytes": 137 }, { "flow_id": "flow-aaec65307476994450ca6e59", "transport": "udp", "stream": 45, "initiator_ip": "10.11.26.183", "initiator_port": 59750, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1751, "last_frame": 1757, "first_seen_epoch": "1732596614.747884", "last_seen_epoch": "1732596614.804739", "packets": 2, "bytes": 170, "initiator_bytes": 77, "responder_bytes": 93 }, { "flow_id": "flow-9e3bd496d848a178fa120308", "transport": "udp", "stream": 46, "initiator_ip": "10.11.26.183", "initiator_port": 50502, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1752, "last_frame": 1753, "first_seen_epoch": "1732596614.747965", "last_seen_epoch": "1732596614.74825", "packets": 2, "bytes": 179, "initiator_bytes": 77, "responder_bytes": 102 }, { "flow_id": "flow-f467ce0b402d10ac1f186530", "transport": "tcp", "stream": 45, "initiator_ip": "10.11.26.183", "initiator_port": 53328, "responder_ip": "142.251.186.95", "responder_port": 443, "first_frame": 1756, "last_frame": 12061, "first_seen_epoch": "1732596614.76669", "last_seen_epoch": "1732596623.238804", "packets": 35, "bytes": 12518, "initiator_bytes": 3407, "responder_bytes": 9111 }, { "flow_id": "flow-c2c1af8b34d6afc26336db09", "transport": "tcp", "stream": 46, "initiator_ip": "10.11.26.183", "initiator_port": 53329, "responder_ip": "142.250.138.94", "responder_port": 443, "first_frame": 1758, "last_frame": 12049, "first_seen_epoch": "1732596614.805297", "last_seen_epoch": "1732596623.238331", "packets": 99, "bytes": 68660, "initiator_bytes": 5381, "responder_bytes": 63279 }, { "flow_id": "flow-14733019809759e4d2cc5dfe", "transport": "udp", "stream": 47, "initiator_ip": "10.11.26.183", "initiator_port": 53071, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1759, "last_frame": 1773, "first_seen_epoch": "1732596614.805541", "last_seen_epoch": "1732596614.853623", "packets": 2, "bytes": 244, "initiator_bytes": 74, "responder_bytes": 170 }, { "flow_id": "flow-a028008939e0897a8eb8cab1", "transport": "udp", "stream": 48, "initiator_ip": "10.11.26.183", "initiator_port": 58757, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 1760, "last_frame": 1761, "first_seen_epoch": "1732596614.805661", "last_seen_epoch": "1732596614.806012", "packets": 2, "bytes": 173, "initiator_bytes": 74, "responder_bytes": 99 }, { "flow_id": "flow-f909df18b570bc6c671aa723", "transport": "tcp", "stream": 47, "initiator_ip": "10.11.26.183", "initiator_port": 53330, "responder_ip": "142.250.138.94", "responder_port": 443, "first_frame": 1762, "last_frame": 1925, "first_seen_epoch": "1732596614.806087", "last_seen_epoch": "1732596614.974477", "packets": 18, "bytes": 8204, "initiator_bytes": 2353, "responder_bytes": 5851 }, { "flow_id": "flow-4ed1a9c7b6bf8dc02a1d1232", "transport": "tcp", "stream": 48, "initiator_ip": "10.11.26.183", "initiator_port": 53331, "responder_ip": "142.250.138.94", "responder_port": 443, "first_frame": 1764, "last_frame": 1955, "first_seen_epoch": "1732596614.806522", "last_seen_epoch": "1732596614.989329", "packets": 16, "bytes": 6861, "initiator_bytes": 2385, "responder_bytes": 4476 }, { "flow_id": "flow-b5c5158770ed331e0e086fb8", "transport": "tcp", "stream": 49, "initiator_ip": "10.11.26.183", "initiator_port": 53332, "responder_ip": "142.251.186.147", "responder_port": 443, "first_frame": 1774, "last_frame": 12052, "first_seen_epoch": "1732596614.854072", "last_seen_epoch": "1732596623.23839", "packets": 37, "bytes": 12357, "initiator_bytes": 3555, "responder_bytes": 8802 }, { "flow_id": "flow-92549dfb4c6e8a2ceaee7723", "transport": "tcp", "stream": 50, "initiator_ip": "10.11.26.183", "initiator_port": 53333, "responder_ip": "142.251.186.147", "responder_port": 443, "first_frame": 1775, "last_frame": 12065, "first_seen_epoch": "1732596614.854143", "last_seen_epoch": "1732596623.247859", "packets": 34, "bytes": 13200, "initiator_bytes": 3544, "responder_bytes": 9656 }, { "flow_id": "flow-e291138bce92fd0f69058311", "transport": "udp", "stream": 49, "initiator_ip": "10.11.26.183", "initiator_port": 55260, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2093, "last_frame": 2108, "first_seen_epoch": "1732596615.297504", "last_seen_epoch": "1732596615.339531", "packets": 2, "bytes": 184, "initiator_bytes": 76, "responder_bytes": 108 }, { "flow_id": "flow-f80e8658ec09ff07a5f54486", "transport": "udp", "stream": 50, "initiator_ip": "10.11.26.183", "initiator_port": 56610, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2094, "last_frame": 2110, "first_seen_epoch": "1732596615.297574", "last_seen_epoch": "1732596615.341209", "packets": 2, "bytes": 209, "initiator_bytes": 76, "responder_bytes": 133 }, { "flow_id": "flow-64a81d4057ab2152ba203982", "transport": "udp", "stream": 51, "initiator_ip": "10.11.26.183", "initiator_port": 61984, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2095, "last_frame": 2109, "first_seen_epoch": "1732596615.298818", "last_seen_epoch": "1732596615.339589", "packets": 2, "bytes": 238, "initiator_bytes": 79, "responder_bytes": 159 }, { "flow_id": "flow-a4dc733973ac27595e18645e", "transport": "udp", "stream": 52, "initiator_ip": "10.11.26.183", "initiator_port": 52421, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2096, "last_frame": 2114, "first_seen_epoch": "1732596615.298882", "last_seen_epoch": "1732596615.346197", "packets": 2, "bytes": 215, "initiator_bytes": 79, "responder_bytes": 136 }, { "flow_id": "flow-2c79b21bf49343d6932abd4b", "transport": "tcp", "stream": 51, "initiator_ip": "10.11.26.183", "initiator_port": 53334, "responder_ip": "142.250.113.120", "responder_port": 443, "first_frame": 2111, "last_frame": 12045, "first_seen_epoch": "1732596615.341655", "last_seen_epoch": "1732596623.238174", "packets": 99, "bytes": 80197, "initiator_bytes": 4799, "responder_bytes": 75398 }, { "flow_id": "flow-9d8ebd0af8877e6a84a10b36", "transport": "tcp", "stream": 52, "initiator_ip": "10.11.26.183", "initiator_port": 53335, "responder_ip": "142.250.115.95", "responder_port": 443, "first_frame": 2115, "last_frame": 12057, "first_seen_epoch": "1732596615.346596", "last_seen_epoch": "1732596623.238736", "packets": 395, "bytes": 322365, "initiator_bytes": 12825, "responder_bytes": 309540 }, { "flow_id": "flow-fe77729ed289bdae22730703", "transport": "tcp", "stream": 53, "initiator_ip": "10.11.26.183", "initiator_port": 53336, "responder_ip": "142.250.115.95", "responder_port": 443, "first_frame": 2469, "last_frame": 12058, "first_seen_epoch": "1732596615.686151", "last_seen_epoch": "1732596623.238736", "packets": 35, "bytes": 11790, "initiator_bytes": 3414, "responder_bytes": 8376 }, { "flow_id": "flow-1cfc3e6bbb790cb483f7f9ca", "transport": "udp", "stream": 53, "initiator_ip": "10.11.26.183", "initiator_port": 50644, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2512, "last_frame": 2514, "first_seen_epoch": "1732596615.731544", "last_seen_epoch": "1732596615.731901", "packets": 2, "bytes": 176, "initiator_bytes": 80, "responder_bytes": 96 }, { "flow_id": "flow-d33d165e3abb844f5afe994c", "transport": "udp", "stream": 54, "initiator_ip": "10.11.26.183", "initiator_port": 61667, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2513, "last_frame": 2515, "first_seen_epoch": "1732596615.731619", "last_seen_epoch": "1732596615.731944", "packets": 2, "bytes": 226, "initiator_bytes": 80, "responder_bytes": 146 }, { "flow_id": "flow-ad5f2eed88ecc87472dae04f", "transport": "tcp", "stream": 54, "initiator_ip": "10.11.26.183", "initiator_port": 53337, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 2517, "last_frame": 12067, "first_seen_epoch": "1732596615.732156", "last_seen_epoch": "1732596623.248327", "packets": 2954, "bytes": 2844417, "initiator_bytes": 62710, "responder_bytes": 2781707 }, { "flow_id": "flow-79d654945ba4a06d50fbc75b", "transport": "udp", "stream": 55, "initiator_ip": "10.11.26.183", "initiator_port": 59443, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2548, "last_frame": 2564, "first_seen_epoch": "1732596615.737596", "last_seen_epoch": "1732596615.738378", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-de77e4d81e834ffe6a601b36", "transport": "udp", "stream": 56, "initiator_ip": "10.11.26.183", "initiator_port": 52547, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2551, "last_frame": 2727, "first_seen_epoch": "1732596615.737637", "last_seen_epoch": "1732596615.779927", "packets": 2, "bytes": 227, "initiator_bytes": 78, "responder_bytes": 149 }, { "flow_id": "flow-03d8c320eac32e4985c99429", "transport": "tcp", "stream": 55, "initiator_ip": "10.11.26.183", "initiator_port": 53338, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 2572, "last_frame": 12075, "first_seen_epoch": "1732596615.747036", "last_seen_epoch": "1732596623.253991", "packets": 38, "bytes": 11762, "initiator_bytes": 3432, "responder_bytes": 8330 }, { "flow_id": "flow-600886a98b7de8b838383df9", "transport": "udp", "stream": 57, "initiator_ip": "10.11.26.183", "initiator_port": 62527, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2683, "last_frame": 2685, "first_seen_epoch": "1732596615.759516", "last_seen_epoch": "1732596615.759828", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-a63c5406f8c5d47687a0bff1", "transport": "udp", "stream": 58, "initiator_ip": "10.11.26.183", "initiator_port": 57443, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 2684, "last_frame": 2686, "first_seen_epoch": "1732596615.759609", "last_seen_epoch": "1732596615.759949", "packets": 2, "bytes": 222, "initiator_bytes": 83, "responder_bytes": 139 }, { "flow_id": "flow-dd971d180d9cf9824a65f645", "transport": "tcp", "stream": 56, "initiator_ip": "10.11.26.183", "initiator_port": 53339, "responder_ip": "13.56.30.207", "responder_port": 443, "first_frame": 2688, "last_frame": 12104, "first_seen_epoch": "1732596615.760262", "last_seen_epoch": "1732596623.273478", "packets": 36, "bytes": 14631, "initiator_bytes": 3530, "responder_bytes": 11101 }, { "flow_id": "flow-02410e6e8f9009e2134d34ca", "transport": "udp", "stream": 59, "initiator_ip": "10.11.26.183", "initiator_port": 64435, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3366, "last_frame": 3600, "first_seen_epoch": "1732596616.137502", "last_seen_epoch": "1732596616.223537", "packets": 2, "bytes": 265, "initiator_bytes": 79, "responder_bytes": 186 }, { "flow_id": "flow-c67daab302236762b7c970fa", "transport": "udp", "stream": 60, "initiator_ip": "10.11.26.183", "initiator_port": 55797, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3367, "last_frame": 3604, "first_seen_epoch": "1732596616.137576", "last_seen_epoch": "1732596616.233588", "packets": 2, "bytes": 201, "initiator_bytes": 79, "responder_bytes": 122 }, { "flow_id": "flow-3dec3dc3dbc8aafa289fa22d", "transport": "udp", "stream": 61, "initiator_ip": "10.11.26.183", "initiator_port": 49886, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3368, "last_frame": 3599, "first_seen_epoch": "1732596616.13789", "last_seen_epoch": "1732596616.223537", "packets": 2, "bytes": 263, "initiator_bytes": 78, "responder_bytes": 185 }, { "flow_id": "flow-b148195b3c7acafd95bad010", "transport": "udp", "stream": 62, "initiator_ip": "10.11.26.183", "initiator_port": 61724, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3369, "last_frame": 3601, "first_seen_epoch": "1732596616.137958", "last_seen_epoch": "1732596616.223586", "packets": 2, "bytes": 199, "initiator_bytes": 78, "responder_bytes": 121 }, { "flow_id": "flow-59f4c83e9b5d104a7c1c4ed9", "transport": "tcp", "stream": 57, "initiator_ip": "10.11.26.183", "initiator_port": 53340, "responder_ip": "18.160.156.61", "responder_port": 443, "first_frame": 3603, "last_frame": 12039, "first_seen_epoch": "1732596616.22375", "last_seen_epoch": "1732596623.228109", "packets": 122, "bytes": 88947, "initiator_bytes": 5745, "responder_bytes": 83202 }, { "flow_id": "flow-384c08e79b6c19e01e058a42", "transport": "tcp", "stream": 58, "initiator_ip": "10.11.26.183", "initiator_port": 53341, "responder_ip": "18.160.156.103", "responder_port": 443, "first_frame": 3605, "last_frame": 12042, "first_seen_epoch": "1732596616.233957", "last_seen_epoch": "1732596623.228325", "packets": 34, "bytes": 14683, "initiator_bytes": 3394, "responder_bytes": 11289 }, { "flow_id": "flow-6a7e4f735ae5bf2ae5938b45", "transport": "udp", "stream": 63, "initiator_ip": "10.11.26.183", "initiator_port": 49687, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3761, "last_frame": 3763, "first_seen_epoch": "1732596616.459272", "last_seen_epoch": "1732596616.459658", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-179b8ab8adc95b9a53df4049", "transport": "udp", "stream": 64, "initiator_ip": "10.11.26.183", "initiator_port": 51940, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3762, "last_frame": 3764, "first_seen_epoch": "1732596616.459352", "last_seen_epoch": "1732596616.459754", "packets": 2, "bytes": 274, "initiator_bytes": 78, "responder_bytes": 196 }, { "flow_id": "flow-e045f0ab2056e689f751629b", "transport": "tcp", "stream": 59, "initiator_ip": "10.11.26.183", "initiator_port": 53342, "responder_ip": "13.107.21.239", "responder_port": 443, "first_frame": 3766, "last_frame": 12079, "first_seen_epoch": "1732596616.460059", "last_seen_epoch": "1732596623.254079", "packets": 32, "bytes": 11318, "initiator_bytes": 3221, "responder_bytes": 8097 }, { "flow_id": "flow-7d15e1ba323a6e50662f5b38", "transport": "udp", "stream": 65, "initiator_ip": "10.11.26.183", "initiator_port": 55966, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3767, "last_frame": 3769, "first_seen_epoch": "1732596616.461213", "last_seen_epoch": "1732596616.461508", "packets": 2, "bytes": 176, "initiator_bytes": 80, "responder_bytes": 96 }, { "flow_id": "flow-98c82020695aa64bf2c74cb1", "transport": "udp", "stream": 66, "initiator_ip": "10.11.26.183", "initiator_port": 64824, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3768, "last_frame": 3770, "first_seen_epoch": "1732596616.461279", "last_seen_epoch": "1732596616.461644", "packets": 2, "bytes": 217, "initiator_bytes": 80, "responder_bytes": 137 }, { "flow_id": "flow-f0d9fd7f908d35deccc517ed", "transport": "tcp", "stream": 60, "initiator_ip": "10.11.26.183", "initiator_port": 53343, "responder_ip": "142.251.186.95", "responder_port": 443, "first_frame": 3771, "last_frame": 12060, "first_seen_epoch": "1732596616.461813", "last_seen_epoch": "1732596623.238756", "packets": 43, "bytes": 14664, "initiator_bytes": 3759, "responder_bytes": 10905 }, { "flow_id": "flow-27459aafa1a2bcbfafccf92e", "transport": "udp", "stream": 67, "initiator_ip": "10.11.26.183", "initiator_port": 53114, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3781, "last_frame": 3790, "first_seen_epoch": "1732596616.467169", "last_seen_epoch": "1732596616.527922", "packets": 2, "bytes": 166, "initiator_bytes": 75, "responder_bytes": 91 }, { "flow_id": "flow-8c090a4add200ad7bc7a9a2a", "transport": "udp", "stream": 68, "initiator_ip": "10.11.26.183", "initiator_port": 54030, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3782, "last_frame": 3783, "first_seen_epoch": "1732596616.467247", "last_seen_epoch": "1732596616.467534", "packets": 2, "bytes": 175, "initiator_bytes": 75, "responder_bytes": 100 }, { "flow_id": "flow-bd8653fcf1e9c1cfbfd0ba09", "transport": "tcp", "stream": 61, "initiator_ip": "10.11.26.183", "initiator_port": 53344, "responder_ip": "142.250.113.94", "responder_port": 443, "first_frame": 3791, "last_frame": 12051, "first_seen_epoch": "1732596616.528451", "last_seen_epoch": "1732596623.238364", "packets": 283, "bytes": 249952, "initiator_bytes": 8868, "responder_bytes": 241084 }, { "flow_id": "flow-0371d3424afd3a5370f8c315", "transport": "udp", "stream": 69, "initiator_ip": "10.11.26.183", "initiator_port": 54418, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3850, "last_frame": 3852, "first_seen_epoch": "1732596616.649524", "last_seen_epoch": "1732596616.649854", "packets": 2, "bytes": 170, "initiator_bytes": 77, "responder_bytes": 93 }, { "flow_id": "flow-5ef522d032078688b28125ba", "transport": "udp", "stream": 70, "initiator_ip": "10.11.26.183", "initiator_port": 50248, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3851, "last_frame": 3853, "first_seen_epoch": "1732596616.649593", "last_seen_epoch": "1732596616.649948", "packets": 2, "bytes": 179, "initiator_bytes": 77, "responder_bytes": 102 }, { "flow_id": "flow-933dc7e4787a7a5aa7ddc7b1", "transport": "tcp", "stream": 62, "initiator_ip": "10.11.26.183", "initiator_port": 53345, "responder_ip": "142.250.138.94", "responder_port": 443, "first_frame": 3854, "last_frame": 12053, "first_seen_epoch": "1732596616.650399", "last_seen_epoch": "1732596623.23839", "packets": 111, "bytes": 88233, "initiator_bytes": 5132, "responder_bytes": 83101 }, { "flow_id": "flow-9e5772701d464c8723ee6d84", "transport": "tcp", "stream": 63, "initiator_ip": "10.11.26.183", "initiator_port": 53346, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 3935, "last_frame": 11965, "first_seen_epoch": "1732596616.729991", "last_seen_epoch": "1732596622.973968", "packets": 18, "bytes": 5246, "initiator_bytes": 3174, "responder_bytes": 2072 }, { "flow_id": "flow-3429fe658840061b09c3de12", "transport": "tcp", "stream": 64, "initiator_ip": "10.11.26.183", "initiator_port": 53347, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 3936, "last_frame": 11963, "first_seen_epoch": "1732596616.730343", "last_seen_epoch": "1732596622.973928", "packets": 18, "bytes": 4977, "initiator_bytes": 3126, "responder_bytes": 1851 }, { "flow_id": "flow-417807dccac1a9259c8bedd1", "transport": "tcp", "stream": 65, "initiator_ip": "10.11.26.183", "initiator_port": 53348, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 3937, "last_frame": 12111, "first_seen_epoch": "1732596616.730817", "last_seen_epoch": "1732596623.285258", "packets": 2230, "bytes": 2149301, "initiator_bytes": 48422, "responder_bytes": 2100879 }, { "flow_id": "flow-42d005692a7d38c109e91354", "transport": "tcp", "stream": 66, "initiator_ip": "10.11.26.183", "initiator_port": 53349, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 3938, "last_frame": 11984, "first_seen_epoch": "1732596616.730909", "last_seen_epoch": "1732596623.081122", "packets": 425, "bytes": 397787, "initiator_bytes": 11316, "responder_bytes": 386471 }, { "flow_id": "flow-ed0f5e3fa79a764586845155", "transport": "udp", "stream": 71, "initiator_ip": "10.11.26.183", "initiator_port": 62432, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3939, "last_frame": 4022, "first_seen_epoch": "1732596616.731036", "last_seen_epoch": "1732596616.783489", "packets": 2, "bytes": 214, "initiator_bytes": 75, "responder_bytes": 139 }, { "flow_id": "flow-b59cb55d5acac4cf1c2ff1c4", "transport": "udp", "stream": 72, "initiator_ip": "10.11.26.183", "initiator_port": 50283, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 3940, "last_frame": 4018, "first_seen_epoch": "1732596616.731109", "last_seen_epoch": "1732596616.780201", "packets": 2, "bytes": 211, "initiator_bytes": 75, "responder_bytes": 136 }, { "flow_id": "flow-32a4c3c5622db081a50210ab", "transport": "tcp", "stream": 67, "initiator_ip": "10.11.26.183", "initiator_port": 53350, "responder_ip": "151.101.66.137", "responder_port": 443, "first_frame": 4023, "last_frame": 12043, "first_seen_epoch": "1732596616.783718", "last_seen_epoch": "1732596623.228345", "packets": 74, "bytes": 42621, "initiator_bytes": 4563, "responder_bytes": 38058 }, { "flow_id": "flow-ba28d3718ad98791ebd45cad", "transport": "udp", "stream": 73, "initiator_ip": "10.11.26.183", "initiator_port": 123, "responder_ip": "10.11.26.3", "responder_port": 123, "first_frame": 9280, "last_frame": 26847, "first_seen_epoch": "1732596619.358988", "last_seen_epoch": "1732599691.603022", "packets": 8, "bytes": 1296, "initiator_bytes": 648, "responder_bytes": 648 }, { "flow_id": "flow-7d0734639aa4faae5e14f2dc", "transport": "udp", "stream": 74, "initiator_ip": "10.11.26.183", "initiator_port": 61444, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 11968, "last_frame": 11973, "first_seen_epoch": "1732596622.974195", "last_seen_epoch": "1732596623.053128", "packets": 2, "bytes": 345, "initiator_bytes": 72, "responder_bytes": 273 }, { "flow_id": "flow-ef7cc718e1056ec908093921", "transport": "udp", "stream": 75, "initiator_ip": "10.11.26.183", "initiator_port": 59813, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 11969, "last_frame": 11970, "first_seen_epoch": "1732596622.974289", "last_seen_epoch": "1732596622.974687", "packets": 2, "bytes": 326, "initiator_bytes": 72, "responder_bytes": 254 }, { "flow_id": "flow-fd6eacedf1eef42d37b9f423", "transport": "tcp", "stream": 68, "initiator_ip": "10.11.26.183", "initiator_port": 53351, "responder_ip": "104.117.244.96", "responder_port": 443, "first_frame": 11974, "last_frame": 12128, "first_seen_epoch": "1732596623.053567", "last_seen_epoch": "1732596623.336309", "packets": 31, "bytes": 10054, "initiator_bytes": 3422, "responder_bytes": 6632 }, { "flow_id": "flow-a7811835a20fdd32b42add8e", "transport": "udp", "stream": 76, "initiator_ip": "10.11.26.183", "initiator_port": 55279, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 11991, "last_frame": 11993, "first_seen_epoch": "1732596623.131197", "last_seen_epoch": "1732596623.131584", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-b3c973d378070f66af522625", "transport": "udp", "stream": 77, "initiator_ip": "10.11.26.183", "initiator_port": 51731, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 11992, "last_frame": 11994, "first_seen_epoch": "1732596623.131278", "last_seen_epoch": "1732596623.1317", "packets": 2, "bytes": 274, "initiator_bytes": 78, "responder_bytes": 196 }, { "flow_id": "flow-09bacfe0c505f5d6cb39123b", "transport": "tcp", "stream": 69, "initiator_ip": "10.11.26.183", "initiator_port": 53353, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 12024, "last_frame": 12130, "first_seen_epoch": "1732596623.173133", "last_seen_epoch": "1732596623.372725", "packets": 18, "bytes": 7014, "initiator_bytes": 2478, "responder_bytes": 4536 }, { "flow_id": "flow-c65be7f30a72ab4b1ae3e2f7", "transport": "tcp", "stream": 70, "initiator_ip": "10.11.26.183", "initiator_port": 53354, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 12114, "last_frame": 12695, "first_seen_epoch": "1732596623.313585", "last_seen_epoch": "1732596632.907691", "packets": 32, "bytes": 11100, "initiator_bytes": 3399, "responder_bytes": 7701 }, { "flow_id": "flow-e3e1f37857b85719408672e9", "transport": "tcp", "stream": 71, "initiator_ip": "10.11.26.183", "initiator_port": 53356, "responder_ip": "213.246.109.5", "responder_port": 443, "first_frame": 12372, "last_frame": 12697, "first_seen_epoch": "1732596626.629902", "last_seen_epoch": "1732596632.992929", "packets": 307, "bytes": 281283, "initiator_bytes": 9348, "responder_bytes": 271935 }, { "flow_id": "flow-16131bf6f6505169bffc7aa1", "transport": "tcp", "stream": 72, "initiator_ip": "10.11.26.183", "initiator_port": 53357, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 12701, "last_frame": 20369, "first_seen_epoch": "1732596637.892679", "last_seen_epoch": "1732596648.629416", "packets": 24, "bytes": 7734, "initiator_bytes": 5573, "responder_bytes": 2161 }, { "flow_id": "flow-1af6971eb37db44ea9125a9d", "transport": "tcp", "stream": 73, "initiator_ip": "10.11.26.183", "initiator_port": 53358, "responder_ip": "40.118.171.167", "responder_port": 443, "first_frame": 12722, "last_frame": 12744, "first_seen_epoch": "1732596638.045631", "last_seen_epoch": "1732596638.492931", "packets": 23, "bytes": 10525, "initiator_bytes": 2965, "responder_bytes": 7560 }, { "flow_id": "flow-89ec8f36d94cdee980550e1a", "transport": "tcp", "stream": 74, "initiator_ip": "10.11.26.183", "initiator_port": 53359, "responder_ip": "10.11.26.3", "responder_port": 139, "first_frame": 12747, "last_frame": 20412, "first_seen_epoch": "1732596640.453654", "last_seen_epoch": "1732596654.005572", "packets": 24, "bytes": 3552, "initiator_bytes": 1743, "responder_bytes": 1809 }, { "flow_id": "flow-0db004dd6191f75ae0624e38", "transport": "udp", "stream": 78, "initiator_ip": "10.11.26.183", "initiator_port": 64100, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 12766, "last_frame": 12780, "first_seen_epoch": "1732596640.541323", "last_seen_epoch": "1732596640.793456", "packets": 4, "bytes": 425, "initiator_bytes": 155, "responder_bytes": 270 }, { "flow_id": "flow-a9476a0e8dbb6118a4f81c8c", "transport": "tcp", "stream": 75, "initiator_ip": "10.11.26.183", "initiator_port": 53360, "responder_ip": "193.42.38.139", "responder_port": 443, "first_frame": 12768, "last_frame": 20328, "first_seen_epoch": "1732596640.543208", "last_seen_epoch": "1732596645.634119", "packets": 7552, "bytes": 5718632, "initiator_bytes": 223411, "responder_bytes": 5495221 }, { "flow_id": "flow-00fad8319587a3b8fa1ec1c0", "transport": "tcp", "stream": 76, "initiator_ip": "10.11.26.183", "initiator_port": 53361, "responder_ip": "104.117.247.99", "responder_port": 80, "first_frame": 12781, "last_frame": 20329, "first_seen_epoch": "1732596640.794044", "last_seen_epoch": "1732596645.634232", "packets": 8, "bytes": 1610, "initiator_bytes": 540, "responder_bytes": 1070 }, { "flow_id": "flow-2a15f8f01eff4098c9154a97", "transport": "tcp", "stream": 77, "initiator_ip": "10.11.26.183", "initiator_port": 53362, "responder_ip": "194.180.191.64", "responder_port": 443, "first_frame": 20330, "last_frame": 26587, "first_seen_epoch": "1732596645.642382", "last_seen_epoch": "1732599555.297852", "packets": 116, "bytes": 21449, "initiator_bytes": 17814, "responder_bytes": 3635 }, { "flow_id": "flow-3ab8f7002474977564c51c9b", "transport": "udp", "stream": 79, "initiator_ip": "10.11.26.183", "initiator_port": 52962, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20331, "last_frame": 20332, "first_seen_epoch": "1732596645.646175", "last_seen_epoch": "1732596645.678408", "packets": 2, "bytes": 220, "initiator_bytes": 86, "responder_bytes": 134 }, { "flow_id": "flow-1aac980e1b6a8d40fb6e44c5", "transport": "tcp", "stream": 78, "initiator_ip": "10.11.26.183", "initiator_port": 53363, "responder_ip": "104.26.1.231", "responder_port": 80, "first_frame": 20333, "last_frame": 21142, "first_seen_epoch": "1732596645.687354", "last_seen_epoch": "1732596755.683244", "packets": 11, "bytes": 1894, "initiator_bytes": 478, "responder_bytes": 1416 }, { "flow_id": "flow-cbf494ea6fa9d2ebc9a24c57", "transport": "udp", "stream": 80, "initiator_ip": "10.11.26.183", "initiator_port": 56163, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20352, "last_frame": 20353, "first_seen_epoch": "1732596648.371153", "last_seen_epoch": "1732596648.381164", "packets": 2, "bytes": 315, "initiator_bytes": 89, "responder_bytes": 226 }, { "flow_id": "flow-357cdd7ef01382138ffaadc8", "transport": "tcp", "stream": 79, "initiator_ip": "10.11.26.183", "initiator_port": 53365, "responder_ip": "52.168.112.67", "responder_port": 443, "first_frame": 20354, "last_frame": 20405, "first_seen_epoch": "1732596648.381812", "last_seen_epoch": "1732596648.987336", "packets": 47, "bytes": 24464, "initiator_bytes": 18469, "responder_bytes": 5995 }, { "flow_id": "flow-08830ce40060bba6a9aa5790", "transport": "udp", "stream": 81, "initiator_ip": "10.11.26.183", "initiator_port": 59953, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20413, "last_frame": 20497, "first_seen_epoch": "1732596656.408572", "last_seen_epoch": "1732596662.927869", "packets": 8, "bytes": 1098, "initiator_bytes": 358, "responder_bytes": 740 }, { "flow_id": "flow-1f6d24f9afbd5567df4b3077", "transport": "udp", "stream": 82, "initiator_ip": "10.11.26.183", "initiator_port": 59954, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 20415, "last_frame": 20416, "first_seen_epoch": "1732596656.409538", "last_seen_epoch": "1732596656.410589", "packets": 2, "bytes": 500, "initiator_bytes": 269, "responder_bytes": 231 }, { "flow_id": "flow-383e189fcf4c957ee4400321", "transport": "tcp", "stream": 80, "initiator_ip": "10.11.26.183", "initiator_port": 53366, "responder_ip": "10.11.26.3", "responder_port": 135, "first_frame": 20417, "last_frame": 20486, "first_seen_epoch": "1732596656.526427", "last_seen_epoch": "1732596656.55958", "packets": 10, "bytes": 1716, "initiator_bytes": 844, "responder_bytes": 872 }, { "flow_id": "flow-b21d39850d93858aa9612a13", "transport": "tcp", "stream": 81, "initiator_ip": "10.11.26.183", "initiator_port": 53367, "responder_ip": "10.11.26.3", "responder_port": 49671, "first_frame": 20424, "last_frame": 20487, "first_seen_epoch": "1732596656.529307", "last_seen_epoch": "1732596656.559621", "packets": 22, "bytes": 6850, "initiator_bytes": 4422, "responder_bytes": 2428 }, { "flow_id": "flow-8261c3529323bb0073712100", "transport": "tcp", "stream": 82, "initiator_ip": "10.11.26.183", "initiator_port": 53368, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 20447, "last_frame": 20485, "first_seen_epoch": "1732596656.540355", "last_seen_epoch": "1732596656.555777", "packets": 21, "bytes": 7893, "initiator_bytes": 3729, "responder_bytes": 4164 }, { "flow_id": "flow-6c8fc453679cd4723c6a6a51", "transport": "tcp", "stream": 83, "initiator_ip": "10.11.26.183", "initiator_port": 53369, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 20464, "last_frame": 20483, "first_seen_epoch": "1732596656.54926", "last_seen_epoch": "1732596656.555653", "packets": 18, "bytes": 7243, "initiator_bytes": 3097, "responder_bytes": 4146 }, { "flow_id": "flow-4c15f18c62b3c23739861431", "transport": "tcp", "stream": 84, "initiator_ip": "10.11.26.183", "initiator_port": 53370, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 20498, "last_frame": 21093, "first_seen_epoch": "1732596662.928467", "last_seen_epoch": "1732596729.56862", "packets": 18, "bytes": 4499, "initiator_bytes": 2735, "responder_bytes": 1764 }, { "flow_id": "flow-df81ac65bf381e1ed5093711", "transport": "tcp", "stream": 85, "initiator_ip": "10.11.26.183", "initiator_port": 53372, "responder_ip": "10.11.26.3", "responder_port": 139, "first_frame": 20520, "last_frame": 20548, "first_seen_epoch": "1732596670.479047", "last_seen_epoch": "1732596681.214733", "packets": 24, "bytes": 3552, "initiator_bytes": 1743, "responder_bytes": 1809 }, { "flow_id": "flow-b3390e9df31779a462e3aa8d", "transport": "tcp", "stream": 86, "initiator_ip": "10.11.26.183", "initiator_port": 53374, "responder_ip": "10.11.26.3", "responder_port": 139, "first_frame": 20553, "last_frame": 20602, "first_seen_epoch": "1732596700.539178", "last_seen_epoch": "1732596711.280831", "packets": 24, "bytes": 3552, "initiator_bytes": 1743, "responder_bytes": 1809 }, { "flow_id": "flow-1b61b0c3e2ff3917afb8b2d1", "transport": "udp", "stream": 83, "initiator_ip": "10.11.26.183", "initiator_port": 64265, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20611, "last_frame": 21202, "first_seen_epoch": "1732596717.645174", "last_seen_epoch": "1732596828.368686", "packets": 14, "bytes": 1855, "initiator_bytes": 628, "responder_bytes": 1227 }, { "flow_id": "flow-e26f03ebaca585c4bbb0ea46", "transport": "udp", "stream": 84, "initiator_ip": "10.11.26.183", "initiator_port": 56078, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20615, "last_frame": 20617, "first_seen_epoch": "1732596717.771245", "last_seen_epoch": "1732596717.771656", "packets": 2, "bytes": 225, "initiator_bytes": 75, "responder_bytes": 150 }, { "flow_id": "flow-f923ed57b4631fee501ac6ad", "transport": "udp", "stream": 85, "initiator_ip": "10.11.26.183", "initiator_port": 50632, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20616, "last_frame": 20619, "first_seen_epoch": "1732596717.771348", "last_seen_epoch": "1732596717.811936", "packets": 2, "bytes": 209, "initiator_bytes": 75, "responder_bytes": 134 }, { "flow_id": "flow-58cb299284a6e668dfbda736", "transport": "tcp", "stream": 87, "initiator_ip": "10.11.26.183", "initiator_port": 53376, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 20618, "last_frame": 21087, "first_seen_epoch": "1732596717.781645", "last_seen_epoch": "1732596721.411338", "packets": 25, "bytes": 10550, "initiator_bytes": 3016, "responder_bytes": 7534 }, { "flow_id": "flow-079057b8826ccd34e10d44d5", "transport": "udp", "stream": 86, "initiator_ip": "10.11.26.183", "initiator_port": 60063, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20641, "last_frame": 20643, "first_seen_epoch": "1732596718.245175", "last_seen_epoch": "1732596718.245558", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-0ebfd6c38729b62330b2f843", "transport": "udp", "stream": 87, "initiator_ip": "10.11.26.183", "initiator_port": 53179, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20642, "last_frame": 20644, "first_seen_epoch": "1732596718.245257", "last_seen_epoch": "1732596718.245677", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-984cce1fe7507c766d44c798", "transport": "tcp", "stream": 88, "initiator_ip": "10.11.26.183", "initiator_port": 53377, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 20645, "last_frame": 21080, "first_seen_epoch": "1732596718.246073", "last_seen_epoch": "1732596721.410945", "packets": 56, "bytes": 25505, "initiator_bytes": 5035, "responder_bytes": 20470 }, { "flow_id": "flow-d2ddcc49d155931f5ab14f47", "transport": "udp", "stream": 88, "initiator_ip": "10.11.26.183", "initiator_port": 51584, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20686, "last_frame": 20700, "first_seen_epoch": "1732596718.573908", "last_seen_epoch": "1732596718.642054", "packets": 2, "bytes": 403, "initiator_bytes": 71, "responder_bytes": 332 }, { "flow_id": "flow-471dcbd219154eacf90b3c20", "transport": "udp", "stream": 89, "initiator_ip": "10.11.26.183", "initiator_port": 50758, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20687, "last_frame": 20696, "first_seen_epoch": "1732596718.574019", "last_seen_epoch": "1732596718.632512", "packets": 2, "bytes": 320, "initiator_bytes": 71, "responder_bytes": 249 }, { "flow_id": "flow-e4979e41d1368b8ab93cc758", "transport": "udp", "stream": 90, "initiator_ip": "10.11.26.183", "initiator_port": 62292, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20688, "last_frame": 20697, "first_seen_epoch": "1732596718.574687", "last_seen_epoch": "1732596718.632694", "packets": 2, "bytes": 409, "initiator_bytes": 72, "responder_bytes": 337 }, { "flow_id": "flow-9986898529ff06d44b1a6dde", "transport": "udp", "stream": 91, "initiator_ip": "10.11.26.183", "initiator_port": 59416, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20689, "last_frame": 20694, "first_seen_epoch": "1732596718.574755", "last_seen_epoch": "1732596718.631155", "packets": 2, "bytes": 326, "initiator_bytes": 72, "responder_bytes": 254 }, { "flow_id": "flow-796bda85717c60ea535c43fe", "transport": "udp", "stream": 92, "initiator_ip": "10.11.26.183", "initiator_port": 61673, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20690, "last_frame": 20693, "first_seen_epoch": "1732596718.576293", "last_seen_epoch": "1732596718.630938", "packets": 2, "bytes": 255, "initiator_bytes": 87, "responder_bytes": 168 }, { "flow_id": "flow-76bbde183289578be43a51f0", "transport": "udp", "stream": 93, "initiator_ip": "10.11.26.183", "initiator_port": 63774, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20691, "last_frame": 20692, "first_seen_epoch": "1732596718.576331", "last_seen_epoch": "1732596718.620959", "packets": 2, "bytes": 207, "initiator_bytes": 87, "responder_bytes": 120 }, { "flow_id": "flow-9f14dd2cf0641d1cb54a7509", "transport": "tcp", "stream": 89, "initiator_ip": "10.11.26.183", "initiator_port": 53378, "responder_ip": "104.117.247.162", "responder_port": 443, "first_frame": 20695, "last_frame": 21077, "first_seen_epoch": "1732596718.631623", "last_seen_epoch": "1732596721.391269", "packets": 51, "bytes": 14552, "initiator_bytes": 4492, "responder_bytes": 10060 }, { "flow_id": "flow-3912fb796063c89950f4b84e", "transport": "udp", "stream": 94, "initiator_ip": "10.11.26.183", "initiator_port": 49216, "responder_ip": "104.117.244.106", "responder_port": 443, "first_frame": 20698, "last_frame": 21135, "first_seen_epoch": "1732596718.634025", "last_seen_epoch": "1732596748.724948", "packets": 26, "bytes": 10436, "initiator_bytes": 3360, "responder_bytes": 7076 }, { "flow_id": "flow-8c20898bc3b2454730323753", "transport": "udp", "stream": 95, "initiator_ip": "10.11.26.183", "initiator_port": 63303, "responder_ip": "104.117.244.105", "responder_port": 443, "first_frame": 20701, "last_frame": 21054, "first_seen_epoch": "1732596718.64304", "last_seen_epoch": "1732596719.305231", "packets": 160, "bytes": 119785, "initiator_bytes": 7740, "responder_bytes": 112045 }, { "flow_id": "flow-9945933276c00f179ad8307c", "transport": "udp", "stream": 96, "initiator_ip": "10.11.26.183", "initiator_port": 59807, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20707, "last_frame": 20750, "first_seen_epoch": "1732596718.678308", "last_seen_epoch": "1732596718.73264", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-e4587ca4ed6d6048b4d7fed3", "transport": "udp", "stream": 97, "initiator_ip": "10.11.26.183", "initiator_port": 56290, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20708, "last_frame": 20743, "first_seen_epoch": "1732596718.678375", "last_seen_epoch": "1732596718.731588", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-30d3f29be2f55611511b2f4c", "transport": "udp", "stream": 98, "initiator_ip": "10.11.26.183", "initiator_port": 65282, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20709, "last_frame": 20749, "first_seen_epoch": "1732596718.678622", "last_seen_epoch": "1732596718.732622", "packets": 2, "bytes": 366, "initiator_bytes": 74, "responder_bytes": 292 }, { "flow_id": "flow-2429c9c3314df097bfa99759", "transport": "udp", "stream": 99, "initiator_ip": "10.11.26.183", "initiator_port": 54545, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20710, "last_frame": 20744, "first_seen_epoch": "1732596718.678664", "last_seen_epoch": "1732596718.73201", "packets": 2, "bytes": 280, "initiator_bytes": 74, "responder_bytes": 206 }, { "flow_id": "flow-b39869a0215a36fa46c1674e", "transport": "udp", "stream": 100, "initiator_ip": "10.11.26.183", "initiator_port": 62378, "responder_ip": "23.221.22.209", "responder_port": 443, "first_frame": 20751, "last_frame": 21067, "first_seen_epoch": "1732596718.733467", "last_seen_epoch": "1732596719.430878", "packets": 36, "bytes": 13363, "initiator_bytes": 4853, "responder_bytes": 8510 }, { "flow_id": "flow-9267b31b011cd8fe918b5217", "transport": "tcp", "stream": 90, "initiator_ip": "10.11.26.183", "initiator_port": 53379, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 20753, "last_frame": 21086, "first_seen_epoch": "1732596718.733572", "last_seen_epoch": "1732596721.411182", "packets": 39, "bytes": 14513, "initiator_bytes": 4102, "responder_bytes": 10411 }, { "flow_id": "flow-36db421ea4844d837adaf38a", "transport": "udp", "stream": 101, "initiator_ip": "10.11.26.183", "initiator_port": 63229, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20803, "last_frame": 20806, "first_seen_epoch": "1732596718.967648", "last_seen_epoch": "1732596718.968116", "packets": 2, "bytes": 237, "initiator_bytes": 72, "responder_bytes": 165 }, { "flow_id": "flow-2bfac6b8fb333942838b56ce", "transport": "udp", "stream": 102, "initiator_ip": "10.11.26.183", "initiator_port": 58946, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 20804, "last_frame": 20805, "first_seen_epoch": "1732596718.967691", "last_seen_epoch": "1732596718.968097", "packets": 2, "bytes": 278, "initiator_bytes": 72, "responder_bytes": 206 }, { "flow_id": "flow-4e42722f2968b5033ac62c25", "transport": "tcp", "stream": 91, "initiator_ip": "10.11.26.183", "initiator_port": 53380, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 20807, "last_frame": 21084, "first_seen_epoch": "1732596718.968805", "last_seen_epoch": "1732596721.411094", "packets": 24, "bytes": 10408, "initiator_bytes": 2946, "responder_bytes": 7462 }, { "flow_id": "flow-0474291a6d887edfb904fcfb", "transport": "udp", "stream": 103, "initiator_ip": "10.11.26.183", "initiator_port": 59414, "responder_ip": "23.221.22.209", "responder_port": 443, "first_frame": 20832, "last_frame": 21068, "first_seen_epoch": "1732596719.047275", "last_seen_epoch": "1732596719.45086", "packets": 31, "bytes": 10785, "initiator_bytes": 5162, "responder_bytes": 5623 }, { "flow_id": "flow-8d665eeed1d2e292dca99793", "transport": "tcp", "stream": 92, "initiator_ip": "10.11.26.183", "initiator_port": 53382, "responder_ip": "10.11.26.3", "responder_port": 139, "first_frame": 21101, "last_frame": 21134, "first_seen_epoch": "1732596730.591834", "last_seen_epoch": "1732596741.321054", "packets": 24, "bytes": 3552, "initiator_bytes": 1743, "responder_bytes": 1809 }, { "flow_id": "flow-4e6b6ef62e55beca816d7ed4", "transport": "tcp", "stream": 93, "initiator_ip": "10.11.26.183", "initiator_port": 53387, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 21159, "last_frame": 21187, "first_seen_epoch": "1732596827.738332", "last_seen_epoch": "1732596827.750439", "packets": 17, "bytes": 6743, "initiator_bytes": 3083, "responder_bytes": 3660 }, { "flow_id": "flow-804aa13710170d700f009034", "transport": "tcp", "stream": 94, "initiator_ip": "10.11.26.183", "initiator_port": 53388, "responder_ip": "10.11.26.3", "responder_port": 88, "first_frame": 21166, "last_frame": 21177, "first_seen_epoch": "1732596827.741377", "last_seen_epoch": "1732596827.745075", "packets": 12, "bytes": 4301, "initiator_bytes": 2166, "responder_bytes": 2135 }, { "flow_id": "flow-9389405a6b98c5aa962d2f32", "transport": "tcp", "stream": 95, "initiator_ip": "10.11.26.183", "initiator_port": 53389, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 21188, "last_frame": 21200, "first_seen_epoch": "1732596827.75901", "last_seen_epoch": "1732596827.76211", "packets": 13, "bytes": 3372, "initiator_bytes": 2619, "responder_bytes": 753 }, { "flow_id": "flow-0c652b4fdf866cab3d6c5d13", "transport": "tcp", "stream": 96, "initiator_ip": "10.11.26.183", "initiator_port": 53390, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 21203, "last_frame": 21299, "first_seen_epoch": "1732596828.369897", "last_seen_epoch": "1732596954.730602", "packets": 30, "bytes": 10851, "initiator_bytes": 3124, "responder_bytes": 7727 }, { "flow_id": "flow-3f93653505756ba0e848e09d", "transport": "udp", "stream": 104, "initiator_ip": "10.11.26.183", "initiator_port": 57315, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21250, "last_frame": 21377, "first_seen_epoch": "1732596897.02909", "last_seen_epoch": "1732597162.367264", "packets": 6, "bytes": 929, "initiator_bytes": 320, "responder_bytes": 609 }, { "flow_id": "flow-560f53cb2c0b075726aa21db", "transport": "tcp", "stream": 97, "initiator_ip": "10.11.26.183", "initiator_port": 53395, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 21254, "last_frame": 21270, "first_seen_epoch": "1732596897.032754", "last_seen_epoch": "1732596897.041301", "packets": 17, "bytes": 6743, "initiator_bytes": 3083, "responder_bytes": 3660 }, { "flow_id": "flow-4d84c33237b6a39571076801", "transport": "tcp", "stream": 98, "initiator_ip": "10.11.26.183", "initiator_port": 53396, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 21271, "last_frame": 21283, "first_seen_epoch": "1732596897.047046", "last_seen_epoch": "1732596897.051626", "packets": 13, "bytes": 3372, "initiator_bytes": 2619, "responder_bytes": 753 }, { "flow_id": "flow-cc55226632a09b8702f5fc4c", "transport": "tcp", "stream": 99, "initiator_ip": "10.11.26.183", "initiator_port": 53400, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21302, "last_frame": 21345, "first_seen_epoch": "1732596963.40314", "last_seen_epoch": "1732597030.02381", "packets": 28, "bytes": 11295, "initiator_bytes": 3035, "responder_bytes": 8260 }, { "flow_id": "flow-899e76163ffe2f5f23142f92", "transport": "tcp", "stream": 100, "initiator_ip": "10.11.26.183", "initiator_port": 53411, "responder_ip": "20.189.173.6", "responder_port": 443, "first_frame": 21378, "last_frame": 21412, "first_seen_epoch": "1732597162.368648", "last_seen_epoch": "1732597163.120297", "packets": 35, "bytes": 13319, "initiator_bytes": 7587, "responder_bytes": 5732 }, { "flow_id": "flow-4ee1cead425010f59fde0f1f", "transport": "udp", "stream": 105, "initiator_ip": "10.11.26.183", "initiator_port": 51403, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21419, "last_frame": 21420, "first_seen_epoch": "1732597237.655349", "last_seen_epoch": "1732597237.686162", "packets": 2, "bytes": 395, "initiator_bytes": 91, "responder_bytes": 304 }, { "flow_id": "flow-ad33cf3af2cf5edd5159620e", "transport": "tcp", "stream": 101, "initiator_ip": "10.11.26.183", "initiator_port": 53412, "responder_ip": "20.99.184.37", "responder_port": 443, "first_frame": 21421, "last_frame": 21467, "first_seen_epoch": "1732597237.688816", "last_seen_epoch": "1732597238.15384", "packets": 24, "bytes": 9988, "initiator_bytes": 2725, "responder_bytes": 7263 }, { "flow_id": "flow-bde5a54d2c0312f5a7da1fa9", "transport": "udp", "stream": 106, "initiator_ip": "10.11.26.183", "initiator_port": 64501, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21422, "last_frame": 21423, "first_seen_epoch": "1732597237.702147", "last_seen_epoch": "1732597237.705023", "packets": 2, "bytes": 394, "initiator_bytes": 109, "responder_bytes": 285 }, { "flow_id": "flow-a6487dadf0ed3e290790f5a6", "transport": "tcp", "stream": 102, "initiator_ip": "10.11.26.183", "initiator_port": 53413, "responder_ip": "23.204.171.61", "responder_port": 443, "first_frame": 21424, "last_frame": 21458, "first_seen_epoch": "1732597237.707382", "last_seen_epoch": "1732597237.991651", "packets": 21, "bytes": 8442, "initiator_bytes": 1263, "responder_bytes": 7179 }, { "flow_id": "flow-54123c63c4edef58e7fba85e", "transport": "udp", "stream": 107, "initiator_ip": "10.11.26.183", "initiator_port": 50129, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21474, "last_frame": 21475, "first_seen_epoch": "1732597242.931032", "last_seen_epoch": "1732597242.954335", "packets": 2, "bytes": 270, "initiator_bytes": 91, "responder_bytes": 179 }, { "flow_id": "flow-8db9548470ae896d36346e6f", "transport": "tcp", "stream": 103, "initiator_ip": "10.11.26.183", "initiator_port": 53414, "responder_ip": "52.165.164.15", "responder_port": 443, "first_frame": 21476, "last_frame": 21607, "first_seen_epoch": "1732597242.95615", "last_seen_epoch": "1732597247.964095", "packets": 131, "bytes": 108271, "initiator_bytes": 80615, "responder_bytes": 27656 }, { "flow_id": "flow-f012d63a9cd9d48a20215cce", "transport": "udp", "stream": 108, "initiator_ip": "10.11.26.183", "initiator_port": 64584, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21610, "last_frame": 21611, "first_seen_epoch": "1732597249.477051", "last_seen_epoch": "1732597249.499839", "packets": 2, "bytes": 315, "initiator_bytes": 89, "responder_bytes": 226 }, { "flow_id": "flow-aaf7d26a5f15555e44e6f7a2", "transport": "tcp", "stream": 104, "initiator_ip": "10.11.26.183", "initiator_port": 53417, "responder_ip": "20.42.73.28", "responder_port": 443, "first_frame": 21612, "last_frame": 21639, "first_seen_epoch": "1732597249.500351", "last_seen_epoch": "1732597250.084444", "packets": 28, "bytes": 8562, "initiator_bytes": 3110, "responder_bytes": 5452 }, { "flow_id": "flow-d569eb9342433f8e30aea4b7", "transport": "tcp", "stream": 105, "initiator_ip": "10.11.26.183", "initiator_port": 53419, "responder_ip": "10.11.26.3", "responder_port": 135, "first_frame": 21641, "last_frame": 21704, "first_seen_epoch": "1732597251.948853", "last_seen_epoch": "1732597265.252301", "packets": 12, "bytes": 1412, "initiator_bytes": 742, "responder_bytes": 670 }, { "flow_id": "flow-3eb9c8401f5c521a304bbc7c", "transport": "tcp", "stream": 106, "initiator_ip": "10.11.26.183", "initiator_port": 53420, "responder_ip": "10.11.26.3", "responder_port": 49671, "first_frame": 21648, "last_frame": 21703, "first_seen_epoch": "1732597251.950805", "last_seen_epoch": "1732597265.252282", "packets": 16, "bytes": 2426, "initiator_bytes": 1452, "responder_bytes": 974 }, { "flow_id": "flow-973ed14fb19fcbf429f04693", "transport": "udp", "stream": 109, "initiator_ip": "10.11.26.183", "initiator_port": 57266, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21662, "last_frame": 21715, "first_seen_epoch": "1732597259.823089", "last_seen_epoch": "1732597316.698604", "packets": 6, "bytes": 739, "initiator_bytes": 234, "responder_bytes": 505 }, { "flow_id": "flow-d38d9a142407937bb2fda25f", "transport": "udp", "stream": 110, "initiator_ip": "10.11.26.183", "initiator_port": 50712, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21663, "last_frame": 25850, "first_seen_epoch": "1732597259.823118", "last_seen_epoch": "1732597533.438034", "packets": 6, "bytes": 642, "initiator_bytes": 232, "responder_bytes": 410 }, { "flow_id": "flow-57ff60aeae309c2940666fdb", "transport": "tcp", "stream": 107, "initiator_ip": "10.11.26.183", "initiator_port": 53421, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21670, "last_frame": 21779, "first_seen_epoch": "1732597263.773397", "last_seen_epoch": "1732597331.934606", "packets": 28, "bytes": 11292, "initiator_bytes": 3035, "responder_bytes": 8257 }, { "flow_id": "flow-b3146195bedd2fea60906a3d", "transport": "tcp", "stream": 108, "initiator_ip": "10.11.26.183", "initiator_port": 53422, "responder_ip": "23.53.127.105", "responder_port": 80, "first_frame": 21716, "last_frame": 21738, "first_seen_epoch": "1732597316.700471", "last_seen_epoch": "1732597317.032729", "packets": 8, "bytes": 1143, "initiator_bytes": 623, "responder_bytes": 520 }, { "flow_id": "flow-716c8fb49bf1f41423ec14c0", "transport": "udp", "stream": 111, "initiator_ip": "10.11.26.183", "initiator_port": 54339, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21723, "last_frame": 21724, "first_seen_epoch": "1732597316.907959", "last_seen_epoch": "1732597316.912599", "packets": 2, "bytes": 241, "initiator_bytes": 75, "responder_bytes": 166 }, { "flow_id": "flow-ddb0342a557392a46ff24bfb", "transport": "tcp", "stream": 109, "initiator_ip": "10.11.26.183", "initiator_port": 53423, "responder_ip": "23.201.68.167", "responder_port": 443, "first_frame": 21725, "last_frame": 21744, "first_seen_epoch": "1732597316.914216", "last_seen_epoch": "1732597317.136573", "packets": 19, "bytes": 6316, "initiator_bytes": 1459, "responder_bytes": 4857 }, { "flow_id": "flow-6195a8e993565281457daa08", "transport": "udp", "stream": 112, "initiator_ip": "10.11.26.183", "initiator_port": 51810, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21745, "last_frame": 21758, "first_seen_epoch": "1732597317.771757", "last_seen_epoch": "1732597328.412034", "packets": 10, "bytes": 1263, "initiator_bytes": 401, "responder_bytes": 862 }, { "flow_id": "flow-bd7c053412e9aea277bcacad", "transport": "tcp", "stream": 110, "initiator_ip": "10.11.26.183", "initiator_port": 53424, "responder_ip": "20.189.173.23", "responder_port": 443, "first_frame": 21759, "last_frame": 21800, "first_seen_epoch": "1732597328.413494", "last_seen_epoch": "1732597438.42764", "packets": 23, "bytes": 8302, "initiator_bytes": 1197, "responder_bytes": 7105 }, { "flow_id": "flow-1a6c2cb8217fb78ad18647d0", "transport": "tcp", "stream": 111, "initiator_ip": "10.11.26.183", "initiator_port": 53425, "responder_ip": "20.189.173.23", "responder_port": 443, "first_frame": 21801, "last_frame": 25874, "first_seen_epoch": "1732597442.72143", "last_seen_epoch": "1732597548.447277", "packets": 23, "bytes": 8334, "initiator_bytes": 1229, "responder_bytes": 7105 }, { "flow_id": "flow-671b4552bd6f02ea6c161c72", "transport": "udp", "stream": 113, "initiator_ip": "10.11.26.183", "initiator_port": 53077, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21827, "last_frame": 21828, "first_seen_epoch": "1732597494.129895", "last_seen_epoch": "1732597494.149055", "packets": 2, "bytes": 304, "initiator_bytes": 92, "responder_bytes": 212 }, { "flow_id": "flow-fab3c7e7d070af74350ec596", "transport": "tcp", "stream": 112, "initiator_ip": "10.11.26.183", "initiator_port": 53427, "responder_ip": "20.189.173.26", "responder_port": 443, "first_frame": 21829, "last_frame": 25890, "first_seen_epoch": "1732597494.150391", "last_seen_epoch": "1732597604.181564", "packets": 27, "bytes": 10634, "initiator_bytes": 2896, "responder_bytes": 7738 }, { "flow_id": "flow-97c0a3ebd0c6f0add1d88b9a", "transport": "udp", "stream": 114, "initiator_ip": "10.11.26.183", "initiator_port": 60678, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 21853, "last_frame": 21854, "first_seen_epoch": "1732597496.83651", "last_seen_epoch": "1732597496.869223", "packets": 2, "bytes": 303, "initiator_bytes": 74, "responder_bytes": 229 }, { "flow_id": "flow-69e4e7ee5ed4252428e7aef1", "transport": "tcp", "stream": 113, "initiator_ip": "10.11.26.183", "initiator_port": 53428, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21855, "last_frame": 21922, "first_seen_epoch": "1732597496.871522", "last_seen_epoch": "1732597497.376131", "packets": 51, "bytes": 38822, "initiator_bytes": 2719, "responder_bytes": 36103 }, { "flow_id": "flow-19a527aa298aabafe6029814", "transport": "tcp", "stream": 114, "initiator_ip": "10.11.26.183", "initiator_port": 53429, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21856, "last_frame": 25840, "first_seen_epoch": "1732597496.896207", "last_seen_epoch": "1732597519.520431", "packets": 126, "bytes": 107603, "initiator_bytes": 5436, "responder_bytes": 102167 }, { "flow_id": "flow-ebaf32a95114c02163c0b42b", "transport": "tcp", "stream": 115, "initiator_ip": "10.11.26.183", "initiator_port": 53430, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21957, "last_frame": 25841, "first_seen_epoch": "1732597497.781327", "last_seen_epoch": "1732597519.520532", "packets": 81, "bytes": 68815, "initiator_bytes": 3656, "responder_bytes": 65159 }, { "flow_id": "flow-b72e6903e364a9c7157af3ad", "transport": "tcp", "stream": 116, "initiator_ip": "10.11.26.183", "initiator_port": 53431, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21958, "last_frame": 25842, "first_seen_epoch": "1732597497.781605", "last_seen_epoch": "1732597519.520532", "packets": 77, "bytes": 62899, "initiator_bytes": 3502, "responder_bytes": 59397 }, { "flow_id": "flow-70dc32f180a8b8ed41240fca", "transport": "tcp", "stream": 117, "initiator_ip": "10.11.26.183", "initiator_port": 53432, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21959, "last_frame": 25843, "first_seen_epoch": "1732597497.781831", "last_seen_epoch": "1732597519.52054", "packets": 73, "bytes": 60600, "initiator_bytes": 3435, "responder_bytes": 57165 }, { "flow_id": "flow-170c21e1631ca1cbdde3ef48", "transport": "tcp", "stream": 118, "initiator_ip": "10.11.26.183", "initiator_port": 53433, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 21960, "last_frame": 25844, "first_seen_epoch": "1732597497.782153", "last_seen_epoch": "1732597519.520604", "packets": 70, "bytes": 56824, "initiator_bytes": 3422, "responder_bytes": 53402 }, { "flow_id": "flow-1ebc4d89c0d904885f2bf906", "transport": "udp", "stream": 115, "initiator_ip": "10.11.26.183", "initiator_port": 52465, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 22276, "last_frame": 22277, "first_seen_epoch": "1732597498.252993", "last_seen_epoch": "1732597498.258597", "packets": 2, "bytes": 251, "initiator_bytes": 92, "responder_bytes": 159 }, { "flow_id": "flow-71a695a55bdf397c29e3beee", "transport": "tcp", "stream": 119, "initiator_ip": "10.11.26.183", "initiator_port": 53434, "responder_ip": "52.109.0.136", "responder_port": 443, "first_frame": 22278, "last_frame": 25846, "first_seen_epoch": "1732597498.259145", "last_seen_epoch": "1732597519.520715", "packets": 51, "bytes": 41011, "initiator_bytes": 7070, "responder_bytes": 33941 }, { "flow_id": "flow-870ee99b4338887320984464", "transport": "udp", "stream": 116, "initiator_ip": "10.11.26.183", "initiator_port": 58641, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 22384, "last_frame": 22387, "first_seen_epoch": "1732597499.619497", "last_seen_epoch": "1732597499.634256", "packets": 2, "bytes": 280, "initiator_bytes": 92, "responder_bytes": 188 }, { "flow_id": "flow-76c9525741c8bcdc4727a441", "transport": "udp", "stream": 117, "initiator_ip": "10.11.26.183", "initiator_port": 57554, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 22385, "last_frame": 22386, "first_seen_epoch": "1732597499.619497", "last_seen_epoch": "1732597499.634228", "packets": 2, "bytes": 280, "initiator_bytes": 92, "responder_bytes": 188 }, { "flow_id": "flow-aa7c84df9734896808aca4fd", "transport": "tcp", "stream": 120, "initiator_ip": "10.11.26.183", "initiator_port": 53437, "responder_ip": "173.222.49.101", "responder_port": 443, "first_frame": 22388, "last_frame": 23566, "first_seen_epoch": "1732597499.635314", "last_seen_epoch": "1732597500.139281", "packets": 748, "bytes": 719436, "initiator_bytes": 15901, "responder_bytes": 703535 }, { "flow_id": "flow-2a7af230fd5f54f7a66c9c16", "transport": "tcp", "stream": 121, "initiator_ip": "10.11.26.183", "initiator_port": 53436, "responder_ip": "173.222.49.101", "responder_port": 443, "first_frame": 22389, "last_frame": 23572, "first_seen_epoch": "1732597499.635333", "last_seen_epoch": "1732597500.140007", "packets": 437, "bytes": 415744, "initiator_bytes": 9661, "responder_bytes": 406083 }, { "flow_id": "flow-a6c9b04ffee95120b637a68a", "transport": "udp", "stream": 118, "initiator_ip": "10.11.26.183", "initiator_port": 55110, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 23573, "last_frame": 23574, "first_seen_epoch": "1732597500.387511", "last_seen_epoch": "1732597500.418189", "packets": 2, "bytes": 280, "initiator_bytes": 92, "responder_bytes": 188 }, { "flow_id": "flow-110fa950ec4a2c022bc16f1b", "transport": "tcp", "stream": 122, "initiator_ip": "10.11.26.183", "initiator_port": 53438, "responder_ip": "173.222.49.101", "responder_port": 443, "first_frame": 23575, "last_frame": 24465, "first_seen_epoch": "1732597500.418668", "last_seen_epoch": "1732597500.935281", "packets": 855, "bytes": 823777, "initiator_bytes": 18001, "responder_bytes": 805776 }, { "flow_id": "flow-41e30400228567285b665c45", "transport": "udp", "stream": 119, "initiator_ip": "10.11.26.183", "initiator_port": 53681, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 23587, "last_frame": 23589, "first_seen_epoch": "1732597500.557158", "last_seen_epoch": "1732597500.574101", "packets": 2, "bytes": 280, "initiator_bytes": 92, "responder_bytes": 188 }, { "flow_id": "flow-74c532888272a00a1ba7096a", "transport": "tcp", "stream": 123, "initiator_ip": "10.11.26.183", "initiator_port": 53439, "responder_ip": "173.222.49.101", "responder_port": 443, "first_frame": 23590, "last_frame": 25845, "first_seen_epoch": "1732597500.575279", "last_seen_epoch": "1732597519.520604", "packets": 32, "bytes": 21885, "initiator_bytes": 1621, "responder_bytes": 20264 }, { "flow_id": "flow-70fddec34b593550ac900bef", "transport": "udp", "stream": 120, "initiator_ip": "10.11.26.183", "initiator_port": 55128, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 23964, "last_frame": 24030, "first_seen_epoch": "1732597500.817685", "last_seen_epoch": "1732597500.835461", "packets": 2, "bytes": 280, "initiator_bytes": 92, "responder_bytes": 188 }, { "flow_id": "flow-7254a558d6bd619f2ad9c1ad", "transport": "tcp", "stream": 124, "initiator_ip": "10.11.26.183", "initiator_port": 53440, "responder_ip": "173.222.49.101", "responder_port": 443, "first_frame": 24033, "last_frame": 25834, "first_seen_epoch": "1732597500.836045", "last_seen_epoch": "1732597501.430381", "packets": 1370, "bytes": 1326163, "initiator_bytes": 28261, "responder_bytes": 1297902 }, { "flow_id": "flow-8c46b84e46546756eaddb254", "transport": "tcp", "stream": 125, "initiator_ip": "10.11.26.183", "initiator_port": 53442, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 25853, "last_frame": 25879, "first_seen_epoch": "1732597537.880323", "last_seen_epoch": "1732597548.610626", "packets": 24, "bytes": 7734, "initiator_bytes": 5573, "responder_bytes": 2161 }, { "flow_id": "flow-30fe9178507aef700b2cb5f0", "transport": "tcp", "stream": 126, "initiator_ip": "10.11.26.183", "initiator_port": 53443, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 25897, "last_frame": 25967, "first_seen_epoch": "1732597616.694612", "last_seen_epoch": "1732597726.769185", "packets": 37, "bytes": 12024, "initiator_bytes": 3005, "responder_bytes": 9019 }, { "flow_id": "flow-1c57eb98a707e7591cf3c4f4", "transport": "tcp", "stream": 127, "initiator_ip": "10.11.26.183", "initiator_port": 53444, "responder_ip": "20.189.173.23", "responder_port": 443, "first_frame": 25936, "last_frame": 25961, "first_seen_epoch": "1732597668.971208", "last_seen_epoch": "1732597669.290192", "packets": 24, "bytes": 8394, "initiator_bytes": 1289, "responder_bytes": 7105 }, { "flow_id": "flow-3447381ceda4c435360f58e2", "transport": "udp", "stream": 121, "initiator_ip": "10.11.26.183", "initiator_port": 58159, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 25976, "last_frame": 25977, "first_seen_epoch": "1732597789.025745", "last_seen_epoch": "1732597789.027193", "packets": 2, "bytes": 304, "initiator_bytes": 92, "responder_bytes": 212 }, { "flow_id": "flow-80cda65cbfb51e4e2a13bd5c", "transport": "tcp", "stream": 128, "initiator_ip": "10.11.26.183", "initiator_port": 53445, "responder_ip": "20.189.173.16", "responder_port": 443, "first_frame": 25978, "last_frame": 26046, "first_seen_epoch": "1732597789.028481", "last_seen_epoch": "1732597899.089646", "packets": 30, "bytes": 12111, "initiator_bytes": 4387, "responder_bytes": 7724 }, { "flow_id": "flow-7d2377e832ae92c806e4740c", "transport": "udp", "stream": 122, "initiator_ip": "10.11.26.183", "initiator_port": 59270, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26020, "last_frame": 26021, "first_seen_epoch": "1732597848.394016", "last_seen_epoch": "1732597848.410925", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-9407fd267ab61c2ed49ffec3", "transport": "udp", "stream": 123, "initiator_ip": "10.11.26.183", "initiator_port": 62613, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26030, "last_frame": 26140, "first_seen_epoch": "1732597859.866812", "last_seen_epoch": "1732598406.273953", "packets": 6, "bytes": 789, "initiator_bytes": 245, "responder_bytes": 544 }, { "flow_id": "flow-f75a1311b5cac3384d2d339d", "transport": "udp", "stream": 124, "initiator_ip": "10.11.26.183", "initiator_port": 55765, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26031, "last_frame": 26209, "first_seen_epoch": "1732597859.866911", "last_seen_epoch": "1732598448.372475", "packets": 6, "bytes": 642, "initiator_bytes": 232, "responder_bytes": 410 }, { "flow_id": "flow-cc8c40a16c44d694b5d5589d", "transport": "tcp", "stream": 129, "initiator_ip": "10.11.26.183", "initiator_port": 53459, "responder_ip": "20.42.73.25", "responder_port": 443, "first_frame": 26141, "last_frame": 26180, "first_seen_epoch": "1732598406.275405", "last_seen_epoch": "1732598407.038807", "packets": 40, "bytes": 13690, "initiator_bytes": 7738, "responder_bytes": 5952 }, { "flow_id": "flow-0d02b7fc14d952b778675561", "transport": "tcp", "stream": 130, "initiator_ip": "10.11.26.183", "initiator_port": 53462, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 26187, "last_frame": 26214, "first_seen_epoch": "1732598437.874585", "last_seen_epoch": "1732598448.614047", "packets": 24, "bytes": 7734, "initiator_bytes": 5573, "responder_bytes": 2161 }, { "flow_id": "flow-178a198b63521bbb9c144d88", "transport": "udp", "stream": 125, "initiator_ip": "10.11.26.183", "initiator_port": 62125, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26219, "last_frame": 26234, "first_seen_epoch": "1732598459.901594", "last_seen_epoch": "1732598497.311858", "packets": 6, "bytes": 777, "initiator_bytes": 230, "responder_bytes": 547 }, { "flow_id": "flow-28d8e8a7d00709575de98899", "transport": "udp", "stream": 126, "initiator_ip": "10.11.26.183", "initiator_port": 56349, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26220, "last_frame": 26356, "first_seen_epoch": "1732598459.901594", "last_seen_epoch": "1732598808.377331", "packets": 6, "bytes": 642, "initiator_bytes": 232, "responder_bytes": 410 }, { "flow_id": "flow-b6e1c1a608a4971b82c522e9", "transport": "tcp", "stream": 131, "initiator_ip": "10.11.26.183", "initiator_port": 53466, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 26235, "last_frame": 26314, "first_seen_epoch": "1732598497.312875", "last_seen_epoch": "1732598613.825647", "packets": 62, "bytes": 40632, "initiator_bytes": 2445, "responder_bytes": 38187 }, { "flow_id": "flow-d4f2bdd891b4132dfdc3e1d1", "transport": "udp", "stream": 127, "initiator_ip": "10.11.26.183", "initiator_port": 49456, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26411, "last_frame": 26547, "first_seen_epoch": "1732599059.936351", "last_seen_epoch": "1732599453.343164", "packets": 6, "bytes": 642, "initiator_bytes": 232, "responder_bytes": 410 }, { "flow_id": "flow-95dddf13d59f79aa7d1c6f7d", "transport": "udp", "stream": 128, "initiator_ip": "10.11.26.183", "initiator_port": 60774, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26412, "last_frame": 26511, "first_seen_epoch": "1732599059.936351", "last_seen_epoch": "1732599354.427394", "packets": 6, "bytes": 854, "initiator_bytes": 239, "responder_bytes": 615 }, { "flow_id": "flow-daeb3ed2a8a50b35c4d661d1", "transport": "tcp", "stream": 132, "initiator_ip": "10.11.26.183", "initiator_port": 53481, "responder_ip": "20.189.173.26", "responder_port": 443, "first_frame": 26451, "last_frame": 26528, "first_seen_epoch": "1732599294.018345", "last_seen_epoch": "1732599404.379613", "packets": 27, "bytes": 10598, "initiator_bytes": 2860, "responder_bytes": 7738 }, { "flow_id": "flow-364f90749ac900d09ed54c3a", "transport": "tcp", "stream": 133, "initiator_ip": "10.11.26.183", "initiator_port": 53482, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 26484, "last_frame": 26507, "first_seen_epoch": "1732599337.882244", "last_seen_epoch": "1732599348.619219", "packets": 24, "bytes": 7734, "initiator_bytes": 5573, "responder_bytes": 2161 }, { "flow_id": "flow-c21c921202625267bd5abc76", "transport": "tcp", "stream": 134, "initiator_ip": "10.11.26.183", "initiator_port": 53483, "responder_ip": "23.53.127.200", "responder_port": 80, "first_frame": 26512, "last_frame": 26537, "first_seen_epoch": "1732599354.434358", "last_seen_epoch": "1732599414.645214", "packets": 13, "bytes": 1868, "initiator_bytes": 981, "responder_bytes": 887 }, { "flow_id": "flow-b336e1d1e0964198e1a2927b", "transport": "udp", "stream": 129, "initiator_ip": "10.11.26.183", "initiator_port": 59053, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26564, "last_frame": 26565, "first_seen_epoch": "1732599520.362771", "last_seen_epoch": "1732599520.744444", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-adde13a6ee89780ea694401a", "transport": "udp", "stream": 130, "initiator_ip": "10.11.26.183", "initiator_port": 59054, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 26592, "last_frame": 26608, "first_seen_epoch": "1732599597.731952", "last_seen_epoch": "1732599597.752712", "packets": 4, "bytes": 1043, "initiator_bytes": 581, "responder_bytes": 462 }, { "flow_id": "flow-676a021e62ca9adbc0d55602", "transport": "udp", "stream": 131, "initiator_ip": "10.11.26.183", "initiator_port": 52089, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26594, "last_frame": 26870, "first_seen_epoch": "1732599597.736612", "last_seen_epoch": "1732599747.553388", "packets": 8, "bytes": 891, "initiator_bytes": 327, "responder_bytes": 564 }, { "flow_id": "flow-cf4126574ba9bc03f4f926ea", "transport": "tcp", "stream": 135, "initiator_ip": "10.11.26.183", "initiator_port": 53493, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 26596, "last_frame": 26794, "first_seen_epoch": "1732599597.740544", "last_seen_epoch": "1732599598.049379", "packets": 22, "bytes": 9274, "initiator_bytes": 4014, "responder_bytes": 5260 }, { "flow_id": "flow-7c8dce07408bcf75253b8d3e", "transport": "tcp", "stream": 136, "initiator_ip": "10.11.26.183", "initiator_port": 53494, "responder_ip": "10.11.26.3", "responder_port": 135, "first_frame": 26610, "last_frame": 26801, "first_seen_epoch": "1732599597.833398", "last_seen_epoch": "1732599609.655151", "packets": 12, "bytes": 1412, "initiator_bytes": 742, "responder_bytes": 670 }, { "flow_id": "flow-e8336aa3a09ff02331b32870", "transport": "tcp", "stream": 137, "initiator_ip": "10.11.26.183", "initiator_port": 53495, "responder_ip": "10.11.26.3", "responder_port": 49671, "first_frame": 26617, "last_frame": 26819, "first_seen_epoch": "1732599597.836625", "last_seen_epoch": "1732599629.672427", "packets": 20, "bytes": 5414, "initiator_bytes": 3768, "responder_bytes": 1646 }, { "flow_id": "flow-5540b07c43f8bde9be1587d0", "transport": "udp", "stream": 132, "initiator_ip": "10.11.26.183", "initiator_port": 52091, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 26634, "last_frame": 26635, "first_seen_epoch": "1732599597.870794", "last_seen_epoch": "1732599597.871371", "packets": 2, "bytes": 499, "initiator_bytes": 268, "responder_bytes": 231 }, { "flow_id": "flow-e3160cb668bdbb14e7a5e001", "transport": "tcp", "stream": 138, "initiator_ip": "10.11.26.183", "initiator_port": 53496, "responder_ip": "10.11.26.3", "responder_port": 389, "first_frame": 26639, "last_frame": 26790, "first_seen_epoch": "1732599597.979485", "last_seen_epoch": "1732599598.044938", "packets": 16, "bytes": 3951, "initiator_bytes": 3022, "responder_bytes": 929 }, { "flow_id": "flow-12236eeba62cba4a4b700395", "transport": "tcp", "stream": 139, "initiator_ip": "10.11.26.183", "initiator_port": 53497, "responder_ip": "10.11.26.3", "responder_port": 445, "first_frame": 26652, "last_frame": 26922, "first_seen_epoch": "1732599598.010515", "last_seen_epoch": "1732599838.109487", "packets": 154, "bytes": 39034, "initiator_bytes": 18939, "responder_bytes": 20095 }, { "flow_id": "flow-c1e84970642b5c9476f4e8e5", "transport": "tcp", "stream": 140, "initiator_ip": "10.11.26.183", "initiator_port": 53500, "responder_ip": "194.180.191.64", "responder_port": 443, "first_frame": 26804, "last_frame": 26914, "first_seen_epoch": "1732599628.591982", "last_seen_epoch": "1732599809.941747", "packets": 16, "bytes": 3097, "initiator_bytes": 2162, "responder_bytes": 935 }, { "flow_id": "flow-61664dbb9a3daa1619a97625", "transport": "udp", "stream": 133, "initiator_ip": "10.11.26.183", "initiator_port": 65531, "responder_ip": "10.11.26.3", "responder_port": 53, "first_frame": 26827, "last_frame": 26835, "first_seen_epoch": "1732599659.985869", "last_seen_epoch": "1732599663.325324", "packets": 6, "bytes": 642, "initiator_bytes": 232, "responder_bytes": 410 }, { "flow_id": "flow-5e4d5d7ac490870951975062", "transport": "tcp", "stream": 141, "initiator_ip": "10.11.26.183", "initiator_port": 53506, "responder_ip": "20.7.1.246", "responder_port": 443, "first_frame": 26871, "last_frame": 26898, "first_seen_epoch": "1732599747.554005", "last_seen_epoch": "1732599747.998083", "packets": 28, "bytes": 9098, "initiator_bytes": 3347, "responder_bytes": 5751 } ], "events": { "dns": [ { "event_id": "evt-f0966a60bbd1443f85ae4b22", "kind": "dns", "frame_number": 1, "timestamp_epoch": "1732596578.458138000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65460, "dst_port": 53, "tcp_stream": null, "udp_stream": 0, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-564611f79d2563de4e1e422b", "kind": "dns", "frame_number": 2, "timestamp_epoch": "1732596578.487199000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65460, "tcp_stream": null, "udp_stream": 0, "fields": { "dns.a": "104.117.247.184,104.117.247.144", "dns.cname": "ncsi-geo.trafficmanager.net,www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-7851a3e1bca1e9b395aa5325", "kind": "dns", "frame_number": 13, "timestamp_epoch": "1732596578.918598000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55542, "dst_port": 53, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-f1171605f161ddadff16d153", "kind": "dns", "frame_number": 14, "timestamp_epoch": "1732596578.918662000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49685, "dst_port": 53, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-f125f4fe0b4e6805157be8b0", "kind": "dns", "frame_number": 15, "timestamp_epoch": "1732596578.918790000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56341, "dst_port": 53, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-d35dd4d1e3c074e86d133a6b", "kind": "dns", "frame_number": 16, "timestamp_epoch": "1732596578.918835000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63714, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-92f7c38a7cab9e8b423e4f64", "kind": "dns", "frame_number": 17, "timestamp_epoch": "1732596578.919063000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49685, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.a": "10.11.26.3", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-430b990082dddc1909b9bbaf", "kind": "dns", "frame_number": 18, "timestamp_epoch": "1732596578.919107000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55542, "tcp_stream": null, "udp_stream": 1, "fields": { "dns.a": "10.11.26.3", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-aa4bf9ef7517e0608b9d844a", "kind": "dns", "frame_number": 19, "timestamp_epoch": "1732596578.919159000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63714, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-8f722278a89e36d0bef1bafd", "kind": "dns", "frame_number": 20, "timestamp_epoch": "1732596578.919159000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56341, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-641820856b97b31dae2b04ec", "kind": "dns", "frame_number": 21, "timestamp_epoch": "1732596578.919273000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63714, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-2c92eb14d949048873ee65f2", "kind": "dns", "frame_number": 22, "timestamp_epoch": "1732596578.919350000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56341, "dst_port": 53, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-7e9e18ccca0bd20677889aeb", "kind": "dns", "frame_number": 23, "timestamp_epoch": "1732596578.919448000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63714, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-4d26c790074be177540a41c5", "kind": "dns", "frame_number": 25, "timestamp_epoch": "1732596578.919535000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56341, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-60431abb89f5aaa321f2af1b", "kind": "dns", "frame_number": 55, "timestamp_epoch": "1732596580.633212000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59980, "dst_port": 53, "tcp_stream": null, "udp_stream": 8, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-b76d8ba8f52b5f7fff77ebf0", "kind": "dns", "frame_number": 56, "timestamp_epoch": "1732596580.654972000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59980, "tcp_stream": null, "udp_stream": 8, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-50931f180eb25545e5e5525a", "kind": "dns", "frame_number": 57, "timestamp_epoch": "1732596580.680041000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56066, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-5502f723caeaef3befa0c7e4", "kind": "dns", "frame_number": 58, "timestamp_epoch": "1732596580.699884000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56066, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-bff6f6650d2e9773c5fdd15c", "kind": "dns", "frame_number": 59, "timestamp_epoch": "1732596581.134947000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59726, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d52edb66f4a0f04fa1fcc363", "kind": "dns", "frame_number": 60, "timestamp_epoch": "1732596581.194894000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59726, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.a": "4.149.227.78", "dns.cname": "consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net,licensing-prod-frontdoor-geomap.trafficmanager.net,wus2-2.frontdoor.licensing.commerce.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b66c8725aa6e4ce5432311b8", "kind": "dns", "frame_number": 80, "timestamp_epoch": "1732596581.401527000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53800, "dst_port": 53, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-127531bb73a5d016f4ea0183", "kind": "dns", "frame_number": 81, "timestamp_epoch": "1732596581.401879000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53800, "tcp_stream": null, "udp_stream": 13, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-f553a7d56f65c164d34618cb", "kind": "dns", "frame_number": 110, "timestamp_epoch": "1732596581.705829000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50534, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-ad159b251e78fd5836ef0571", "kind": "dns", "frame_number": 111, "timestamp_epoch": "1732596581.706179000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50534, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-15f47db2c9460ffeaa9f0874", "kind": "dns", "frame_number": 112, "timestamp_epoch": "1732596581.706538000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50534, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-418d6b52250601a8b43dae4c", "kind": "dns", "frame_number": 113, "timestamp_epoch": "1732596581.706702000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50534, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.mshome.net", "dns.qry.type": "33" } }, { "event_id": "evt-b05cf74f10a8a3fe2b926165", "kind": "dns", "frame_number": 147, "timestamp_epoch": "1732596582.134433000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50534, "dst_port": 53, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-6760b7e85d0b9e3f2e4a13c8", "kind": "dns", "frame_number": 148, "timestamp_epoch": "1732596582.155551000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50534, "tcp_stream": null, "udp_stream": 15, "fields": { "dns.a": "20.7.2.167", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-66379a8bd72e14bb559fa8c5", "kind": "dns", "frame_number": 183, "timestamp_epoch": "1732596584.252200000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50366, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-a6f2d926a3d4048671a8360e", "kind": "dns", "frame_number": 184, "timestamp_epoch": "1732596584.252200000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-9c1b18f063a17df580987569", "kind": "dns", "frame_number": 185, "timestamp_epoch": "1732596584.252589000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-84ddf1ebb7bfee91c01eebf6", "kind": "dns", "frame_number": 186, "timestamp_epoch": "1732596584.252645000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50366, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-bc104c9922268095e7d66425", "kind": "dns", "frame_number": 187, "timestamp_epoch": "1732596584.252838000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d2dc7bf378c6b0c3fa803823", "kind": "dns", "frame_number": 188, "timestamp_epoch": "1732596584.252881000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50366, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d990a446613ae30782e8cefb", "kind": "dns", "frame_number": 189, "timestamp_epoch": "1732596584.253026000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-5f54dfbe7987c8cc3bb910b8", "kind": "dns", "frame_number": 190, "timestamp_epoch": "1732596584.253067000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50366, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-85f1cc5ab15f7df5c53945c2", "kind": "dns", "frame_number": 439, "timestamp_epoch": "1732596597.210181000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50366, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-61742fb4ebb15c637d6f9807", "kind": "dns", "frame_number": 440, "timestamp_epoch": "1732596597.228818000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50366, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-bea9c1501bf26aa7d1123245", "kind": "dns", "frame_number": 445, "timestamp_epoch": "1732596597.320330000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54361, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-03341e6584ed8f747f63fbec", "kind": "dns", "frame_number": 446, "timestamp_epoch": "1732596597.320399000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53021, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-c214fa2f2ab2f389211b4886", "kind": "dns", "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53021, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "104.117.244.112,104.117.244.104,104.117.244.89,104.117.244.81,104.117.244.91,104.117.244.82,104.117.244.72,104.117.244.114", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-4fe0e419689296c0bdc839b7", "kind": "dns", "frame_number": 455, "timestamp_epoch": "1732596597.374256000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54361, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.a": "52.109.8.89", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,cus-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4e85469a8317bb35e16a4237", "kind": "dns", "frame_number": 612, "timestamp_epoch": "1732596597.587503000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52444, "dst_port": 53, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-30d6ded4a8a766d606a7e71d", "kind": "dns", "frame_number": 619, "timestamp_epoch": "1732596597.598735000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52444, "tcp_stream": null, "udp_stream": 23, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-3afb34ead643a12e91550fce", "kind": "dns", "frame_number": 681, "timestamp_epoch": "1732596597.846695000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61053, "dst_port": 53, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-54d36ced804638e79a4800c2", "kind": "dns", "frame_number": 691, "timestamp_epoch": "1732596597.879751000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61053, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.a": "52.109.20.47", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,scus-azsc-000.odc.officeapps.live.com,osiprod-scus-bronze-azsc-000.southcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-111b4908e38002f4a79fc460", "kind": "dns", "frame_number": 752, "timestamp_epoch": "1732596598.238793000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56845, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f7a08fe7e4ec6c6760fc63d5", "kind": "dns", "frame_number": 753, "timestamp_epoch": "1732596598.267834000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56845, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.a": "23.221.22.46,23.221.22.57", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-1135682ee74c2f54cc2bc91b", "kind": "dns", "frame_number": 896, "timestamp_epoch": "1732596599.778439000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-851e457d3368bb4779ce070f", "kind": "dns", "frame_number": 897, "timestamp_epoch": "1732596599.778525000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50058, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-e552fb1d3945c971355c1545", "kind": "dns", "frame_number": 898, "timestamp_epoch": "1732596599.778838000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50058, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-53b9b468314681255dbbba5c", "kind": "dns", "frame_number": 899, "timestamp_epoch": "1732596599.778882000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-9514bdf325bb3437041a575a", "kind": "dns", "frame_number": 900, "timestamp_epoch": "1732596599.779113000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50058, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-65e607874d6c584e8f711f12", "kind": "dns", "frame_number": 901, "timestamp_epoch": "1732596599.779148000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-44952008b274d236c9951ebb", "kind": "dns", "frame_number": 902, "timestamp_epoch": "1732596599.779310000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50058, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-4ba8d1ceed9c5fa8521bd3d3", "kind": "dns", "frame_number": 903, "timestamp_epoch": "1732596599.779345000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-01a4417f2b5d5a5ea1725811", "kind": "dns", "frame_number": 904, "timestamp_epoch": "1732596600.178840000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50058, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "nav.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f1c36b16b3e3b15b6ca36efc", "kind": "dns", "frame_number": 905, "timestamp_epoch": "1732596600.218910000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50058, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.a": "4.150.155.223", "dns.cname": "prod-atm-wds-nav.trafficmanager.net,prod-agic-cu-3.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nav.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d5b1d2bf390fe3984e24420b", "kind": "dns", "frame_number": 924, "timestamp_epoch": "1732596600.650450000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60943, "dst_port": 53, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.flags.response": "False", "dns.qry.name": "data-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-702adf16848c3d944012b05e", "kind": "dns", "frame_number": 925, "timestamp_epoch": "1732596600.688712000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60943, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.a": "4.150.155.223", "dns.cname": "prod-atm-wds-edge.trafficmanager.net,prod-agic-cu-3.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "data-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-441acc1c8b9bc4e90421881b", "kind": "dns", "frame_number": 942, "timestamp_epoch": "1732596600.995682000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53070, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-a3cd43ed219ed84400118b07", "kind": "dns", "frame_number": 945, "timestamp_epoch": "1732596601.007532000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53070, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.a": "13.107.5.93", "dns.cname": "deault-exp-tas-com.e-0014.e-msedge.net,e-0014.e-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-61450cfd9d84c51fe0c179ad", "kind": "dns", "frame_number": 947, "timestamp_epoch": "1732596601.011261000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60596, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-f8c5018cfcd2a6fce16fa3e9", "kind": "dns", "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60596, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.a": "40.126.28.11,20.190.135.2,20.190.135.3,40.126.28.22,20.190.135.6,40.126.7.32,40.126.28.14,20.190.135.7", "dns.cname": "login.msa.msidentity.com,www.tm.lg.prod.aadmsa.trafficmanager.net,prdv4a.aadg.msidentity.com,www.tm.v4.a.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-7b64f0668113de4372cc056f", "kind": "dns", "frame_number": 1052, "timestamp_epoch": "1732596606.742134000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54573, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "inputsuggestions.msdxcdn.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7253377cb227b07059ced62b", "kind": "dns", "frame_number": 1053, "timestamp_epoch": "1732596606.771681000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54573, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "inputsuggestions.msdxcdn.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c509d62296aa5985c36c23ee", "kind": "dns", "frame_number": 1054, "timestamp_epoch": "1732596606.794448000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54573, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.a": "13.107.246.57", "dns.cname": "msdx-cdn-y86ykn8r9v.azureedge.net,msdx-cdn-y86ykn8r9v.afd.azureedge.net,azureedge-t-prod.trafficmanager.net,shed.dual-low.s-part-0029.t-0009.t-msedge.net,s-part-0029.t-0009.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "inputsuggestions.msdxcdn.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-040c1af4b53ac4c23f841313", "kind": "dns", "frame_number": 1114, "timestamp_epoch": "1732596610.941790000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60075, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-69d29da7c6c16782f7fea049", "kind": "dns", "frame_number": 1115, "timestamp_epoch": "1732596610.942148000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60075, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-ff6dac2405e81270a8b561fe", "kind": "dns", "frame_number": 1116, "timestamp_epoch": "1732596610.942299000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60075, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-72a9a0954465b40a7b3d2ca0", "kind": "dns", "frame_number": 1117, "timestamp_epoch": "1732596610.942457000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60075, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-efed2b10c46bc83a5e238f3e", "kind": "dns", "frame_number": 1173, "timestamp_epoch": "1732596611.288227000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64395, "dst_port": 53, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.flags.response": "False", "dns.qry.name": "classicgrand.com", "dns.qry.type": "1" } }, { "event_id": "evt-0539c33815778e3d8a9333ce", "kind": "dns", "frame_number": 1174, "timestamp_epoch": "1732596611.288325000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51749, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "classicgrand.com", "dns.qry.type": "65" } }, { "event_id": "evt-e64a3f92549577913afb937d", "kind": "dns", "frame_number": 1175, "timestamp_epoch": "1732596611.288517000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61339, "dst_port": 53, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-84b144f047189445f21634f7", "kind": "dns", "frame_number": 1176, "timestamp_epoch": "1732596611.288580000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63354, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-20f318860624b631404d5ccd", "kind": "dns", "frame_number": 1177, "timestamp_epoch": "1732596611.291652000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63222, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "classicgrand.com", "dns.qry.type": "1" } }, { "event_id": "evt-fad4ec27c5f561eb5f916938", "kind": "dns", "frame_number": 1178, "timestamp_epoch": "1732596611.291741000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60876, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "classicgrand.com", "dns.qry.type": "65" } }, { "event_id": "evt-b9692ab757511af76059c9ba", "kind": "dns", "frame_number": 1179, "timestamp_epoch": "1732596611.333612000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63222, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.a": "213.246.109.5", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "classicgrand.com", "dns.qry.type": "1" } }, { "event_id": "evt-34d897a830cb040664ff60a0", "kind": "dns", "frame_number": 1180, "timestamp_epoch": "1732596611.333665000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63354, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-f078b0d47b914a2b6887c2b4", "kind": "dns", "frame_number": 1181, "timestamp_epoch": "1732596611.333665000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64395, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.a": "213.246.109.5", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "classicgrand.com", "dns.qry.type": "1" } }, { "event_id": "evt-36988b3b2ee6cbac80fd4447", "kind": "dns", "frame_number": 1182, "timestamp_epoch": "1732596611.333799000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61339, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.a": "13.107.21.239,204.79.197.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f07131e5b7693baa690daa9d", "kind": "dns", "frame_number": 1189, "timestamp_epoch": "1732596611.444471000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60876, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "classicgrand.com", "dns.qry.type": "65" } }, { "event_id": "evt-a2a5d892f407087d096316e1", "kind": "dns", "frame_number": 1190, "timestamp_epoch": "1732596611.444524000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51749, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "classicgrand.com", "dns.qry.type": "65" } }, { "event_id": "evt-61f5aca9e5737067c692a11f", "kind": "dns", "frame_number": 1332, "timestamp_epoch": "1732596614.145454000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52957, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-51dfcf6049019c36036430aa", "kind": "dns", "frame_number": 1333, "timestamp_epoch": "1732596614.145534000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65406, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "65" } }, { "event_id": "evt-0df4722a136ec99e060e243b", "kind": "dns", "frame_number": 1334, "timestamp_epoch": "1732596614.150461000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63950, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "1" } }, { "event_id": "evt-97e168b2fade47b3d66df8f8", "kind": "dns", "frame_number": 1335, "timestamp_epoch": "1732596614.150571000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60694, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "65" } }, { "event_id": "evt-3fb18f905fc2ceff7a401a8a", "kind": "dns", "frame_number": 1336, "timestamp_epoch": "1732596614.234653000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60694, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "65" } }, { "event_id": "evt-77f80d452ed9ba7e24b6a7f9", "kind": "dns", "frame_number": 1337, "timestamp_epoch": "1732596614.236416000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63950, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.a": "52.8.34.0,13.56.30.207", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "1" } }, { "event_id": "evt-973f2f9840d7effabaf820ce", "kind": "dns", "frame_number": 1374, "timestamp_epoch": "1732596614.315055000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52957, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.a": "193.42.38.139", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-e8494fe088977acb03c7783a", "kind": "dns", "frame_number": 1377, "timestamp_epoch": "1732596614.319904000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65406, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "65" } }, { "event_id": "evt-87ff22632d256392d5bc3923", "kind": "dns", "frame_number": 1718, "timestamp_epoch": "1732596614.714156000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49611, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-cf9964d24ad2d460c1f09e02", "kind": "dns", "frame_number": 1719, "timestamp_epoch": "1732596614.714254000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55111, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-a635bbb0e6d47b2078fd7a4b", "kind": "dns", "frame_number": 1751, "timestamp_epoch": "1732596614.747884000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59750, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-75600c49d9eff58c02f4489a", "kind": "dns", "frame_number": 1752, "timestamp_epoch": "1732596614.747965000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50502, "dst_port": 53, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-676b514608551dd55069691b", "kind": "dns", "frame_number": 1753, "timestamp_epoch": "1732596614.748250000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50502, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-2e01221a69531d92eea8ac2b", "kind": "dns", "frame_number": 1754, "timestamp_epoch": "1732596614.763708000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55111, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-0000793b851e6ffab1b646f8", "kind": "dns", "frame_number": 1755, "timestamp_epoch": "1732596614.766334000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49611, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.a": "142.251.186.95", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-f05e74d49321f13c740df79b", "kind": "dns", "frame_number": 1757, "timestamp_epoch": "1732596614.804739000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59750, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.a": "142.250.138.94", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-42bc51f92245aef7cec82fdf", "kind": "dns", "frame_number": 1759, "timestamp_epoch": "1732596614.805541000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53071, "dst_port": 53, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.google.com", "dns.qry.type": "1" } }, { "event_id": "evt-f361af012e72717cda778334", "kind": "dns", "frame_number": 1760, "timestamp_epoch": "1732596614.805661000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 58757, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.google.com", "dns.qry.type": "65" } }, { "event_id": "evt-c6a1ef649940eb62c84dbb9e", "kind": "dns", "frame_number": 1761, "timestamp_epoch": "1732596614.806012000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 58757, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.google.com", "dns.qry.type": "65" } }, { "event_id": "evt-16af307341438216484e9138", "kind": "dns", "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53071, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.a": "142.251.186.147,142.251.186.99,142.251.186.106,142.251.186.103,142.251.186.105,142.251.186.104", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.google.com", "dns.qry.type": "1" } }, { "event_id": "evt-7df201a35b508d80103f2e88", "kind": "dns", "frame_number": 2093, "timestamp_epoch": "1732596615.297504000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55260, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-f6ec821c32a72b92726b2356", "kind": "dns", "frame_number": 2094, "timestamp_epoch": "1732596615.297574000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56610, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-f11400ef0710d1c2e53a49df", "kind": "dns", "frame_number": 2095, "timestamp_epoch": "1732596615.298818000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61984, "dst_port": 53, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.response": "False", "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-ec4cefea21685056386b5da4", "kind": "dns", "frame_number": 2096, "timestamp_epoch": "1732596615.298882000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52421, "dst_port": 53, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.flags.response": "False", "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-9503a0af4296422088062d50", "kind": "dns", "frame_number": 2108, "timestamp_epoch": "1732596615.339531000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55260, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.a": "142.250.113.120,142.250.113.94", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-c866cc9afdcff36f6395192c", "kind": "dns", "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61984, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.a": "142.250.115.95,142.251.186.95,142.250.114.95,142.250.113.95,142.251.116.95", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-e957faf18ad97b0c2261f7a2", "kind": "dns", "frame_number": 2110, "timestamp_epoch": "1732596615.341209000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56610, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-f7a5865f56953585ecea742d", "kind": "dns", "frame_number": 2114, "timestamp_epoch": "1732596615.346197000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52421, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-1e2efe9a01773aef8b0a28a2", "kind": "dns", "frame_number": 2512, "timestamp_epoch": "1732596615.731544000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50644, "dst_port": 53, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.flags.response": "False", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-648a78b8fef1ec8594511105", "kind": "dns", "frame_number": 2513, "timestamp_epoch": "1732596615.731619000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61667, "dst_port": 53, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.flags.response": "False", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "65" } }, { "event_id": "evt-6a8655e72f046b3d62636e52", "kind": "dns", "frame_number": 2514, "timestamp_epoch": "1732596615.731901000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50644, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.a": "193.42.38.139", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-dca853985be6e2e6c3ce5b3a", "kind": "dns", "frame_number": 2515, "timestamp_epoch": "1732596615.731944000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61667, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "65" } }, { "event_id": "evt-b43a8fcc50203a3fb4100320", "kind": "dns", "frame_number": 2548, "timestamp_epoch": "1732596615.737596000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59443, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-080352a6a5960b1df2e1fbcf", "kind": "dns", "frame_number": 2551, "timestamp_epoch": "1732596615.737637000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52547, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-4e43bf1f6255490f81a490bd", "kind": "dns", "frame_number": 2564, "timestamp_epoch": "1732596615.738378000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59443, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "204.79.197.239,13.107.21.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b5df88c835d80ececc7430c9", "kind": "dns", "frame_number": 2683, "timestamp_epoch": "1732596615.759516000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62527, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "1" } }, { "event_id": "evt-75e9d2eba440efa3b4a3f041", "kind": "dns", "frame_number": 2684, "timestamp_epoch": "1732596615.759609000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57443, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "65" } }, { "event_id": "evt-5bec9ad3a2e5f7fd8c81e89a", "kind": "dns", "frame_number": 2685, "timestamp_epoch": "1732596615.759828000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62527, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.a": "13.56.30.207,52.8.34.0", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "1" } }, { "event_id": "evt-fd7779f18ff4fcc89ca6a690", "kind": "dns", "frame_number": 2686, "timestamp_epoch": "1732596615.759949000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57443, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "confirmsubscription.com", "dns.qry.type": "65" } }, { "event_id": "evt-5f99e8364a98945c331f87e7", "kind": "dns", "frame_number": 2727, "timestamp_epoch": "1732596615.779927000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52547, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-2df9f4781daa39c094d208b6", "kind": "dns", "frame_number": 3366, "timestamp_epoch": "1732596616.137502000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64435, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "css.createsend1.com", "dns.qry.type": "1" } }, { "event_id": "evt-10fda0f4b8239c5d7032abce", "kind": "dns", "frame_number": 3367, "timestamp_epoch": "1732596616.137576000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55797, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "css.createsend1.com", "dns.qry.type": "65" } }, { "event_id": "evt-1f763ab6688f3e232006e315", "kind": "dns", "frame_number": 3368, "timestamp_epoch": "1732596616.137890000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49886, "dst_port": 53, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.response": "False", "dns.qry.name": "js.createsend1.com", "dns.qry.type": "1" } }, { "event_id": "evt-5febaa94d28febce35920a37", "kind": "dns", "frame_number": 3369, "timestamp_epoch": "1732596616.137958000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61724, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "js.createsend1.com", "dns.qry.type": "65" } }, { "event_id": "evt-18db6bc31c8a31a78f5118fb", "kind": "dns", "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49886, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.a": "18.160.156.61,18.160.156.103,18.160.156.77,18.160.156.92", "dns.cname": "d33w6v2v5ta015.cloudfront.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "js.createsend1.com", "dns.qry.type": "1" } }, { "event_id": "evt-c57919bd02c179a2e10c0abb", "kind": "dns", "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64435, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "18.160.156.103,18.160.156.77,18.160.156.92,18.160.156.61", "dns.cname": "d33w6v2v5ta015.cloudfront.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "css.createsend1.com", "dns.qry.type": "1" } }, { "event_id": "evt-4064174650c40fef84765ab9", "kind": "dns", "frame_number": 3601, "timestamp_epoch": "1732596616.223586000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61724, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.cname": "d33w6v2v5ta015.cloudfront.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "js.createsend1.com", "dns.qry.type": "65" } }, { "event_id": "evt-799225526ea7d5982f838502", "kind": "dns", "frame_number": 3604, "timestamp_epoch": "1732596616.233588000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55797, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.cname": "d33w6v2v5ta015.cloudfront.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "css.createsend1.com", "dns.qry.type": "65" } }, { "event_id": "evt-09861d7a97b0079a7dfefb6f", "kind": "dns", "frame_number": 3761, "timestamp_epoch": "1732596616.459272000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49687, "dst_port": 53, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ba48e7b67261f1470668c66d", "kind": "dns", "frame_number": 3762, "timestamp_epoch": "1732596616.459352000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51940, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-60c47cd840007f3f41592179", "kind": "dns", "frame_number": 3763, "timestamp_epoch": "1732596616.459658000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49687, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.a": "13.107.21.239,204.79.197.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-add73b41bb1846c5ea83f85e", "kind": "dns", "frame_number": 3764, "timestamp_epoch": "1732596616.459754000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51940, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-155b4cf339393229eb260ef2", "kind": "dns", "frame_number": 3767, "timestamp_epoch": "1732596616.461213000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55966, "dst_port": 53, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d43d5d92c8b4069c9c83c4d", "kind": "dns", "frame_number": 3768, "timestamp_epoch": "1732596616.461279000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64824, "dst_port": 53, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-0be73bfee3c8a2ed56b463a9", "kind": "dns", "frame_number": 3769, "timestamp_epoch": "1732596616.461508000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55966, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.a": "142.251.186.95", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1" } }, { "event_id": "evt-09f15a52fd0303afb211dd66", "kind": "dns", "frame_number": 3770, "timestamp_epoch": "1732596616.461644000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64824, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "65" } }, { "event_id": "evt-0af023adebad7a2a0689e6d8", "kind": "dns", "frame_number": 3781, "timestamp_epoch": "1732596616.467169000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53114, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-a2bb04586c898404fafb0d59", "kind": "dns", "frame_number": 3782, "timestamp_epoch": "1732596616.467247000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54030, "dst_port": 53, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-c561fd2db90796c000f26e02", "kind": "dns", "frame_number": 3783, "timestamp_epoch": "1732596616.467534000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54030, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-3237d002a8a65d294c2329e8", "kind": "dns", "frame_number": 3790, "timestamp_epoch": "1732596616.527922000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53114, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.a": "142.250.113.94", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-47db7d79cf56b6b4711263df", "kind": "dns", "frame_number": 3850, "timestamp_epoch": "1732596616.649524000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54418, "dst_port": 53, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7990ec3dff474a71cc3b712", "kind": "dns", "frame_number": 3851, "timestamp_epoch": "1732596616.649593000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50248, "dst_port": 53, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.flags.response": "False", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-05656c28406bad61c4747cbd", "kind": "dns", "frame_number": 3852, "timestamp_epoch": "1732596616.649854000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54418, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.a": "142.250.138.94", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-11c4b73b726794f3963791ac", "kind": "dns", "frame_number": 3853, "timestamp_epoch": "1732596616.649948000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50248, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-f222751f7441c8c7c4679ee8", "kind": "dns", "frame_number": 3939, "timestamp_epoch": "1732596616.731036000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62432, "dst_port": 53, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.flags.response": "False", "dns.qry.name": "code.jquery.com", "dns.qry.type": "1" } }, { "event_id": "evt-3c2623dd73bff589b37a013c", "kind": "dns", "frame_number": 3940, "timestamp_epoch": "1732596616.731109000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50283, "dst_port": 53, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.flags.response": "False", "dns.qry.name": "code.jquery.com", "dns.qry.type": "65" } }, { "event_id": "evt-71bf3b7edaf0ce4578d1157a", "kind": "dns", "frame_number": 4018, "timestamp_epoch": "1732596616.780201000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50283, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "code.jquery.com", "dns.qry.type": "65" } }, { "event_id": "evt-d7850677cfb14dbc60087d41", "kind": "dns", "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62432, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.a": "151.101.66.137,151.101.194.137,151.101.130.137,151.101.2.137", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "code.jquery.com", "dns.qry.type": "1" } }, { "event_id": "evt-ee5f53530170f6b5f4dba123", "kind": "dns", "frame_number": 8687, "timestamp_epoch": "1732596618.944669000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60075, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-c834249840709c7177bd63f4", "kind": "dns", "frame_number": 8688, "timestamp_epoch": "1732596618.944965000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60075, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-161d57008f5adeae27e5d211", "kind": "dns", "frame_number": 8689, "timestamp_epoch": "1732596618.945228000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60075, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-c6b2cfa7ffb18f524c8f084f", "kind": "dns", "frame_number": 8691, "timestamp_epoch": "1732596618.945400000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60075, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-5d38f2ef05db4568ebd4c59d", "kind": "dns", "frame_number": 11968, "timestamp_epoch": "1732596622.974195000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61444, "dst_port": 53, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-e532020dafa6ff70833f78b0", "kind": "dns", "frame_number": 11969, "timestamp_epoch": "1732596622.974289000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59813, "dst_port": 53, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-daf174dec193aba22e23c077", "kind": "dns", "frame_number": 11970, "timestamp_epoch": "1732596622.974687000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59813, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-73976c4494b818e9690b48b8", "kind": "dns", "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61444, "tcp_stream": null, "udp_stream": 74, "fields": { "dns.a": "104.117.244.96,104.117.244.114,104.117.244.81,104.117.244.89,104.117.244.105", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-9207ae5f8c1f0c6fbdb8cb86", "kind": "dns", "frame_number": 11991, "timestamp_epoch": "1732596623.131197000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55279, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ddd8f99bac9f6730547a0b9b", "kind": "dns", "frame_number": 11992, "timestamp_epoch": "1732596623.131278000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51731, "dst_port": 53, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-56786aa4e9ac5f508e3ab4f2", "kind": "dns", "frame_number": 11993, "timestamp_epoch": "1732596623.131584000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55279, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.a": "204.79.197.239,13.107.21.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-16bba38f7d7c2fb441da05fb", "kind": "dns", "frame_number": 11994, "timestamp_epoch": "1732596623.131700000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51731, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-0656b7cd989d8afc0b6a480d", "kind": "dns", "frame_number": 12720, "timestamp_epoch": "1732596638.014376000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60075, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-fd59755fbbba2d9cf6eb2e34", "kind": "dns", "frame_number": 12721, "timestamp_epoch": "1732596638.033346000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60075, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.a": "40.118.171.167", "dns.cname": "prod-atm-wds-apprep.trafficmanager.net,prod-agic-wu-2.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "checkappexec.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1d49382e24cf91c5d013e371", "kind": "dns", "frame_number": 12766, "timestamp_epoch": "1732596640.541323000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64100, "dst_port": 53, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.response": "False", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-c0c36b67cce5e3f5c0c435e9", "kind": "dns", "frame_number": 12767, "timestamp_epoch": "1732596640.541627000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64100, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.a": "193.42.38.139", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "modandcrackedapk.com", "dns.qry.type": "1" } }, { "event_id": "evt-9859fc90270f79e9b52cd808", "kind": "dns", "frame_number": 12779, "timestamp_epoch": "1732596640.759860000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64100, "dst_port": 53, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.response": "False", "dns.qry.name": "r10.o.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-01ca26360d954d5b8b215f9a", "kind": "dns", "frame_number": 12780, "timestamp_epoch": "1732596640.793456000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64100, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.a": "104.117.247.99,104.117.247.67", "dns.cname": "o.lencr.edgesuite.net,a1887.dscq.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r10.o.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-1ccae8ea6f4cd6dd6d5c3101", "kind": "dns", "frame_number": 20331, "timestamp_epoch": "1732596645.646175000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52962, "dst_port": 53, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.flags.response": "False", "dns.qry.name": "geo.netsupportsoftware.com", "dns.qry.type": "1" } }, { "event_id": "evt-c63e4178cb55006b1c8cb4ae", "kind": "dns", "frame_number": 20332, "timestamp_epoch": "1732596645.678408000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52962, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.a": "104.26.1.231,104.26.0.231,172.67.68.212", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "geo.netsupportsoftware.com", "dns.qry.type": "1" } }, { "event_id": "evt-388fba5d468b69abfb714a26", "kind": "dns", "frame_number": 20352, "timestamp_epoch": "1732596648.371153000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56163, "dst_port": 53, "tcp_stream": null, "udp_stream": 80, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4d03b0427188873f99b90828", "kind": "dns", "frame_number": 20353, "timestamp_epoch": "1732596648.381164000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56163, "tcp_stream": null, "udp_stream": 80, "fields": { "dns.a": "52.168.112.67", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus04.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e0fb9d59a484f1067c5163fe", "kind": "dns", "frame_number": 20413, "timestamp_epoch": "1732596656.408572000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59953, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-f7c34be36e42af5604ad75e1", "kind": "dns", "frame_number": 20414, "timestamp_epoch": "1732596656.408916000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59953, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.a": "10.11.26.3", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-9b3a7f9bd79da3bd03303c79", "kind": "dns", "frame_number": 20488, "timestamp_epoch": "1732596659.781734000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59953, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-130905d18fc4e34ed894a2da", "kind": "dns", "frame_number": 20489, "timestamp_epoch": "1732596659.781734000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-796c23910f371db48f972c36", "kind": "dns", "frame_number": 20490, "timestamp_epoch": "1732596659.782088000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59953, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-04b42373dd28de3bf774b383", "kind": "dns", "frame_number": 20491, "timestamp_epoch": "1732596659.782134000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-a7e0fc57381f1ad20e021896", "kind": "dns", "frame_number": 20492, "timestamp_epoch": "1732596659.782325000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59953, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-b022e041f833ba10e3661e52", "kind": "dns", "frame_number": 20493, "timestamp_epoch": "1732596659.782369000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-ee93d755c4a2e7ddfe59826c", "kind": "dns", "frame_number": 20494, "timestamp_epoch": "1732596659.836575000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-144c42fcb6927cbe751e71a4", "kind": "dns", "frame_number": 20495, "timestamp_epoch": "1732596659.836636000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59953, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-be88ae0f9c7dfd03e9ef3912", "kind": "dns", "frame_number": 20496, "timestamp_epoch": "1732596662.909942000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59953, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-801a164425cba7289eefb239", "kind": "dns", "frame_number": 20497, "timestamp_epoch": "1732596662.927869000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59953, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-72375ef2988b7d266df3138e", "kind": "dns", "frame_number": 20611, "timestamp_epoch": "1732596717.645174000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-cb2219b8a47be8d748c13763", "kind": "dns", "frame_number": 20612, "timestamp_epoch": "1732596717.645557000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-94f9e579f04cc548f264ebde", "kind": "dns", "frame_number": 20613, "timestamp_epoch": "1732596717.645705000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-403be8f033481761118d02fb", "kind": "dns", "frame_number": 20614, "timestamp_epoch": "1732596717.645876000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-567cf5d80f7b3f0e07faea8d", "kind": "dns", "frame_number": 20615, "timestamp_epoch": "1732596717.771245000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56078, "dst_port": 53, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-ce6ba335ab74d8c62ee6aafb", "kind": "dns", "frame_number": 20616, "timestamp_epoch": "1732596717.771348000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50632, "dst_port": 53, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-241b57f17e06377a62f3c4af", "kind": "dns", "frame_number": 20617, "timestamp_epoch": "1732596717.771656000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56078, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-91db58015def5874a6f442ca", "kind": "dns", "frame_number": 20619, "timestamp_epoch": "1732596717.811936000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50632, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-9e483cba264c3506500f52ad", "kind": "dns", "frame_number": 20641, "timestamp_epoch": "1732596718.245175000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60063, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-db9e22db6f0a406b94b7787b", "kind": "dns", "frame_number": 20642, "timestamp_epoch": "1732596718.245257000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53179, "dst_port": 53, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-7e2af319e61b49e1dd61f55d", "kind": "dns", "frame_number": 20643, "timestamp_epoch": "1732596718.245558000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60063, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-989f7386fd770854a0d2d460", "kind": "dns", "frame_number": 20644, "timestamp_epoch": "1732596718.245677000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53179, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-1ff87fa4e856ce62b5b92d1b", "kind": "dns", "frame_number": 20686, "timestamp_epoch": "1732596718.573908000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51584, "dst_port": 53, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a32e12eba9fc66eb8cc7b42", "kind": "dns", "frame_number": 20687, "timestamp_epoch": "1732596718.574019000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50758, "dst_port": 53, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-1e64441c349626a492b1631d", "kind": "dns", "frame_number": 20688, "timestamp_epoch": "1732596718.574687000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62292, "dst_port": 53, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-2e4c4a305b9337d3441df834", "kind": "dns", "frame_number": 20689, "timestamp_epoch": "1732596718.574755000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59416, "dst_port": 53, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-6431266b38f7c566fd5fc15d", "kind": "dns", "frame_number": 20690, "timestamp_epoch": "1732596718.576293000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61673, "dst_port": 53, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-4c84134b768a2f77a95c145b", "kind": "dns", "frame_number": 20691, "timestamp_epoch": "1732596718.576331000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63774, "dst_port": 53, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-3598dce3bd5cc3fa02d9cdd5", "kind": "dns", "frame_number": 20692, "timestamp_epoch": "1732596718.620959000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63774, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-e71f6a8bd7ddae2be32748d7", "kind": "dns", "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61673, "tcp_stream": null, "udp_stream": 92, "fields": { "dns.a": "104.117.247.162,104.117.247.139,104.117.247.186", "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-e42822cf19f83513ef145feb", "kind": "dns", "frame_number": 20694, "timestamp_epoch": "1732596718.631155000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59416, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-64ef919ca15083b29c207d61", "kind": "dns", "frame_number": 20696, "timestamp_epoch": "1732596718.632512000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50758, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-ab2ac8760e5a3e4063b8aeab", "kind": "dns", "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62292, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.a": "104.117.244.106,104.117.244.105,104.117.244.88,104.117.244.74,104.117.244.97,104.117.244.82,104.117.244.99,104.117.244.72,104.117.244.107", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-06e7bfb575b1be1e87951297", "kind": "dns", "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51584, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.a": "104.117.244.105,104.117.244.88,104.117.244.74,104.117.244.97,104.117.244.82,104.117.244.99,104.117.244.72,104.117.244.107,104.117.244.106", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-5923b8490fba75ffb1ffb1e4", "kind": "dns", "frame_number": 20707, "timestamp_epoch": "1732596718.678308000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59807, "dst_port": 53, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-861cc1f2e753b6f624ea9157", "kind": "dns", "frame_number": 20708, "timestamp_epoch": "1732596718.678375000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56290, "dst_port": 53, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-f4d03b65be2eb95b7710755c", "kind": "dns", "frame_number": 20709, "timestamp_epoch": "1732596718.678622000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65282, "dst_port": 53, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-64e8ffe04bd83e9e97d185b7", "kind": "dns", "frame_number": 20710, "timestamp_epoch": "1732596718.678664000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54545, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-714dc6e4d5a8519a1ba2f01a", "kind": "dns", "frame_number": 20743, "timestamp_epoch": "1732596718.731588000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56290, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-4b7ac3d2ce6a26d64bf9714e", "kind": "dns", "frame_number": 20744, "timestamp_epoch": "1732596718.732010000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54545, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-b1b6e63add72d52ed68155b3", "kind": "dns", "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65282, "tcp_stream": null, "udp_stream": 98, "fields": { "dns.a": "23.221.22.209,23.221.22.205,23.221.22.206,23.221.22.218,23.221.22.217,23.221.22.207,23.221.22.219,23.221.22.208,23.221.22.196", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-2f53c9e61b0030b78565691a", "kind": "dns", "frame_number": 20750, "timestamp_epoch": "1732596718.732640000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59807, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b4069e6f156436eb821887bb", "kind": "dns", "frame_number": 20803, "timestamp_epoch": "1732596718.967648000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 63229, "dst_port": 53, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-7be8bdbe39604c63c6703595", "kind": "dns", "frame_number": 20804, "timestamp_epoch": "1732596718.967691000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 58946, "dst_port": 53, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-9e886b5cd1af25191bf69670", "kind": "dns", "frame_number": 20805, "timestamp_epoch": "1732596718.968097000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 58946, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-571585e96fba7dde084617c4", "kind": "dns", "frame_number": 20806, "timestamp_epoch": "1732596718.968116000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 63229, "tcp_stream": null, "udp_stream": 101, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-bbc6e639b273ac7bffb68b1a", "kind": "dns", "frame_number": 21089, "timestamp_epoch": "1732596725.656491000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-4e311cc38e29328cb06dd67a", "kind": "dns", "frame_number": 21090, "timestamp_epoch": "1732596725.656822000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-89641c9d6253022015e6f7da", "kind": "dns", "frame_number": 21091, "timestamp_epoch": "1732596725.657174000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-efed4175ba83b40ebc266d6f", "kind": "dns", "frame_number": 21092, "timestamp_epoch": "1732596725.657338000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d42acfca45e757097961c39a", "kind": "dns", "frame_number": 21155, "timestamp_epoch": "1732596827.734566000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-e64351c9d6bb492c33edc960", "kind": "dns", "frame_number": 21156, "timestamp_epoch": "1732596827.734921000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-2c6d20962511537ea8706ead", "kind": "dns", "frame_number": 21157, "timestamp_epoch": "1732596827.735101000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-756aead53eececa6e0b98a84", "kind": "dns", "frame_number": 21158, "timestamp_epoch": "1732596827.735270000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-7f14f1b195b82fe83db9e87a", "kind": "dns", "frame_number": 21201, "timestamp_epoch": "1732596828.312934000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64265, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-01e0345be2147e3df3ad9ead", "kind": "dns", "frame_number": 21202, "timestamp_epoch": "1732596828.368686000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64265, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.a": "20.96.153.111", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ec78bcca15b0ede3e73cdc7a", "kind": "dns", "frame_number": 21250, "timestamp_epoch": "1732596897.029090000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57315, "dst_port": 53, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-6f42d8dca8ea2e375828da73", "kind": "dns", "frame_number": 21251, "timestamp_epoch": "1732596897.029589000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57315, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-2c1ddb2508496e965fcb1091", "kind": "dns", "frame_number": 21252, "timestamp_epoch": "1732596897.029962000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57315, "dst_port": 53, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-25fda87dcb4106434dfd120d", "kind": "dns", "frame_number": 21253, "timestamp_epoch": "1732596897.030137000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57315, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.NEMOTODES-DC.nemotoads.health", "dns.qry.type": "33" } }, { "event_id": "evt-9dccef6715f7c66620f49f76", "kind": "dns", "frame_number": 21374, "timestamp_epoch": "1732597158.403809000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 61048, "dst_port": 53, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-d9b8a9b75dd5847fc566fbff", "kind": "dns", "frame_number": 21375, "timestamp_epoch": "1732597158.422564000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 61048, "tcp_stream": null, "udp_stream": 17, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-4bb750e1b35b848ac5d6f8d8", "kind": "dns", "frame_number": 21376, "timestamp_epoch": "1732597162.341944000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57315, "dst_port": 53, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d6d635dc6123d47812aeb0b3", "kind": "dns", "frame_number": 21377, "timestamp_epoch": "1732597162.367264000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57315, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.a": "20.189.173.6", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus05.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-78843ab2a403a7af97b3f717", "kind": "dns", "frame_number": 21419, "timestamp_epoch": "1732597237.655349000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51403, "dst_port": 53, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.flags.response": "False", "dns.qry.name": "displaycatalog.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5f3b6fc36a513e855d17c593", "kind": "dns", "frame_number": 21420, "timestamp_epoch": "1732597237.686162000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51403, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.a": "20.99.184.37", "dns.cname": "displaycatalog-rp.md.mp.microsoft.com.akadns.net,rp-consumer-prod-displaycatalog-geomap.trafficmanager.net,wus2s1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "displaycatalog.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ccfdd5ea76ffbe6af721f249", "kind": "dns", "frame_number": 21422, "timestamp_epoch": "1732597237.702147000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64501, "dst_port": 53, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-09f8974ed6340aed9e4c7971", "kind": "dns", "frame_number": 21423, "timestamp_epoch": "1732597237.705023000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64501, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.a": "23.204.171.61", "dns.cname": "killbittrafficmanager.trafficmanager.net,storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-94b6ccc5e447b90e1f5a4350", "kind": "dns", "frame_number": 21474, "timestamp_epoch": "1732597242.931032000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50129, "dst_port": 53, "tcp_stream": null, "udp_stream": 107, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a25269f44f8aadef6169675e", "kind": "dns", "frame_number": 21475, "timestamp_epoch": "1732597242.954335000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50129, "tcp_stream": null, "udp_stream": 107, "fields": { "dns.a": "52.165.164.15", "dns.cname": "fe3.delivery.mp.microsoft.com,glb.cws.prod.dcat.dsp.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-78befd47edffa4d94b1007ac", "kind": "dns", "frame_number": 21610, "timestamp_epoch": "1732597249.477051000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 64584, "dst_port": 53, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b6e4c4b806d667953755a02e", "kind": "dns", "frame_number": 21611, "timestamp_epoch": "1732597249.499839000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 64584, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.a": "20.42.73.28", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus15.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6a4961f8688907d234819c46", "kind": "dns", "frame_number": 21662, "timestamp_epoch": "1732597259.823089000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57266, "dst_port": 53, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-3faf89a2de50285f396579b2", "kind": "dns", "frame_number": 21663, "timestamp_epoch": "1732597259.823118000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50712, "dst_port": 53, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-2e4e2f20586b967e97f02966", "kind": "dns", "frame_number": 21664, "timestamp_epoch": "1732597259.823544000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50712, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-eec22c7580ef515f8d97a817", "kind": "dns", "frame_number": 21665, "timestamp_epoch": "1732597259.823606000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57266, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-c810e4189811c3eb6b28cd7d", "kind": "dns", "frame_number": 21666, "timestamp_epoch": "1732597259.823854000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50712, "dst_port": 53, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-647deb27f2c15de78a96bc57", "kind": "dns", "frame_number": 21667, "timestamp_epoch": "1732597259.823873000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57266, "dst_port": 53, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-54c4cfd88232ebccb466f24a", "kind": "dns", "frame_number": 21668, "timestamp_epoch": "1732597259.884101000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57266, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-fb8ff06c678ead04bc1b7ae5", "kind": "dns", "frame_number": 21669, "timestamp_epoch": "1732597259.884131000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50712, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-597f53b6926692121148700f", "kind": "dns", "frame_number": 21714, "timestamp_epoch": "1732597316.691521000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57266, "dst_port": 53, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.response": "False", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-e76db4f1ef0c05dadf323693", "kind": "dns", "frame_number": 21715, "timestamp_epoch": "1732597316.698604000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57266, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.a": "23.53.127.105,23.53.127.114", "dns.cname": "acroipm2.adobe.com.edgesuite.net,a122.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-10512fc625468b6e8a626068", "kind": "dns", "frame_number": 21723, "timestamp_epoch": "1732597316.907959000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 54339, "dst_port": 53, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.flags.response": "False", "dns.qry.name": "armmf.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7e5d0a2a4528e8282afe392", "kind": "dns", "frame_number": 21724, "timestamp_epoch": "1732597316.912599000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 54339, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.a": "23.201.68.167", "dns.cname": "ssl.adobe.com.edgekey.net,e4578.dscb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "armmf.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-d3f8d7313fcfba878d0fc904", "kind": "dns", "frame_number": 21745, "timestamp_epoch": "1732597317.771757000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51810, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-c28c290c8d299652ab97d010", "kind": "dns", "frame_number": 21746, "timestamp_epoch": "1732597317.772120000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51810, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-4c887bbcb84d9f8d2d50e4c0", "kind": "dns", "frame_number": 21747, "timestamp_epoch": "1732597317.772258000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51810, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-6333261f730132f4559d7390", "kind": "dns", "frame_number": 21748, "timestamp_epoch": "1732597317.772416000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51810, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-4f7f1e38fd5f37c0dc4c5d10", "kind": "dns", "frame_number": 21753, "timestamp_epoch": "1732597325.778660000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51810, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-de8ff3cc5e8bce96bd41eb8f", "kind": "dns", "frame_number": 21754, "timestamp_epoch": "1732597325.778936000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51810, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-c12acd2eeb4c73ee6f7176f8", "kind": "dns", "frame_number": 21755, "timestamp_epoch": "1732597325.779510000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51810, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-1109b62959c79be647256ed4", "kind": "dns", "frame_number": 21756, "timestamp_epoch": "1732597325.779840000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51810, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-4017024a18000c0ddca75938", "kind": "dns", "frame_number": 21757, "timestamp_epoch": "1732597328.392326000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 51810, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0726a2d393eac02ee208c225", "kind": "dns", "frame_number": 21758, "timestamp_epoch": "1732597328.412034000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 51810, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.a": "20.189.173.23", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus16.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ce98172f1ed42e12b828b693", "kind": "dns", "frame_number": 21827, "timestamp_epoch": "1732597494.129895000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53077, "dst_port": 53, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-995a66c7bc007530d51de2b0", "kind": "dns", "frame_number": 21828, "timestamp_epoch": "1732597494.149055000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53077, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.a": "20.189.173.26", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdwus19.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f25c8b3f8eb2c8e022d3ab51", "kind": "dns", "frame_number": 21853, "timestamp_epoch": "1732597496.836510000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60678, "dst_port": 53, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-eb07d3da4e7c28552340146c", "kind": "dns", "frame_number": 21854, "timestamp_epoch": "1732597496.869223000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60678, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-56f60212ac891328c0059e9b", "kind": "dns", "frame_number": 22276, "timestamp_epoch": "1732597498.252993000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52465, "dst_port": 53, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.flags.response": "False", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-7847eb28570e8d48c38c55a5", "kind": "dns", "frame_number": 22277, "timestamp_epoch": "1732597498.258597000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52465, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.a": "52.109.0.136", "dns.cname": "prod.mrodevicemgr.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-ea2c673f0d4e4689f354244b", "kind": "dns", "frame_number": 22384, "timestamp_epoch": "1732597499.619497000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 58641, "dst_port": 53, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.flags.response": "False", "dns.qry.name": "fa000000002.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-66837bd51e8442914f3bbb93", "kind": "dns", "frame_number": 22385, "timestamp_epoch": "1732597499.619497000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 57554, "dst_port": 53, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.flags.response": "False", "dns.qry.name": "fa000000005.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-07046e637c9d02b161c6a544", "kind": "dns", "frame_number": 22386, "timestamp_epoch": "1732597499.634228000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 57554, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.a": "173.222.49.101", "dns.cname": "resources.office.net.edgekey.net,e11271.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fa000000005.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-54d30312a18a088ab99120b2", "kind": "dns", "frame_number": 22387, "timestamp_epoch": "1732597499.634256000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 58641, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.a": "173.222.49.101", "dns.cname": "resources.office.net.edgekey.net,e11271.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fa000000002.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-986b098f58f9cd74adb2fae9", "kind": "dns", "frame_number": 23573, "timestamp_epoch": "1732597500.387511000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55110, "dst_port": 53, "tcp_stream": null, "udp_stream": 118, "fields": { "dns.flags.response": "False", "dns.qry.name": "fa000000116.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-12c83a348c73f3d77728c6c1", "kind": "dns", "frame_number": 23574, "timestamp_epoch": "1732597500.418189000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55110, "tcp_stream": null, "udp_stream": 118, "fields": { "dns.a": "173.222.49.101", "dns.cname": "resources.office.net.edgekey.net,e11271.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fa000000116.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-f5c05fc92f31fc54e0a2d79a", "kind": "dns", "frame_number": 23587, "timestamp_epoch": "1732597500.557158000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53681, "dst_port": 53, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.flags.response": "False", "dns.qry.name": "fa000000128.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-e57509a249577a28c6117f35", "kind": "dns", "frame_number": 23589, "timestamp_epoch": "1732597500.574101000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 53681, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.a": "173.222.49.101", "dns.cname": "resources.office.net.edgekey.net,e11271.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fa000000128.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-16b13a9b7e27259a97012773", "kind": "dns", "frame_number": 23964, "timestamp_epoch": "1732597500.817685000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55128, "dst_port": 53, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.flags.response": "False", "dns.qry.name": "fa000000163.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-4e962b0ebadbcfcb9c1a9999", "kind": "dns", "frame_number": 24030, "timestamp_epoch": "1732597500.835461000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55128, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.a": "173.222.49.101", "dns.cname": "resources.office.net.edgekey.net,e11271.dscg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fa000000163.resources.office.net", "dns.qry.type": "1" } }, { "event_id": "evt-c790f685fadc8d2703690640", "kind": "dns", "frame_number": 25849, "timestamp_epoch": "1732597533.406949000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 50712, "dst_port": 53, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-6dab6c035ba98beb187373ee", "kind": "dns", "frame_number": 25850, "timestamp_epoch": "1732597533.438034000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 50712, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-a8f1b4ba1a41f650fe76e9fa", "kind": "dns", "frame_number": 25976, "timestamp_epoch": "1732597789.025745000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 58159, "dst_port": 53, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d578db11e455a925afcb6d9", "kind": "dns", "frame_number": 25977, "timestamp_epoch": "1732597789.027193000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 58159, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.a": "20.189.173.16", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdwus17.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1324d4e7c5e794e6d9c512e6", "kind": "dns", "frame_number": 26020, "timestamp_epoch": "1732597848.394016000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59270, "dst_port": 53, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-607e561239c4d598e1711b2e", "kind": "dns", "frame_number": 26021, "timestamp_epoch": "1732597848.410925000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59270, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-b9549849db000e0e49c8bc23", "kind": "dns", "frame_number": 26030, "timestamp_epoch": "1732597859.866812000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62613, "dst_port": 53, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-40ba7d90733ea5f6abd58046", "kind": "dns", "frame_number": 26031, "timestamp_epoch": "1732597859.866911000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55765, "dst_port": 53, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-31b598a686d87b1793189684", "kind": "dns", "frame_number": 26032, "timestamp_epoch": "1732597859.867198000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62613, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-641ff9a54753855f33ef8e31", "kind": "dns", "frame_number": 26033, "timestamp_epoch": "1732597859.867272000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55765, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-7300c2699782045467efb796", "kind": "dns", "frame_number": 26034, "timestamp_epoch": "1732597859.867661000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62613, "dst_port": 53, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-371690ba0055c82b4cb06391", "kind": "dns", "frame_number": 26035, "timestamp_epoch": "1732597859.867710000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55765, "dst_port": 53, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-c4da952f6e26c93c2ca18237", "kind": "dns", "frame_number": 26036, "timestamp_epoch": "1732597859.914522000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62613, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-955e7032660e366f97e2cf3b", "kind": "dns", "frame_number": 26037, "timestamp_epoch": "1732597859.914603000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55765, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-8492c1b5d6003a7a10344bd4", "kind": "dns", "frame_number": 26139, "timestamp_epoch": "1732598406.258526000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62613, "dst_port": 53, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1474b8b272235b88a56a9ae0", "kind": "dns", "frame_number": 26140, "timestamp_epoch": "1732598406.273953000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62613, "tcp_stream": null, "udp_stream": 123, "fields": { "dns.a": "20.42.73.25", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus06.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-33fd00e19391859c785f8dbc", "kind": "dns", "frame_number": 26208, "timestamp_epoch": "1732598448.347107000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 55765, "dst_port": 53, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-d4213b80bbd783705e7f05d4", "kind": "dns", "frame_number": 26209, "timestamp_epoch": "1732598448.372475000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 55765, "tcp_stream": null, "udp_stream": 124, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-072f33f1764e123249ce27e0", "kind": "dns", "frame_number": 26219, "timestamp_epoch": "1732598459.901594000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62125, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-a71973a4bed1792803a4aa7e", "kind": "dns", "frame_number": 26220, "timestamp_epoch": "1732598459.901594000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56349, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-3556435f897e77c438f4bbdc", "kind": "dns", "frame_number": 26221, "timestamp_epoch": "1732598459.902062000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56349, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-c3e592eaa29202463c2d698c", "kind": "dns", "frame_number": 26222, "timestamp_epoch": "1732598459.902091000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62125, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-eb91502d1d99aa954576c815", "kind": "dns", "frame_number": 26223, "timestamp_epoch": "1732598459.902413000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56349, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-e9bb7dead1e546261128482a", "kind": "dns", "frame_number": 26224, "timestamp_epoch": "1732598459.902433000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62125, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-4cb5dec6330caf6e251abd05", "kind": "dns", "frame_number": 26225, "timestamp_epoch": "1732598459.951992000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62125, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-005235fddd16693951fe2c6e", "kind": "dns", "frame_number": 26226, "timestamp_epoch": "1732598459.952027000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56349, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-5920ab56893852ee88167b54", "kind": "dns", "frame_number": 26233, "timestamp_epoch": "1732598497.286225000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 62125, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-4f1323552d4233367a5130b5", "kind": "dns", "frame_number": 26234, "timestamp_epoch": "1732598497.311858000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 62125, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-f2de30647566a34e5f799272", "kind": "dns", "frame_number": 26355, "timestamp_epoch": "1732598808.369148000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 56349, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-7540a15f50908ccf469f7ad6", "kind": "dns", "frame_number": 26356, "timestamp_epoch": "1732598808.377331000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 56349, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ddf12beceec34a1942308cd", "kind": "dns", "frame_number": 26411, "timestamp_epoch": "1732599059.936351000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49456, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-b1917858bd761c011c61c670", "kind": "dns", "frame_number": 26412, "timestamp_epoch": "1732599059.936351000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60774, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-0bed209987ff0946a2d78da9", "kind": "dns", "frame_number": 26413, "timestamp_epoch": "1732599059.936808000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60774, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-12a53d58f87860a402cf870f", "kind": "dns", "frame_number": 26414, "timestamp_epoch": "1732599059.936885000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49456, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-f3c147e4453ac6a7ee217950", "kind": "dns", "frame_number": 26415, "timestamp_epoch": "1732599059.937154000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49456, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-2c63e9dc1cefbce31152dcd9", "kind": "dns", "frame_number": 26416, "timestamp_epoch": "1732599059.937198000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60774, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-3b6f00726ffa2111c5437b4d", "kind": "dns", "frame_number": 26417, "timestamp_epoch": "1732599059.998703000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49456, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-82d924fd8a2013e216e21561", "kind": "dns", "frame_number": 26418, "timestamp_epoch": "1732599059.998779000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60774, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-ec7dc781e54c4f3978fcd14a", "kind": "dns", "frame_number": 26510, "timestamp_epoch": "1732599354.351479000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 60774, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-772e14e65217223c13a24828", "kind": "dns", "frame_number": 26511, "timestamp_epoch": "1732599354.427394000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 60774, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.a": "23.53.127.200,23.219.87.81", "dns.cname": "ctldl.windowsupdate.com.delivery.microsoft.com,wu-b-net.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-225bf79e9a2dfefd3b7061bd", "kind": "dns", "frame_number": 26546, "timestamp_epoch": "1732599453.328109000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 49456, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0e85cb044b3bf8ee178529e", "kind": "dns", "frame_number": 26547, "timestamp_epoch": "1732599453.343164000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 49456, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-1a7781ab8ba73f6757ad3f72", "kind": "dns", "frame_number": 26564, "timestamp_epoch": "1732599520.362771000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 59053, "dst_port": 53, "tcp_stream": null, "udp_stream": 129, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-0994575fe7d294be7a209a57", "kind": "dns", "frame_number": 26565, "timestamp_epoch": "1732599520.744444000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 59053, "tcp_stream": null, "udp_stream": 129, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-1027708fbf4ac4f8d8173e84", "kind": "dns", "frame_number": 26594, "timestamp_epoch": "1732599597.736612000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52089, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "NEMOTODES-DC.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-1276ae4f871702958057499e", "kind": "dns", "frame_number": 26595, "timestamp_epoch": "1732599597.736954000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52089, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "10.11.26.3", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "NEMOTODES-DC.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-cfdad0f458c9fc460afd7ee9", "kind": "dns", "frame_number": 26826, "timestamp_epoch": "1732599659.985769000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52089, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-158d679d5c12c599df8af5a3", "kind": "dns", "frame_number": 26827, "timestamp_epoch": "1732599659.985869000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65531, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-386c3a3124c7b419ac1011a9", "kind": "dns", "frame_number": 26828, "timestamp_epoch": "1732599659.986175000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52089, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-7939c0b858a44000c8d7582e", "kind": "dns", "frame_number": 26829, "timestamp_epoch": "1732599659.986270000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65531, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.nemotoads.health", "dns.qry.type": "1" } }, { "event_id": "evt-ff990179b8e49cfa8c0dff94", "kind": "dns", "frame_number": 26830, "timestamp_epoch": "1732599659.986528000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52089, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-aeb6b20b09383cc82b2f0699", "kind": "dns", "frame_number": 26831, "timestamp_epoch": "1732599659.986548000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65531, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-1ce918e9b82cc07f104100d3", "kind": "dns", "frame_number": 26832, "timestamp_epoch": "1732599660.031331000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65531, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-d6b74f22a7434cc30315a20a", "kind": "dns", "frame_number": 26833, "timestamp_epoch": "1732599660.031369000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52089, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.mshome.net", "dns.qry.type": "1" } }, { "event_id": "evt-f324c0313539c220fe119f03", "kind": "dns", "frame_number": 26834, "timestamp_epoch": "1732599663.309490000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 65531, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-bf3101c100daf881874f115e", "kind": "dns", "frame_number": 26835, "timestamp_epoch": "1732599663.325324000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 65531, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-8e531bc62814111df6dfd266", "kind": "dns", "frame_number": 26869, "timestamp_epoch": "1732599747.537533000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 52089, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-37d83d3e7391a4cfdf045da8", "kind": "dns", "frame_number": 26870, "timestamp_epoch": "1732599747.553388000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 53, "dst_port": 52089, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "20.7.1.246", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-3a8d70eac5bed994c1c79e8c", "kind": "http_request", "frame_number": 6, "timestamp_epoch": "1732596578.525014000", "src_ip": "10.11.26.183", "dst_ip": "104.117.247.184", "src_port": 53279, "dst_port": 80, "tcp_stream": 0, "udp_stream": null, "fields": { "http.host": "www.msftconnecttest.com", "http.request.full_uri": "http://www.msftconnecttest.com/connecttest.txt", "http.request.method": "GET", "http.request.uri": "/connecttest.txt", "http.response_in": "8", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-0f7839659d74c00aa35a570d", "kind": "http_request", "frame_number": 82, "timestamp_epoch": "1732596581.464546000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a31534a1669c59aab152e53f", "kind": "http_request", "frame_number": 161, "timestamp_epoch": "1732596582.399669000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a3d3388f1db0300fea9731d2", "kind": "http_request", "frame_number": 192, "timestamp_epoch": "1732596584.470841000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-890d2a21c21fb925beb1fd29", "kind": "http_request", "frame_number": 194, "timestamp_epoch": "1732596585.414782000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-99828977c22a5adb6844da7a", "kind": "http_request", "frame_number": 198, "timestamp_epoch": "1732596586.393845000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-320daa48b862388b5190f7bc", "kind": "http_request", "frame_number": 202, "timestamp_epoch": "1732596589.396641000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-3107b14f813795cad74529a6", "kind": "http_request", "frame_number": 205, "timestamp_epoch": "1732596592.396657000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-ccfefde50169c10da78aae4d", "kind": "http_request", "frame_number": 12788, "timestamp_epoch": "1732596640.833231000", "src_ip": "10.11.26.183", "dst_ip": "104.117.247.99", "src_port": 53361, "dst_port": 80, "tcp_stream": 76, "udp_stream": null, "fields": { "http.host": "r10.o.lencr.org", "http.request.full_uri": "http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D", "http.request.method": "GET", "http.request.uri": "/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D", "http.response_in": "12790", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-6b17e2aa112150b80418fc2b", "kind": "http_request", "frame_number": 20336, "timestamp_epoch": "1732596645.744628000", "src_ip": "10.11.26.183", "dst_ip": "104.26.1.231", "src_port": 53363, "dst_port": 80, "tcp_stream": 78, "udp_stream": null, "fields": { "http.host": "geo.netsupportsoftware.com", "http.request.full_uri": "http://geo.netsupportsoftware.com/location/loca.asp", "http.request.method": "GET", "http.request.uri": "/location/loca.asp", "http.response_in": "20344" } }, { "event_id": "evt-1a8a37b5e071c38113684bce", "kind": "http_request", "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "22", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.response_in": "20341", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-f9a9fd7170145993d818f45d", "kind": "http_request", "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "250", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.response_in": "20346", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-aef9baf1a24ce34d60e48d47", "kind": "http_request", "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "76", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-813b60c7af2eca75a2d64427", "kind": "http_request", "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "84", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-ee5e0ef701c8f4a3f4caf513", "kind": "http_request", "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-06b1de9a4606eb412a49fc28", "kind": "http_request", "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-c46ac724bfd982b23a49239b", "kind": "http_request", "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-342e75303c40d138ea93622b", "kind": "http_request", "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-f06f60c4d862b5d93ebdbbaa", "kind": "http_request", "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-72f594f384a53d5b902d0802", "kind": "http_request", "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-00964c03c5aca54a6081b664", "kind": "http_request", "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-5973d17ae459b75f982f13c6", "kind": "http_request", "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-d4e60c91c0155a459fa75986", "kind": "http_request", "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-d2d7fa65da1cc81e9b0027a9", "kind": "http_request", "frame_number": 21604, "timestamp_epoch": "1732597247.829451000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-4f3f2e1f1e87ea1f753b182f", "kind": "http_request", "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-e44a2e4834f3157467930987", "kind": "http_request", "frame_number": 21640, "timestamp_epoch": "1732597250.834538000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-aac74325814e5ba30d452231", "kind": "http_request", "frame_number": 21661, "timestamp_epoch": "1732597253.847522000", "src_ip": "10.11.26.183", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-aec5dfe02ce97fd54ab036ae", "kind": "http_request", "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-ad9a42fee0dbe7ee438f483c", "kind": "http_request", "frame_number": 21719, "timestamp_epoch": "1732597316.726360000", "src_ip": "10.11.26.183", "dst_ip": "23.53.127.105", "src_port": 53422, "dst_port": 80, "tcp_stream": 108, "udp_stream": null, "fields": { "http.host": "acroipm2.adobe.com", "http.request.full_uri": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "http.request.method": "GET", "http.request.uri": "/assets/Owner/arm/ProcessMAU.txt", "http.response_in": "21721", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)" } }, { "event_id": "evt-aa038a5eabad47961dae3f96", "kind": "http_request", "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-27ac37bbec2136b3efa717dd", "kind": "http_request", "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-4023263467de643bd17c07ab", "kind": "http_request", "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-6c3605e30d9c0819891fc952", "kind": "http_request", "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-e6bd49e2bd260f7e1989a36b", "kind": "http_request", "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-4b1cbae21a9e9c6a6b3976e0", "kind": "http_request", "frame_number": 25937, "timestamp_epoch": "1732597669.001919000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-90d80806648aba215a49a716", "kind": "http_request", "frame_number": 25968, "timestamp_epoch": "1732597729.062950000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-61c739c53c082926c625a3f6", "kind": "http_request", "frame_number": 25985, "timestamp_epoch": "1732597789.216290000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-86b08875b09aa3e6fd798f7b", "kind": "http_request", "frame_number": 26022, "timestamp_epoch": "1732597849.369834000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-f9b8b772b07319d5b16fe286", "kind": "http_request", "frame_number": 26051, "timestamp_epoch": "1732597909.523158000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-5198a2d20b26b00a0829109d", "kind": "http_request", "frame_number": 26055, "timestamp_epoch": "1732597969.680246000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-b790a30049fa4a8d098fe74b", "kind": "http_request", "frame_number": 26066, "timestamp_epoch": "1732598029.737747000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-b8daca8d36e02906de7cd98d", "kind": "http_request", "frame_number": 26074, "timestamp_epoch": "1732598089.880222000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-d5a9d8e01c03a5a00e86b521", "kind": "http_request", "frame_number": 26087, "timestamp_epoch": "1732598149.936096000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-ab2d512d7f59b5db2565ad81", "kind": "http_request", "frame_number": 26097, "timestamp_epoch": "1732598210.090084000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-344fa5d729ac0bea3dd839c5", "kind": "http_request", "frame_number": 26107, "timestamp_epoch": "1732598270.148715000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-e6d3804963166ce94648f7b1", "kind": "http_request", "frame_number": 26119, "timestamp_epoch": "1732598330.207754000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-36b39a250c5d7006c6b52ff2", "kind": "http_request", "frame_number": 26133, "timestamp_epoch": "1732598390.367131000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-b7dcfbd544e738d3ff1a6d47", "kind": "http_request", "frame_number": 26215, "timestamp_epoch": "1732598450.424378000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-02c1a4d9e9bfd4634aef265d", "kind": "http_request", "frame_number": 26297, "timestamp_epoch": "1732598510.485705000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-2565d95e93d599b4e3ceadb7", "kind": "http_request", "frame_number": 26301, "timestamp_epoch": "1732598570.640951000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-104842aaa8a9f0f7b0c48b60", "kind": "http_request", "frame_number": 26317, "timestamp_epoch": "1732598630.794559000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-cab5074ff8aea76a6db719a8", "kind": "http_request", "frame_number": 26325, "timestamp_epoch": "1732598691.056411000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-f28430ab17b719fa0fd8e1be", "kind": "http_request", "frame_number": 26339, "timestamp_epoch": "1732598751.112829000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-ac58bfa56f49f255920f2fc8", "kind": "http_request", "frame_number": 26357, "timestamp_epoch": "1732598811.175685000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-7c744d38f90c681187574d06", "kind": "http_request", "frame_number": 26371, "timestamp_epoch": "1732598871.330432000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-755e5286be45de6ea20c8be1", "kind": "http_request", "frame_number": 26381, "timestamp_epoch": "1732598931.593448000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-bd48a8a634fce972d5008ffb", "kind": "http_request", "frame_number": 26395, "timestamp_epoch": "1732598991.748754000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-a33304562e6febce19f93f41", "kind": "http_request", "frame_number": 26407, "timestamp_epoch": "1732599052.010090000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-00acca883de4712eccbf25ce", "kind": "http_request", "frame_number": 26425, "timestamp_epoch": "1732599112.161738000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-123ba01e7671a2b02954bb3e", "kind": "http_request", "frame_number": 26431, "timestamp_epoch": "1732599172.411164000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-e08f21415a6194dde3b8e803", "kind": "http_request", "frame_number": 26441, "timestamp_epoch": "1732599232.561197000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-bd9de12a3aa512d0acb22cd8", "kind": "http_request", "frame_number": 26449, "timestamp_epoch": "1732599292.717415000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-dc46e222951b22d0e1578bbe", "kind": "http_request", "frame_number": 26508, "timestamp_epoch": "1732599352.967228000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-fe678940b96c65f0999712c7", "kind": "http_request", "frame_number": 26515, "timestamp_epoch": "1732599354.476422000", "src_ip": "10.11.26.183", "dst_ip": "23.53.127.200", "src_port": 53483, "dst_port": 80, "tcp_stream": 134, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce02e9976e1239e1", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce02e9976e1239e1", "http.response_in": "26517", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-32ce992dfc75225bc280d6fa", "kind": "http_request", "frame_number": 26518, "timestamp_epoch": "1732599354.546751000", "src_ip": "10.11.26.183", "dst_ip": "23.53.127.200", "src_port": 53483, "dst_port": 80, "tcp_stream": 134, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?778a0928305752e9", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?778a0928305752e9", "http.response_in": "26520", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-3d2c9a3eda9779b6395d3d64", "kind": "http_request", "frame_number": 26533, "timestamp_epoch": "1732599413.228563000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-59aa53776c9022c2e8b15ef1", "kind": "http_request", "frame_number": 26554, "timestamp_epoch": "1732599473.382552000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-31d62964acd293c87bd3ab62", "kind": "http_request", "frame_number": 26570, "timestamp_epoch": "1732599533.536694000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53362, "dst_port": 443, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-ed02454111ad0656fa0e8a2f", "kind": "http_request", "frame_number": 26809, "timestamp_epoch": "1732599628.801338000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "22", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.response_in": "26810", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-13b3417195e491194f727775", "kind": "http_request", "frame_number": 26811, "timestamp_epoch": "1732599629.009850000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "250", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.response_in": "26812", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-b08ed33706afc4bc100499a0", "kind": "http_request", "frame_number": 26814, "timestamp_epoch": "1732599629.317405000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "84", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-97da224684a90a09bbc9a3c6", "kind": "http_request", "frame_number": 26842, "timestamp_epoch": "1732599689.372894000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-b475336fb0ea08bd9ae4c014", "kind": "http_request", "frame_number": 26901, "timestamp_epoch": "1732599749.528770000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } }, { "event_id": "evt-cd047f9149e7996094827c44", "kind": "http_request", "frame_number": 26913, "timestamp_epoch": "1732599809.682016000", "src_ip": "10.11.26.183", "dst_ip": "194.180.191.64", "src_port": 53500, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "36", "http.host": "194.180.191.64", "http.request.full_uri": "http://194.180.191.64/fakeurl.htm", "http.request.method": "POST", "http.request.uri": "http://194.180.191.64/fakeurl.htm", "http.user_agent": "NetSupport Manager/1.3" } } ], "http_response": [ { "event_id": "evt-cd7f80c686566e9ba61fb73f", "kind": "http_response", "frame_number": 8, "timestamp_epoch": "1732596578.572840000", "src_ip": "104.117.247.184", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53279, "tcp_stream": 0, "udp_stream": null, "fields": { "http.content_length": "22", "http.content_type": "text/plain", "http.request_in": "6", "http.response.code": "200" } }, { "event_id": "evt-0c34634b737ac6b6708972d5", "kind": "http_response", "frame_number": 12790, "timestamp_epoch": "1732596640.928426000", "src_ip": "104.117.247.99", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53361, "tcp_stream": 76, "udp_stream": null, "fields": { "http.content_length": "504", "http.content_type": "application/ocsp-response", "http.request_in": "12788", "http.response.code": "200" } }, { "event_id": "evt-f7b1ca497362d2dd9adc6e7e", "kind": "http_response", "frame_number": 20341, "timestamp_epoch": "1732596646.040395000", "src_ip": "194.180.191.64", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53362, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "61", "http.content_type": "application/x-www-form-urlencoded", "http.request_in": "20340", "http.response.code": "200" } }, { "event_id": "evt-f15e3c5e4a9e6ad4241e0da4", "kind": "http_response", "frame_number": 20344, "timestamp_epoch": "1732596646.217770000", "src_ip": "104.26.1.231", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53363, "tcp_stream": 78, "udp_stream": null, "fields": { "http.content_type": "text/html; Charset=utf-8", "http.request_in": "20336", "http.response.code": "200" } }, { "event_id": "evt-2ac9eb4146eb8687bfbae723", "kind": "http_response", "frame_number": 20346, "timestamp_epoch": "1732596646.247479000", "src_ip": "194.180.191.64", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53362, "tcp_stream": 77, "udp_stream": null, "fields": { "http.content_length": "152", "http.content_type": "application/x-www-form-urlencoded", "http.request_in": "20342", "http.response.code": "200" } }, { "event_id": "evt-d6acf92ba2a423388982ae7d", "kind": "http_response", "frame_number": 21721, "timestamp_epoch": "1732597316.771075000", "src_ip": "23.53.127.105", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53422, "tcp_stream": 108, "udp_stream": null, "fields": { "http.content_length": "4", "http.content_type": "text/plain; charset=UTF-8", "http.request_in": "21719", "http.response.code": "200" } }, { "event_id": "evt-916436c1782efb2112b4c138", "kind": "http_response", "frame_number": 26517, "timestamp_epoch": "1732599354.532334000", "src_ip": "23.53.127.200", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53483, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "26515", "http.response.code": "304" } }, { "event_id": "evt-155eac656f465e4b2d5dd49e", "kind": "http_response", "frame_number": 26520, "timestamp_epoch": "1732599354.596371000", "src_ip": "23.53.127.200", "dst_ip": "10.11.26.183", "src_port": 80, "dst_port": 53483, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_type": "application/vnd.ms-cab-compressed", "http.request_in": "26518", "http.response.code": "304" } }, { "event_id": "evt-a4a4a6c1f5581a583d22d2a0", "kind": "http_response", "frame_number": 26810, "timestamp_epoch": "1732599629.005749000", "src_ip": "194.180.191.64", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53500, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "61", "http.content_type": "application/x-www-form-urlencoded", "http.request_in": "26809", "http.response.code": "200" } }, { "event_id": "evt-19a2e838ba890415944cee0e", "kind": "http_response", "frame_number": 26812, "timestamp_epoch": "1732599629.216675000", "src_ip": "194.180.191.64", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53500, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "152", "http.content_type": "application/x-www-form-urlencoded", "http.request_in": "26811", "http.response.code": "200" } } ], "tls_client_hello": [ { "event_id": "evt-99ab93678d625f85e953451b", "kind": "tls_client_hello", "frame_number": 68, "timestamp_epoch": "1732596581.290159000", "src_ip": "10.11.26.183", "dst_ip": "4.149.227.78", "src_port": 53282, "dst_port": 443, "tcp_stream": 3, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-c90f03558b67bffe6d4fd0b9", "kind": "tls_client_hello", "frame_number": 109, "timestamp_epoch": "1732596581.686056000", "src_ip": "10.11.26.183", "dst_ip": "4.149.227.78", "src_port": 53283, "dst_port": 443, "tcp_stream": 4, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-a2b5b29f4d75c7612d71077a", "kind": "tls_client_hello", "frame_number": 152, "timestamp_epoch": "1732596582.235129000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } }, { "event_id": "evt-c3351c5c91ab3a807f664bb8", "kind": "tls_client_hello", "frame_number": 444, "timestamp_epoch": "1732596597.286707000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53300, "dst_port": 443, "tcp_stream": 20, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-f6fbd6e38897f1e7fda975d9", "kind": "tls_client_hello", "frame_number": 452, "timestamp_epoch": "1732596597.357302000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53300, "dst_port": 443, "tcp_stream": 20, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-5970aa38eddf19649393de53", "kind": "tls_client_hello", "frame_number": 457, "timestamp_epoch": "1732596597.376532000", "src_ip": "10.11.26.183", "dst_ip": "104.117.244.112", "src_port": 53301, "dst_port": 443, "tcp_stream": 21, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-cfd7f6f3d373004246c24607", "kind": "tls_client_hello", "frame_number": 530, "timestamp_epoch": "1732596597.451002000", "src_ip": "10.11.26.183", "dst_ip": "52.109.8.89", "src_port": 53302, "dst_port": 443, "tcp_stream": 22, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-92504bbfa2bda8e8eeb7a338", "kind": "tls_client_hello", "frame_number": 588, "timestamp_epoch": "1732596597.556517000", "src_ip": "10.11.26.183", "dst_ip": "40.126.29.9", "src_port": 53307, "dst_port": 443, "tcp_stream": 27, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-9b736e31d44c3d3d6af00821", "kind": "tls_client_hello", "frame_number": 623, "timestamp_epoch": "1732596597.615857000", "src_ip": "10.11.26.183", "dst_ip": "40.126.29.9", "src_port": 53307, "dst_port": 443, "tcp_stream": 27, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-bf12e4d47740a924de30054c", "kind": "tls_client_hello", "frame_number": 634, "timestamp_epoch": "1732596597.664239000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53308, "dst_port": 443, "tcp_stream": 28, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-7bf1f3bdc7c24cca8517212a", "kind": "tls_client_hello", "frame_number": 647, "timestamp_epoch": "1732596597.726676000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53308, "dst_port": 443, "tcp_stream": 28, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-a071771da1474d477b41e81c", "kind": "tls_client_hello", "frame_number": 715, "timestamp_epoch": "1732596597.935163000", "src_ip": "10.11.26.183", "dst_ip": "52.109.20.47", "src_port": 53309, "dst_port": 443, "tcp_stream": 29, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-ffe059d751067bb1126eabea", "kind": "tls_client_hello", "frame_number": 757, "timestamp_epoch": "1732596598.308291000", "src_ip": "10.11.26.183", "dst_ip": "23.221.22.46", "src_port": 53310, "dst_port": 443, "tcp_stream": 30, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-ddbbceffd12b4f2011e03183", "kind": "tls_client_hello", "frame_number": 909, "timestamp_epoch": "1732596600.384384000", "src_ip": "10.11.26.183", "dst_ip": "4.150.155.223", "src_port": 53311, "dst_port": 443, "tcp_stream": 31, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nav.smartscreen.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-5f5174ab7d3b26ffc6f92a10", "kind": "tls_client_hello", "frame_number": 932, "timestamp_epoch": "1732596600.839005000", "src_ip": "10.11.26.183", "dst_ip": "4.150.155.223", "src_port": 53312, "dst_port": 443, "tcp_stream": 32, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "data-edge.smartscreen.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-00cf9a15614ca74284aa37e4", "kind": "tls_client_hello", "frame_number": 953, "timestamp_epoch": "1732596601.071650000", "src_ip": "10.11.26.183", "dst_ip": "13.107.5.93", "src_port": 53313, "dst_port": 443, "tcp_stream": 33, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "68b3ecfaf0034bb9fcbecd518b5ab8d4" } }, { "event_id": "evt-3ab8bf336a68a8e22458ab65", "kind": "tls_client_hello", "frame_number": 962, "timestamp_epoch": "1732596601.100903000", "src_ip": "10.11.26.183", "dst_ip": "40.126.28.11", "src_port": 53314, "dst_port": 443, "tcp_stream": 34, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.live.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-92843594ccd994b377e8670c", "kind": "tls_client_hello", "frame_number": 965, "timestamp_epoch": "1732596601.137006000", "src_ip": "10.11.26.183", "dst_ip": "13.107.5.93", "src_port": 53313, "dst_port": 443, "tcp_stream": 33, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "68b3ecfaf0034bb9fcbecd518b5ab8d4" } }, { "event_id": "evt-9098282abb699329bbdde29e", "kind": "tls_client_hello", "frame_number": 1022, "timestamp_epoch": "1732596602.849797000", "src_ip": "10.11.26.183", "dst_ip": "13.107.5.93", "src_port": 53315, "dst_port": 443, "tcp_stream": 35, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "68b3ecfaf0034bb9fcbecd518b5ab8d4" } }, { "event_id": "evt-f3fb656c7dc85129ce5f3f40", "kind": "tls_client_hello", "frame_number": 1028, "timestamp_epoch": "1732596602.917874000", "src_ip": "10.11.26.183", "dst_ip": "13.107.5.93", "src_port": 53315, "dst_port": 443, "tcp_stream": 35, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "68b3ecfaf0034bb9fcbecd518b5ab8d4" } }, { "event_id": "evt-f0ac62a064e94b8160908b45", "kind": "tls_client_hello", "frame_number": 1058, "timestamp_epoch": "1732596606.840908000", "src_ip": "10.11.26.183", "dst_ip": "13.107.246.57", "src_port": 53317, "dst_port": 443, "tcp_stream": 36, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "inputsuggestions.msdxcdn.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-9cea6c452e55d70752baccdb", "kind": "tls_client_hello", "frame_number": 1062, "timestamp_epoch": "1732596606.889860000", "src_ip": "10.11.26.183", "dst_ip": "13.107.246.57", "src_port": 53317, "dst_port": 443, "tcp_stream": 36, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "inputsuggestions.msdxcdn.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-efca90b14f314abfbcdb7eff", "kind": "tls_client_hello", "frame_number": 1188, "timestamp_epoch": "1732596611.399775000", "src_ip": "10.11.26.183", "dst_ip": "13.107.21.239", "src_port": 53321, "dst_port": 443, "tcp_stream": 40, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "7230db75fbd5472f76d02c10787af505" } }, { "event_id": "evt-4840ccf7108b7d17c419dfc9", "kind": "tls_client_hello", "frame_number": 1206, "timestamp_epoch": "1732596611.512916000", "src_ip": "10.11.26.183", "dst_ip": "213.246.109.5", "src_port": 53322, "dst_port": 443, "tcp_stream": 41, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "classicgrand.com", "tls.handshake.ja3": "129a4a4460936a7d35cf0b4a876c02c5" } }, { "event_id": "evt-45b9ae55c305d39c2853462f", "kind": "tls_client_hello", "frame_number": 1366, "timestamp_epoch": "1732596614.310565000", "src_ip": "10.11.26.183", "dst_ip": "52.8.34.0", "src_port": 53325, "dst_port": 443, "tcp_stream": 42, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "confirmsubscription.com", "tls.handshake.ja3": "1d2c110dc93a519d4c14a15898f20f6c" } }, { "event_id": "evt-ef784ea49a7d4ad0f0ec6e51", "kind": "tls_client_hello", "frame_number": 1407, "timestamp_epoch": "1732596614.403860000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53326, "dst_port": 443, "tcp_stream": 43, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "f24a7ea8a60779966dc83806405c4091" } }, { "event_id": "evt-de2e36fe05f83e73fc12b67e", "kind": "tls_client_hello", "frame_number": 1490, "timestamp_epoch": "1732596614.488757000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53327, "dst_port": 443, "tcp_stream": 44, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "cbcf96af03d431db8e0fd90215b03309" } }, { "event_id": "evt-db279a1f1f9cd09f68fef282", "kind": "tls_client_hello", "frame_number": 1768, "timestamp_epoch": "1732596614.821985000", "src_ip": "10.11.26.183", "dst_ip": "142.251.186.95", "src_port": 53328, "dst_port": 443, "tcp_stream": 45, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.googleapis.com", "tls.handshake.ja3": "2ef63960b5419ce0be770acb72a1e6d5" } }, { "event_id": "evt-a02596d095c315125f2961b3", "kind": "tls_client_hello", "frame_number": 1772, "timestamp_epoch": "1732596614.849040000", "src_ip": "10.11.26.183", "dst_ip": "142.250.138.94", "src_port": 53329, "dst_port": 443, "tcp_stream": 46, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.gstatic.com", "tls.handshake.ja3": "c86423ffed1add9d50dccf646bd7fdbd" } }, { "event_id": "evt-a070505f759a62f20e2190dd", "kind": "tls_client_hello", "frame_number": 1779, "timestamp_epoch": "1732596614.856007000", "src_ip": "10.11.26.183", "dst_ip": "142.250.138.94", "src_port": 53330, "dst_port": 443, "tcp_stream": 47, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.gstatic.com", "tls.handshake.ja3": "1a41c18f74e0a1125e7eb86dc20da423" } }, { "event_id": "evt-6c7756f391d5bddf15bbd960", "kind": "tls_client_hello", "frame_number": 1783, "timestamp_epoch": "1732596614.859109000", "src_ip": "10.11.26.183", "dst_ip": "142.250.138.94", "src_port": 53331, "dst_port": 443, "tcp_stream": 48, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.gstatic.com", "tls.handshake.ja3": "488f29e13a0873e296eb2dcca6ec38d0" } }, { "event_id": "evt-9c8cad53feafbcd9fda3067d", "kind": "tls_client_hello", "frame_number": 1823, "timestamp_epoch": "1732596614.914670000", "src_ip": "10.11.26.183", "dst_ip": "142.251.186.147", "src_port": 53332, "dst_port": 443, "tcp_stream": 49, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.google.com", "tls.handshake.ja3": "b6b910fa2621ea444621910f5e10aa4a" } }, { "event_id": "evt-ec7eeb1a01ec85429feff602", "kind": "tls_client_hello", "frame_number": 1828, "timestamp_epoch": "1732596614.915243000", "src_ip": "10.11.26.183", "dst_ip": "142.251.186.147", "src_port": 53333, "dst_port": 443, "tcp_stream": 50, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.google.com", "tls.handshake.ja3": "9c5ffd0e64cc58a2ad1806964fe2da4e" } }, { "event_id": "evt-99ae37a11dc181945069848f", "kind": "tls_client_hello", "frame_number": 2149, "timestamp_epoch": "1732596615.382036000", "src_ip": "10.11.26.183", "dst_ip": "142.250.113.120", "src_port": 53334, "dst_port": 443, "tcp_stream": 51, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "maps.gstatic.com", "tls.handshake.ja3": "f82158b828f02d82f1f70fbb0f1d6145" } }, { "event_id": "evt-60d9e9ae55388e84be42ef8d", "kind": "tls_client_hello", "frame_number": 2153, "timestamp_epoch": "1732596615.396979000", "src_ip": "10.11.26.183", "dst_ip": "142.250.115.95", "src_port": 53335, "dst_port": 443, "tcp_stream": 52, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "maps.googleapis.com", "tls.handshake.ja3": "46181092bc7467ccd870ec99523f7113" } }, { "event_id": "evt-e09829629fe2103680ed2028", "kind": "tls_client_hello", "frame_number": 2510, "timestamp_epoch": "1732596615.726675000", "src_ip": "10.11.26.183", "dst_ip": "142.250.115.95", "src_port": 53336, "dst_port": 443, "tcp_stream": 53, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "maps.googleapis.com", "tls.handshake.ja3": "53e42f80bc48a39739f5221b803b1f70" } }, { "event_id": "evt-42757994c4e87651a21c339a", "kind": "tls_client_hello", "frame_number": 2739, "timestamp_epoch": "1732596615.797852000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.239", "src_port": 53338, "dst_port": 443, "tcp_stream": 55, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "b8f7a95293e0d02d297ecef1efcc79d5" } }, { "event_id": "evt-35e8ce221dbc153c64ad31c0", "kind": "tls_client_hello", "frame_number": 2983, "timestamp_epoch": "1732596615.827162000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53337, "dst_port": 443, "tcp_stream": 54, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "910d5ef16eeb9c556a6f011876c16d38" } }, { "event_id": "evt-460d3662510f6f86d69319ed", "kind": "tls_client_hello", "frame_number": 3068, "timestamp_epoch": "1732596615.846763000", "src_ip": "10.11.26.183", "dst_ip": "13.56.30.207", "src_port": 53339, "dst_port": 443, "tcp_stream": 56, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "confirmsubscription.com", "tls.handshake.ja3": "9763df22d3de0549862e28d0f1103365" } }, { "event_id": "evt-884f32a6f3ffdc8dbacaca95", "kind": "tls_client_hello", "frame_number": 3611, "timestamp_epoch": "1732596616.274241000", "src_ip": "10.11.26.183", "dst_ip": "18.160.156.103", "src_port": 53341, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "css.createsend1.com", "tls.handshake.ja3": "4c24b4903c9a3c9b3c46306472bda896" } }, { "event_id": "evt-4123579d7684f3ff764fc91d", "kind": "tls_client_hello", "frame_number": 3613, "timestamp_epoch": "1732596616.274450000", "src_ip": "10.11.26.183", "dst_ip": "18.160.156.61", "src_port": 53340, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "js.createsend1.com", "tls.handshake.ja3": "0d7e324cc471d537395a5a84963ff4c0" } }, { "event_id": "evt-99921e15dcf2e54349e5c30b", "kind": "tls_client_hello", "frame_number": 3789, "timestamp_epoch": "1732596616.518575000", "src_ip": "10.11.26.183", "dst_ip": "142.251.186.95", "src_port": 53343, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.googleapis.com", "tls.handshake.ja3": "1aef2a0442d1535b67c961be49fbd9b0" } }, { "event_id": "evt-3507926f011d10c19a873134", "kind": "tls_client_hello", "frame_number": 3795, "timestamp_epoch": "1732596616.533605000", "src_ip": "10.11.26.183", "dst_ip": "13.107.21.239", "src_port": 53342, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "34578b889dbdfd86b5a0639eb869f9c5" } }, { "event_id": "evt-aa8e394ec351da4c0793eda8", "kind": "tls_client_hello", "frame_number": 3810, "timestamp_epoch": "1732596616.574611000", "src_ip": "10.11.26.183", "dst_ip": "142.250.113.94", "src_port": 53344, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.gstatic.com", "tls.handshake.ja3": "39a2db8b2473a3d4cfe7cb23a26e03d6" } }, { "event_id": "evt-dd20ee0387c1da59218e52cc", "kind": "tls_client_hello", "frame_number": 3885, "timestamp_epoch": "1732596616.694694000", "src_ip": "10.11.26.183", "dst_ip": "142.250.138.94", "src_port": 53345, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fonts.gstatic.com", "tls.handshake.ja3": "893fda16143345fbd7d6384fd5f69a44" } }, { "event_id": "evt-580f403a7b94e3e2f5cd7cb0", "kind": "tls_client_hello", "frame_number": 4118, "timestamp_epoch": "1732596616.815810000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53347, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "0652c09be13a164e73c3c66e2d5cd600" } }, { "event_id": "evt-efa431a8276271ba27d68379", "kind": "tls_client_hello", "frame_number": 4120, "timestamp_epoch": "1732596616.816199000", "src_ip": "10.11.26.183", "dst_ip": "151.101.66.137", "src_port": 53350, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "code.jquery.com", "tls.handshake.ja3": "c73376907efd66947a8978eacfd15135" } }, { "event_id": "evt-4a77f0c62efc0c5d80f0758e", "kind": "tls_client_hello", "frame_number": 4143, "timestamp_epoch": "1732596616.818773000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53346, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "2dd32544ddd46095f157e79a028dcda9" } }, { "event_id": "evt-0c802ba39b0247250efb2683", "kind": "tls_client_hello", "frame_number": 4147, "timestamp_epoch": "1732596616.819151000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53348, "dst_port": 443, "tcp_stream": 65, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "af5ca235cbec16c4b5ad43da2bd9b40a" } }, { "event_id": "evt-b5c0cc93bfa5ca6465325511", "kind": "tls_client_hello", "frame_number": 4149, "timestamp_epoch": "1732596616.819307000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53349, "dst_port": 443, "tcp_stream": 66, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "8f08a45cb17ce5d331bb4a861f26181f" } }, { "event_id": "evt-ad311a15389f4315090ba04e", "kind": "tls_client_hello", "frame_number": 11988, "timestamp_epoch": "1732596623.093978000", "src_ip": "10.11.26.183", "dst_ip": "104.117.244.96", "src_port": 53351, "dst_port": 443, "tcp_stream": 68, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "97cdfdfb6ce55b090e5070647c73305e" } }, { "event_id": "evt-a90e2502fc920de311cf4769", "kind": "tls_client_hello", "frame_number": 12083, "timestamp_epoch": "1732596623.254432000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.239", "src_port": 53353, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "996d810fbaded0fd221205ee7a391364" } }, { "event_id": "evt-f04972d469cda3fe591607e6", "kind": "tls_client_hello", "frame_number": 12134, "timestamp_epoch": "1732596623.379240000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.239", "src_port": 53354, "dst_port": 443, "tcp_stream": 70, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "82fc3feb7b73141563a581cb3a02b9e2" } }, { "event_id": "evt-c07f7879e504136bee22e0d1", "kind": "tls_client_hello", "frame_number": 12376, "timestamp_epoch": "1732596626.773909000", "src_ip": "10.11.26.183", "dst_ip": "213.246.109.5", "src_port": 53356, "dst_port": 443, "tcp_stream": 71, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "classicgrand.com", "tls.handshake.ja3": "ab617a1bfb55ac132b8893703d7cfec3" } }, { "event_id": "evt-c90e99e0165ccdc78141b2e0", "kind": "tls_client_hello", "frame_number": 12725, "timestamp_epoch": "1732596638.149298000", "src_ip": "10.11.26.183", "dst_ip": "40.118.171.167", "src_port": 53358, "dst_port": 443, "tcp_stream": 73, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "checkappexec.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-c80b8c15b02b0f76da057646", "kind": "tls_client_hello", "frame_number": 12771, "timestamp_epoch": "1732596640.624765000", "src_ip": "10.11.26.183", "dst_ip": "193.42.38.139", "src_port": 53360, "dst_port": 443, "tcp_stream": 75, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "modandcrackedapk.com", "tls.handshake.ja3": "2800f914a7a4ba98aa9df62d316a460c" } }, { "event_id": "evt-d321af5752fd7fd4d0c9f470", "kind": "tls_client_hello", "frame_number": 20357, "timestamp_epoch": "1732596648.472268000", "src_ip": "10.11.26.183", "dst_ip": "52.168.112.67", "src_port": 53365, "dst_port": 443, "tcp_stream": 79, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-20d45485d11dd1ba4e67b906", "kind": "tls_client_hello", "frame_number": 20501, "timestamp_epoch": "1732596662.988273000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53370, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-5f53d891d29e7c39b088ee54", "kind": "tls_client_hello", "frame_number": 20505, "timestamp_epoch": "1732596663.054999000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53370, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-db8732303c0a4b3e98f61939", "kind": "tls_client_hello", "frame_number": 20623, "timestamp_epoch": "1732596717.846942000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53376, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "10b3abe91219287930575e96187aab46" } }, { "event_id": "evt-f4f28d74da302a0d25242619", "kind": "tls_client_hello", "frame_number": 20627, "timestamp_epoch": "1732596717.911883000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53376, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "10b3abe91219287930575e96187aab46" } }, { "event_id": "evt-e20cc13d450e9c738651a330", "kind": "tls_client_hello", "frame_number": 20649, "timestamp_epoch": "1732596718.304948000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53377, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "e544273138fcf6e7dc137dd4f74d6fd0" } }, { "event_id": "evt-7384d9976de9c2a066e1a23a", "kind": "tls_client_hello", "frame_number": 20653, "timestamp_epoch": "1732596718.372163000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53377, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "e544273138fcf6e7dc137dd4f74d6fd0" } }, { "event_id": "evt-3c5c29b6b09ad5b95fc4f3fa", "kind": "tls_client_hello", "frame_number": 20699, "timestamp_epoch": "1732596718.634150000", "src_ip": "10.11.26.183", "dst_ip": "104.117.244.106", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "e71e6cff682837413473fd63dc10f5d4" } }, { "event_id": "evt-94dfa6d476a82b4f49f272c4", "kind": "tls_client_hello", "frame_number": 20702, "timestamp_epoch": "1732596718.643146000", "src_ip": "10.11.26.183", "dst_ip": "104.117.244.105", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "089117d8abb9d0685ac2756412f44d8c" } }, { "event_id": "evt-58c3bc7e736c6c2e003fbbf5", "kind": "tls_client_hello", "frame_number": 20706, "timestamp_epoch": "1732596718.671608000", "src_ip": "10.11.26.183", "dst_ip": "104.117.247.162", "src_port": 53378, "dst_port": 443, "tcp_stream": 89, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img-s-msn-com.akamaized.net", "tls.handshake.ja3": "7117eb033929b913d5dbbef620c9ca24" } }, { "event_id": "evt-199c0cb0cc8cac3ebd073aa6", "kind": "tls_client_hello", "frame_number": 20752, "timestamp_epoch": "1732596718.733572000", "src_ip": "10.11.26.183", "dst_ip": "23.221.22.209", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "c806504b9d641f3b26d1af269ed474ab" } }, { "event_id": "evt-afc335257bcba5c4af77cc5b", "kind": "tls_client_hello", "frame_number": 20772, "timestamp_epoch": "1732596718.792127000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53379, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "b13922eb23a33bd76cd8442814f25cb5" } }, { "event_id": "evt-265c36c5ab3b24372d731fec", "kind": "tls_client_hello", "frame_number": 20779, "timestamp_epoch": "1732596718.861647000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53379, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "b13922eb23a33bd76cd8442814f25cb5" } }, { "event_id": "evt-14eb0f4186c29e4477ec4591", "kind": "tls_client_hello", "frame_number": 20822, "timestamp_epoch": "1732596719.021655000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53380, "dst_port": 443, "tcp_stream": 91, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "5c0851e1f7c97a5fdf8ee34bd73a8ff4" } }, { "event_id": "evt-0589025b4462458747c27c17", "kind": "tls_client_hello", "frame_number": 20833, "timestamp_epoch": "1732596719.047376000", "src_ip": "10.11.26.183", "dst_ip": "23.221.22.209", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "a702db92a1dad8b0a7ddf9ef0fcf3d68" } }, { "event_id": "evt-e10cef8aae45aee01bf7f3f4", "kind": "tls_client_hello", "frame_number": 20842, "timestamp_epoch": "1732596719.092213000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53380, "dst_port": 443, "tcp_stream": 91, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "5c0851e1f7c97a5fdf8ee34bd73a8ff4" } }, { "event_id": "evt-57986ba469b624ac7d7e9311", "kind": "tls_client_hello", "frame_number": 21206, "timestamp_epoch": "1732596828.451764000", "src_ip": "10.11.26.183", "dst_ip": "20.96.153.111", "src_port": 53390, "dst_port": 443, "tcp_stream": 96, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fd.api.iris.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-65f6f1db48adb06fe1416650", "kind": "tls_client_hello", "frame_number": 21305, "timestamp_epoch": "1732596963.469275000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53400, "dst_port": 443, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-925518c52a9c1749a853a13a", "kind": "tls_client_hello", "frame_number": 21309, "timestamp_epoch": "1732596963.539605000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53400, "dst_port": 443, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-e99a3759011319de0384a29b", "kind": "tls_client_hello", "frame_number": 21381, "timestamp_epoch": "1732597162.443203000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.6", "src_port": 53411, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-c31a994e76d6681782c5a575", "kind": "tls_client_hello", "frame_number": 21427, "timestamp_epoch": "1732597237.746118000", "src_ip": "10.11.26.183", "dst_ip": "23.204.171.61", "src_port": 53413, "dst_port": 443, "tcp_stream": 102, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-a7b92bff44f48567d43a68fb", "kind": "tls_client_hello", "frame_number": 21437, "timestamp_epoch": "1732597237.792870000", "src_ip": "10.11.26.183", "dst_ip": "20.99.184.37", "src_port": 53412, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "displaycatalog.mp.microsoft.com", "tls.handshake.ja3": "fae0e5d973c96ae1888b99538efa0363" } }, { "event_id": "evt-d22e03d50d2b32d6a1fc09f9", "kind": "tls_client_hello", "frame_number": 21479, "timestamp_epoch": "1732597243.035063000", "src_ip": "10.11.26.183", "dst_ip": "52.165.164.15", "src_port": 53414, "dst_port": 443, "tcp_stream": 103, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-67d60dc0809ea966f2c13a10", "kind": "tls_client_hello", "frame_number": 21615, "timestamp_epoch": "1732597249.594804000", "src_ip": "10.11.26.183", "dst_ip": "20.42.73.28", "src_port": 53417, "dst_port": 443, "tcp_stream": 104, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-30ee942d814a26f0f20f32c5", "kind": "tls_client_hello", "frame_number": 21673, "timestamp_epoch": "1732597263.857546000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53421, "dst_port": 443, "tcp_stream": 107, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-96a65ac851c8f8ba1b814592", "kind": "tls_client_hello", "frame_number": 21677, "timestamp_epoch": "1732597263.938947000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53421, "dst_port": 443, "tcp_stream": 107, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-a31784f5cff3c5cd869be82d", "kind": "tls_client_hello", "frame_number": 21728, "timestamp_epoch": "1732597316.941078000", "src_ip": "10.11.26.183", "dst_ip": "23.201.68.167", "src_port": 53423, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "armmf.adobe.com", "tls.handshake.ja3": "2800f914a7a4ba98aa9df62d316a460c" } }, { "event_id": "evt-131f2d316fb17ea833a59d8f", "kind": "tls_client_hello", "frame_number": 21762, "timestamp_epoch": "1732597328.483720000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.23", "src_port": 53424, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-58775e24ed2d90361b033110", "kind": "tls_client_hello", "frame_number": 21804, "timestamp_epoch": "1732597442.804139000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.23", "src_port": 53425, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-d86e809d37e770080e0ea74d", "kind": "tls_client_hello", "frame_number": 21832, "timestamp_epoch": "1732597494.231822000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.26", "src_port": 53427, "dst_port": 443, "tcp_stream": 112, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-bb45c3d45de21b108bb33a0c", "kind": "tls_client_hello", "frame_number": 21835, "timestamp_epoch": "1732597494.315214000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.26", "src_port": 53427, "dst_port": 443, "tcp_stream": 112, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-d453be61e2eca0d64c72dfda", "kind": "tls_client_hello", "frame_number": 21859, "timestamp_epoch": "1732597496.939407000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53428, "dst_port": 443, "tcp_stream": 113, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-ab0821c3b3fb3b5d28d3cb20", "kind": "tls_client_hello", "frame_number": 21862, "timestamp_epoch": "1732597496.954561000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53429, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-d683f7586a86968ef44c8aa8", "kind": "tls_client_hello", "frame_number": 21970, "timestamp_epoch": "1732597497.854417000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53433, "dst_port": 443, "tcp_stream": 118, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-3f4e74717002769cc4831f81", "kind": "tls_client_hello", "frame_number": 21971, "timestamp_epoch": "1732597497.854462000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53431, "dst_port": 443, "tcp_stream": 116, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-84fbe3d87e3e81f28580896b", "kind": "tls_client_hello", "frame_number": 21972, "timestamp_epoch": "1732597497.854602000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53430, "dst_port": 443, "tcp_stream": 115, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-04e752e64f6c590bb365a20f", "kind": "tls_client_hello", "frame_number": 21973, "timestamp_epoch": "1732597497.854883000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53432, "dst_port": 443, "tcp_stream": 117, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-e45495090867b43dfe5ae072", "kind": "tls_client_hello", "frame_number": 22314, "timestamp_epoch": "1732597498.334994000", "src_ip": "10.11.26.183", "dst_ip": "52.109.0.136", "src_port": 53434, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mrodevicemgr.officeapps.live.com", "tls.handshake.ja3": "2800f914a7a4ba98aa9df62d316a460c" } }, { "event_id": "evt-9f99f180b53e8f8262904779", "kind": "tls_client_hello", "frame_number": 22392, "timestamp_epoch": "1732597499.674632000", "src_ip": "10.11.26.183", "dst_ip": "173.222.49.101", "src_port": 53437, "dst_port": 443, "tcp_stream": 120, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fa000000005.resources.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-35e6ddd94558d3667edb915f", "kind": "tls_client_hello", "frame_number": 22395, "timestamp_epoch": "1732597499.694523000", "src_ip": "10.11.26.183", "dst_ip": "173.222.49.101", "src_port": 53436, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fa000000002.resources.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-42a82cbc888c495ffc7c292c", "kind": "tls_client_hello", "frame_number": 23578, "timestamp_epoch": "1732597500.461778000", "src_ip": "10.11.26.183", "dst_ip": "173.222.49.101", "src_port": 53438, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fa000000116.resources.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-8450b1a06b80d89189f866ff", "kind": "tls_client_hello", "frame_number": 23594, "timestamp_epoch": "1732597500.614675000", "src_ip": "10.11.26.183", "dst_ip": "173.222.49.101", "src_port": 53439, "dst_port": 443, "tcp_stream": 123, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fa000000128.resources.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-6cadf3a21083640d41dca877", "kind": "tls_client_hello", "frame_number": 24468, "timestamp_epoch": "1732597500.938703000", "src_ip": "10.11.26.183", "dst_ip": "173.222.49.101", "src_port": 53440, "dst_port": 443, "tcp_stream": 124, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fa000000163.resources.office.net", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-1a506feadb3148b27a627b14", "kind": "tls_client_hello", "frame_number": 25900, "timestamp_epoch": "1732597616.759687000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53443, "dst_port": 443, "tcp_stream": 126, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "d7268fba5c8ebdc86121861931c04402" } }, { "event_id": "evt-857554de8df920d6c8990cc4", "kind": "tls_client_hello", "frame_number": 25904, "timestamp_epoch": "1732597616.838060000", "src_ip": "10.11.26.183", "dst_ip": "204.79.197.203", "src_port": 53443, "dst_port": 443, "tcp_stream": 126, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "d7268fba5c8ebdc86121861931c04402" } }, { "event_id": "evt-f32766a5ac949adb2a6eae2e", "kind": "tls_client_hello", "frame_number": 25940, "timestamp_epoch": "1732597669.045614000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.23", "src_port": 53444, "dst_port": 443, "tcp_stream": 127, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-008d1711e3943e7903794fa1", "kind": "tls_client_hello", "frame_number": 25981, "timestamp_epoch": "1732597789.105406000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.16", "src_port": 53445, "dst_port": 443, "tcp_stream": 128, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "2800f914a7a4ba98aa9df62d316a460c" } }, { "event_id": "evt-fffaf5e221b36065c35f1da7", "kind": "tls_client_hello", "frame_number": 25984, "timestamp_epoch": "1732597789.178852000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.16", "src_port": 53445, "dst_port": 443, "tcp_stream": 128, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "2800f914a7a4ba98aa9df62d316a460c" } }, { "event_id": "evt-dc2911ebc4b7e5edaeefb464", "kind": "tls_client_hello", "frame_number": 26144, "timestamp_epoch": "1732598406.354950000", "src_ip": "10.11.26.183", "dst_ip": "20.42.73.25", "src_port": 53459, "dst_port": 443, "tcp_stream": 129, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-b3681daeace5fa249ec791e2", "kind": "tls_client_hello", "frame_number": 26238, "timestamp_epoch": "1732598497.372599000", "src_ip": "10.11.26.183", "dst_ip": "52.113.194.132", "src_port": 53466, "dst_port": 443, "tcp_stream": 131, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-274d82ae9faab2bc76077572", "kind": "tls_client_hello", "frame_number": 26454, "timestamp_epoch": "1732599294.111943000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.26", "src_port": 53481, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-19a38732c046831a7cc64074", "kind": "tls_client_hello", "frame_number": 26457, "timestamp_epoch": "1732599294.200453000", "src_ip": "10.11.26.183", "dst_ip": "20.189.173.26", "src_port": 53481, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "6634ba84945fce7cc2d7864edc49b103" } }, { "event_id": "evt-6adb8774d438738c6df44426", "kind": "tls_client_hello", "frame_number": 26874, "timestamp_epoch": "1732599747.624130000", "src_ip": "10.11.26.183", "dst_ip": "20.7.1.246", "src_port": 53506, "dst_port": 443, "tcp_stream": 141, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } } ], "dhcp": [], "identity": [ { "event_id": "evt-44d22ddb1d36606848dd49f5", "kind": "identity", "frame_number": 43, "timestamp_epoch": "1732596579.031921000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-3e02f344ea2527973870295d", "kind": "identity", "frame_number": 45, "timestamp_epoch": "1732596579.034205000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-a5bf66166502f5eff049d225", "kind": "identity", "frame_number": 51, "timestamp_epoch": "1732596580.112726000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "DESKTOP-B8TQK49.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-bf96ba7839349889b77fcc9b", "kind": "identity", "frame_number": 52, "timestamp_epoch": "1732596580.112858000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-4fac582618b74d9fb62fec25", "kind": "identity", "frame_number": 53, "timestamp_epoch": "1732596580.113038000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 7, "fields": { "dns.qry.name": "DESKTOP-B8TQK49", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-4bc2325009574f0f1c8aa9d8", "kind": "identity", "frame_number": 63, "timestamp_epoch": "1732596581.247986000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "DESKTOP-B8TQK49.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-b02eca7a1b1b661b7553ce45", "kind": "identity", "frame_number": 64, "timestamp_epoch": "1732596581.248060000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c8aa8d5b2139f569802c25cf", "kind": "identity", "frame_number": 65, "timestamp_epoch": "1732596581.248179000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.qry.name": "DESKTOP-B8TQK49", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-81229ee8b2b016c220330d8f", "kind": "identity", "frame_number": 69, "timestamp_epoch": "1732596581.324171000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<20>,DESKTOP-B8TQK49<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c5ab2ce31705555cdbb679b5", "kind": "identity", "frame_number": 70, "timestamp_epoch": "1732596581.324270000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<00>,DESKTOP-B8TQK49<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-5138496dfd0477f86d8e17fe", "kind": "identity", "frame_number": 71, "timestamp_epoch": "1732596581.324341000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<00>,NEMOTODES<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-07406d6436a65556fcb1b22b", "kind": "identity", "frame_number": 144, "timestamp_epoch": "1732596582.086915000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<00>,NEMOTODES<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-4917d84c5bda36e79ef3b669", "kind": "identity", "frame_number": 145, "timestamp_epoch": "1732596582.087011000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<00>,DESKTOP-B8TQK49<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-dba3b02e6e0733a3611cf0d5", "kind": "identity", "frame_number": 146, "timestamp_epoch": "1732596582.087011000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<20>,DESKTOP-B8TQK49<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-441f7b19bf505592f51f02c6", "kind": "identity", "frame_number": 174, "timestamp_epoch": "1732596582.863956000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<20>,DESKTOP-B8TQK49<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-456f937ea0ef59a6648a9df1", "kind": "identity", "frame_number": 175, "timestamp_epoch": "1732596582.863956000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<00>,DESKTOP-B8TQK49<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-43c56f6e599a01ffbb1f5170", "kind": "identity", "frame_number": 176, "timestamp_epoch": "1732596582.864083000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<00>,NEMOTODES<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-1073ff971b60ea77779c91b5", "kind": "identity", "frame_number": 180, "timestamp_epoch": "1732596583.619885000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<00>,NEMOTODES<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-a27e83cac240edff97185adf", "kind": "identity", "frame_number": 181, "timestamp_epoch": "1732596583.619885000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<00>,DESKTOP-B8TQK49<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-076ba9a29c5e515dc8c6d6dd", "kind": "identity", "frame_number": 182, "timestamp_epoch": "1732596583.620016000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-B8TQK49<20>,DESKTOP-B8TQK49<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-8789edbca1d77aa6567bd62c", "kind": "identity", "frame_number": 191, "timestamp_epoch": "1732596584.407629000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<1e>,NEMOTODES<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-3aa6a96a4bb6ef447dd1d9af", "kind": "identity", "frame_number": 193, "timestamp_epoch": "1732596585.167073000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<1e>,NEMOTODES<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-3626b2f5dd0278e40a761926", "kind": "identity", "frame_number": 197, "timestamp_epoch": "1732596585.940378000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<1e>,NEMOTODES<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-ede98b31f95b437c98e11845", "kind": "identity", "frame_number": 199, "timestamp_epoch": "1732596586.702380000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "NEMOTODES<1e>,NEMOTODES<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-10993fd0689c483bedf1425b", "kind": "identity", "frame_number": 200, "timestamp_epoch": "1732596587.487349000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-8edc14a63638ecace2e0433b", "kind": "identity", "frame_number": 201, "timestamp_epoch": "1732596587.491453000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-ae3a7f37c5d837575b29143f", "kind": "identity", "frame_number": 213, "timestamp_epoch": "1732596595.423123000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "10" } }, { "event_id": "evt-642b1839bfdd92f9e438395f", "kind": "identity", "frame_number": 214, "timestamp_epoch": "1732596595.424103000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 6, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "30" } }, { "event_id": "evt-1c3289b8eed809153e89d71c", "kind": "identity", "frame_number": 221, "timestamp_epoch": "1732596595.429067000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "10" } }, { "event_id": "evt-88e0ce93b9de791a59213efc", "kind": "identity", "frame_number": 223, "timestamp_epoch": "1732596595.431118000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "11" } }, { "event_id": "evt-97a2532553bbe99b1578e5fe", "kind": "identity", "frame_number": 232, "timestamp_epoch": "1732596595.432052000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-192dd8ecb367a5621d8c65e1", "kind": "identity", "frame_number": 235, "timestamp_epoch": "1732596595.434581000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-8176c6b3d8d8b1b3f44015d9", "kind": "identity", "frame_number": 256, "timestamp_epoch": "1732596595.580842000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-73f8c0df1383526de9b13ba8", "kind": "identity", "frame_number": 259, "timestamp_epoch": "1732596595.581097000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5f3d99f28a6285b07c2115d7", "kind": "identity", "frame_number": 261, "timestamp_epoch": "1732596595.581499000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-91e44e9b984fee4c4315d5b9", "kind": "identity", "frame_number": 268, "timestamp_epoch": "1732596595.583174000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-8c38f0039f13ef315b5d4b65", "kind": "identity", "frame_number": 271, "timestamp_epoch": "1732596595.583338000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-913508c905b1a9a6af473d22", "kind": "identity", "frame_number": 275, "timestamp_epoch": "1732596595.584724000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-a2f5f2c10ac8fa90730d86aa", "kind": "identity", "frame_number": 279, "timestamp_epoch": "1732596595.584902000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 12, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-b57f73a8c3e2847efb451b65", "kind": "identity", "frame_number": 287, "timestamp_epoch": "1732596595.585320000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-46d18e2c4cb5b21a17594dad", "kind": "identity", "frame_number": 293, "timestamp_epoch": "1732596595.585830000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-6d8c2b9060766ba6fde4c3b6", "kind": "identity", "frame_number": 294, "timestamp_epoch": "1732596595.585903000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-afcc9dcf1d187ad2cb67691c", "kind": "identity", "frame_number": 296, "timestamp_epoch": "1732596595.586122000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "15" } }, { "event_id": "evt-a08d347e67ef22c36c39f850", "kind": "identity", "frame_number": 298, "timestamp_epoch": "1732596595.586603000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-c25f97f36d37e06353d61a62", "kind": "identity", "frame_number": 308, "timestamp_epoch": "1732596595.587320000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-3ab7ff8315d4ae4b2455b1e4", "kind": "identity", "frame_number": 314, "timestamp_epoch": "1732596595.588332000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-e7112a1bba208e0d5f3fe2df", "kind": "identity", "frame_number": 317, "timestamp_epoch": "1732596595.588638000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-44be77725413561348b905d7", "kind": "identity", "frame_number": 318, "timestamp_epoch": "1732596595.588755000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-6b55866480db03fa8f277d4d", "kind": "identity", "frame_number": 319, "timestamp_epoch": "1732596595.588943000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-459b6871736752c055dfc1a1", "kind": "identity", "frame_number": 320, "timestamp_epoch": "1732596595.589034000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-fdc18853abad88f1d22e4ffa", "kind": "identity", "frame_number": 321, "timestamp_epoch": "1732596595.589086000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-6f9d48104e1a98d58f8adfea", "kind": "identity", "frame_number": 322, "timestamp_epoch": "1732596595.589272000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-1f368cfd4e706db2558f23e0", "kind": "identity", "frame_number": 324, "timestamp_epoch": "1732596595.589423000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-70f10ab668e0ec0e0548b118", "kind": "identity", "frame_number": 325, "timestamp_epoch": "1732596595.589509000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d091544dddc8817f5371c8f0", "kind": "identity", "frame_number": 326, "timestamp_epoch": "1732596595.589685000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c09a0d2bbf8a6ca61c50a325", "kind": "identity", "frame_number": 327, "timestamp_epoch": "1732596595.589777000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-4624532e996502157b956468", "kind": "identity", "frame_number": 328, "timestamp_epoch": "1732596595.589930000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-aa0d1a82b0b20e802f7f2110", "kind": "identity", "frame_number": 329, "timestamp_epoch": "1732596595.590040000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-895e10407d5b2067dfb44e24", "kind": "identity", "frame_number": 330, "timestamp_epoch": "1732596595.590229000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-7804cfe40a272c6bc4b5af0a", "kind": "identity", "frame_number": 333, "timestamp_epoch": "1732596595.590598000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-c3bd8404d7fa13799438095e", "kind": "identity", "frame_number": 334, "timestamp_epoch": "1732596595.590763000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d42d1fb76198ac4210835ebc", "kind": "identity", "frame_number": 337, "timestamp_epoch": "1732596595.591034000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f32f6d9422852ec9b78f5ff6", "kind": "identity", "frame_number": 340, "timestamp_epoch": "1732596595.591192000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-59fa8b5fb9647731ae89f1c5", "kind": "identity", "frame_number": 342, "timestamp_epoch": "1732596595.591453000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-0c3cd83ee7218ed24440b3a7", "kind": "identity", "frame_number": 344, "timestamp_epoch": "1732596595.591682000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3204593d05c51048bd733ee7", "kind": "identity", "frame_number": 345, "timestamp_epoch": "1732596595.591967000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-8d2c72c8f62830661703ed1f", "kind": "identity", "frame_number": 346, "timestamp_epoch": "1732596595.592111000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-f6e8b03b27c47d784dfeeb65", "kind": "identity", "frame_number": 348, "timestamp_epoch": "1732596595.592505000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-81d4b65c84b68c07c1e72618", "kind": "identity", "frame_number": 349, "timestamp_epoch": "1732596595.592658000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-7f605cd33af63db071b44d9f", "kind": "identity", "frame_number": 350, "timestamp_epoch": "1732596595.592934000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-4f6872ae35f288ef4b0c3f88", "kind": "identity", "frame_number": 351, "timestamp_epoch": "1732596595.593077000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6b372fc8ab679de3148992c7", "kind": "identity", "frame_number": 352, "timestamp_epoch": "1732596595.593509000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-614ea74364f2fc08dc2584b8", "kind": "identity", "frame_number": 353, "timestamp_epoch": "1732596595.593657000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-556b22ca1367507201d4a40e", "kind": "identity", "frame_number": 355, "timestamp_epoch": "1732596595.594089000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "samr.samr_UserInfo21.account_name": "oboomwald", "samr.samr_UserInfo21.full_name": "Oliver Q. Boomwald" } }, { "event_id": "evt-e9e840c9f5cb9f8e7debeb84", "kind": "identity", "frame_number": 358, "timestamp_epoch": "1732596595.594248000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a851b97a8387641bc2145c6d", "kind": "identity", "frame_number": 360, "timestamp_epoch": "1732596595.594659000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-0198b7a536dfc268927bc6f2", "kind": "identity", "frame_number": 361, "timestamp_epoch": "1732596595.594830000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-7e1d17e3c23c4ffd310154bc", "kind": "identity", "frame_number": 364, "timestamp_epoch": "1732596595.595194000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-75fedbf9751f9964cb0ebece", "kind": "identity", "frame_number": 366, "timestamp_epoch": "1732596595.595354000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-766c1b27aaea8653502a3327", "kind": "identity", "frame_number": 367, "timestamp_epoch": "1732596595.595679000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-743dfd300297f3c11c2b23fd", "kind": "identity", "frame_number": 368, "timestamp_epoch": "1732596595.595836000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-92eba8f454ce39abaad2ce79", "kind": "identity", "frame_number": 369, "timestamp_epoch": "1732596595.596027000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b467c737a37e46e06c28509b", "kind": "identity", "frame_number": 371, "timestamp_epoch": "1732596595.596273000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-cf1cc2766f72ad672b7c740a", "kind": "identity", "frame_number": 372, "timestamp_epoch": "1732596595.596294000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-0ec19455d0eb3a1a16af10db", "kind": "identity", "frame_number": 374, "timestamp_epoch": "1732596595.596520000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-8964ee62f68521bc259c3baa", "kind": "identity", "frame_number": 375, "timestamp_epoch": "1732596595.596654000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3aa70fdd7dee5a20f17c0326", "kind": "identity", "frame_number": 376, "timestamp_epoch": "1732596595.596929000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-4791fe529c8b95c1738fcf5b", "kind": "identity", "frame_number": 377, "timestamp_epoch": "1732596595.597066000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c034b45afbb082faa63e7247", "kind": "identity", "frame_number": 378, "timestamp_epoch": "1732596595.597278000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-5cbe21fc92191b202c9b10f6", "kind": "identity", "frame_number": 379, "timestamp_epoch": "1732596595.597345000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-1abcb529d4d158400da86d27", "kind": "identity", "frame_number": 380, "timestamp_epoch": "1732596595.597411000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1ac4c49d779739c6b3dc4bd8", "kind": "identity", "frame_number": 381, "timestamp_epoch": "1732596595.597507000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-33f8c91214db3a3a42f421db", "kind": "identity", "frame_number": 388, "timestamp_epoch": "1732596595.603729000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-127a263767ec1fc017734621", "kind": "identity", "frame_number": 390, "timestamp_epoch": "1732596595.604722000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-5acae50b9cbe1e1432970fb9", "kind": "identity", "frame_number": 412, "timestamp_epoch": "1732596595.829209000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a080620cbc464d4706458433", "kind": "identity", "frame_number": 413, "timestamp_epoch": "1732596595.829940000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-80328cb0436d2cb089d11ce4", "kind": "identity", "frame_number": 418, "timestamp_epoch": "1732596595.830952000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-948cecd18e7b3c7086718e36", "kind": "identity", "frame_number": 421, "timestamp_epoch": "1732596595.833972000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-cc4c809aaa5b2c38f59bb631", "kind": "identity", "frame_number": 428, "timestamp_epoch": "1732596595.834655000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-51d69e7410fc660f5bf3f775", "kind": "identity", "frame_number": 430, "timestamp_epoch": "1732596595.836631000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-7b652aace9914c75b12957df", "kind": "identity", "frame_number": 431, "timestamp_epoch": "1732596595.836937000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-36dfaefa66d59ffa44ba5249", "kind": "identity", "frame_number": 432, "timestamp_epoch": "1732596595.837244000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e374eaa5162cfbe68bb89104", "kind": "identity", "frame_number": 433, "timestamp_epoch": "1732596595.837364000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a71c154075a6e3c5127f0b03", "kind": "identity", "frame_number": 434, "timestamp_epoch": "1732596595.837557000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-611a0cac085d25da6812ce2d", "kind": "identity", "frame_number": 476, "timestamp_epoch": "1732596597.426892000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-9ce39fdf8187bd183156464f", "kind": "identity", "frame_number": 482, "timestamp_epoch": "1732596597.428379000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-1585914b6f3602a82ea950a3", "kind": "identity", "frame_number": 483, "timestamp_epoch": "1732596597.428695000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "15" } }, { "event_id": "evt-78d7934f22621a6807400627", "kind": "identity", "frame_number": 515, "timestamp_epoch": "1732596597.440552000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-6613aab0aa5a546bfc1cd6e1", "kind": "identity", "frame_number": 517, "timestamp_epoch": "1732596597.442740000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-4baebb194f90fccab7d813d4", "kind": "identity", "frame_number": 535, "timestamp_epoch": "1732596597.465797000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-a780e1c2477e3658d71a8c24", "kind": "identity", "frame_number": 537, "timestamp_epoch": "1732596597.466785000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-c15a950b3e3a81a409b70924", "kind": "identity", "frame_number": 662, "timestamp_epoch": "1732596597.796774000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c8706d95e1b879680e57f138", "kind": "identity", "frame_number": 663, "timestamp_epoch": "1732596597.796987000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e8aa73a22065262d1fac4b98", "kind": "identity", "frame_number": 665, "timestamp_epoch": "1732596597.797514000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-cff335313455e9ea1c21840d", "kind": "identity", "frame_number": 666, "timestamp_epoch": "1732596597.797534000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-548190b3a59fbe04835fc0fe", "kind": "identity", "frame_number": 668, "timestamp_epoch": "1732596597.797730000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-0c33e78ab4d692d8e71149f7", "kind": "identity", "frame_number": 669, "timestamp_epoch": "1732596597.797963000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-0e669906fcbae06ee1351129", "kind": "identity", "frame_number": 670, "timestamp_epoch": "1732596597.798934000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-fbd76d1c9a8bcd740b3efb64", "kind": "identity", "frame_number": 671, "timestamp_epoch": "1732596597.799261000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f3988006e769532fdd9edca0", "kind": "identity", "frame_number": 743, "timestamp_epoch": "1732596598.172420000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-141b6f43b0d484f49ae3ef93", "kind": "identity", "frame_number": 744, "timestamp_epoch": "1732596598.172831000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-9222a09bde86fc89b9955a45", "kind": "identity", "frame_number": 745, "timestamp_epoch": "1732596598.173069000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-29915401c6982ed565189906", "kind": "identity", "frame_number": 746, "timestamp_epoch": "1732596598.173242000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-912fecca16f7b0ce2b3d141d", "kind": "identity", "frame_number": 777, "timestamp_epoch": "1732596598.725541000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-dc22aaaa5345347729346ad6", "kind": "identity", "frame_number": 778, "timestamp_epoch": "1732596598.725951000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-1a17553222b283edbb4cbb84", "kind": "identity", "frame_number": 779, "timestamp_epoch": "1732596598.726231000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-baa70fbe6152e77076dbd3e0", "kind": "identity", "frame_number": 780, "timestamp_epoch": "1732596598.726444000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a809c820a0d86830dff38659", "kind": "identity", "frame_number": 781, "timestamp_epoch": "1732596598.727303000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-014c933190a15dff35d9d743", "kind": "identity", "frame_number": 782, "timestamp_epoch": "1732596598.727676000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e22e02beed5be79514d4070c", "kind": "identity", "frame_number": 783, "timestamp_epoch": "1732596598.727940000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-297ebbd9a26fce1fe091836f", "kind": "identity", "frame_number": 784, "timestamp_epoch": "1732596598.728153000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-da6e81f9c187fdf268cf51ea", "kind": "identity", "frame_number": 785, "timestamp_epoch": "1732596598.728988000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5a07a9f24d3cc988f872c178", "kind": "identity", "frame_number": 786, "timestamp_epoch": "1732596598.729409000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-45dec5bb8b91c464e02d6817", "kind": "identity", "frame_number": 787, "timestamp_epoch": "1732596598.729632000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-cc03be07526e4e3384f7a3cf", "kind": "identity", "frame_number": 788, "timestamp_epoch": "1732596598.729829000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-850ac8fffad75775aa12ef17", "kind": "identity", "frame_number": 789, "timestamp_epoch": "1732596598.730438000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-341b48c3bcb17a4b50ce0178", "kind": "identity", "frame_number": 790, "timestamp_epoch": "1732596598.730862000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-c46593f0ea97ecd6eb301f58", "kind": "identity", "frame_number": 791, "timestamp_epoch": "1732596598.731045000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-b39f105a22b08ced00d83983", "kind": "identity", "frame_number": 792, "timestamp_epoch": "1732596598.731238000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2fee11cab40c54e070b6873a", "kind": "identity", "frame_number": 1047, "timestamp_epoch": "1732596606.288161000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5d2719e6067fd1f3cfa36536", "kind": "identity", "frame_number": 1048, "timestamp_epoch": "1732596606.288361000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-46c93cf31d796b930699c4d2", "kind": "identity", "frame_number": 1049, "timestamp_epoch": "1732596606.288656000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-f4405349bd9da7790a3774f9", "kind": "identity", "frame_number": 1050, "timestamp_epoch": "1732596606.288801000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-3af5d412301901d805a439f3", "kind": "identity", "frame_number": 1092, "timestamp_epoch": "1732596610.399200000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-19580e977d11cb2106c49d66", "kind": "identity", "frame_number": 1093, "timestamp_epoch": "1732596610.416304000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "NEMOTODE-DC<20>" } }, { "event_id": "evt-a01116e07fe65dc8b208ebc8", "kind": "identity", "frame_number": 1094, "timestamp_epoch": "1732596610.416490000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "NEMOTODE-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7c977fdb2f967259b24262dd", "kind": "identity", "frame_number": 1101, "timestamp_epoch": "1732596610.418210000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1829c03015d7168f0bcbc658", "kind": "identity", "frame_number": 1102, "timestamp_epoch": "1732596610.418921000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-cb095db2c300352df423f6fa", "kind": "identity", "frame_number": 1103, "timestamp_epoch": "1732596610.419229000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-B8TQK49", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-e6221c9b5105ce1941c2566b", "kind": "identity", "frame_number": 1109, "timestamp_epoch": "1732596610.422359000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-eec4950af37c652ad888fd60", "kind": "identity", "frame_number": 1112, "timestamp_epoch": "1732596610.434887000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-19e05e24c9c5a40a5b91cdb7", "kind": "identity", "frame_number": 1138, "timestamp_epoch": "1732596611.011629000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-d3a24f133de7fd1879f2b244", "kind": "identity", "frame_number": 1140, "timestamp_epoch": "1732596611.014080000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-bb1442552ed310070f37c018", "kind": "identity", "frame_number": 1151, "timestamp_epoch": "1732596611.018656000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-7645317460ac459ff8b01873", "kind": "identity", "frame_number": 1153, "timestamp_epoch": "1732596611.020767000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-2b51d9790a0c08fe4e5b4860", "kind": "identity", "frame_number": 12112, "timestamp_epoch": "1732596623.287295000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3602b2a5e850b2d38f38acbb", "kind": "identity", "frame_number": 12370, "timestamp_epoch": "1732596624.288928000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-785cfd2b83c287819933c2f5", "kind": "identity", "frame_number": 12371, "timestamp_epoch": "1732596626.289799000", "src_ip": "10.11.26.183", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-374888961e3824d809231bd2", "kind": "identity", "frame_number": 12592, "timestamp_epoch": "1732596629.526035000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-94185a498d87483128679480", "kind": "identity", "frame_number": 12593, "timestamp_epoch": "1732596629.526436000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a8d1fb2ad6c37d89af5f985d", "kind": "identity", "frame_number": 12594, "timestamp_epoch": "1732596629.526611000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a0d8c450c1d3d8829c861c3d", "kind": "identity", "frame_number": 12595, "timestamp_epoch": "1732596629.526815000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-059defc10e800bfd65005b3f", "kind": "identity", "frame_number": 12596, "timestamp_epoch": "1732596629.527292000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-afc9345a6e268f02a16197c5", "kind": "identity", "frame_number": 12597, "timestamp_epoch": "1732596629.527613000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b4afb73dc1f4c813bac090e7", "kind": "identity", "frame_number": 12598, "timestamp_epoch": "1732596629.527752000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5f5355b196404ac726fa066a", "kind": "identity", "frame_number": 12599, "timestamp_epoch": "1732596629.527950000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e5b0038d52bbdd8362b407f8", "kind": "identity", "frame_number": 12698, "timestamp_epoch": "1732596635.075528000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-b222def2f484120f4ca266ec", "kind": "identity", "frame_number": 12699, "timestamp_epoch": "1732596635.076042000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-5c737bed3a5a96dbebe2a7d3", "kind": "identity", "frame_number": 12705, "timestamp_epoch": "1732596637.893878000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-dfff2b680545358192e7445f", "kind": "identity", "frame_number": 12706, "timestamp_epoch": "1732596637.894130000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2601c2f7d25e9073af989e37", "kind": "identity", "frame_number": 12707, "timestamp_epoch": "1732596637.894707000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2633bf881426e7a4712e42a2", "kind": "identity", "frame_number": 12710, "timestamp_epoch": "1732596637.895940000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-7181fe22580fbfff1f396013", "kind": "identity", "frame_number": 12712, "timestamp_epoch": "1732596637.898027000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-428c0359b7749541654ec90d", "kind": "identity", "frame_number": 12713, "timestamp_epoch": "1732596637.898417000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5562c07966bc92b91962acbf", "kind": "identity", "frame_number": 12714, "timestamp_epoch": "1732596637.898642000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-bfff44f64a7d53d94d6ab468", "kind": "identity", "frame_number": 12715, "timestamp_epoch": "1732596637.898905000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6fe6a0508a3cc186737bc87c", "kind": "identity", "frame_number": 12716, "timestamp_epoch": "1732596637.899046000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-705945212a07f1deda9cced7", "kind": "identity", "frame_number": 12717, "timestamp_epoch": "1732596637.899090000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-fcb177bc8cf23ee04bfb3552", "kind": "identity", "frame_number": 12718, "timestamp_epoch": "1732596637.899336000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-ae587c5b3d2e1b10a01d6f09", "kind": "identity", "frame_number": 12745, "timestamp_epoch": "1732596640.453185000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 12, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "NEMOTODE-DC<20>" } }, { "event_id": "evt-b370db2e60694f594d72da2e", "kind": "identity", "frame_number": 12746, "timestamp_epoch": "1732596640.453405000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 31, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "NEMOTODE-DC<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-4fbc87ee919c95917db3e600", "kind": "identity", "frame_number": 12753, "timestamp_epoch": "1732596640.455514000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d95e7a7b8a77f00c6a0893e1", "kind": "identity", "frame_number": 12754, "timestamp_epoch": "1732596640.456095000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-bc929ce94c38e54f0fae0fee", "kind": "identity", "frame_number": 12755, "timestamp_epoch": "1732596640.456514000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 74, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-B8TQK49", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-42f28a13a2271eab826bdb84", "kind": "identity", "frame_number": 12761, "timestamp_epoch": "1732596640.459523000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6bf5c5ef0357c2c856f01f54", "kind": "identity", "frame_number": 12764, "timestamp_epoch": "1732596640.476277000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-cbbf0be3b46220fe2b194774", "kind": "identity", "frame_number": 20365, "timestamp_epoch": "1732596648.628430000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-7fe56aa75df7e268304bf969", "kind": "identity", "frame_number": 20366, "timestamp_epoch": "1732596648.628661000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-7d9bca21bb0ab3e0fd0bdb21", "kind": "identity", "frame_number": 20367, "timestamp_epoch": "1732596648.628908000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-99d12062925d0abb80067c26", "kind": "identity", "frame_number": 20368, "timestamp_epoch": "1732596648.629057000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 72, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-fe644a54d7343b24242cfce2", "kind": "identity", "frame_number": 20428, "timestamp_epoch": "1732596656.530425000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-d528011f0a26c2c3cf7949aa", "kind": "identity", "frame_number": 20430, "timestamp_epoch": "1732596656.531936000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-f64ebd5b89676d577f50ffe3", "kind": "identity", "frame_number": 20431, "timestamp_epoch": "1732596656.532307000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "15" } }, { "event_id": "evt-315e5dfdff27b5a4f0fa8d8e", "kind": "identity", "frame_number": 20455, "timestamp_epoch": "1732596656.543311000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-59c7b7f0df5bf1a28d1f2343", "kind": "identity", "frame_number": 20457, "timestamp_epoch": "1732596656.545412000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-40314b2c62cc1aa0365d9acf", "kind": "identity", "frame_number": 20468, "timestamp_epoch": "1732596656.550432000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-79c2f5ad760dce377940ba2d", "kind": "identity", "frame_number": 20470, "timestamp_epoch": "1732596656.552608000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-7cb9fe9d6100a0063ac08f65", "kind": "identity", "frame_number": 20526, "timestamp_epoch": "1732596670.482635000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 85, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1ed07a26de9557fc72b4c1ff", "kind": "identity", "frame_number": 20527, "timestamp_epoch": "1732596670.483339000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 85, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-28b84874a228518e56718450", "kind": "identity", "frame_number": 20528, "timestamp_epoch": "1732596670.484518000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 85, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-B8TQK49", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-0f92bb389eec43e5825e555a", "kind": "identity", "frame_number": 20534, "timestamp_epoch": "1732596670.489238000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-03a36415e8204cd5a9b89322", "kind": "identity", "frame_number": 20537, "timestamp_epoch": "1732596670.509451000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2c062311c5670f45ecaae7bd", "kind": "identity", "frame_number": 20559, "timestamp_epoch": "1732596700.541440000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-f479906d7dc1e04483707715", "kind": "identity", "frame_number": 20560, "timestamp_epoch": "1732596700.542010000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d08ad9b7378395e5b84418ff", "kind": "identity", "frame_number": 20561, "timestamp_epoch": "1732596700.542499000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 86, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-B8TQK49", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-016183597b71ee0f331fd67b", "kind": "identity", "frame_number": 20567, "timestamp_epoch": "1732596700.545876000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-378e6c27e75e8fb30a67d2ec", "kind": "identity", "frame_number": 20570, "timestamp_epoch": "1732596700.563134000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-31b65f586329e9d765471164", "kind": "identity", "frame_number": 21107, "timestamp_epoch": "1732596730.595124000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-8963704a5180c04c06706b83", "kind": "identity", "frame_number": 21108, "timestamp_epoch": "1732596730.596011000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-4bcd8762ce85785c85c8ffe4", "kind": "identity", "frame_number": 21109, "timestamp_epoch": "1732596730.597171000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-B8TQK49", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-d6d5d2d58dc8649535018450", "kind": "identity", "frame_number": 21115, "timestamp_epoch": "1732596730.601894000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-456773eaaf33ce15a9f7878c", "kind": "identity", "frame_number": 21118, "timestamp_epoch": "1732596730.619152000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.response_computer_name": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-9d9b0fcfc5bd709f81f9088e", "kind": "identity", "frame_number": 21170, "timestamp_epoch": "1732596827.741955000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-4ad9913a3edc0302e5c5a5db", "kind": "identity", "frame_number": 21173, "timestamp_epoch": "1732596827.744857000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 94, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.CNameString": "oboomwald", "kerberos.msg_type": "13" } }, { "event_id": "evt-d5e5b8acd14d45033c76f7d2", "kind": "identity", "frame_number": 21179, "timestamp_epoch": "1732596827.745508000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-ccc72fdc901d9b9d9f3f7ad0", "kind": "identity", "frame_number": 21181, "timestamp_epoch": "1732596827.747859000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-af00ef0ed4ea1ca3a8d823ab", "kind": "identity", "frame_number": 21192, "timestamp_epoch": "1732596827.760127000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-14bfadf7c4227236dea58c88", "kind": "identity", "frame_number": 21194, "timestamp_epoch": "1732596827.761122000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-8cb6871afb9f35f1fcd53b68", "kind": "identity", "frame_number": 21262, "timestamp_epoch": "1732596897.036140000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-ce9f2bde34c76cf50f1a2980", "kind": "identity", "frame_number": 21264, "timestamp_epoch": "1732596897.038424000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-ca76adac3415dc84b132a11d", "kind": "identity", "frame_number": 21275, "timestamp_epoch": "1732596897.048150000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-184eaba81e0490579cebfe32", "kind": "identity", "frame_number": 21277, "timestamp_epoch": "1732596897.050275000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-3e1f5d813300bda7423c3aa1", "kind": "identity", "frame_number": 21286, "timestamp_epoch": "1732596905.388633000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-139c3ae93db788d7ff91a5c0", "kind": "identity", "frame_number": 21287, "timestamp_epoch": "1732596905.388984000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-92f21f8eca1888d1a1e85dad", "kind": "identity", "frame_number": 21707, "timestamp_epoch": "1732597305.742568000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-85a3aca17a46559a7e485397", "kind": "identity", "frame_number": 25837, "timestamp_epoch": "1732597505.721145000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2a0587698e33dbf25ef760bc", "kind": "identity", "frame_number": 25838, "timestamp_epoch": "1732597505.721503000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-1273634896371943aa3c4c0a", "kind": "identity", "frame_number": 25857, "timestamp_epoch": "1732597537.881688000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-fccf6c862a898a7bff009c0d", "kind": "identity", "frame_number": 25858, "timestamp_epoch": "1732597537.882159000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-ca3e257321e8a3c9e0bacab9", "kind": "identity", "frame_number": 25859, "timestamp_epoch": "1732597537.882731000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-33e3410c06bfdc5217a8eae5", "kind": "identity", "frame_number": 25862, "timestamp_epoch": "1732597537.886238000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-3764e9441845b05c1cd4026f", "kind": "identity", "frame_number": 25864, "timestamp_epoch": "1732597537.888379000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-8ca4efadb1390bff70fab1dd", "kind": "identity", "frame_number": 25865, "timestamp_epoch": "1732597537.889385000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-498b3e8699126710644e9f00", "kind": "identity", "frame_number": 25866, "timestamp_epoch": "1732597537.889679000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2d8ad48973b2d521a83defe0", "kind": "identity", "frame_number": 25867, "timestamp_epoch": "1732597537.890175000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3a3f6fa337b1ec46701017d6", "kind": "identity", "frame_number": 25868, "timestamp_epoch": "1732597537.890388000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-87b643d2dfd346577e6ecc28", "kind": "identity", "frame_number": 25869, "timestamp_epoch": "1732597537.890509000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e788414e4099331bf5b0fa6f", "kind": "identity", "frame_number": 25870, "timestamp_epoch": "1732597537.890714000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-21ebc1c02ab561fff9a744fe", "kind": "identity", "frame_number": 25875, "timestamp_epoch": "1732597548.609285000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-9aaa69035693bce21e475ed5", "kind": "identity", "frame_number": 25876, "timestamp_epoch": "1732597548.609516000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a77af49ef4e0485f58797424", "kind": "identity", "frame_number": 25877, "timestamp_epoch": "1732597548.609932000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6cec17fb780a5eb0d0d6f009", "kind": "identity", "frame_number": 25878, "timestamp_epoch": "1732597548.610084000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 125, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-70a4f328e4cc4aff1b7b9d00", "kind": "identity", "frame_number": 26065, "timestamp_epoch": "1732598026.462711000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-fecd5020afd80f86ac675362", "kind": "identity", "frame_number": 26082, "timestamp_epoch": "1732598106.064652000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1d2da4f387c44e365f7736cc", "kind": "identity", "frame_number": 26083, "timestamp_epoch": "1732598106.064986000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f6a9e01afd51fe26e5c88eec", "kind": "identity", "frame_number": 26191, "timestamp_epoch": "1732598437.875995000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-cedc7fd1fd327802d11bc18b", "kind": "identity", "frame_number": 26192, "timestamp_epoch": "1732598437.876444000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e1064cce4de1ee40288b630a", "kind": "identity", "frame_number": 26193, "timestamp_epoch": "1732598437.877005000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-270f818bb41cc84a39fcc62c", "kind": "identity", "frame_number": 26196, "timestamp_epoch": "1732598437.879847000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-baeeb81f3d57bbbef6b6a012", "kind": "identity", "frame_number": 26198, "timestamp_epoch": "1732598437.882166000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-d3b8cb3f4a8922a537ed9aef", "kind": "identity", "frame_number": 26199, "timestamp_epoch": "1732598437.883239000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d3322c02c1df3d4a812a6d9c", "kind": "identity", "frame_number": 26200, "timestamp_epoch": "1732598437.883517000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-0a4f3ea69fd774b915097bc7", "kind": "identity", "frame_number": 26201, "timestamp_epoch": "1732598437.884053000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e956e25e9a4072d6ae7489cc", "kind": "identity", "frame_number": 26202, "timestamp_epoch": "1732598437.884337000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a0c641897e0a28cb86a75f5a", "kind": "identity", "frame_number": 26203, "timestamp_epoch": "1732598437.884377000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a77292bc009104389ad04a90", "kind": "identity", "frame_number": 26204, "timestamp_epoch": "1732598437.884688000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a8d01bedb97fbed8d357b261", "kind": "identity", "frame_number": 26210, "timestamp_epoch": "1732598448.612489000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1e3983caa9e83a9811025967", "kind": "identity", "frame_number": 26211, "timestamp_epoch": "1732598448.612705000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-12985c3ab29d0174b1275d9e", "kind": "identity", "frame_number": 26212, "timestamp_epoch": "1732598448.613146000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-ff50c384b6b57c3f8e2a07b2", "kind": "identity", "frame_number": 26213, "timestamp_epoch": "1732598448.613530000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-c80da6fb089ea57ec6477dcf", "kind": "identity", "frame_number": 26333, "timestamp_epoch": "1732598706.388732000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-dadc5f855b7b2a5de1f907e4", "kind": "identity", "frame_number": 26334, "timestamp_epoch": "1732598706.389012000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d06efcfd5c7b02615d3be7fe", "kind": "identity", "frame_number": 26338, "timestamp_epoch": "1732598748.800364000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-356b55fd08fe9f1344ccea2b", "kind": "identity", "frame_number": 26479, "timestamp_epoch": "1732599306.728336000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-0b57f7fbd3480fcaf3d564a7", "kind": "identity", "frame_number": 26480, "timestamp_epoch": "1732599306.728684000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-94a24fee87b9dcc36f7ea89b", "kind": "identity", "frame_number": 26488, "timestamp_epoch": "1732599337.883541000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-4e9e6e88545921c90f103087", "kind": "identity", "frame_number": 26489, "timestamp_epoch": "1732599337.883898000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c2995ef5e86b79ea262464f3", "kind": "identity", "frame_number": 26490, "timestamp_epoch": "1732599337.884525000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f468d904f787bfd80909e6c7", "kind": "identity", "frame_number": 26493, "timestamp_epoch": "1732599337.885964000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-ab377995ae7809c26cb466ea", "kind": "identity", "frame_number": 26495, "timestamp_epoch": "1732599337.888278000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-e2e04b555db6835baa3f68e4", "kind": "identity", "frame_number": 26496, "timestamp_epoch": "1732599337.888698000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-35ccd54cc380a769e8e38bf6", "kind": "identity", "frame_number": 26497, "timestamp_epoch": "1732599337.888954000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-831dec2396da336479485557", "kind": "identity", "frame_number": 26498, "timestamp_epoch": "1732599337.889274000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d291f1f7be390720419c3265", "kind": "identity", "frame_number": 26499, "timestamp_epoch": "1732599337.889367000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-9d71a379079a1baf4bc6ff34", "kind": "identity", "frame_number": 26500, "timestamp_epoch": "1732599337.889476000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a88ad879ecca8ad06bcfd123", "kind": "identity", "frame_number": 26501, "timestamp_epoch": "1732599337.889688000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-fc6ce201e9f2f6bc436db4e0", "kind": "identity", "frame_number": 26503, "timestamp_epoch": "1732599348.617650000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-ecd3527a6eb5c78948926417", "kind": "identity", "frame_number": 26504, "timestamp_epoch": "1732599348.617901000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b40b10dd251715b828064959", "kind": "identity", "frame_number": 26505, "timestamp_epoch": "1732599348.618350000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-64d893a8693d94ae3d77e6c3", "kind": "identity", "frame_number": 26506, "timestamp_epoch": "1732599348.618621000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 133, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-18e9a1261770f6df1043ca9a", "kind": "identity", "frame_number": 26550, "timestamp_epoch": "1732599467.227300000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-B8TQK49", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6d10fb5b25022d1a2b6da764", "kind": "identity", "frame_number": 26604, "timestamp_epoch": "1732599597.744037000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-0d4b0fe7f1def1555131f048", "kind": "identity", "frame_number": 26606, "timestamp_epoch": "1732599597.746289000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-af7065ad4ab9a736843767e2", "kind": "identity", "frame_number": 26621, "timestamp_epoch": "1732599597.838430000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-c419174644e95b6670fb4007", "kind": "identity", "frame_number": 26623, "timestamp_epoch": "1732599597.839720000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-d15e4905d512e7bee36bb1d5", "kind": "identity", "frame_number": 26624, "timestamp_epoch": "1732599597.840424000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "15" } }, { "event_id": "evt-80c6388d9aa74501a504f294", "kind": "identity", "frame_number": 26643, "timestamp_epoch": "1732599597.983021000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-c6d91b1bd770e5923af9ca3a", "kind": "identity", "frame_number": 26645, "timestamp_epoch": "1732599597.984023000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-922a4ff3e17e6f340f834d08", "kind": "identity", "frame_number": 26656, "timestamp_epoch": "1732599598.011482000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-7fa3f10a47154d77483446c9", "kind": "identity", "frame_number": 26657, "timestamp_epoch": "1732599598.011850000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-0b2cb7c3e51e8de8e18a0bd1", "kind": "identity", "frame_number": 26658, "timestamp_epoch": "1732599598.012115000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d8faccf5b486527b7a032dcb", "kind": "identity", "frame_number": 26661, "timestamp_epoch": "1732599598.013465000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b", "kerberos.msg_type": "14" } }, { "event_id": "evt-8590439fd1a9402f5841f188", "kind": "identity", "frame_number": 26663, "timestamp_epoch": "1732599598.014406000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d", "kerberos.msg_type": "15" } }, { "event_id": "evt-de5a88973641ab07f26ac445", "kind": "identity", "frame_number": 26664, "timestamp_epoch": "1732599598.014864000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e569ddb8320e890b5fb0a5e6", "kind": "identity", "frame_number": 26665, "timestamp_epoch": "1732599598.015315000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-91355f6ec9221e06b0834039", "kind": "identity", "frame_number": 26666, "timestamp_epoch": "1732599598.015696000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-308efab2f708cf40409887be", "kind": "identity", "frame_number": 26667, "timestamp_epoch": "1732599598.015832000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e48cce6f6de4fc591dda76b6", "kind": "identity", "frame_number": 26668, "timestamp_epoch": "1732599598.015903000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-816f483e2ea8592a247b88e9", "kind": "identity", "frame_number": 26669, "timestamp_epoch": "1732599598.016182000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-119fb7c03c7125419bb8becf", "kind": "identity", "frame_number": 26671, "timestamp_epoch": "1732599598.016545000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a73b4b99b7cdf80823f356b1", "kind": "identity", "frame_number": 26672, "timestamp_epoch": "1732599598.016708000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-846ea7e015dc8f3908daef70", "kind": "identity", "frame_number": 26673, "timestamp_epoch": "1732599598.017017000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-44fcdbaf23cf0ec5582aa390", "kind": "identity", "frame_number": 26674, "timestamp_epoch": "1732599598.017114000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-bdf3b1714e270825943581a7", "kind": "identity", "frame_number": 26675, "timestamp_epoch": "1732599598.017504000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3fe3a5805ded0ccf6e628a9a", "kind": "identity", "frame_number": 26676, "timestamp_epoch": "1732599598.017632000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2964aaa67f59216f75b77ecd", "kind": "identity", "frame_number": 26677, "timestamp_epoch": "1732599598.021917000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c883570c0fdc4ada2936663a", "kind": "identity", "frame_number": 26678, "timestamp_epoch": "1732599598.022402000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f4f61f73bc9203b3ada57843", "kind": "identity", "frame_number": 26679, "timestamp_epoch": "1732599598.022725000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-bfb8620961029d415eb14167", "kind": "identity", "frame_number": 26680, "timestamp_epoch": "1732599598.022830000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-03feca91d8670315ca4c5ef4", "kind": "identity", "frame_number": 26681, "timestamp_epoch": "1732599598.023036000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-b1f211e812b2717b9f51e41c", "kind": "identity", "frame_number": 26682, "timestamp_epoch": "1732599598.023283000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f4c16ff4258c23173bac0253", "kind": "identity", "frame_number": 26683, "timestamp_epoch": "1732599598.023821000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-cd77abb6119425a515f11d09", "kind": "identity", "frame_number": 26684, "timestamp_epoch": "1732599598.024283000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-920ed33c80a4960853725e0f", "kind": "identity", "frame_number": 26685, "timestamp_epoch": "1732599598.024526000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2c7b1642232b7e98986a5a8e", "kind": "identity", "frame_number": 26686, "timestamp_epoch": "1732599598.024628000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-8587c5c0655c3163328e30fa", "kind": "identity", "frame_number": 26687, "timestamp_epoch": "1732599598.024791000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-8b3f22f52053e5827cfb2930", "kind": "identity", "frame_number": 26688, "timestamp_epoch": "1732599598.025008000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-ec4fa01adc20b9822e06a1d3", "kind": "identity", "frame_number": 26689, "timestamp_epoch": "1732599598.025700000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6f3a9bfe10a8b11649440f4a", "kind": "identity", "frame_number": 26690, "timestamp_epoch": "1732599598.026171000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-85b225665af0cff0617f4778", "kind": "identity", "frame_number": 26691, "timestamp_epoch": "1732599598.026439000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6579b6f58911682abc9d9c28", "kind": "identity", "frame_number": 26692, "timestamp_epoch": "1732599598.026540000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-c5862aa80b076a057dd0db32", "kind": "identity", "frame_number": 26693, "timestamp_epoch": "1732599598.026714000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-9bc093abba299142b750c1fc", "kind": "identity", "frame_number": 26694, "timestamp_epoch": "1732599598.026951000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2d2ebeba5cae89759d12fe30", "kind": "identity", "frame_number": 26695, "timestamp_epoch": "1732599598.027704000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-af428eff948c0dd3c45616fb", "kind": "identity", "frame_number": 26696, "timestamp_epoch": "1732599598.028170000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-fc7c22973776daf8f181150b", "kind": "identity", "frame_number": 26697, "timestamp_epoch": "1732599598.028399000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e8ed9ff4582a61b40122f589", "kind": "identity", "frame_number": 26698, "timestamp_epoch": "1732599598.028500000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-248ad3e0a39c707dcd49d27c", "kind": "identity", "frame_number": 26699, "timestamp_epoch": "1732599598.028675000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c0639e3f1f5f6296c25395da", "kind": "identity", "frame_number": 26700, "timestamp_epoch": "1732599598.028885000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-cb74feaf38b660e460896567", "kind": "identity", "frame_number": 26701, "timestamp_epoch": "1732599598.029172000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6d2e5401043ade203cf16dda", "kind": "identity", "frame_number": 26702, "timestamp_epoch": "1732599598.029424000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-20b43afc3a3b8b3f8d1cf038", "kind": "identity", "frame_number": 26703, "timestamp_epoch": "1732599598.029658000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-f00e4682fc785ea176a5f544", "kind": "identity", "frame_number": 26704, "timestamp_epoch": "1732599598.029762000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b2272286e69f7dd97b742d18", "kind": "identity", "frame_number": 26705, "timestamp_epoch": "1732599598.029935000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-56d6cc1cdcad6a59e8206248", "kind": "identity", "frame_number": 26706, "timestamp_epoch": "1732599598.030044000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b409a8d5ae87b6a8d4f9fcc6", "kind": "identity", "frame_number": 26707, "timestamp_epoch": "1732599598.030201000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-223572b0c2c3f5bc2368c622", "kind": "identity", "frame_number": 26708, "timestamp_epoch": "1732599598.030302000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-bdd0a6e4019ffb1968351f19", "kind": "identity", "frame_number": 26709, "timestamp_epoch": "1732599598.030504000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-fec401e876782442d5437f58", "kind": "identity", "frame_number": 26710, "timestamp_epoch": "1732599598.030721000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-14cb92c6f5726e233046de80", "kind": "identity", "frame_number": 26711, "timestamp_epoch": "1732599598.030985000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-7a2852b1a15d790a17761f6c", "kind": "identity", "frame_number": 26712, "timestamp_epoch": "1732599598.031094000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-3a297c51083eefcb25a6478d", "kind": "identity", "frame_number": 26713, "timestamp_epoch": "1732599598.031242000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-4fb696c214c20b562e189bd4", "kind": "identity", "frame_number": 26714, "timestamp_epoch": "1732599598.031342000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-f96678b87c150ccbe8abc99e", "kind": "identity", "frame_number": 26715, "timestamp_epoch": "1732599598.031530000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-86531c7acc358ec63521eeaa", "kind": "identity", "frame_number": 26716, "timestamp_epoch": "1732599598.031624000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-43ea3d1adea514fd766ea5b6", "kind": "identity", "frame_number": 26717, "timestamp_epoch": "1732599598.031815000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a2dc723a976dcd22b4a6ff62", "kind": "identity", "frame_number": 26718, "timestamp_epoch": "1732599598.031924000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-c7c02d52b8a45b59853404e4", "kind": "identity", "frame_number": 26719, "timestamp_epoch": "1732599598.032077000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2096bbf3835703edadaddde0", "kind": "identity", "frame_number": 26720, "timestamp_epoch": "1732599598.032192000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-61a76fe5dbafa25bbea2394b", "kind": "identity", "frame_number": 26721, "timestamp_epoch": "1732599598.032537000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6d7acbf4fa00b5f479c3ee84", "kind": "identity", "frame_number": 26722, "timestamp_epoch": "1732599598.032687000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-155cfe8221cdcea647caa506", "kind": "identity", "frame_number": 26723, "timestamp_epoch": "1732599598.033368000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-68e312b3a7041dd4ba591f12", "kind": "identity", "frame_number": 26724, "timestamp_epoch": "1732599598.033661000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-8fc006fdd9af5a5e03aff934", "kind": "identity", "frame_number": 26725, "timestamp_epoch": "1732599598.033948000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2cb0f35117c676aaa23977ed", "kind": "identity", "frame_number": 26726, "timestamp_epoch": "1732599598.034265000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-165d4e23430e5f02fa1f0010", "kind": "identity", "frame_number": 26727, "timestamp_epoch": "1732599598.034669000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-651a46fdc3cb8709c4b9f7ad", "kind": "identity", "frame_number": 26728, "timestamp_epoch": "1732599598.034976000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-2f1a6fb1b39ccfaff9b6e550", "kind": "identity", "frame_number": 26729, "timestamp_epoch": "1732599598.035309000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-775b9c27c7c9b6d51806520f", "kind": "identity", "frame_number": 26730, "timestamp_epoch": "1732599598.035582000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-30a18ee7d3b337ba7b73af85", "kind": "identity", "frame_number": 26731, "timestamp_epoch": "1732599598.035812000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-8b5864c980c859dfc7653536", "kind": "identity", "frame_number": 26732, "timestamp_epoch": "1732599598.035917000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-9631d127f3770a283f83a8a5", "kind": "identity", "frame_number": 26733, "timestamp_epoch": "1732599598.036081000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-fb18a6bb04bd1ea9b46882c1", "kind": "identity", "frame_number": 26734, "timestamp_epoch": "1732599598.036185000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d21b06a6deb906662d910f27", "kind": "identity", "frame_number": 26735, "timestamp_epoch": "1732599598.036339000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2aa3340fa4cdf083459c3cee", "kind": "identity", "frame_number": 26736, "timestamp_epoch": "1732599598.036449000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-00ffc8d89766259428943cf9", "kind": "identity", "frame_number": 26737, "timestamp_epoch": "1732599598.036644000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-affbe237e027ee8d6526ece4", "kind": "identity", "frame_number": 26738, "timestamp_epoch": "1732599598.036853000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-61afe9851fcbabede3ff5e91", "kind": "identity", "frame_number": 26739, "timestamp_epoch": "1732599598.037079000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-1e398c1951966fa39fffff5c", "kind": "identity", "frame_number": 26740, "timestamp_epoch": "1732599598.037175000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-55d7c7b6dc9675c2a4afde2d", "kind": "identity", "frame_number": 26741, "timestamp_epoch": "1732599598.037317000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-5c07008ff0a47c0324978125", "kind": "identity", "frame_number": 26742, "timestamp_epoch": "1732599598.037411000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-ba8922e8197c467f116e015b", "kind": "identity", "frame_number": 26743, "timestamp_epoch": "1732599598.037553000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-14f5bb70f04a3298b135ec3b", "kind": "identity", "frame_number": 26744, "timestamp_epoch": "1732599598.037657000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-77f62dcc901f3af502ac2cbe", "kind": "identity", "frame_number": 26745, "timestamp_epoch": "1732599598.037796000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-13a22ab04234ec6f1a9a3bc7", "kind": "identity", "frame_number": 26746, "timestamp_epoch": "1732599598.037913000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-6290dcacd5a2a485c05e194d", "kind": "identity", "frame_number": 26747, "timestamp_epoch": "1732599598.038058000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-3b10d9749d8e1d04d27fc1eb", "kind": "identity", "frame_number": 26748, "timestamp_epoch": "1732599598.038147000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-649ddb1660d9d31e957a9215", "kind": "identity", "frame_number": 26749, "timestamp_epoch": "1732599598.038384000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-a97f7670495f5138d484edfa", "kind": "identity", "frame_number": 26750, "timestamp_epoch": "1732599598.038471000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-19a92716e937840add3f04c2", "kind": "identity", "frame_number": 26751, "timestamp_epoch": "1732599598.038636000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-80d26aabac523409602b9c49", "kind": "identity", "frame_number": 26753, "timestamp_epoch": "1732599598.039106000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-b8aa1d9e4f06d7df8de89e43", "kind": "identity", "frame_number": 26755, "timestamp_epoch": "1732599598.039446000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-9c174615c9a204eb90959510", "kind": "identity", "frame_number": 26758, "timestamp_epoch": "1732599598.039612000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-738dd2b1d8460627980714dc", "kind": "identity", "frame_number": 26759, "timestamp_epoch": "1732599598.039841000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-2427584e2a002bcf285549b5", "kind": "identity", "frame_number": 26760, "timestamp_epoch": "1732599598.040042000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a02885479019b0b1dae00944", "kind": "identity", "frame_number": 26761, "timestamp_epoch": "1732599598.040199000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-70b6ea6a847d60a226209674", "kind": "identity", "frame_number": 26762, "timestamp_epoch": "1732599598.040303000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a7ddc2d8f0b8f51199457a6f", "kind": "identity", "frame_number": 26763, "timestamp_epoch": "1732599598.040385000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-4176c001f2bfed70cd59f777", "kind": "identity", "frame_number": 26764, "timestamp_epoch": "1732599598.040480000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-ccb1a805d59f8856ff9c2bcf", "kind": "identity", "frame_number": 26765, "timestamp_epoch": "1732599598.040562000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-e5954676d906ed8aee66f8be", "kind": "identity", "frame_number": 26766, "timestamp_epoch": "1732599598.040657000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-a5c174e25540eaac45a4e2a4", "kind": "identity", "frame_number": 26767, "timestamp_epoch": "1732599598.040748000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-96741714f70c637df9bbfc49", "kind": "identity", "frame_number": 26768, "timestamp_epoch": "1732599598.040843000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-caacf814e9e612617d20a836", "kind": "identity", "frame_number": 26769, "timestamp_epoch": "1732599598.040996000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d96577d48094f685c7ea6ccd", "kind": "identity", "frame_number": 26770, "timestamp_epoch": "1732599598.041204000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-37c076d6591d562b330cc9a0", "kind": "identity", "frame_number": 26771, "timestamp_epoch": "1732599598.041329000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c7b953bc649155da3b5e7d09", "kind": "identity", "frame_number": 26772, "timestamp_epoch": "1732599598.041441000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-89612d3def3149620ecd4273", "kind": "identity", "frame_number": 26773, "timestamp_epoch": "1732599598.041515000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-d2005d08c7a5fce698afccf9", "kind": "identity", "frame_number": 26774, "timestamp_epoch": "1732599598.041617000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-12695a8d833e9e8ddcff3050", "kind": "identity", "frame_number": 26775, "timestamp_epoch": "1732599598.041694000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-dca9835224232684f3de7c5b", "kind": "identity", "frame_number": 26776, "timestamp_epoch": "1732599598.041788000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-d7daba3def7d1337f37e3012", "kind": "identity", "frame_number": 26777, "timestamp_epoch": "1732599598.041861000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6d81781efca4582cd5396221", "kind": "identity", "frame_number": 26778, "timestamp_epoch": "1732599598.041977000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-8b71ad358f30a9ace05098f9", "kind": "identity", "frame_number": 26779, "timestamp_epoch": "1732599598.042049000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-af5701d71371a6e89dc52e71", "kind": "identity", "frame_number": 26780, "timestamp_epoch": "1732599598.042136000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-438b5e1ddc3e5de0353f5626", "kind": "identity", "frame_number": 26781, "timestamp_epoch": "1732599598.042302000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-6f55ec9e0061faf56f4c768f", "kind": "identity", "frame_number": 26782, "timestamp_epoch": "1732599598.042385000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-e3adad702beb888693e434f5", "kind": "identity", "frame_number": 26783, "timestamp_epoch": "1732599598.042597000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-009b5b1c68f217d9e30bcd38", "kind": "identity", "frame_number": 26784, "timestamp_epoch": "1732599598.042700000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } }, { "event_id": "evt-7a1995582cb4d2798dc3f473", "kind": "identity", "frame_number": 26785, "timestamp_epoch": "1732599598.042990000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "00:24:e8:7f:09:5d", "eth.src": "d0:57:7b:ce:fc:8b" } }, { "event_id": "evt-c9a2354560629a27ec58367b", "kind": "identity", "frame_number": 26786, "timestamp_epoch": "1732599598.043121000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 139, "udp_stream": null, "fields": { "eth.dst": "d0:57:7b:ce:fc:8b", "eth.src": "00:24:e8:7f:09:5d" } } ], "directory_service": [ { "event_id": "evt-02f85419ea6cc3b8af9d686c", "kind": "directory_service", "frame_number": 36, "timestamp_epoch": "1732596579.029388000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-551747382b351ac4ae5a6409", "kind": "directory_service", "frame_number": 40, "timestamp_epoch": "1732596579.030853000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6e8c1922249560a6043abcda", "kind": "directory_service", "frame_number": 43, "timestamp_epoch": "1732596579.031921000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c880d0cc06844d11d1283699", "kind": "directory_service", "frame_number": 45, "timestamp_epoch": "1732596579.034205000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-236ff89beb9a53c86e58324b", "kind": "directory_service", "frame_number": 46, "timestamp_epoch": "1732596579.034568000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-02d3a8862266cd13f4cd6ba8", "kind": "directory_service", "frame_number": 304, "timestamp_epoch": "1732596595.586808000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3bdb8eb472f5f23f02903294", "kind": "directory_service", "frame_number": 305, "timestamp_epoch": "1732596595.587007000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c35d5220964b1e4bba6fc69b", "kind": "directory_service", "frame_number": 309, "timestamp_epoch": "1732596595.587339000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-abcc108175cd1133045de5a0", "kind": "directory_service", "frame_number": 311, "timestamp_epoch": "1732596595.587700000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-dbb87572945b1ee428e6c4a8", "kind": "directory_service", "frame_number": 312, "timestamp_epoch": "1732596595.587890000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-78bbf7a1dc7b951e7d469b5d", "kind": "directory_service", "frame_number": 313, "timestamp_epoch": "1732596595.588294000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a8c3a3069243394341090c4a", "kind": "directory_service", "frame_number": 315, "timestamp_epoch": "1732596595.588486000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c516fe36c7391fb8627210bc", "kind": "directory_service", "frame_number": 316, "timestamp_epoch": "1732596595.588613000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-859f15ce39d979474f392791", "kind": "directory_service", "frame_number": 330, "timestamp_epoch": "1732596595.590229000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-faf1f9e4ff5a916a2f5cc216", "kind": "directory_service", "frame_number": 333, "timestamp_epoch": "1732596595.590598000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-346648061d26afd9d35601e0", "kind": "directory_service", "frame_number": 334, "timestamp_epoch": "1732596595.590763000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-203e3ccd4b05e64138983d5f", "kind": "directory_service", "frame_number": 337, "timestamp_epoch": "1732596595.591034000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-f02d9560541b4c4bb46a8cfd", "kind": "directory_service", "frame_number": 340, "timestamp_epoch": "1732596595.591192000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-668821867a2202889319f080", "kind": "directory_service", "frame_number": 342, "timestamp_epoch": "1732596595.591453000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-9fca9ccedd835577441fa90f", "kind": "directory_service", "frame_number": 344, "timestamp_epoch": "1732596595.591682000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-7755c43c9044ec7e68eaac0c", "kind": "directory_service", "frame_number": 345, "timestamp_epoch": "1732596595.591967000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-4b14f7bfb091371925575a76", "kind": "directory_service", "frame_number": 346, "timestamp_epoch": "1732596595.592111000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-425bcf95137443b1c7f03c68", "kind": "directory_service", "frame_number": 348, "timestamp_epoch": "1732596595.592505000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-27f39293479dfa25ae65a859", "kind": "directory_service", "frame_number": 349, "timestamp_epoch": "1732596595.592658000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-8072d1a1b855ba73603b53b0", "kind": "directory_service", "frame_number": 350, "timestamp_epoch": "1732596595.592934000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-4a0678edbce784a53c79d75d", "kind": "directory_service", "frame_number": 351, "timestamp_epoch": "1732596595.593077000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-0c3e41e9f9d8b680dfd17838", "kind": "directory_service", "frame_number": 352, "timestamp_epoch": "1732596595.593509000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-a84cf89351b557b43b0c618f", "kind": "directory_service", "frame_number": 353, "timestamp_epoch": "1732596595.593657000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-4f9d9814084f5746cde2f4af", "kind": "directory_service", "frame_number": 355, "timestamp_epoch": "1732596595.594089000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "oboomwald", "samr.samr_UserInfo21.full_name": "Oliver Q. Boomwald" } }, { "event_id": "evt-6f6a27ae45e7e163cbaad1e0", "kind": "directory_service", "frame_number": 358, "timestamp_epoch": "1732596595.594248000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-987ea66987f9c020e98d9b8a", "kind": "directory_service", "frame_number": 359, "timestamp_epoch": "1732596595.594374000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f8b613e25a3264ba965cd590", "kind": "directory_service", "frame_number": 360, "timestamp_epoch": "1732596595.594659000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-71ad82f912cc50721c69da23", "kind": "directory_service", "frame_number": 361, "timestamp_epoch": "1732596595.594830000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-d4c138f836505b0c56426e76", "kind": "directory_service", "frame_number": 363, "timestamp_epoch": "1732596595.595173000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-8802e3702f7269803cb7df78", "kind": "directory_service", "frame_number": 364, "timestamp_epoch": "1732596595.595194000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-06e8b83733f8d84e14306cca", "kind": "directory_service", "frame_number": 366, "timestamp_epoch": "1732596595.595354000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-ca47296cb6f8e02d3a067824", "kind": "directory_service", "frame_number": 367, "timestamp_epoch": "1732596595.595679000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-1ce1e87d9033b747b415230e", "kind": "directory_service", "frame_number": 368, "timestamp_epoch": "1732596595.595836000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-851386cbbca0a7eaa0d151e6", "kind": "directory_service", "frame_number": 369, "timestamp_epoch": "1732596595.596027000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-8c242ae29453b33ad2b689ba", "kind": "directory_service", "frame_number": 371, "timestamp_epoch": "1732596595.596273000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-4ebd141321c6a0c71e790098", "kind": "directory_service", "frame_number": 372, "timestamp_epoch": "1732596595.596294000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-e85f012a70a892bdffaf60bf", "kind": "directory_service", "frame_number": 374, "timestamp_epoch": "1732596595.596520000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-aa5f83c1e57846285a345877", "kind": "directory_service", "frame_number": 375, "timestamp_epoch": "1732596595.596654000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-8cc0179dd025d9eed57d59eb", "kind": "directory_service", "frame_number": 376, "timestamp_epoch": "1732596595.596929000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-704743d9d97c0fa84998a5a8", "kind": "directory_service", "frame_number": 377, "timestamp_epoch": "1732596595.597066000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1834a237b143e9578ce314cd", "kind": "directory_service", "frame_number": 378, "timestamp_epoch": "1732596595.597278000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-017ce5ae20617e0c61a2e90d", "kind": "directory_service", "frame_number": 379, "timestamp_epoch": "1732596595.597345000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8f6ecdcae5aaad1200435489", "kind": "directory_service", "frame_number": 382, "timestamp_epoch": "1732596595.600858000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.baseObject": "DC=nemotodes,DC=health", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-ee85543cba59a33dba044bab", "kind": "directory_service", "frame_number": 383, "timestamp_epoch": "1732596595.601465000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-f339b742a2784329bb54c434", "kind": "directory_service", "frame_number": 388, "timestamp_epoch": "1732596595.603729000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-ba6a866b38c1f60c182b5df5", "kind": "directory_service", "frame_number": 390, "timestamp_epoch": "1732596595.604722000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-7951d544e18ff8f2d9065712", "kind": "directory_service", "frame_number": 391, "timestamp_epoch": "1732596595.605015000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-664d6cb5b4c2d3218fda609e", "kind": "directory_service", "frame_number": 392, "timestamp_epoch": "1732596595.605218000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-61334881d7d25725afcb3a75", "kind": "directory_service", "frame_number": 393, "timestamp_epoch": "1732596595.605405000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=nemotodes,DC=health", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2f97ba8276856e80a9c01f04", "kind": "directory_service", "frame_number": 394, "timestamp_epoch": "1732596595.605655000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-101e66fa6d7c155ef5061f56", "kind": "directory_service", "frame_number": 395, "timestamp_epoch": "1732596595.605921000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=nemotodes,DC=health", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-040ec981e22c107346474367", "kind": "directory_service", "frame_number": 396, "timestamp_epoch": "1732596595.606287000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-eedb12b74d3551982ea5edc2", "kind": "directory_service", "frame_number": 397, "timestamp_epoch": "1732596595.612414000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e42e57de702de0d55a8d33cd", "kind": "directory_service", "frame_number": 401, "timestamp_epoch": "1732596595.614914000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-bd756b128b2e09a576f64ea3", "kind": "directory_service", "frame_number": 486, "timestamp_epoch": "1732596597.430818000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-381de872bf6b943efb7fca7b", "kind": "directory_service", "frame_number": 487, "timestamp_epoch": "1732596597.431332000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-16d5fcf3b0f339da97164500", "kind": "directory_service", "frame_number": 488, "timestamp_epoch": "1732596597.431540000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-cd7a67534f5a9f6e0b25266a", "kind": "directory_service", "frame_number": 489, "timestamp_epoch": "1732596597.432272000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-733aa9c67a3ae19595e52819", "kind": "directory_service", "frame_number": 490, "timestamp_epoch": "1732596597.432409000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9943db882c2d7ecf9ae11cc6", "kind": "directory_service", "frame_number": 491, "timestamp_epoch": "1732596597.432620000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7a2ba823fcad070a020bbfec", "kind": "directory_service", "frame_number": 500, "timestamp_epoch": "1732596597.434219000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-debfe875c979a860717d15fa", "kind": "directory_service", "frame_number": 501, "timestamp_epoch": "1732596597.434596000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-fccb715fbf6522ffdfc468bd", "kind": "directory_service", "frame_number": 502, "timestamp_epoch": "1732596597.434750000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b9c6e6317ec1ae5630a97b78", "kind": "directory_service", "frame_number": 503, "timestamp_epoch": "1732596597.435395000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c577ae49878069aff0d22c7a", "kind": "directory_service", "frame_number": 504, "timestamp_epoch": "1732596597.435524000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-262f49bd81579c04e836ae8b", "kind": "directory_service", "frame_number": 505, "timestamp_epoch": "1732596597.435730000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-15d6c1e28c63e2d308ceb4c6", "kind": "directory_service", "frame_number": 510, "timestamp_epoch": "1732596597.438168000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f4775cd1c620058a77dbc34f", "kind": "directory_service", "frame_number": 512, "timestamp_epoch": "1732596597.439561000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f2801336a274b5415ed24747", "kind": "directory_service", "frame_number": 515, "timestamp_epoch": "1732596597.440552000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-e2c6fc9f84fc403e6e0b0ad7", "kind": "directory_service", "frame_number": 517, "timestamp_epoch": "1732596597.442740000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-641f041c16749943862aa9cf", "kind": "directory_service", "frame_number": 518, "timestamp_epoch": "1732596597.443147000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-cbd738171d182842faa9adb6", "kind": "directory_service", "frame_number": 520, "timestamp_epoch": "1732596597.443804000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-4085506c591f1ce81ceec1d1", "kind": "directory_service", "frame_number": 522, "timestamp_epoch": "1732596597.446466000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-1fe315e7a52fe6469c024b89", "kind": "directory_service", "frame_number": 523, "timestamp_epoch": "1732596597.447405000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-8c9bcc66f1c8191d446061f2", "kind": "directory_service", "frame_number": 524, "timestamp_epoch": "1732596597.447634000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-dd7084176024a1eaaebf29a8", "kind": "directory_service", "frame_number": 525, "timestamp_epoch": "1732596597.448211000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-3a0ec6c8460b1d0ef7a7f1d0", "kind": "directory_service", "frame_number": 535, "timestamp_epoch": "1732596597.465797000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-3eea1d0d0ce47c8b66182543", "kind": "directory_service", "frame_number": 537, "timestamp_epoch": "1732596597.466785000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-2397b16aac78ec0e27d731b4", "kind": "directory_service", "frame_number": 538, "timestamp_epoch": "1732596597.467107000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": {} }, { "event_id": "evt-e69a03fb9bc10c83828d30c0", "kind": "directory_service", "frame_number": 541, "timestamp_epoch": "1732596597.467868000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": {} }, { "event_id": "evt-05d69e1e90e0b73eeedea3e5", "kind": "directory_service", "frame_number": 543, "timestamp_epoch": "1732596597.468024000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": {} }, { "event_id": "evt-3a7399516762ec3ed569fd31", "kind": "directory_service", "frame_number": 544, "timestamp_epoch": "1732596597.468577000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": {} }, { "event_id": "evt-3d2e6fd47e750f5223b12964", "kind": "directory_service", "frame_number": 545, "timestamp_epoch": "1732596597.468754000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 26, "udp_stream": null, "fields": {} }, { "event_id": "evt-9c2cd539aa7d3d304500c479", "kind": "directory_service", "frame_number": 548, "timestamp_epoch": "1732596597.468892000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 25, "udp_stream": null, "fields": {} }, { "event_id": "evt-e6719922c4c005585bcbf662", "kind": "directory_service", "frame_number": 1120, "timestamp_epoch": "1732596611.004869000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-848879098c783f5ec18aeff0", "kind": "directory_service", "frame_number": 1121, "timestamp_epoch": "1732596611.005236000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a5dfb1cc69fc5adb60ff2d78", "kind": "directory_service", "frame_number": 1122, "timestamp_epoch": "1732596611.005414000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-890548ac2510f2f002002dcf", "kind": "directory_service", "frame_number": 1123, "timestamp_epoch": "1732596611.006177000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8110f78e2c2f18ee67c93a4c", "kind": "directory_service", "frame_number": 1124, "timestamp_epoch": "1732596611.006319000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-93cf95dc7479b755193e502c", "kind": "directory_service", "frame_number": 1125, "timestamp_epoch": "1732596611.006536000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d024cb0b889f36c058c727ad", "kind": "directory_service", "frame_number": 1128, "timestamp_epoch": "1732596611.008033000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c1e17ae28d9e8b92eac23aba", "kind": "directory_service", "frame_number": 1129, "timestamp_epoch": "1732596611.008413000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-1d9192a69df555fb2f7b8a68", "kind": "directory_service", "frame_number": 1130, "timestamp_epoch": "1732596611.008586000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e8fbeb60ea3aa6e678df736e", "kind": "directory_service", "frame_number": 1131, "timestamp_epoch": "1732596611.009217000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4d938db829b5c0a471f1d4f4", "kind": "directory_service", "frame_number": 1132, "timestamp_epoch": "1732596611.009379000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-af7d29366a495be5b08099fd", "kind": "directory_service", "frame_number": 1133, "timestamp_epoch": "1732596611.009581000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 24, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-605f7e15bbd17a920f5d80c4", "kind": "directory_service", "frame_number": 1138, "timestamp_epoch": "1732596611.011629000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-8ccf184f46a7a8ceed376fcb", "kind": "directory_service", "frame_number": 1140, "timestamp_epoch": "1732596611.014080000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f39ad85a53a8f1ee162398c0", "kind": "directory_service", "frame_number": 1141, "timestamp_epoch": "1732596611.014485000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-10a221f7eb6df1c2c9865f17", "kind": "directory_service", "frame_number": 1142, "timestamp_epoch": "1732596611.015142000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-64030dd9b297c426ce3ba453", "kind": "directory_service", "frame_number": 1143, "timestamp_epoch": "1732596611.015315000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-0749064196d058c9901e0ada", "kind": "directory_service", "frame_number": 1144, "timestamp_epoch": "1732596611.015919000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-b307d05191234f694868a450", "kind": "directory_service", "frame_number": 1145, "timestamp_epoch": "1732596611.016071000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-8ef2b49d8621381a57741670", "kind": "directory_service", "frame_number": 1146, "timestamp_epoch": "1732596611.016629000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-4e7632d288b703fed0860aeb", "kind": "directory_service", "frame_number": 1151, "timestamp_epoch": "1732596611.018656000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-8fb0a623d38be1a3002bedf1", "kind": "directory_service", "frame_number": 1153, "timestamp_epoch": "1732596611.020767000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-7c90eb02ef5e316c76ad3e1d", "kind": "directory_service", "frame_number": 1154, "timestamp_epoch": "1732596611.021073000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": {} }, { "event_id": "evt-8587c8abb2d0215cabe9f71c", "kind": "directory_service", "frame_number": 1157, "timestamp_epoch": "1732596611.022156000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": {} }, { "event_id": "evt-f5f2c3fc0a8e95aedfca1ca5", "kind": "directory_service", "frame_number": 1159, "timestamp_epoch": "1732596611.022315000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": {} }, { "event_id": "evt-a5b546949d267971250d1acd", "kind": "directory_service", "frame_number": 1160, "timestamp_epoch": "1732596611.023059000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": {} }, { "event_id": "evt-28650afef339ddf04ac3b3a7", "kind": "directory_service", "frame_number": 1161, "timestamp_epoch": "1732596611.023177000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": {} }, { "event_id": "evt-079a2860494a111d2fc7b20a", "kind": "directory_service", "frame_number": 1163, "timestamp_epoch": "1732596611.023322000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 38, "udp_stream": null, "fields": {} }, { "event_id": "evt-480a9fcc9cfd298ec296bb59", "kind": "directory_service", "frame_number": 20433, "timestamp_epoch": "1732596656.533998000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-94fbcef01afdc40ae7777faf", "kind": "directory_service", "frame_number": 20434, "timestamp_epoch": "1732596656.534486000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-29d3b028de2a627d4c79fc14", "kind": "directory_service", "frame_number": 20435, "timestamp_epoch": "1732596656.534849000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-52cfbe08d9973aec6ae158bb", "kind": "directory_service", "frame_number": 20436, "timestamp_epoch": "1732596656.535544000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-26c339dc40680ef1e0fc5be3", "kind": "directory_service", "frame_number": 20437, "timestamp_epoch": "1732596656.535867000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-31fde06dd800479d8a7f3442", "kind": "directory_service", "frame_number": 20438, "timestamp_epoch": "1732596656.536083000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-23e4a79606e63bc9366f9871", "kind": "directory_service", "frame_number": 20441, "timestamp_epoch": "1732596656.537556000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8af01d95fa0f93d9c7bc80a0", "kind": "directory_service", "frame_number": 20442, "timestamp_epoch": "1732596656.537881000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0e6bb13906717b489b94a8f3", "kind": "directory_service", "frame_number": 20443, "timestamp_epoch": "1732596656.538202000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-7ec670b3b70b5d2da3d666fc", "kind": "directory_service", "frame_number": 20444, "timestamp_epoch": "1732596656.538841000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-59b3e67abcc0ab5d9b327dd5", "kind": "directory_service", "frame_number": 20445, "timestamp_epoch": "1732596656.539148000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-996781d0d1c8bd2ee8466d52", "kind": "directory_service", "frame_number": 20446, "timestamp_epoch": "1732596656.539357000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 81, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3085f175f2ea2b88e6f3cd3c", "kind": "directory_service", "frame_number": 20450, "timestamp_epoch": "1732596656.541082000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-d3c56fa8ae1406c34e658fd9", "kind": "directory_service", "frame_number": 20452, "timestamp_epoch": "1732596656.542432000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-69be88ecf46ceabb8730d513", "kind": "directory_service", "frame_number": 20455, "timestamp_epoch": "1732596656.543311000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-54b9887dcd23ae7ec4029648", "kind": "directory_service", "frame_number": 20457, "timestamp_epoch": "1732596656.545412000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1bfe4b79d5fe495f0993013a", "kind": "directory_service", "frame_number": 20458, "timestamp_epoch": "1732596656.545813000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-174ac93008062f9f1fdfe41a", "kind": "directory_service", "frame_number": 20459, "timestamp_epoch": "1732596656.546433000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-ee54b658f7dd3bb1ee1d0c40", "kind": "directory_service", "frame_number": 20460, "timestamp_epoch": "1732596656.546756000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-bc3b667ba6b13ee7cfa0c58f", "kind": "directory_service", "frame_number": 20461, "timestamp_epoch": "1732596656.547363000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-99bbcfb4c74f881897037d6f", "kind": "directory_service", "frame_number": 20462, "timestamp_epoch": "1732596656.547675000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-8d49cd42cb0e63176e41c1c2", "kind": "directory_service", "frame_number": 20463, "timestamp_epoch": "1732596656.548244000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-155be4e19dbcc58c963fbe49", "kind": "directory_service", "frame_number": 20468, "timestamp_epoch": "1732596656.550432000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-10b2150e5875c6011c70e1d1", "kind": "directory_service", "frame_number": 20470, "timestamp_epoch": "1732596656.552608000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a5228c28f2e436b13a0f7e74", "kind": "directory_service", "frame_number": 20471, "timestamp_epoch": "1732596656.552990000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": {} }, { "event_id": "evt-885b8029d63e8842d19e5faa", "kind": "directory_service", "frame_number": 20474, "timestamp_epoch": "1732596656.554080000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": {} }, { "event_id": "evt-9998a2648a479757761bc3bc", "kind": "directory_service", "frame_number": 20476, "timestamp_epoch": "1732596656.554350000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": {} }, { "event_id": "evt-d6b0d6704129266cae6d3cd5", "kind": "directory_service", "frame_number": 20477, "timestamp_epoch": "1732596656.555100000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": {} }, { "event_id": "evt-12babe7bb5922ebe3da08b43", "kind": "directory_service", "frame_number": 20478, "timestamp_epoch": "1732596656.555397000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 83, "udp_stream": null, "fields": {} }, { "event_id": "evt-ed0b0613950411bb5eede0df", "kind": "directory_service", "frame_number": 20480, "timestamp_epoch": "1732596656.555572000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 82, "udp_stream": null, "fields": {} }, { "event_id": "evt-3bae802eda437af48ccafe7e", "kind": "directory_service", "frame_number": 21162, "timestamp_epoch": "1732596827.738941000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-43b79fc633355873cb4e5c78", "kind": "directory_service", "frame_number": 21164, "timestamp_epoch": "1732596827.740374000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b450a9807555a2af4844bbfd", "kind": "directory_service", "frame_number": 21179, "timestamp_epoch": "1732596827.745508000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-2723eb756cdd271d54c33777", "kind": "directory_service", "frame_number": 21181, "timestamp_epoch": "1732596827.747859000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-fa6f0d06d168f3c77d2cd38b", "kind": "directory_service", "frame_number": 21182, "timestamp_epoch": "1732596827.749181000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Oliver Q.. Boomwald,CN=Users,DC=nemotodes,DC=health", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-32f3fe846a57596f89b0e536", "kind": "directory_service", "frame_number": 21183, "timestamp_epoch": "1732596827.750040000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e2dca722a557b61381fde694", "kind": "directory_service", "frame_number": 21184, "timestamp_epoch": "1732596827.750218000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-444fa3358a4e96cca706e80f", "kind": "directory_service", "frame_number": 21192, "timestamp_epoch": "1732596827.760127000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-90b10f1dd8f2b8e7c1efd469", "kind": "directory_service", "frame_number": 21194, "timestamp_epoch": "1732596827.761122000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-926779015fb19ac03247fc2c", "kind": "directory_service", "frame_number": 21195, "timestamp_epoch": "1732596827.761428000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Oliver Q.. Boomwald,CN=Users,DC=nemotodes,DC=health", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-01525f72b391efb9b304ef46", "kind": "directory_service", "frame_number": 21196, "timestamp_epoch": "1732596827.761727000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-0efd3940a302d8fae49ade9c", "kind": "directory_service", "frame_number": 21197, "timestamp_epoch": "1732596827.761912000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 95, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-744bd3ef3349981c821da979", "kind": "directory_service", "frame_number": 21257, "timestamp_epoch": "1732596897.033500000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e943663c4fce3f1f0931ad66", "kind": "directory_service", "frame_number": 21259, "timestamp_epoch": "1732596897.034953000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b26e0a6ff8976dbc37943050", "kind": "directory_service", "frame_number": 21262, "timestamp_epoch": "1732596897.036140000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-e85e3c85bc5378cf38e5774f", "kind": "directory_service", "frame_number": 21264, "timestamp_epoch": "1732596897.038424000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1fd89a693a30fc27aa298c2f", "kind": "directory_service", "frame_number": 21265, "timestamp_epoch": "1732596897.039773000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Oliver Q.. Boomwald,CN=Users,DC=nemotodes,DC=health", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-078aa6d6efad085d5d34cbe6", "kind": "directory_service", "frame_number": 21266, "timestamp_epoch": "1732596897.040650000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-80c6167d5f0a6f02e6013697", "kind": "directory_service", "frame_number": 21267, "timestamp_epoch": "1732596897.040938000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 97, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-fc0346ee08482605a60438d1", "kind": "directory_service", "frame_number": 21275, "timestamp_epoch": "1732596897.048150000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c755bcb815095b6666b0ae79", "kind": "directory_service", "frame_number": 21277, "timestamp_epoch": "1732596897.050275000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-fd4a6df263e8b8a3d50739cd", "kind": "directory_service", "frame_number": 21278, "timestamp_epoch": "1732596897.050523000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Oliver Q.. Boomwald,CN=Users,DC=nemotodes,DC=health", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-46535cc15029a690131a6610", "kind": "directory_service", "frame_number": 21279, "timestamp_epoch": "1732596897.051221000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-27f6c09c9d2a6c12f6b1adca", "kind": "directory_service", "frame_number": 21280, "timestamp_epoch": "1732596897.051336000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 98, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-67c4210a486c56049a58187f", "kind": "directory_service", "frame_number": 26599, "timestamp_epoch": "1732599597.741334000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ef34b6a4b2539d26425ae234", "kind": "directory_service", "frame_number": 26601, "timestamp_epoch": "1732599597.742724000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-a3f90960d864e4c486c0d9c6", "kind": "directory_service", "frame_number": 26604, "timestamp_epoch": "1732599597.744037000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-b16c46b8217f8e74b97a6e88", "kind": "directory_service", "frame_number": 26606, "timestamp_epoch": "1732599597.746289000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b7b36fd1b09b0cb4a455f434", "kind": "directory_service", "frame_number": 26626, "timestamp_epoch": "1732599597.841790000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-08c5b08a66e080d2c3144eff", "kind": "directory_service", "frame_number": 26627, "timestamp_epoch": "1732599597.842269000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-13413098a77cb0e1af2a19ab", "kind": "directory_service", "frame_number": 26628, "timestamp_epoch": "1732599597.842980000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-80614feefb87b56bbf70be1a", "kind": "directory_service", "frame_number": 26629, "timestamp_epoch": "1732599597.843863000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-40a21ea3df0bfcc94f12065e", "kind": "directory_service", "frame_number": 26630, "timestamp_epoch": "1732599597.844431000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-b5159b0a5a5c14584c417740", "kind": "directory_service", "frame_number": 26631, "timestamp_epoch": "1732599597.844792000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a1f899cc0956f11d67eb6ff6", "kind": "directory_service", "frame_number": 26632, "timestamp_epoch": "1732599597.868867000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.baseObject": "DC=nemotodes,DC=health", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-3083764c2967f656efa7ffa4", "kind": "directory_service", "frame_number": 26633, "timestamp_epoch": "1732599597.869495000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-6c3f2d5207d832475a686a02", "kind": "directory_service", "frame_number": 26643, "timestamp_epoch": "1732599597.983021000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-e24657e9d7e8c701351b1cc3", "kind": "directory_service", "frame_number": 26645, "timestamp_epoch": "1732599597.984023000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-aeae4ee0ed02ce1192bca2b0", "kind": "directory_service", "frame_number": 26646, "timestamp_epoch": "1732599597.985102000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ce5875f81697422b708e534a", "kind": "directory_service", "frame_number": 26647, "timestamp_epoch": "1732599597.985532000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5c31ffafced5a8f6481d7461", "kind": "directory_service", "frame_number": 26648, "timestamp_epoch": "1732599597.986188000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=nemotodes,DC=health", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5f9bdb98ecd5f3f4c54b830c", "kind": "directory_service", "frame_number": 26649, "timestamp_epoch": "1732599597.986650000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ee089784f2c9bb9af73a91c7", "kind": "directory_service", "frame_number": 26650, "timestamp_epoch": "1732599597.988239000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=nemotodes,DC=health", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-99f11879a02bdd86a30f50e5", "kind": "directory_service", "frame_number": 26651, "timestamp_epoch": "1732599597.989094000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-192c58f46cf4ad5ca7ebc7f5", "kind": "directory_service", "frame_number": 26787, "timestamp_epoch": "1732599598.044618000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-b1e7386d98ac44b52655ecd8", "kind": "directory_service", "frame_number": 26791, "timestamp_epoch": "1732599598.049093000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": null, "dst_port": null, "tcp_stream": 135, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-9fb6e541b46ca6dd31c5a2b7", "kind": "unclassified_tcp", "frame_number": 4529, "timestamp_epoch": "1732596617.073803000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "4b753b6b74b8e99e921a52094b1432211f94f6771119919feacb458be3bd19e7c6b42eec4c5d840d0091af8be2ed5787a2d4c93bc4ea9df2e060015519616bcd74072ecafd2ca06290686e3ef637654b4c61ed6867efc466e5ed4c9c8e74378d1ff3d8f7fc5ea81cdfb5c7658bd33aa258a7a401d78a4f0ec64c1c3255965207d4b2bf09ac76f56b9eb2ed57c8424eb4da83f058b6d9c08c880bccea4790f0fb7be1e1a2c6043df07140b34f1b27a7bd39b8d3101b2bfc058ce98c8ced737cdb4f271873ef2c7765c8acf62b65d127e474c568592c033599c9b97552b38272160757f06a43563818f00189a8ed4654e502e610a183a476576edaf02c7c38e4ac888077c1a36c6caa48f4db207cb763a37aff7e143096139f445861233d749607ee2e8184f0ef988b253354f07659bbe92cca58ad28e8bdaaf3aa45d3018a9c91920c786057a4c6cd0ba171c056f33e5341b9195eca518202d61874ffa4481691a7d6cc88ae732f5d72c013c55232c8783a6ac193c719c4600c4d15edafa69b24a69313f60f5faec3d415ffaefa415cc7b3ab5160b4ec562f03c921c9551ef2f7a74d63f6cfcf93fd82b7484edc45aef95d2766e04c4a31ad69310cfaedf17a5b36c9e6a4c7c10fb6de40b2b03ea9eee03c75319494f33844ff6e91b6a1594f78256bc0be6104bf499886d220956546b49d83745a27114279409d4732549009aad5dbe15a873a4867519caee46b626e81effe407bf32c8edda7c430135792242b84058798e99cf2f8b1f790289c3059d539b25404cd93633d0b2894c6c06abccf580e1bcf495a057916278f789e61bed5d5634067e415011c80c74a0547d369e95946c6975c3744148820857aa83987adf127b62814cf114d665427ea5f79c74fd332466a079f8ce343951d1a058ad2fdd66d268d41a959456fe6f80e028b19a39c5dfb50db72da5f66b09545f7342a433d67361ca3818622152d901c15eb5efad8fa2a013a35d8504a2a44068f3818ea1e35999221fce00bcc8cd474e710b0604ea798775f49c5333dee822705ad74b57b948f9b9fc9b3263a6dfa7eb3519f60be57d9ca8af2dd120d88b32e207ca4ceb87d6bc340549203b657655e367a0ea7232fca87a3dadcb7793485a37a9b7b43ccbf755bbba260a83a88d1f4e1260bb4c417a8b4893111daeab1b53021bd84e6203e3a2d19251bd2411a6af1c33d2ad99a1df9cd76df4d33f93fc81d9013fc2b0c9ca22d8002c0e536dd11b7b3ef2e8e27f1db645674b2968844c2f99c0db61bc3cbe1f9acf1fcb4047fa5838a336f12564a6423577eb191114ed1b9652948522226dbc3232a445037a14d630d798e16b32ef67916d60dd55e9783f3f8da10ed1b0b602a00c600c28e0beea3b7d10af0c7b69c95fb4feb3af45f1d503069124da3cd9e83451142bcf379c8521a6b9f3960efe591882a6344dfe663db8240169d1210b4bcf8f3f3cf2f8c720e510ec110fb476442cd2bf9e86e60d140183782a3a13a28998a17a8cd34892eed71d81e14078a812af0d9c742b63de237e6a774ca23018b355f4bd34f84cda3079d19af7c94819459bf3a8a23c7121d5b9d8b713074450ae620c6a30ee870d76556dba0a7048c63e50b414bfa1f3efafc14987ad7e0d6b3c3c5d76575336c104e07ddbb08299713041e1c9b7300dbdfde385bad7a916b79551526d217fd109f63db7b6989f85d8ce3ad8366071ed450fca51ae0bbfacadfbc883bfb5c4cb05186d04f2e9b560ae2ed137ceab543af798107039467d2011d1b3e9e52db987fb23a8f47913b660e522d71b61ad4bc6670b89a3042941adde35bedcf46e73c879d4fc5417db4c626aa1871e070e85366589e7875b8000c0eedb7c11d0ea37dade62906b897cd9e26a35beaade202f755a545665c5d067eb6b48b1819fd02e417dfe90eadf0d2" } }, { "event_id": "evt-f19f227984dbdf096aa0fff5", "kind": "unclassified_tcp", "frame_number": 4825, "timestamp_epoch": "1732596617.267154000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "6c275e26c5fd5920a3030f28876c5830295e95fac36dc65fa5d9972cc6fc14b30f53a5c46be44dc6ab6b2a1b821c26db80d9a31cba7c79b7aeb0bf2a5d4db011821b62db0c0ddea8a58694401048c4d4342d2e5408279743e184739e123f0e5130068354f8aff6892d1a3a3e05888ad76b5ee1710648410345dee8195cb9003f758a92b414c60b25b135592a6831cebd300acded9bc97bf1043b8a7892fdf1ce8a2790017e4265fcbdf1b6e5b9009643a91c2258b6165b49c60b8a3e4e5f51745d2a1a30350466b50b074f23f494ab232f52a0e7129faeea3c211b061d2fbbb5e5f4954a74dd1d7a5a79f9663a74ce8ff3c5aa2383cf3f55ebb3c33718eae4b432a7cafa78224c020e9d66dcdb2d0bffe26115a4d566fa85b15318517fb3c86cca2c09b854358866b9cd3572153d4c3a68aa39c9e1e34c1b2ae2009f4fdec6f87b88dccc20efe9e38b1ab8ee5dbf5054a39f032194845b86b68d37e5db1ee4a6f87f9b73da191db37bcd4971305c57e64586a9f84fc6904e98ce2e55f228177497e62141427dc7fa270cc6e681b3ddb9338fe4fa1847498b1398e9b95588c9aa62785f84f5addefb53e17b47b5800295e861e85447f8f559f3d7e0f4a702c7e57f8bb917eeb58c6c2b5c71902192067ab7778a50c494f9b7f323c44aa2f8a0a7df2365140ad1c18d0131fdae8cda250ed2748ef5f25c8135dba5438427076de8a2a1f877fdbbc2efcebb0f7d1915c54e5b89b206e938f83994efd75b8a6d60510ad59bbe84fc5a089e5e91bbe080c81b8f8a25ff6e737eb4079dee82aa9df5f33cc219cd16e54d3a1e6df70190802bee2fbccf5c65d065989db643c8dd2f8ad0c5d96e567cca86ef57b5b68352c7bc634f3e383f12141b7f735aff00f05c3ffea889132102b163b188137a49376dceb4a622a6e911020a681f3461b0555c77b638a08fb2156ce197247b7cd0c9297bcf07e0c253524fbe9c2e85676f6c2822104443e51e9f90822909cd4bd39b2310b5daa1b12e94365c34932953b1bc449b3d0a752de7354d39704751ec744fa44d981fca1a5ea7dcd6f51366cedc6a932a0b0a51e7f17a506740a9b3151519f22762538ffaea8e13f8b9b8ad7113a6bf287552832e728bb85c1bd779424ca4e5d7a1d92537822fdb71c9b18f454c2491e3b46662c2a46a2f99566b25087823343a2e3c860304227444244a8d73b305854fb6966d567ed15605cafe981ba18e70ef67bb97d33b8b29aac8362c71119c1351a8e0aa5e55c28a2f2136b94e8be5fc84ba75c7492a6ec9495f586811b6f333cf512149d6d3ffaa30bd2eb8e5838ce63136c845348b9e8f344b6f8f0c97f68b730ac83ea3e8064cace018af2c23ea6fb2194327bbb1f325994b095ad2ad52c4024a34d4d2d01374e2d0063478c52df3c9edb439622c40239b7c7421c24d5d47405b81611f9134cc5a65af206da639e346ec708e1e2bbe555242c0042fba95a6a1b4b202ff1bd18413ca775411bc92087df0fda4b62e761ccff358f8c4cf5c8f84ba79c4e5904043728d1585471cb65074220820e8309817bab2d50f11b048415e7cbbceb449f40ab0848f49920b3788778f35dce8aea9b0eae23cb42947fc4b150f42c1ada56794efb3b5eab5175364b30184ec71932903fbe6185baff6ec05ad54284d584e9bec611c17988d4d0689a5d67437ce5ccd1cd5a02f2796eac40ff4a8d78e0ca2b41320dd9545c942b624adbcc480d94333cef78eb0abcb2bb860e4b5e5fefcec1c4bfee79c1d03e29a2005ea559de29c90ba398d539ca54effa6ecfa0d010b5cc235b15a026f166e68bc431a010222e7c518440f495dd3f084276ed0f78972fcac576aa4f80a0f651ec220642ddeb6768da2acab5e3f324efe9aaeb64c49e46d88282a32e564b6ee4cb561613cab6545417e1658a2c8ac1979c6efa2" } }, { "event_id": "evt-5173d1644b16c156cee49c36", "kind": "unclassified_tcp", "frame_number": 5341, "timestamp_epoch": "1732596617.544183000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "2a7e572d541c27afaea5f77eb74c4c7d34ac8d4b4c70526e40cd8302e59130ca6e8f03a111737e2c8247334f02f41bae05f0a1668301cda07951b5b11b01f01015fa7422f69435a5d12f3df552fd40cd2fa01cd2480dd95e6cfe97f3e568499c577554078290d67cb74f5374f023746631809678e1845e366b548d6b581e71ad78720292cc677bc79b4638f1c06ce2ddf8f9fd526f02bc2a78acacfe416ded6634e61c0a22601887c041f69528e990ea1e6915d3ada91831ebe54e2335bfb8aa54ea4aefccdc245b3c9c5c36a3674a2e52a0f347ddcc464d04079a328a7531cca0739a33ad6bd152ab8ff1e208221442f11dcdb6d4a3eadeb920e723cc1ac9d05650493b030f1d4f1d10535a40b1d4e54af5f53ccb2dbcdeb142b278d980ac377b0ce87118ac08a748237a62a2d166bdee31f32ec81f6d02c505e5ba830c4d0dafea9e8f2c61c716855b7986bd84b515e204d5b69d7d093e90f1035aecb5165a2fb112ab61ab7e8cbc87d109624798e036dd8d05893465345cca9c4bc6f3d3508708be6d6cd91398df397247c140d61b9fd1582dfdb6c4622bcdfe77e71cff30a5bcc5d5325623027ff14a34effbe407c6ea2f89f1f926ee76db81b9d9327464bad056b256d3b8957e127a5c954ebbfa697a03df86483a832d7b647137f96acc32059933aa73e232f36262cc4c315f7a72feca54dfd5010594a744a3384d22af4414be7b1e9027e42b59ec18132f8db59363a4d33b44d4561f29082d939964b0af78950ef0a43a200a3b0479b60a5ef9b9273bd6a1fe899bf3ceb8dfebb78c20685ee7fe9a814e5672843c58756891eca7c495516b96f8e19fc7160ce85a76b957ee02a7e7b6f09687bdf0f08b565cd1c5b7a41496ace184344267edcced36ec8c56329e92046fbd8177d04a4f531ae9b5ce42167c1448b55423b1f2fa317c3323c176eda5b36540bb66ed25a76dafe20fdb5894c0533d6dad66c28c9bb8e95fc28672d96c92d0a8817e99c6129432694f78967f7342c2625ea8f9b11a81a333af7070afcefba2bd505083ca283604745395f23902ac6035486ee3602769fbedabcdc230797424abb3702864d2ac745a816b53d29a5dfd44a4729d7acd8d53bddf551ccc24c4bd333b763d6d68a3adf6de5890eecb9280ce949ac86f6621ec1cf8e7eb06192c4a3e9934d7f720fabcf2c44e7b7737ccff5bf3ba6703d42f446aa00a459278ff13d6a7522eba7cb7cbfc467b80d90ce2967fc0ee4255398dab2ad4d6599d95cbee7ed4dfb51700d2edc7d549a74069a441f04f3f55a3d1fab2a92308b77044dc025a446abb72d17cd269346df494d082a98b7853d34559fae1b56f6ba3b643034bab32fa6742d8d853990f9878999e501f1a5fe4154c0621ce64fe834d08aa29e6f0e38ef1c1395ebfb636b015a0cec2445f84ecf57ea501a71968a7e0065808c4a50676e55e101dc89000e553ba43ae3f08b79434a6a3d462dd42c0a92a3243a3ae73b29c2056bc625e0c1965f1e8dceeb0049172b71929054cf74a4aac439fd3ef7383b9c5cc4f69dbe8a82710c5b969259f90ccaf0707ab1c7ec07c1c1da9666eaf86919583fa2c1e2cec92e760870ea450878518f6f78cc5c0bf12eef4fdc8edb29b96168115f29ac5d0a97667f07e8207fbc750475fcb48cadc30684ad89674d0a530b72d578ca07d977bc2e836f63d149e65052f6400a21d9127d769406373268d2a0941782a3aa4eb3b841fa0206a6f3c8d20f5e90776bed07108fda1d46a34033cba9864fe053d75a77cbb44df92e0b94bbecbda78f4bbf773b999311f18fb37a721416b18db9734dc6cc1c71e1c117bebfbf41909240f1f1f2444fbfd5eab32c80ac296b8d31dab205f3f45b10a3c68a2356318b3d394c9e1872357e94ca5442708f7cc4108bcf099eb43cce7782155ca57cede5bee" } }, { "event_id": "evt-03b548472294909a29717949", "kind": "unclassified_tcp", "frame_number": 5507, "timestamp_epoch": "1732596617.641566000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "2b705c5edb5a978a2b36ee4f254ee46b9f2aabd6ab7cada44e9aed7acdd28bb8126dca4c888c506a2266b1541b52edfc13b72ebca74aecc7b7ab70f902a27589342520f6e44ec7be2c933fb5553d9d27d3b283dd123f43c2332dffa3620961e29f67aa75a0edf2826c70acf1cac50cbea8cb45fe98f9b79ec08960dce156417f322df9be22ea42e57db386d63ba915638a0f9018d655f6982db657ac19e443ed738023e5c380e4b4a65147bd7c81066a87cade828dcd6652c9d2866fe06f26c914e43ab0f90ffc80a184560d88c1691a0ab4faf9c3a03ceeefddffc95c150cbb70fbe42ea1559ccd95df096af9e8373d7d90159d114aa7c38d75f4dd8215fe24392ff8c06fccbc0ef67372f37e2193e4690b7ea053f520a2348a7f8969732f2021e78eab079aba4df11c96452d682c29c6f5f8b5a0d90d4a8782585e62778693d90b6e588fd052b924588f3373cc4e2893de85cc26a91b9e434bae545c62edbeb35d9bddb07050a9f1a4b848fd5a127d49dcd2e1c699cff5c5b35bba523a5e37177199e88066acd4a16e147314e97742c39fc544d453215dae5ff5193210124c2c29f58fdf5cab4886b2181b2c0099efab48034fb3630ec133a148b9f835d4d865e4d2bc57c0928f2cd579a7d7b49361cbb6485f88c38a9e0aac6abf30e15e0967b9d9dccbfb81113a99a3976bf2b57e157ec3cee6da2867e2c4a7bcf70ff0ce0afbd2812accf11840d2699901aff99be4f5a75a27f9b008e0fdee60cfe27d31b47b86398dff8c0591650221659ea44a2b91e9c53256bf049371a6ded92a5c31dfda01e15420e49478726606671411e86938cb01a4ea879c79b535535f90a7eb78cd7635924773c7d8f9ece1bd95624a3495bb80e15aa0f955ad03b8d8559941f505e5009dfd795c46a5232942cb77503b7888a848307665e5a84fc6179ad5b45be62f83a87fdb3c4503a5b082fad11c65886eefefe32a82e3d3df9d19c17315275b8cac722b5de0faab433b2bed795542e64c30c9767c5824ebc0c4386aafb99a657af9617cca6deaef8bb6574379263d209b514599080999071985825c2b756f658dbbe435536d326f3b1590f28306f55d64068525dd3a804a90215f0234f27245ddd41c40173d019979c40a9a1815a330ed135f28a911b8de4493b77142d9ed3cbe5d0182225ebe047754e43cdffea699ca601f5edb42948b9577428daeea25c36a5a41090061f73a19b79e8c02dd8c947f5c573edba4d43c1e5781bc757b1130036fea0f0976352463225f308e7c05477d1e22359c6a40f8d6925cf6b5f8c2253c0ca0b40f570c4987a981ee5402957d8d9985d9fa36a99451aa1bc33118ae557f585b96902a3db124bf338d59858c3e0370d35017f6fb72ed40f558695c2c8365f5346c161f0623f4758f5cdc63db06005ad17a3fd31d33460731525338a838acdff1b0057e6d059f2b5570a8819ed6941d3184f928727156edffebc65ad674bc0a4db5bf0b9ceb45e43bde88b0127c424c0d52f90e0973d0e8f56921759cf4ddb38469bf1943dbf49c99c3027b008baf04b333b212b7580bcbfa9b46c8691fc464875e7b62b8078322eba2b9943b7e804168875b7b14509d77f7f72bc56d4841a1d954787e824a5a0035abd627e5109db14f322efd19b14bae2ce9417f977b23e79a97fb6fed2a72ce9b8adce80ba5f36af854bd7cefaeb7665d8521be1b4e0f482aafb8d8cb9bc2179678cc7a23efdd70a9d422cb09599b9c63af566852a6506e7519de7d14c4b6ac71d240612d45a412496ea78932b7fc61a524fa5e17d48291f7e67dff7e37d83b93856f2047858f84f91094f195080b63bcb72c9710bebd2774011b1a57f7d1790c7420c7ec15be095600b9c516c3c835b783621903cae099bacb9cbb1265185102e2747c489eb834e86de44c268973f573b8adf8" } }, { "event_id": "evt-7e2e5e929a0612c52f634571", "kind": "unclassified_tcp", "frame_number": 5536, "timestamp_epoch": "1732596617.662503000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "3366555825dc06bea217f40d1f62645ab3a5363dfe576ec0c65247d7504c26f6c09d5309e5fb81f7a7bf80693db5e08f0ae885f9239ffb65f12401bc8c1d27f79d57f2f450045ea084a9dc7dcd6fbd8a92e42b39d64f7e9225bc30fe4f01e3f727a4d5a35b060f3afd6f7acd7423792c7aa941e8ef5d3581f5689ad959aa5bf580942740cfa81f6b93b18e89ea0c4880f9d148805388b71ba7821f7388770aa4837a5caac2f4dcb56d6211beb8501448c6210b835d5519bac175f8e3b104a96f68e325e8a74519ce4014925258a17753eaaf1a773111041098617eec73231598d65b339333977d7e0c3f94ab9bc4a14dd421447f96200ef51e782ff74eb2a08fd72b78159baa5f3e0e38f2c61a44174e64925dc18258712b23878aa02015a8161e1dab4b3ec1c75690b66b5483fe4b908ce68033095116ebf22d93834c80735edbbe7baf592f12f7b040d17bf1813b17394f0d160f7ff497451e6857c99b87ec7ae814dcd82ea69800f2fe72aa6613c4ae6478abeec1d56a324265fa059454dbd7b36d3aff20f5250c6bc483fa3f4b940ca4085e4419acc37d100a6c671d053f28170303001381bfa84fdd3b925d59e245fdbcc196c119c04b1703032011750217a12febcbe58778a9829f127bce16fea7374b4c185bbb954973ad632b009ea6100f8a04f994a163797e7bfb13ae1a0f7792d64ca181b5def7c9766081ad0dd0943df2949e5f2691ba0f99bfdb9ed2eaba16c0a0186d4eccfefdafaa45a5aa1dec75ce52cb458ffd6a4e61014c4c21d6b844652f70a17ba442fce4bd00cc0ce2f2c3c4dbd0bb9c41e4622820298d95d03e693f84998b512daee2061985376eee4a129a5dee6d5ff8ad8634561fba3eab17cd0b6519d67e7f8b4c5280b30b97394e0c530850f5c65bea20d586fec4537db7bad0a62c026bd0557af45a9a6b645ce67f29c425155fc9a993dc1d12a45a78f134a5724e4a1d7c14231e75031c2dd05fc2d5048316194f12a03e9d92a3de9e52b985c6012f12e88bf929c05868b33bb7c212c807f3afa3772b6d6cf1432f1cf196dfafdad78ec56b519a1623784c5c4bb5c41b598cc85e791dd076f6accd4f33072f9991dff633e49b67895a26ecb5d0cfbc826e23f34646cc1c4f5ac1ff1d88c23c4ffb22bbad2d247e827cd2e54408061c99ff5dc50c562b1ed8703c3ee467d4d39a8c1c60e6142abc0c071084ae992798641631f69cee09b873401dc36c65f297d096a0f6de718ed8e0434c8fdfd771aa99863708d24b10fe9379819020ffef0dc54a83c75b064cd351a34327808dcbcacd515c701a58a17b9cc09377418841fcf658f5b3d2985bb468478434d008de4c0a4fbdc342ff14d5f00f20697f579f15bc6fceb271969f7d067ac42b78aea0b8d6d3fbd0ae3ab1b788916b27d6e86e76293f613cfdcf3d7976957c31bdb85d67781aae6b6f74fce0753c6c18c1834a263b14ade64666fad0717edf0cf5a13ef381d32af37753f38d46e70772f987eb4a5a88128009b8663ec97f2c2f883f0023e2a65bb78a9b205c75ca6f26e90ec4ce61bcf506febc5654c4cbfa3c3d90a615f93ed1ed61a32e78baf013f9b0de1c2bde55b37991575d84552f684a298598a57d3a81699bf7c9b7a652fbc9e6751350db9c22f8cbf4b0abf5acf4ed04f281784cac2aa1565fc6f21ed9576918939b1432c7a6f6914a2900c5491b3331be097abf0a44990675626870462401495e88e0fdd30274a2d29b346734ea71871d2fdf5967df0025c8ffe4c4cbafa5bc587fe100d5c359f35560f05f79b6dcafdee512122cf26301170b141c1bb14e941e0962c6570e1405757f0422fbc633f0587b2aa3d68b12ec09e066381ed73786b8f7a7dc5d32d97a5eee956a3d1eb004630e544bf55040151e288123fcc0f545390d927958f440cb852426442072097f" } }, { "event_id": "evt-4897be7c43476d73c088a190", "kind": "unclassified_tcp", "frame_number": 5539, "timestamp_epoch": "1732596617.667773000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "3e61295346745dc616acaa1877e37383fbb7ddee55ec4e6f804c4bb26615e84c4439dc8bb7637cb9ab4390f3b12dd818a88f019bed40f8ac6441f3d0da143d4fdcdac7d0e93e7e879b23461c3df92e45a4d2f20bc767a1688d39631b525d191b3194442ef5e4b7870c9ecc17312d3bd84bcbed6deb2d45bf1d60b8556ff01ce4a20164d0ab2f18ad627bbe8aa59150eb322a8442f273d6be5244c9a352aa10ef1e1d47dfee3b2b7c5757707a1843a1f73bbed34dfee5feab60ca4b4e897a638f9559045c1640f2e2ab8c1da081d19b2781367db61778f437095d281aca80ccade558e595f3b0203af7f6d5c009e6c19d8352a8da852606def12a8aeb456f263a25be0a80e4085922a106f7f88d36b96bc1713dd2a3e6af2da5eb70dbf16b28329205d8941ba4a9dd983371a87f9f91326b03a3465e4ed55807687c46c4f5fcdf8d50702782c359d6305fd16eea2c262b751ba5628ce5d12f5fc1522f01db4eb1973ad2f4b588159593a42bb53956e4522a81e054a39ba4cbdd3637ecc44360f18658bad5a40264b8de19585d8ad9d4ddea0f7bfce51a66ff951b44e85540246b613cf147b9640c920832bf083c86146968bf048841314d56c168ebb5ebdbd21df044da219f7648dbd41e1925362bfcd13260bc6fc1e03bf5a8c4e61aa838b8d8ac31fb8e2e2e13c22b5e2c421b337589fb765bbd03daff369ad31b6547e8393c2658b350c926411134d6c104b72d90653647edef1fd4a0de8f73d29c44721105d2adca9c09c69db55b57bc9bce1ba83c75bebc5a12d0a37cace646c9eb20504a31be9c19d76e3940a259bdc620816e4a48728204ec1ed7b7a266c8db7aedf740df71b26860713e620a25ce85b9b1f0227c01dedea9e3e5269a886c63f5e78b3ce7e510a4b6c671f6eb229e7a34958c15f9299e69fa46839bd82c29dc6a232520a4d5525a682b6c2d19bb3a74d4e21ef55108a85168ac10cd20193cdb00f443f9586924f7b46f6fd132bea86dfb1116f1c955004b83c7a183842b46c0649d41b9ebd179ffe2fe53cd4cd6a95014d3668a6b48cc9694d31916527bf8dccb84f92b66529b8171881b3cc69001ae68cf32e3d03bd979ee6579842c4a6a35313c3a93e2fe15542b84de45e44928f94f8330a29cdf92e0fc2d7dba4ebc71bdb89c8a2f447bf216040280881b1606a53c5dcbe4c543d09057020cad918488e579b1abe103a2c6a75491dbe0de0f016fff814ed4a5d9ddf861737374f23693b6acc9cbbc3a672b6cefec6dd9f1558bf968fab5f901f23dd63e5b13df79d46728192120a3a0e6b79e0b7d30d70acb3d8f0cc00031a10a37944bcd861d7a5104afa42a6ea326b38b29907759c359b97e762bfb02054646494df32bab7596782a7bf2b6c4ec66d7d489eec38ad2f4abe09a35e1fbdbefc986e2b1144f471f22f9ac42c91d598b6f663faf32d540b3e5a0f8bd5be02a53f959bb399c878b2bf215b5101dfdee92aa78a4ff5ff3375dee293bd111457c7c1c560499edcb904ccf4e316335adb5a44fe7a9c9f46618a7ae2332dbb9e4b764109f444e8cc07219180becdac3dc5754455f3884be7a74e81d8459fdeeb639fc040b9207b2a9f941ee7b5e1248b3e080ce1a0e4f3dded3b4c35a7031c5a2468ddc567d1c951d07742916e82bfe8a1916dd93a5f10363542119bc56880707e1ee6d0592118e85b7077f5c9e16d3ca1bfefab6c3adce4e96a1c609b78098503e6fb8bd55dd1f476bad462e065287f2bc43a5f5c7deac2afd8e7ad2cb7155513d3060fc789dc4970ae1afd11f874e142bf5c3e15496ebb5ad4298eb93ef2f4215bcbc3cb5e9870d2ec727627d73670ebc043875a30e6cac75dd7899c9a5d43a592c75e0b4c57b62080df123cf7280030e0feb387a9de80699777e81f2524922df05475adec8c95306b11c0d07339fab35" } }, { "event_id": "evt-dacdc31a45a470367bd3a06a", "kind": "unclassified_tcp", "frame_number": 6644, "timestamp_epoch": "1732596618.208715000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "6a21794b13999570b2853deb407bf6b3ad4ba951cb4ff05782b4d1b72d786d4d195a066a52626c787f0c3ec3a60ee86ceeb690dd2dd902a83fb40f7e130b8598587c30d802c17049ec9006b6b7d154c01c93583dffc8b81a890cb81d59427a0cce6cffc31bebb2735b463b5f1ea300e72d79ec96beda7426e5170ac08f0254f71f1655caaaaea2539b4128dc9a0054be729882cd370af17902e82473fadd278cf483876d18950443a5947932558fca5d880d9d82e572ec95cf09c100edff4e2f987cae2e2a996fd1a9b9c8ba63be0a263b388306cca46e5cb11d60f8019978369c32c98964ea397a0507f3f677dd6b6598ffbaf28fb22097e45ae92dd229dfa45d9f0b7ae390cbdb0bff19c3ecaf001ea298d60600b05310f36a63efee8e676d07cd0c2dc791db05a3e358e7b4de0adb876499cacc939f19b5ff8540e6094c4b99eaed14476deaf96eebb28b4f7463824b9471b5bcc92c29a40e07c7b1575ebcacbfd233ab19b5eaf71575c13cafb9f7f2b6de6a528371718c9dc1d1308ff2f681b34f1c3cd095b38205aad309d413c8230df25b7f3beb915203438af1fa6db77b42b9df4a4dbff019aa5b8e1c2cdbd5a2c6a1daa134e5c52cad56b9c3aafa4b5cd2b43ea91d890d3a87f3d063e2b448b1af1e8fbbb1165d9e03e37c5589bd428236f2a8c584cdc8b1ae060a28cc0cfafb6d40e2ed10be93ea5e517bd51a44126d837b18a7319f404cc4320b2a9329e43593e8934700051540840ee92ab8bdf1d3587e1b6012bf652c29d16756273cca8a50bb59eb83d3801d238107ee443bd1c0ac740c1c2acf67d6b4488af821acf9075fe6f1d9dc4243fa0e0c5f7045513dc69d404f9cad54940a42f527e1f645abf4eafa25b843d5f90eb56a1e6b03ff8d46c5507d12ccef63897f0326542fc6b1c124b349787aafe26b378f6b50a50e76bd4ba8fb57bcf92d8723e38143daf94aaa3134a8ad3caec3fb14a3bff8ed1ade38f88e2f81bff979ab96417c1ad696b47023eb210e7a2627d9d407719dd934ba088342f37517b3ddb9e962b9f5e5903ead811f1a137b4a2f3e833d14dea501c0fe529d414ee7832e304f859fdbd197a2eb89d3dc558348b47e98e2e1db2f97e6fa6e297663cbc06706602c6d705a938297b7d691a6fe01f3b7764ee6c31a3f65f78a1e406a7b786bdb4be0632d499db07c2d8ae57551c7871f20377cbde9fc93200d25f8c25e119d6f415748cfa7537947112842088b1aeccc5c04dd507ae60d613ccd6349071aa1351ef1b50aab1275a41dc2e629b0f057d1474a1131a13f4582873596e0871eae4cdd5c7c318ccf63d07b4a215c15598db3aaa29e458425fd697ede4a8a7557e8c52427f400ff8d63dbbcbaf2ecc8663f6b4c59b8df255cd788fbeefbd3155791b7ef13f8d7b4d83e3adef521b332db9478929acd38bff89575000c9950ec497172a0c22806df038a56c2023df87ab77a733e88f022d58d68c4b63aafad8dc9494b9ad8f35f896a4dd460603be25fa79c8922ef0c736ff07f9d318ab943d487eaa5c44eaaa00c36e5e8374cf8e18282373b2b2a8744847db4aa2447e0ba8eed1606364be7d4f36e5ee397df8fca81ff08b447cee1bb08d266442b14d6ef511e9c8bcc8a5aae13b88b1444320d9da1c55012cebb69ce03343cf212e9ec2deba3c12e6f2a1586fc69956a39c28706591291273b7937809781dbb36ffdfffb55e5dccd30ceff0f763e2b2603bdfd39b329a0099f37e517214eb8550a12a238c993757ff45917055311b6a3e1a1eae526d6009b3c572aa5aba340d25158df72006bf8407048b7189fea298e0a741d2dc9db615fcc4a454966ec05e0e75c29409a6c637cf475ee985e2b74f243eaf2fa0a349a3565292818068e1448a21c70c15d87131f9381c53b64afa4971274374f09d3cbfc54c8a471b984f4" } }, { "event_id": "evt-fab5ea26eeb8008a2356bbd0", "kind": "unclassified_tcp", "frame_number": 6910, "timestamp_epoch": "1732596618.292811000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "5072647d8458f8e6cebb27fee2a5b185770145bbeb53253f317b0aa5494eee494af1a26c5580837effd93ed4cce2cd0980f508ce0fdbeda85f3201a90d28fcb7f452cd6b7ff384cc4f8502187b1e4887983af3624cbd75706ec8dfa8fe023fe4d9c91fb762126fa006c83b66e6ca3b08bc0735341fbc03937218484df3df012295d1df3fd1ca378ce3ddfb298242b45d0247ec173764a151785f3518a81835fd24c30a961c2fe58cb7b257d26a3ac588d7c4b79dcdb9f32b2f26ad0aa458b6029d0689f39abf395a1411ef81ab1b3c880447accde60ce47b91996de3e28c11ed3b4f594f7b283db7687e79a6b22fde68477518f9519e68c1f07c6b0f6cd54d6eaf45ff20a64d223e2b8be1eb8d211bcfa1d7536ec0cc6fcd8868dac95be23821c9fda69976d5a7e05e4580615e18e2169cac0b2740c0c181116ec4b7508b420f57dbd464ce2646ee9f013c2baccb00e9975ae2828b16276f5a01f5033e7f3531a28ae072c3ad7fa353067daae4fb5ebea733e2d9a5dccdc0681eb6ea67360eb013a52c9cfa2d20697ab7dcbdbc9ac566b330c4d0a552ae7fa3bd4d8b713c1bf0c6e742f6a0024660f6ad31cbb23c4a00cbbd6cce2ef6881b10da364d0f02e63e6b0555ecc3cef6d56a2473abc78e80aca54a9fa5effdf2dde00e8613c955e583c46c3983e4c551b60c1da7ab631f9af2bc464dc0f420c98ebde9ba5358aaca5c22ff6d9ded8240b9d23fe06af476d94a45a818b9f06ae8ce44cfab451ba453f26894484c1d5cb455d858db238b3254e98e78dc5fa1134c204f1c79f47192a248bd9d8f00123f1a752ce1864847cf93a25bede715a13ece56057ec824b4522816d220def6cd3fa868ad40811026d10cd10a987519a3fc95d3925f00289537ad7a51980cfebfa97625f637a38a041fae30a1b86506b9a9a1b3738ef00a8bc3cccf31e07c3e56af8350baa2d38df1173d2693fbe0541f5d795bda96014d3540060c98de5c38863d69472794bbec146f5d0d31b5b2ecba5770ef05dfd095fb9a398057d575985ebf4ee0a48af60881211fcdaec2dadaaaf9cf3a5cc98fb2dc9592f88663370d946d74cb0b42e4f397ef201d1f66c12d34aa1896db9ca7d8d01d9b6ea01d2c6b223ff98ec609006d3e727570744d818ff97e174caa52e78e901896eab97f51ca9811c8c0eb46792500e2c6ead771d1be5cd00dee6cf23a07e8cc25f75dc8b35d9c134e2c984adcebae03bd87aa06268520214801310794748fd9cd2fe8c858cfa74fdeb1e20bed2068da9e5d53a27936f881698afb3588d5fc84226304debad4c337dec5e7d6aa528c83e023d2b55795c24c391307b91d6c84d3636dd925b6586440e632279c6bab69f8400e11ce09df1d1e201f448629031535c39ff1e0cd27a7640cfcfe2153258e44be03943349f2b3c92f737c8e60de448908c525320fb12602e7b5499532f8c7251b31207317ba545b653e37a9ac40e4f4a6e914331b53f15f77fc2a9171946ad2108466a2c2abd95b746bda2f3bef3e11b67173efe5a5de37eb1b94cb67b4198c516448359709ffac2159733ec821689cff539086df66f2df135c7359205d213caf76ee999c6a121fcb1b4801d8e027dd0e32d2007aa61b019ac51dc7c2f0e027e90167920fa935f906622d5a60910d8c7899c2806336648f5a8c2cdcff9dda3f03d1749cc2bc47a180dd4f71795fdd3b034a406e71fdd0803538d1fb6bb61f37dd246f8533c2abced6e544078fd1dec27696a79a46239049f9ff1f44a18293cfc84cf6f32fbd42e28fd820fee21817cf372ad3ad5cd3546656082e4f698a35de2d3403e1f22e8f4e71197b477abaeb1a9e242b739e94902f830d24f92bda8262392aa5bcc58d343c3a68062e6438a5c0e993491cbfbc7fea79a86bd5514b99f7d08f9cb3c7bf27d3765e23dd33dfa921a3b5" } }, { "event_id": "evt-7220a9ca36efb9a8295e5887", "kind": "unclassified_tcp", "frame_number": 7205, "timestamp_epoch": "1732596618.389736000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "212d323b8b5ff5cfe76aa1f618226c428de2a7f6d8a58f8f5a5cdc1787788ae5e62142294c258651535ffc7260264108b6486badbef09f2ed753c22967e91f8af923d2252163f827ebf8c5eba076c1430b5abb34a74e760868d0ec72f5a6aceba21efcf771b8b0951c938074245198e0986d027b45ff686ff4361073470d4d7e9dd6603933cb34c5456681c576f3c6593d59e26f03a8aff38b7523e13aafa072040893d20b687d6c3a85dd80ca53d69200e56a11e4cc3f7ba4b50b4ded0f9c1c9d863bfc00ff7a4b833dc0518175988f304323e5540ca2a8f38c32dd73039a7fc68c91d4ea5ce512b156d97a0707cbcaf07e1ac6255f8f75df4df904db305d0cee0de7c1b95cc479fd1dcb881f8b47f7ae2a81e35f5ce4f4324005e6e37a9ddf4fe057fe3ef8bc7508e5b363b7e5963474fa2e7ef4637b1af587b3dc46080d8a3bf64abe57a7e5593cf99a64beadfbef1d032988d3d3066e2c905a4c2bcd6bb0feac412b7387c68acbb4a82561b35e934249e0f68b7df7429fa544336e1e15a2062139fece1bfe5d84514f0d2be246661aac5b5c34e0216c8adb49cec80ab2f927c1e02e345b7f385cab195042b87d6b59076658af8559b9c1f82337f2915c6067d979fc21f3d4e085b4da0bc3949205e0f55cde3e98ca6b02777c7dfb2c53be39147116f55b6cb5ae75e669ba44d881b7523c307e1a6942e8ae28ed34ef255ad9bea005b57930761c0c1261590a59a83235ed48277bcedd5185e56cea16793ae2c1ed8852079a3c93fa4ae0a527bf176e6ff03e49756186209aaf8037f1041d4b731fac6cbc6900dd2ea46f52e14a26ddd36071448e491965cecd3ae61c527518578344d575d75aa8e1ea2d98aafb95a920ab0490b1c089ee74afe891ef653b38260d40c98dbd19ed3eddc9e4b2bbb7b278aad3cda73bf34d251bbb911b252e888f5b851bfc216ee999c9aff4a7d3fd2f871bb285de5d59b37ba153a8f1406f9fb614881f48d7dd733abca56f5213e1b6d79d79ac270352345dbc4d1c85b1292f27659554610cbbd75e6dbddc6e2449cf2dc1a9b7f3e046bc4b81f22c785b5d9613fcc1fd4433f972cfff19f8e1c171f7b0b3b81baa38b2766cfa629b6d58c2f4fcc44c05a2f8b1c9f61550eb2302881dd6cad8b28bbe52de36ee8c6ce140b6a83cf27130470c89d0490b273eab4d5fd0291727236b0daea7e5bca11c1c44ca7e1177f4c603c63af61788b66672931846a1be5bd213a30e522079f4cd3a29a6e119499ed4d1f4eb2006024f55baebe31cc0f243b7a656690bd54011e8345eb97bad8fc4244141f0de68a012628d9f6b9eae86c9d28d4ae333a03e076327606d519db1fdb5e048dded6066768305943565b2e95b74cb49ca2001456716201870f02eaf5b42213169433cef43db6af4b369b34506eeb40f0b28821e2b8f6b9a4158482e1dbbf5640a61f107291d59adb579a54c8123cc24d2608e6bf3ccd9983548ae617c4310130a0b8cc8cff70c3cf025e3a4351e082e0ad8536c6a62b0a5b1f2ff0344ec835feb50d2ec858391427b155de3ccd3819770911a11d452380218b6335c4104311fb4ddf4be59e004d9dda69fb8f72ebadcd7fec474980ff95782ab6481da2d01a9f9871b890e6ab580b9e38e49f2b766db1e7718fd5c1543052c43dd3005aeb98b31642168d61151c6a3a00bcf240fb72eaf49997ec6b15cd32f87c45b1b23bb2d8216f838d0e638e71ed7aef90a147cba40f1673293de28fbdb35fea0490c283311cef6a0e1b084fb7f2a189417fb4d927cd727b4ac1bfdf759b77c73cccd6b70cb0ab90ea5684c150f8c8ccf0b3cf5bd69c8253b0eb67925d151975dfc0e3ac1435c3134bed4487e04149da5552787414528cc86184829ae0b724e5792acdb122b29e1c03fde1874f9324e34eddf2c57ea1afa49b24f018ea0" } }, { "event_id": "evt-e88a8af7f29dfaa13e61aaa3", "kind": "unclassified_tcp", "frame_number": 7390, "timestamp_epoch": "1732596618.463288000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "452d2738f0de7c31364caad5d13bcf000c41ce86cabc01155e5084891290ad37187d5c7486a3b88c3acca82f16537f8596fed04191a2242c392ab8b13f6fb643f106b894d94056fded79f9caddbc8cc50aa64b5056d9b076381b0b9e41e305b78214db28c0af42476f1bffcbcfe84a155c55355a49c7bb1fa090cfae125191d9f7cab92b7a5be5df48fbc44a548f375253d1d5370665c54992dd807a975cc3e186b8f6e252ea4dea582f88061a4031a3571a9dc71850a8a20b5b65489e09b6c0964c184487e324d68735a4fb9bcb3268e97ca2c942b911ccd7ea8536e814e4f0d9a8b942de1510c4d43b4b07c60a1a6f2df928248e0a6539b3f8d1101d41a9b2af68f12887d6ffa3397b5dbbacbea2e9f53aabe224bf3fbf82cbff401238459989ff7a003c64cda92a45f2e28ef6adf696fc718305faf022b14734e562ca8a8206a22d242366c357457e6e66074fda3293513b151fc62ae0e1c1227b8a8163819f4d37806231d4210a9cc737c706895f83afc17b5951145f40d17d1c4af2da27a71973f273f033b3f7dc9b4ee4a40347a181d6d141f7f83d4d17abb010dd0a84430ec54183121aa4c2675134a3a45850a76e997298f3dc4f85c5449a8fe6eb5bad5310130022b2a5fda867545897cb4b72cfa65a402e747abbd786e66b942d0c95f6aff9dbe68ab5171d6fe3c075c1f5102fb8d27604f98778348f2216d3b0117d48a250e873bceab7affddea6864dae2930540c6c55d26364116ddc242939d3a482703369fda814f6c9fd18e1f799f9bd02d9dfcc8a20fa209b3f3aec9da85de783308358c4b63b75102594fb95d488ec7e111ef7b39436906f82d5cd7238ff6105cc887ff9471703031f5f657d517ec7553c4d17bf43abee8fc4d73abd7fa285415232156f6f764e5c43821932ac97d406b42212d5dde6e96773de57f41b6602a6d8340e660b29870b322619bcc4b3a6db550bc832c34e9839974af6aab7fc1e809e43beda2377ef953248ee335e78caad7456731ddae756ec82d9aae30ab51ed06398fe97c9661e9139ab58101b9b4c8d8d445e1bd36c9c250ac6c7191909ed0dbb92bceb45c47aab29a7e1128a34029886285775ed00ae1c3c6d35c8d6f7bae44d162a44a435abfbd4c59b1431ac7aa9e4b43dada1a476434f2769d5afadc9f02ab0629d3628075dcd24b7816a50a22827f5cb564b117e928fc498288badd26b4a218fec4cd97153002462e0a40db008f08a48c3e13a921c5bb53d4728acda83da0fc1e16ad7c81dd3c7b4788c022ff94be0d6f6c82643bab9148b6bef5236549d6b4877756bfb3727f13913c7d5e6d960cac54d1b8e5f0d7b73ddbf031b0196d6959f24ae6c4d4d8f6f1cb1c8229e43a2095d1feb8ec2d47c947feb7cc2d69e0bc42fdb9391adf6cc591715dc603647d1fefae004731a23dca7b70945cf826674827731a6f858bfea46a2cccb47925e3680f2fd8b90b49a187b1d7fd4bfc8e08c1277a49163811c8fcaca8a0d7db9a067ad10c186b3115645a9acbfdae48383087e325949946635a0e361dfa615eac42677ea9326f10ed3db1c6e038166c9ae440671a0236dd95fd08a27b45ee0154a517552ccd54c989bcdef645517683e0f5d9a2db275c517472ec5f6082499e922f204c66492768d68b64ca54a8ab7b9ba8fd00e25b6437d38b1eda2cd9c3f4fa69d3da9d838f0ba864b5e42fc34f641088ba3c90d33be51f141dc59e467459f93c4e29a155d818f63a83331cd8f5a0f47eb21884999109987125b33854d0c7c3da71697dd6bb89f27bd645cf9b6fef3ff8acd7d7142dbd0061e6322b65e4eeb9e065b2f3c9486de5e367995250953da1cd803dd5c9374dd41894e273c5fec9f1f154e030b771cbfdcd1e7c83531ca71d47d50cd88b16b7954c78bb723bc5c6e410e7ef9be0f5d1885b99f757dcddd" } }, { "event_id": "evt-65ec91689275be0ac7a74de2", "kind": "unclassified_tcp", "frame_number": 7641, "timestamp_epoch": "1732596618.542608000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "72282b555e08e00ffa8b3c2289ad98f7ac204df35271644a4b1f9fa9d3e2d9cb867ae62c1616374279dd65960c39cef52c6b3953c908469f4ff057859c8fc97f02a35cd641c8fade2426290f23c66765869934c35f5d8ccbecd71301af6319abb2ff8b558f87fa4935ec509d7097d20b441efcaab7f9111740b5008cb033010c47d9f89a6dc444d820cb7af8d366718db0cc9f17a7b04d73c1bfde69c36b2088821e3bd1b2b6ad0f94ef24ca836b651a96a9cd63a01b63c24721fbb293f98ff6563fd6e8e9bc2f680445f6b30663d82bd60df5a580ede6e0096eee2b59ca8e11c9a32f87e37b58588498d31079cc1f12d4c0c404e586507a28ea061ac9168a9a75fc5336d432c1eaf6905564ff33e2f69dc2369e1bdc918fc1a4be6fe2978b68ef597260296415a37bf6c860b1a87a1aa88173b4c7494f98359092a5be9d70e2c672e9f958163f3df713eec698ff2ca9322cf65a41d9f0bcebc9ad259f1a078bdb6fbf931d44c3eb2982a3c247aeb73ffe40a62a2cc71a70ca5f04c0b9bbdaa47a47c30c05d2746e4da9eab3bb65833fd8a210d46d39765c7923646a69fbb75392fd48ba215e58ed9aa84ab7ca19e0594c1344b1dc7e2b04433ade1cc53d03909def014bf4d3920ab640afd82c0eae606e5c17c44e026efcbf08ee8004db841772bb49989bf3e36d7c96ef23bc66447fbb9a47e018bd267f297307bf8d84aa22d1fdda96b660ad600ac4664348d89ab697db669fdb72401378e48e0e7bcd19051eaecbc970236edd96f520c0574d2cac03cadd711b9e96c7ecb69078e3c59afcd4032ea868e94d311b28b94b1ff993ca1fd941e32c94fa5382a60b71be9591f61d3a1e90164a86be9b797b8a14a62dd250adb82663f7ae6be4c3e04cd78ee86db4b49fc6a15170ed6f130faae2b3646911cf28f531aaef4bba8a3bd80ebff1460c94416294cacde790069836ae85de649d85be6c4abf1d452fa1e3a93ebfa183dae058425ad7805aa0834a11e50c2e11cf80ef2aebe6f2a3739442a143f8af060e1e9fdaef5bd086c5f770e66cc7a8ddc6de3cca4b9bcd733b2acbc451d6cf0289a4ce9e421eb72f9ed819c0f3a3b53e8414216a5025863941840459160c974424527b7262f37ede109659076524c63be4147e7f9f932c5ed226acd7649fcf3733f79d3011cacb3921b80f37162afc8d18efd63cbaed83a0906284a963ffc5e3423a790cda814b9c8c19ec4574885ea6a31354fabf20e4a0e825ebe23f42ce2aa42f0cd3bd87ce58f36c2c9047df3a06d36d63bcf0351117b724498fe24fb2a7cb2fd6bf196da0a3c2a489904f9fe151bc82aad15a862acaf492312d27596319988c6e2ca5dda4cc5b927aeaa1c6e88c3ef70e7021cdb0799b1e87c3b3683fdd4469e89ee7b4c1dfe1d55e2ea2320e0b63a982bf0dd30cb49d22c0d338bdc1e1198d685ef77c6445264463b180c6b8ccdc21e0c088941367774a961803a2002cdfc7f8f86c068b7b900c64a9125becf7220bea009d2aa848aa4570b19b4593ad6829a0dc9d85ecb399f4e0db54a7ced6f6ea08dc1b433b10a9162e5b9beca610b8f47e281f7ad9c5fa360acdc88124499160abfb55a8ad7fc8b828593e94bcc5921e894ea1e95ba146a5b55875845f0ff4cbcbc150867dfd91f08feb53518784dd32d3fc90371979b4582161c9a658ce04d0b8ad1fef3785f16347af9651fe8a21efd145972ab5fdd237d18244aee136c8c8aec268b23ee0fcd5149e3b14b03fc797016cf8a0ff0546b21dc42a71df0c47c27cc648d13d604f6e776a40c68fd0f0e3f14c46cea7165514b5f2fb7c7ea150bec8bddb5b775ae19d8aa10468ba2633617d01393e5dd296f754e90458e2a0947303274cb4ead4b1ed21eb8c533daabb1ad3bf6aae8843e24a95665b4a925467e7e080d58eec63bfff157f34ad3e72" } }, { "event_id": "evt-a66d77381e300bb964314b28", "kind": "unclassified_tcp", "frame_number": 7785, "timestamp_epoch": "1732596618.599119000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "33717448d6bd0ea4e3e0d3815b8be3820ea9f274132211f9b0a4d1ae0569cbbaabde4025384508d0fd69e1939581a5017aa792f5c70912c412672ef4fdd1563f4e088e147e52845846e3f4b865e874f6091cfe06c421d1da140b22fc2e47ad73bb29af5157cd669ccac10bfdc6f4bb261289106cb6d72560dbd16a49d6cb62b070cb9317a95035dd11fb860dcbf7d4bd54e572945ed831cd70e7ad1e0d79b8fb9e7c9c6da83bc64a4bbe75bd9bded0408db3b3502590083a7ce04b3f65881b5527bd26a4a3e0aa89ca4d26355ffd6ff18a37fdceae2e7d7388003c894bea4a3595c8382b164afe81386e3537c624efe4f20422f41ef6c3a519a9ff678eb1aa6fc8f4a7f229197d5212fe85394a43ed9b555d3535827e9404abc518ffd65d62af2bd8990e68b9f5cc50bfd463c397503c092ff910f0b500c9f12bdd5783373a0de44e4c8760df1b25c48466acef35148e1a1e7c2be85f93016eedd5b195de19c18bb52df2d17340b88fa65858875e78704ff4d4de882a77201b54381f4336a2f8d33949da052f6755c1770f067ba5d01a4b8f822256d038071b9b214fbabd2c361ab7f81069bdeed95500af9530b26fa0a772f1ec0334d0776f5067fc8bf57f51ad562406ca4c7bd11da2e2d8c5130b9c2fc3375331ea55060e805c69407a91eba2c7512579f4d760229ff3a6743c0bfaebf7a389ee25e8dfcf9156bd42083b176891146a0c04f7cda8ef83c0e9eb5893c1e1002b74e1923a87856d68e0dad7bf71137972ddabe57f5bd6fa30a0f76e2ef48aa8fd286923396157992a22ea960407ecef6f846dea7dcbcd25c607b7e0e8bd3fba49a2b9711ecfe5c3ef2a2d37299fab0f9c65912d6b6b116299ea5390b179c30fb86b637e373239f7074244fadbba9bf7863fdc4ba6a46b2338c94ec1762756aca62b70a537f4d7d9098b902e16fa6fade6269eb7b77f64638e7edfe16f3315806ccd95ada838b7ef3c169819134ce7ca9895373ce0c3a904257daa5bdd57f6fd31cb6939d93ad8667ba3fd5dabf9e0f914ad1a48d7550db61ed401ff9e59068c73ccd5dd94e8fd3707767cd5023019704e888c55385ff0e064f17694d7f7060f176e4ea7022591857bf04061e3686e902314e5d9d6a1a92f91d84a233d11962fc20d725e765af8c8bd2137bd280db448ac8219f6c1403dc2af0effe198201dca311ccb89a6b3687e58713a8ccad5dfa8258ddd4f78a588bb04881306afddbe307193c16134d86704bd2f51f8bb42db0aa081a01d22043f2e165f7a6dbb41e240f953f730b07a5ebe7d097b0d55d870d0e6a0892343f13e23674860743b7eb9c65b1007808137790a32a8492904ba056f00bcfb602dace706291d480c80eb207dcf9090dc23bbb0ee40caf9e7b948efd8d0e68704953156f7c75cd92db1470990e76f6614869ff2a695feabe1b1d28c122ef5afbab71f96cf3ee1b1a8ae4d7155552287dffe2160d4eea89069449cdfc154689405649fa590ee9969f27f4cb881b89581b51bbe171f108375d8ebf8a73513fb4ae620234d685d90f694925b796499c071e5ad2a0a96d719aa2b0da39f1376945c9df1c715d42f5088c5cf745bca001d47992d485b176143df5ffe23aab36f725512a9c7020bb4c7e9e8ed9b21a04f41f1402b6c5dfc4c51364a6a4842bfbf61c0305a3333952d4325574af8aa47f06e8bfeb363fa34b63d6c8929c8ed9a8eee2a141d4ccec665b041988d08221613408f0607678f2a812d73c06630089ae85e91c1bb7cc75c8d83945c788a631a039aa2b69b74c7cfa5d45f76cc23832a70e0ea0e82d08743352b22dc4e30c4a36ea6b9c8070f9cca76b0bb039d1506e57dee3d2610980dc47a106d43eaa459fb018b9d542528bddd7d11ec2157fe5e7d4bcdc582f63567318f9215d72c128e804aab33971c40b8832886ba4bdf" } }, { "event_id": "evt-fdfdbd255adc271ef7f0234b", "kind": "unclassified_tcp", "frame_number": 8369, "timestamp_epoch": "1732596618.810873000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "59532248282894891c886068631bb2388f624ac5764260e2f3b77341474481189a9ac2b3b0f44608827290a8c113adb98e40563dd604fd0ecc363df4da3f06b4f390f5ca592059d47960077bf3ac573435a9a2d745b12140557b0925a33f3bfcd20b6d92b72534ed30cbc917ca707521774a77120c3d9ceb81a3478db641acb09a4ef78836bb6ffae204243c3303aa1739a6d435f337a2fbda8cdc1a1e4b7c306863d2322d20a60a0973d2badb1ed380b11f3fc5c3fccfd4174126a3769aee11cc74ca890bb05a87a739e5c9e531bbc70f01c02b4e64ef2dd72382b91bfb9aa74a9db19f288db8782c870f892d5822c515add1f2d00c9ba61707890959d6185250f254131ac28f20819cd86c5090f62d16dffb2cfeaeb098cca104f634f3b5e629809bff717b37a6cd2bb578de993081b14212ad87775230f63b6f3f1eb39c14a26945659d1673b64db452e85109ae54e6b8dbaf92dff0e5d4f1711585d158c02a6af76377ce6fc2d4c7782678b1d39165f8505ca4ab129823acb51c6de6e2befaf2937c97976bf8b324a5d12f5d40b877dcb6965444ad3497309219fca2f0c6e00024017139fa19ff8b677bc9c54b0b8bc082d7907382a9b87f18c1d8b2b69b30352da82e01dd8547b26573879221361cca611d439c21127d2b94a38ce627b5e898d6e6d64eab83b3e80712a3275e52bdb3869cd158bc195f62686f966fb18752b3f087ba5a9f9f21c55312b349459083b53ab364dfbdd54ca1933e18bacf6dc81b790b0d802873597ccb58c0a9b41641df43e974454bb0849af66cc385ba520c62c768b8decd2986e153b4d4c55a308c4281e4b5a178f6527c84c9e3461660b3e15dfff8e268572bb525a00dfd9b09441af3ababd301da7a6a30f8c0911bbea56d52afcba6b6de4e23cf58856ac74f01032eabb97d0823862561c5714ed521b792a5b18af34e3a411ea17c19a26eb6e41c3551677aa268fdd75683a57d2d599365e72e3e4693629850622089952df1b48d832d7b15b5b77c1ac533ad058ed7714d782633e4f9b709795a94e91b1dd733db7423110e00dd582acec63e84f30720291fc282b72f7831c61211417ba03473c50043ff77f4e1baa77d24b67be5de45ff71df05928530e0bb81c20c77dd10cd4ddb41afc17bc46c69b3b446b875922b3af5454013eb3e109a5ecba0d032ea2bc997a3c2897cf4d0c7e0165caa5203604c823cdeb2c5843d64b2de6653ac0c3112b9a7f9ca882db18dadf54aeacbc734f1d4b350cce2643b2048e149f8f0d6aecfcaa64c4a286e97c2fac9bd9df9b7ad07fb4ef8f2f03430aa82b953e6242b5677cb5e5d3ad43448f63ea21bbd02f78391280e8fa35f2cc4336e1ebca1a4fde6452e5e12e8b552e193f38ed3810905cc6947bb415d1a236dbbf0e4b3035492811e80c33d9c39f2cbe30146bbf48502d820234e9d3084f1bfbc5449c35cbaebb995b21b4f5c73f4f2b372c1e250eff626305a44b2fcebc2d6e9e435835c484333d677859709d808770597f9382fd314190731afce504e2e2a0a0e17a2e2f5c80cc1c5168171f1006ce08b6ab8d01458b033230a2d6102f4e39b12c2eb28839f29cb3bd0cb139ab3982c04011486d826fbef2915168f077ae6420a1b3ec74ebed3569ddf773fca01095e814071ad975d981f850f5725187995e08489445a2bf53c72c80997c56f1c252b707c30d2b68f8f84a29e91fe7f703bc20257e0d5af9ba713841d36833f442ce488ae90aa39010ff3ccb87a43811c8b0e595e12d1a2367d8a9a5667a296449dd6e2f7e67472ad1f3f1511901ae1cd6ade2682ae271c0f852784710cac4735f6a314ac741237fa09ade81c981b452664d42bb18050096993691cc353b84ed3d2f0f189bb2b5d646d4b319b78408c6b24a4b9f1dacae0dd033ee687ba4f9651899c446d768e0fd5" } }, { "event_id": "evt-d9b413d1f8e8500a0badf034", "kind": "unclassified_tcp", "frame_number": 8590, "timestamp_epoch": "1732596618.885340000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "66334c276c6c2a494e6e9489174f3c010eedde1607caa68694b5ae9310c9a9c1220b38b0f12e5bbf9832f0cc1e66a8bba564b2dba134a8b2c3daf4f63f3de4420b8d028dc9a86a0f813628ae0f3ac57c828dacacffea9d428ea18aefea145eaf2c2c61f2c527d7f3861e9a3ebd88a834f89bcbada884af21562ab894b49e45a6d109d1486c40a56de4033acc364ab6fcbd69ea192da13747fc97800b18d0a23f6e8d2fafee3832075c3a68347aafa48e3bd8a26af1a80244b7c9f95aa77d437fcdb736c0a171345ab11546695304c6878fa78222133bfa91eadaec10797302894bad9af63d814ade836594ccab319c1f11ff0e8f5c74a4480e0e32c2437811847fb37c546e7b6af5fa34105f9b3413e02416c17af9840167ee4fee8772daf1fdf0b6ff293a23109a6827d40668830937ee1eca3ef01184326040802dcb626b9797aa018264bc32589cfbac37fe86306755a4a187bdc9e0792862cf6299e2ea91c0c5d578e83fcf6d614e783ab179b159bbb089c70098dc0aa117859b5f83b1f8e01f45b13072f57cd82141684c05a7618674d9f5ec0c9924e90d465f3b967ceccdbf4e544ad179b389376e848b057f821307dbbb9e4bd9fbe20c73e37118eaf00a1761a04ff2ae0989d44a29dcbf5046b02f157a6ab9e811d793394515cbbb1a6f0ac2eb239769dec10c25bfb043ec2ab64fff22df0fcb75488b16f0f8e3a81fe759b37fab1e5616e07e756cc8ddb84d82cebc567adb87bf9c9722643410cd4530e39378a059262eb36eb9afbe5317b8fab2309870fd52e33700991f31c1ee8850608df64849f6c974a90321f9b398cb0ff1604d2c145ae6130edeaacfcf4484ea0505e571203943a882c424ead55c8e70d5b9160da37f5a93ad4daf91910ae678b78e70b09f9464f787a3bdc0201fd074b99c5465d1e8b3b70b2bd4cebd57e3f8d55ce36320e327bd0a46d98d8cd9f93b8266e70d106adcf53f7b82d473d3152d0c353333884651ce6852f892daaaf6fb92d52b8de307867c653d82e22d8243072ff4dd073a59969bad72d64891dd9c4c92234de70c5cb7534c8f351925779cab8454baf3dc9617cc540d1d748344b7bcf6cafaccc9f39835043fbaa898fe2221e194f01bdd935c7afdc7eb6319e151dfc52c47977341e36e1e2c7ffb400c6a55b0e1425333220efa9c7ab23e2fc9191334958291f0c3c4b80fbb3cbb8e28781d72d806dee070ff3d5c3d3c2ea887eb88279ede938d5742494ca626afedb6485791d86f55de66835d5839bb0ab2f4bf86fd3144cd2cfe95ad109496d0e8b320b6eff6ab8462222a5024b3074a86dba4ff62f78e4ec9e16d8e353795c9da85e6311efdab8976d969347b2aad629c033754e70016cca88c36b431ca1c462d2b0f165284749da526f9796ca2c9e6b1628666fb05e5775cf6cc94f2ad1b41ad4ca576d8d5e0e64bda0558f7505987dc844084b8a58073a41ecdc4c17464b41c6dce2ae88d3344dd153ef55c5ce49b6fe16cfc52c8ba6644e99a3f8b1462dfec1daddc755922808daab4dca239329386b5ab47fc208034fbc20bfe04d15e186fbe07182642473d1b497f7b21ef7fa9ca7b26b02e75e6522e9eed2b4b2a49e7e4b3bd041be19f9d7fda380a64e1bfe9a91029e84e3d80ba5a0776e0b6f392edc894505ca9d93e8c9afff499bfbe34809651c5126f4330fc285a10f6c09ab1f6292732828e1cee6d5f37458368fa61efbe0c5d57db5725edfc34547ad2d6b54e7195913b7cb161be7a0f397dab40e1df9d5a424d1d770215e12e98a84e685e1fa99bcc6ac655ccff005db87ad470badf469b85edf615184d2e8d98f9c5b496a041869eeb22ea13f71f99ca5709f228a1d250dc264c65b91b70a4bc1db3a3fd5215935a8616a4875b83af46a1c60aecab1c720f6b03dfbce78a0955f7002df5a864dc8d" } }, { "event_id": "evt-93fd74ea306827fa19e95012", "kind": "unclassified_tcp", "frame_number": 8710, "timestamp_epoch": "1732596618.956972000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "482865742fdddfd03f0f5f1510e80b8a49794a8436e217939ccd33ef4a83210bd8abacff98d513238af204c814f2556f9dfe8cf2f1781e5996f9e8b015d29bb2756df7d789f268cde45f0593eff69c7957c1afd68ea2f8c136ef713077dd6317827e7b9488ba61c04272bb5a1fc240da8cf3c30314eed68cf495b12ec33e53de9cf01f1b6d13810f359f8cd29d92aa28a1dbbe7bb06ecfa95a344a53b5b155507d48aa9947977fac3b98e52a37eb19569de90959e80aa58512db2b00b18ce044562d722d7d46415e9ed40aeb7f323a6e01436aa3301b0cd64af4bfdec97e4812ad1cc8002f2ad5aa11fcb9a0420dbf928b58ab8eba58cfff1129da2727e71502dad12425fa5694cfb7fee83187be8bae3a4c14bb937ca8140ff83c7d839ff922fa9d7fd5af29a343b8ae78a94dd8a130e7d3c778bcadc1361f666ba6096d164b90dbbf00bcaea2300909f9a3e474a7f42414d893ed8c73825205854dea2bc576797e6c73698d184ca3dfd6698274978a9e9fa8fabb5d205e092a407d16125d06889063044d1ee35f36753eaf4adadb993dfa1127648003b621d24550fd535c78b50b09b52ab3e0eb06c4a5c39ed47449f30b99fa2b355e350d1d596d62b2870edecb60e7dc3368034c3e38b4a2c27dd0bfed5e47d2444b5acfdab02554eb09d0140c368cc001778371151ad58ffe04980ef3a6b9db9986ad14943176d0643ad8add548e4203dda8ba49112866c47ee1a73d5c8672db0c3f45720f66abc9a175ba64dc40aada6e7040b0c45a95cc068e8d19674e45eb9c207fd1f48a03b50758a9f7ae9e034f7043810ec08287c30f6ee2f116279ae2f080e31ab68d1edb26e919381c9e4cf6cc43d140ccec6acc5a58a315da368a53f5974336c141ac8f531ea1f91ad891cbf5c492d3eadba96a1f1fb5f65764f107d2dc9ca1d8518e1f80e6ae4837f4e865cf6742005154ce318714942ed6223e1b99dd36868041417395e40035e555d1842fad83362726e5cf3a6daab2b3377d33d964c9c50e60decf4ca45926f56682fc9efff822e204c99903caad6a2249d106457cfc2b609e4f7314771a116433ec3b69c84603952cd6313a2e3ebb5863dd86a16430655d9630c1373bb6e2e4f58a74cbecd8a04b05f4174327b75bf78dafa9c5c7c68e201df6ed0a324ad05e76b0711aba0539aab1924dbbbb4dc14093a693a9bef044782615865dfdefa883aedd2902bf226bad519d38e46e1e37540591ac7234da2ef20703f9dbfe2001c912fea5714f51eaeaf4ba7761cffda9798dae49c3ee73465113321bc41351abf077bbfba6c30137b56cae7e072795a877e303e3af721a061cc3ea263a1b5b0956123a72f22ee35bab045146ca4842644a78049921141a976c85bc915b8d8bb2a8869d2590f747002169076133cbe151f62dfc1b15565a643116269b403820b434ee744bf65b4908c228d5e40440a1a1b7a20f97b6a4d2755837123203b1db7b90e86cd2c220c039be437c660bd57284b87e776cb52e11aee72294ec6868b8479c7f63c6c029058089215ebc15ae5f879188eff476c92f8f1a7088499c9035558addb1b86e33ff9836e02ce14a7d0524a75a4211171f82ee4891f66e3202303ced30adb41bee16b4f4f4426283ba4cf7264ae36cc3a329d8dd6bbe1c00fc5e26cc6f8fc1e2fc1d3073e2ddc4b5e338060f89d78639c6aee3a507584a4155a63b2bf41ded3d74414c8637833e90a555f6aec31cad8fa35ed517c27ce73268d6840dccf0ca2d87290f6c5fa1d0c7910cf667740a66f964ff93e9664328823ca3d75c2bc0be88d355e77fd39bdd69f9d7f5a01161308edfaa36af738d92c3db59161a6a23f213d717b8dd27e970eb63328c97e8e1e02c39bb23b55d66b425cc6d5725f9fdb1cb29e489823e04f8595be46b8439c78a3f3c837dbf6f34e904b0e" } }, { "event_id": "evt-2cb4afca7af311b61961dba3", "kind": "unclassified_tcp", "frame_number": 8923, "timestamp_epoch": "1732596619.057615000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "50485b57a14a16a241bcc2c2500c3adb387a784375a6c2c2ec93912ebcb74ee0b017845e2ba58cc578791bf17d0a28fb890602fcd86bc66d0b01df7179b9b2d5c43f3f6262ca5b687e81c5e1d87867d1082f0c36f9377e77ea28bcc9c355160df6907186798cb191b6104cefa4d65787f5a5164aee6d42b242f7d0b89861324b7788a037c65b91260210e8936900e4191a1ad3580656eff22f7beec20da66f753f78d6f2a75378733f73c87f1a2fde05b245d2be1eb38c1d5401e4db12bcf974dba92ceda7c40ff43b3a561895292ebb1f53d9bdba41f2f0650c0cfea7549206db11b1bac5daae653b56c9d0aa05262b1502383809d640203f6fd2c91ab94893470bb87574eb995851444b9d308b9fcc992fc7ea21c68454dc2985cc236a2bfca0a8f02242a9eea40d74a998d100145ef14a7c581c164636b6f25bf60c327e38a361422be32a4ba1998bc8652044ded88f637332e8a427ba97cc3a1334944b06346807c78e68e3d725cecefd74622267ea7cc4a3b9c599068dcddbe6b6c7ddc1f1bc00018d1d44c754098ce99ee885836c0ad62becc48d1703031f5f4ed2471fbebb53e01a42570241ee1eb980c9eb57addfc7259dc8ae0c5d3e4edfe8dc5d6cecce392669393e7649381134e31e3da362e46af1fbcf91db71a2e5f9fd15c095b3c81e4f255d6a0f946f5401935df56d9bc789aa5d4228ca67a0cd40057b571f34f3d6e3f53ea3898c9641f524ee996477a2936f547d73dc1c5772c860556ed6f2d09cf4664b337b5db598eafbf84fedb3ca1588d005ab40aa1f153f65c2db0dce942cafe254c03302bfc57287f7b2621e13f117b59048a51164cf7dcd8cd6d6c03742cbb2f7f62e47bd771933f70b5e17863225562a375b70cf742f0c1a840eda7e41151646c535d403d8714dd3888772839cec2f61c25a1cba273c84e5c19ca4d187841b09a29798607b5d1537d0d2b5306f1d71851e85a1dcd639e97ba6ee51d934b40475da000a93790f6fb61fd14de6c69f9449682cb27b92756eb4f758ad5cd049266cb8829c584e747b1f3c4793ca0859829c37501bb4c5a997bfa7630223af8d2411146d08e41f78821dad54efba305d82a134c833ced43c82c71887c56a2945eb64f6f6ca18fc2c20efd4a264946f9cb950cc5f8147f1a43f5b4b27ebf2fce31856963a7990937ccf52bd0eab9d88fd5daae5ac65dce9d6367a7bc1e7126157ae88f5b5eeed52506c9ee541fd8ce6bbb3693d95e3f1a7dc23a73942878544d297f619d7590ac692a5e5e9faa832df68ea56ffc786af5f92304440bb8ad64c14b4b1d06ad93b28175e41d2a42f944b830362b6c577e64c15aad89d821f8f648a117929e013e07d695bbe7937f2da71dbcb00548941ab78d51189614fb18d1baed550b34c48c1ee2e8a6f80f65e9497dca1f4e87e786d34afe2d29177ab179ea715839fc9358f3882b43f39c1c98f9ec6164f98740e9198bc0e0a5e76538e550b558e323607174fe48e5633c4d849cd070b060cbfc4285158c769b176aeb6cc5b236b599396f11304d0f635c96fd37436d3d09658d3de83ed4ae222bd9706c96b7f3e27f462431ceb2e22b347b38c8ebcdae16de3777dd81357cfc974330e513507311bf619c7712f5760c24419a2e6a4ba4f27c6b5cc38bef28e01d9d13ec251818115d36452d8968003e20bce5698a1bf7d9f30061094ce09bb9254f1086d422d18d19633721550758ce9802dbc4a33e02213adc1fe947e8b25e13342bb03b74c89acc44d1d747f3c21fcc5368ed2f6a844c2a597d78688690878db86929941df0f437e3b4dcbab8e28eb7fc923594d0429b35bc3355500e93700d4e6ea9ed328b142d924895441456e6f2b065153daab5f9463a4d4d24485f0f64fde9b836caac70a3fd3996a107f30ff56d06054a2e0182d16c820ba180a68d1d6" } }, { "event_id": "evt-fdfbd4088c60986cc8c2474e", "kind": "unclassified_tcp", "frame_number": 9157, "timestamp_epoch": "1732596619.263047000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "5577613a18ef8dcf0b258c9498f7048d4c950c227d7c40b667b857c0a0a10ff8cc6db7078c608d13848c138c2c2e5adece6f98c16172f21c352ef91f83cf1a5215c2f0f2ab55b85f04086ee3008fe621095122302b53d5d59a01ac1bc38500061bcd9020bcdfedb5b152435ab4229848a2b61a3776f071a0e38988083f44f1168cec4d935ca479b664d41a92ef67f889b69e9c2c0d65c49032fda9cae518fba41218524c41314361431ffe63580e0280edf201f24d2054cf1bb9e24bde7080b44c78ac15e9347e6f4524e61fb0b7839b999ff752682db5ecfa3b22a8f3ffa46bda8b12036eee241eeb1231e546fa2868b6cceb1e3f2945cdbb9dccdaab01802ff8154edfd19bc7924a0cb4e6d15ff13810fc67a2e0219c07e4a44f48d8922787a324db4b45564fa1fcdf41b7a7ddfcb4ce7f78ad7fad47f48841879b7a9dc3afb4d500a1cc4eee5450121aa831a12adf3f6e08bd82719ecd04c65350e7fc058c37fac46488b8a7584dec428b6f3e330e8de9b6bc32767a269a046508fb0b165efe7048d7e3665c0a0a25e39dbcad38dcbbc8a52ab2af5c5acc4cb3bf73a320c6766807a6fc8d11e836191341c75819c46796ed2140891dfcd80860260f90edaf303242a96518a2dcaa21b7c38c7e631936a557253d5583efc272cc4b0715ba1998231c9b3c34f0d597ed366eafb3d390f32ffefc648af16836506158d074ec80ec07afb99b7998bca4c200f276e8a7a9dba6d4ff1205bd596c5e5f1235d453c4ac3d5999b755f1c2cc874dd3fea4bad7bb4a39c9351752536e78cb1a295afecfb1464426910a99ee9934cc6adf8fbf2523aaa9c59eeef79224dc4ec8c527356dbdcdfde718f08e0f2faebf26dd50ffc77bd33b71afe6db326e7f4240c17ea035f9253b3d700017324157cfbe455b33e4c1d23063fc901bb0a2dd4f4389eb8e33931a6b9b2ad6177e02a37d95a00709b4612ad69ae006ec65c3491ee0ac26b750f1651c9f261938fb8312325ae4cf2036ea1ec030c578b7095813b230960fcde420bc2aa1a768e01b8f7c3ea54fe14f55b8ecda9082735ff5aeebad09c8daf3182bae934663dfc0d535958cc99985333823b0e60cac385111f942366268bfddd5b69ee4a28cbecbfa0e976564f3096cdc1d265e7327b87d9cf264ab92a6e729932d6d8ab603ff03722cf37849c53cc59b87fc6b334a42824b8d624b7dd66cd65050e7b8dfa243122fb5d57c10e96d8d73afcecb89df963d75a23702a5d860cf8bb753fb1c25ab6637eb51b0be32c4a4b4e05e0bc149d4dfaa25643155fdcec5a85caf1b3a44be4665a18a0f3c001878c4bcacdc387c3af8246ce080146d67d7ee78794e8861f243f3d37fdaf360f5afcd54c18ec831ab592b114e0417b1811259f9c264b84ca507e3ad90c28be62e04a09330375ed784e7f781b4e6a1523313fab6034f6c64e39838f4edf6fea005b6f6c40ff22e6582805886be1eceae529dbfba65ca858bfb6522d56806f17a07266ae5fc61a5141d055dc25dddf5db025df3b733d89cc2ad865c0df0a7d50db580d55510e691d456ecf0257aaaa57f6879f1eedbb6ea767e66da0816c39bc499db8355a09baab75fc551b44466f19a58365c8ca87a4761b446a97e0e2284fc52690a9a28d5cffd945d3bf3bee5358988241b701c359b31d246dfade8fffa35b67d58f9a54a2546d2f31ea8734e1c11c8a8e247f054e03c048bd8e09837920d09ae5d852765ef1f4df4d7b0f4c5a58f44ed16c1c3473da459c47a0356fe2e20bc70201d61f370980dc8d58abcd709bedc8f438d7d754ef435b087d910d13ea883f20719dbe7ee8bd07eb664fed76768bbb82bfa901a80526624f06b82a69c376b3ea54547c86ad92e394f2c9159ee35c01720cf8b137c060d5b3f94fa7029bb4ebb4cdff56e493e0d978d51eff1df2cd44906" } }, { "event_id": "evt-9d3a7b2d65c897d290190e5b", "kind": "unclassified_tcp", "frame_number": 9572, "timestamp_epoch": "1732596619.583255000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "6f334779bbc6e35a1bd2f7cbb11f3739fd7ad7872c2f3d45a22953e632876f157617b764d5a15f9ba64110dab05aa1537eb8a5916277a1e851ec677fd4a4e6fa73aa52e57dac47e153d431d8d120958c8388d2d67a41a0e3b3de66f2f632df932b6fe670904fc95491eab92f65f4b8f56029673aeb4ab37762bdd6d5db74a5ad2cb26d32fb651d9e5ed1d114b090605dcde56223882e12c2671fcf5f14960759a85ffe2c2e716e3afa10fe0e7329dd5b49c639751590854c4bf522ddb71a6947c021d691919f983e4cbe8442dd5299354fd7f452e09d27c2dbadb27887a527cf5f7f21d1d0c980d1e078f70bee5123645373cfb871214e367dda9b74cd3998dbb56194a040cf508f71864fde39ce24aad79b209da60b4adcb18276613ce51ce307c137f761ab71ae100d363bf3f6df1fdfce53af6d2c991b4aeecaa031c200d447f1f73400c0177a649eb656a4bb33a5c60666bfa58d02ee73164b84f6f416a8021380b4ee91213f0dcbe1e23398f73c9c74c5a98433b1f6339f05e560a8ed91460c760972e52248e8f8e7b597b4f55d3412aa280dcc45e369dfeef2058ef0339479906e359908d6a989180f2f44222a709787cf9ca29384e77efd909820fadbb0af9173829d9525bcda450333f92964ec370fb03d721d50c0e5395987bd58b118f0a203723157ac994ca8341c1ae798ecf32770d05f59ca170e2267d9e1f25a27b7f7106c4c73f5bf112ca72ae3d06af27b06cf02f51e135620ada96d84a31371c79827f5852b794696b5b4aaefc3638585e379f7f4548e56679a6e771e99771577be9ad9f8e0139e0aa0cd733e7f92af9d3fe693e0e102a0206681638e558afaaf0b86c2e8e61e0db1420f73306b4adc06f000b8d9210436bc809a055941f51316e13de7e4f8ebef37fc4bc779d5d9cf25c10b502e6e74934ffb6398d4d11e7c6e10655eb7e7aa9c5538d10a0d533785e95f0eb23501199faa88f3dd554244a0304c892279137aa5e97b05516475ec0e41179340d69423cee005b27e59be7d25a17b9f83eec32b3bcc082c55b61f38c433228aa82570ff5761ba9650de91fecbc39cb1fcde66e75758f0cdf2db6725e0344d41bd8941e214f337e52e9307d34c4cd3628a6e769335c840462b6863da200bf3f573e770fa05191adf06d21a6dab6994605c5eed13696f91f1fb307b0dea5d4dfcd8d8cb2f74c64f642442d5f9258294ca2deeebe34eb084cfa6631cdb34da8aaad7b76b14039a743afe706176475c359c0b29b3573b233c7b5d9dfe20a10be90601900f49b73fda31b6130d77120ce81a0bccfcf24c47d475501c75e8ef5012333c8f4c1b4f2f33d046dc465f36496a20984b83b8758a5d6e3ba5f3602784b4c6f0e72e2812365e4a59d54f3685f3aa8d9afb6443f5d4a5ea771e37a4be11a42e31a78c5fc99a0193f3e0aec7d2140ca8743ee01b1cc8391cf1afb90dc861aa22d4a28dd2d1d0008e396348ee6c0f1fe5f461af70ebd8991ba3c56b29f3b9ce7efcff10ed27e5cd63c98cf01f824f6a2022161f2949f6541e37319ee6f4bc0a3900c78a3e17737eee2172e1e36d867645fa34b8f6e4fc03eea1aba418b3214b90ba6c2ac4d24eb80939460b0088bf336681bdc7d1f0587400a74afbf8682f02b6e437b4b70c30332ed81d94eedde98e55110f71374302c6683e47aa3d6ce2caa32ba01984b8bd6579f4489dcf3637b843a0af061a75541d0b81ef8d2ddec672d886d9a976d40af012a098437dbeba9bed3e357bd216540e014e7233d7c98043e672696346433fa1b333fe795111dc1d8a374e090554745e4640557ddf7972264fd511ec8e1ab4e5c34e7e5c46dc2ed607d1f38f82a3259aca7a49a732414999d8cb2c443c8f44d6fdade88e98d796b4b1e42c585342be5983f92b92c1252c13514dab5fe4611edccd4209a77d" } }, { "event_id": "evt-cab8041b0c00c58378ed4346", "kind": "unclassified_tcp", "frame_number": 9587, "timestamp_epoch": "1732596619.584787000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "4724555fd5718d8ba6082fa9317390a4752bedb14ca6c3e45472a79a1973b96dcb819887cdb06456ea698f41000a828d91e6656d638f1644b005c8209d843d0eb977c8550681e9b1997bacb095d83b454b18bd00194610518a1582f459981c4e13a26b0e7430aaad209e30c278b0b8e654366410785f32a5b8dcaf502672aafe08ace063774915bff5458bb47f6bd4e87b2befbc3bade5c900fc5e4b928a25e9aee3b436dcc9300baef2f5c47662bfcac292b88d377ddda52921923132aad4b07e9a955356f830c7bff922fbd8d6de666db0e05bba7fc4779860ac42fb682037fbb7ddca307ba2d000f6dfbc362c7473c92b10690327a04ec2cc2396e0d4f48c5a28c524c5d9f9fe710ce41656ae13313f66720664a6f0cc16968b11e2998a1a10f316fbd555105016b053e4af27f2406492ef98874bf25dd219582665c32a2fc437fd166d54959b5284ffda762ca5d119f28977352104ab20cf299386067e530835ef88b3167cbf883de286c0a9a83a9dee685e766756ac92b6025b18e588ea9001f255bbc2222ce16526c28f269ef81b9d158e0d1b861112d091941a24c8a53afcc6ac82da63bbd4be847c34aeb60b631164e541669590d7bb57e05861626b8307dbcc29c588d2bb93d21999a1a3f20d72231edf30c43d2a6b5cab840e0ffe0c97dece7189dbcdcbc01672784784a64a8e9344375711a1fe47ab62b90df1319d709ccd6c609141dd663b659243e7082735007425a94cbecb8fcf05efe5f6690914e2d94b9f2b085e2d90869caadf8585e0a15298c88b5f11f72d57c05a7308f8adaf7df2ed16fe8e3f24ce3588399388462a5be19b5eb57c789fd7a348155f676ab4f307cee86a0de8a08e8d7efd5e2bae908b0ff16f1c0df6fe3960a5d6c6bf71895b9498c4017e434ff0ca243d016b1e84c0783fd6512c0ec16ba5ef2f5529f19955ba887e15822d6dfbbdbacc0e0786ad2920df0ee2318af93f3822be631dddd33e44b1ae6c04bdf06e0dae4599b829ab118047ab9a310e3c37e629e2bc4c3c26011c9c9e9ab26df501e4c10ae0e5921fa6c3fabf4c1af084912eac5304d01eabfe860bdad4bc40892517f9c2fb7a51fe55e68e5d541559114ccb12d046b4ef8b5d8182dcebc7d5e5bfd7b7f53b33b5bdeb6085162ba92206123018fe741facdb56fbcfe8fc0f3b6b257627b6fdc68b78e950db4baf750609becac852709d77935dd4315617131317f023eaa7ee0a4606e3174399514320e99d6baecc82c0fa31e6eacf26a2203fb145a160e5e912f3ea1d1b3af24d892fcfb6390e4c1f686c32ad18f257549dd49897e1587cab5570c39f923eb0325b6bc53e1171ebde6596ed52552e70550288c29bafe1b23489f3bd559d4a8c04b876a4fd2c03f2af1d95c727d6dd956abf27a5edbd10e360f069a54d3769d044688312cbeef1dbba5717a4b3b47e46807a81a0baf4e283fa2bca04f7bd85c787785171c505305ce952bfa34ff7af4038fbcef882597cd35555b932e109fb57e7a55135754ba67f287ee918860d4eb93a843351a22e9595135de0b06ff4241d5e57ff55849e2e90feea9e7be9c9e5a533c243f4dc2816c68fd0c5c27f39393f9e544cf09f6379cbcde77cf43f58c6d2b56d467af10ad039017e8ab026fd6431b93fe80270fa649be830ed466c3196aa957193950dc067eba5063dea84fced5d552d31fccbf3bded808b39ef9614ea391bc71de069d6ae1bfa848aeaef6d4f5ccc61706778645b05b42f70a81920e2d4f0271188809425f4a0d9e4bf8a750f6dcd65225f270e5591edf26b529131b9cc85f08072d16c2eefacdd2008b4f96cf22956ae86c9f427392cb3a273dea34a5eda941bfe8462497e040c3d1919d70c7e9114c8b2ce295f2bbdc7c7b0113f81ad0c5c6e69860805d96f5256f07dab76c61d27b9905137adb229" } }, { "event_id": "evt-c8e9e380933d5fcd5e453005", "kind": "unclassified_tcp", "frame_number": 9729, "timestamp_epoch": "1732596619.725963000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "6f286b30cc689bbf972ebb68dd8de55cf45bf9e7b9471039c87781d4773baf404a14b19f2456e4cf2aa09c080be577fa253d8cd45be0c61984a292baa5f30313046f861541add299288c7b609cdf1aed2d2294fad2bf23ee0d3b3fdbb5c67a419c88cbbbbf571e65a9d2f06713c9be4fbb39258226d37bc8b4384a7aa21150804fa0ff36cd4b2b7852b9ffefefead249b597ae00e40f760367b5ff5130ad6a14cc946713daa78938b2ca5af8c4df4984997d6906b42a5449fe2d2b70346ec4bcd367bea92a7938441dfe954938dd947c46d0b8f489fe2eb8176c41b7892562f77a1e30d77a37c1450e4c59002498c51dd855ba18bbc034abdbcc29838e71c9d24c65948996a7e95bd8223490f3580ebdfecad42cfdaf93a6cebfdf9eefc30a327fe646a6ef7331bfa64f0726e1c5817e8585d6cc30f9f5e1d971e5d6984ef64742401f96fbca8e54da4b4a955365051f5f5089187dbfa345a83cb9a724024075a401301487e0d65036599aff537a9b1dbf35d2ca84a22ce1fb6ea5f97fbd4d8a9b4c539d64d40d07dcecd81f413ab2c1eb7a8bcef915c20aa1a506241acb58ba38452607fa28b7696ca8f50590a5b269b147c2ec4cbcebac087576805234541042b0f0a22de55ee4394580b32e309b27b811bd5734ac893e2c52eaf9ad9da3c0335791bd5038ebd756e02b125bd302d5a75b31a137e6e0444804b436316cf68cc224364d1e0a361366fe929c91c9fa600fe4adb3e02baf8dc57ed8fd32cb80d7465c29daa59206076eb4416586cf73741d659f60a5d7f0eb5c5235bfa935bdbbcdd46cfe486d9b49a6dc87c9c2feca1eb2364101b3f74370bb3d4d2d8298b1f342c3bb7750a7e81586dc60e6b3bfdf60058a811b8d3225b08e117458c5ccb046e23e443767d5caf1ab16cce7c74ae0b75eb5d2ddfaef3b17d795ae2d2bfb0d2341d2246b6de092438f8da008d588c9b093312935df9204a8d41ac50a6a0ce001058fa61be855216ca3821497a5edd930b32616fd70ecb94e35e28c0645b0fe2761a650a5a43c3ba1055b8fa843ffbf337f117bf02c00cb9725ec1dd3929ec15f1708579396bed8b4af716a24ce7f11b0a930dba0cf38d6bb773f878d28fdc828db9ffbc8255ff9a557ba7efe23a1a0626c8416d3fd8beb3d1af56489a73e8105f4cd3cf1368852b8a5584f2f2750e01e4b2a14554468a2d68ae3d79d340970df3e25029f9b1a84a430fc31f3eb496cda7da9018169156c59ef5e1ddfc4139b3d332642a1efc26b2adf8bbafae090727a03a7f79b93b94d6717f20049b3d9e1583d41e8dace563e911c964427bc23ee6c96e9d6f1d6e9f9817c4983bf233b3c2011ce492dce18f4b752621fe5613dcce10b54303127752fdef756efe3e4041d197028fbf8e95b84bdba48d9165fcc0e22b590077d310fa35323ac04b27d303319ad572a836c1886690063d408bbe0f4f7f98f21bf4ff01af99a5ad8a946df68811f6538ec7c38bd5fa3d8350e6d42833b23ae5b90bf2b4b35d237b0e274a151457c218be760dbc8ce17902ca4435c4b69b833d74bf9665ad280cd0709a9a348a9df8b8dd3d6d60e5947e7147f2e874f99c412626f2f053d609ba0f831a50adc29e57bdbd0142803cea94a73439fd8d124f213f440ef12595ff1a5cf614ef7c6439aa594f658def6ede577ddde4e41ce29847c5c5ad928249064d94d32817a72244a49e16f9c7b1876cb7a9e3caf56be8a3d6b5432d8487405134e6f574d2c15ef7e8cf801a56e08828006159185981fcd293871b5891552029c81f5faaccbf0e260122dfdea31658d180a0bc246c7f82ec594dc84affb164f7e46c6bcbfb86cc14e871660fdb514104d7a30145b1c8108afbbe1eb2a48da0c90c75a038d7b084ca361e69c6c6c528172774e2801494e5a305c0a743d47c401c9b60ba49515e6ce" } }, { "event_id": "evt-150d6662baa8af534e079ae6", "kind": "unclassified_tcp", "frame_number": 10075, "timestamp_epoch": "1732596619.974623000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "282d2e25aedb91bce44abb2a4c7d15576b7b8e6a8087f0e5d25184198e7169cf77f2a65d8c678e9ee53d5501ed1060b791db39f77907aa512e8a3df3b4669a690dda21369fafdd02542467316785bd80338de32e7f45dacddd2a6c920e84389a00d1920499db02b50dd3431c2c49afe79db89cb2fa03af7339177a9e37b9d89b19d52802a98ae5b6dd3a26dff951c8b394c64cdc0f1b61cafb3cd5b43bfda9e514c44772fd33fe551b7d481be2cd006409d43198c11cda15a428d0783e9535d0c4cb36f5e191854233d9f3548978f80df147854cab4ebd233ca83e577c61f405adcc8ce3c02e1e8e0d4166f333f97c0d362938a99854cd16aa8d371b8ec838e45d9e3f1aecc319c1ea06fc75c3e7b902223388756d4507fdec3cb59cf36de2a357085b1800c35bf98b996d5f8fb5b896389d594b031f9eaa5dd5af512eaeb5e380368f5712f3cc1d4c74e6cc9123c789d9f76786202a86270e137cfe7aad7cd650b57be7dbc16d92a7d9ab6263d58ee3ed9db39182e3ca1f67b18d181f57a2b04d483382a4893135b4161a7aaf7337e6cc61f789890234c3cbe1f6663e3f87d0ebf2eac0610676224a893749a94ac2584d0ace52b20409cafce6a7a3d2a66c3954f4098b24beef84a46538928d2c627e165b14612d3d87f84e784b66b7899d5551f53f4a31fa5555e795e8cbebcdb035badd4ff8006900642647278049a12741b5039f5b58da3cf4c045c8a6d0e4af867b30b496073d686280eb2dd3602519386548883c879f087825b95470214cbd585368f661500f4197e193e94b95beeeebf5ea67ac4c628f850ec7ef8b07e90cc02cc96542960bba3f67c08595081a6a44757ccbd1a491b9a5213d1b6d04bb3516d8eb189720683588b7b3b8cf4979efd300690df818ca172aa1af0827c58e2a8bcd0a714146adb95929ee7fd33ecee25cb4791abf9bcc20579ff87c8a682949cad0108b98b4c47fbbabd9eee464c6e800aa7354bdeb2c0497f2c3598e5b004014c4657f666e2d279493d0ff3d069b33c545d80ecc8af24edca9aeb1ace34576f068aed90616d6a43523f21b8f4cc10aaad0012b89a876d8f90de37e12b5522aec6726e1ade03a90535e973effade7eff8007d2b1e6eed3488b1f2026f61e838d09fa2f592407a5b0106bf09e47af812bce27864932c99545f1800c4ea54e132f7a99c45a913a6e2adf322c68e0872e7f222d51515b32bb04c523ad23b43aa28ac5ecf2994f093e097b1c0825868fa2d7f219a225781a004664ce60b25040323d46e53dc2926bbf19f79f17f478710eb35b1a4554cae29252645f1c33fa26d5beb31d9118c7491dc86ae203ff955cbdebf4e3b5589317ba8639c3d1e0024371593e1c817cc1ec18f81e5ac60e988e6d3857b0c25fae5aac3e847ef1d608a26c1bf320c21e5df2dd9155d6012a109a664f4c4a38f89f5bac785bdacd8d45a39a1857f8e36749b44081271fc9afff55b08c60131f57c66061898fc20d96facad210c3c1b9dc2f5f15ceb9e8c03e23420057626a387cee8c89944f46bf1a7244790c1439bb49720b3b9b3cb19eda38c6ac19d6ebb5e297524a280829de1aa42bd6e1e7f622d8980cba9d7b8a1a50726307d7ea2438f61cb35483d1e56e8a6bc89e508d59d1d515298af9c86fc6209b0115143faf0750dc6a63863b1b69234610de9d396e71afca76e6fbab40976678728acad4e1edad88723be263ac647d125d5de7b6d82f50d4e19f34e0c7ae8e925fa7f07d3f72f5a95422501647dd45559c6e96172e375b957d5b67b7ccfb35e27f001e2a62d2d50f91c1a5129e615fc607ba68f9b33c669b950b17638b59550eacd90d5d992d087a577a59d95ef9f4bf46280b15fcc74281203e0da115ad565f402e19cb815a168e3efe6a19e2fe1bca46a579888f1a0f3eab13eddeb5ed683c33c919d" } }, { "event_id": "evt-fae1c2121271f3a5d5be1c5b", "kind": "unclassified_tcp", "frame_number": 10332, "timestamp_epoch": "1732596620.194629000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "58455f36dd4a9357dd6b94d1c8816c6634e5e4ebb4ddd14f15898d0bfb9000d3102b14a74e8fe9cc40f0235d45bb947d052785f2c5c141273552e11ad7bfc378a5f7426109ab3f04b1511a832ae76993222b061b6256495648e7662f559ed5b5be982d062a4c1c8df2c784f812caf51627b2503e953256c748e9201eb28b41383998698df26515b01a4690d9566259db6e7b82a594d1caf1c3d6aa558dc847a802b08033c0830b424b39b934ca836533ad56a6cef10b8f4c252aaba504b607d3c842b37d79a4dd025645929723d158735ee8d4989f558d923959a376d8942f7e81056f670da32fa883bf796e6650090804c70d69e79aed9bc5c6c2b5785b2184484665bf30426981665def1223029b80747eddbf12522c2d512c0369f4082a09ba48a9c99b247b5564939db7942ed13674cb731e8a848a303aa45c8b4c21e0d9208c5e356777041fcf25d9638ea07aee282cf18cb0c515c97c89eb0afdbfcf423c433516e1b9f0d611c525ece52b13525bd26b6f744f2418d829c60c3874e529a9ec2ff0bf1c776f24583036b1ad308d1d342380e5ea0a2926713931f33fcf851a910abb8ac2d2fde4b21721e78e73cad5847b14d31bb5afe5aadc949d3fc4377ba402f621c853dacb3b1929a3b56b47558e179d4404f84b301474835eb8a73f54b70e435d8568e304caef606d664d29a04bc819c4750edc0f199da7af7326d823ec8099d6f7a98a4f5adcc0047227abb6bbaad1d183b095c76fcdec44b7da87b7d541a1794146c392ef842d3ccca7e79c8950f4a78c7a4bdf18755293aa99e34e8efb20ee76c65e4206d5885f1d5840ead0563c6854eeb4ae53a94fe1ec7e77121fa2ffc53dacfcbab82e8b5e3d27016ec045df85b4f6e1e82182774ce2e73b0ea728e8a4f42e9886b205f4dfc5143db612aa7dd12884020e04f88de7dd6ce4b7302ba8dc74743db21d682a43d0470cca8821f81b4b096d7a291e83f539a1a1a56dfb9159e6d7e4cb124c1b703a74de81d01a614aba3e46c0eb57c6a905c175a1835dc385bf1bb2613f48884906a805760929dad6bab6bc45dabb3f72ba89b32769c426c99aff79ccceed6a4da2a40ab73824b74aa7ac0c321f9327d7a75eec8f7e64c3781ac70606f247fdd743b6ef0077e13cc0a0d24e0b794de2d3711a5622e6ec1616042148337786411864325b214fe70733313f9d18b5044bb7c25bec031064f5373cd712f0442e9bef3efd165556487a69fe41e95e107426bd3d3bb1497d16ff0ac8167b393d7b40a4a1021c69a1cba029ae15ffd0da7329c8bf77e19d94a11fa209c8077c8ec12e5a9fe77d083932a0266ad40f3bcf3374ae80e1ebea6d4b3630c609084e8e2e437f6f95d5bc092d142f52e6cb154bb04f6ae66f31f52d9984f215ccdda7363b3ea0bcdd0b24a5261cea07eba4de0ed1176028504849c9f59816a889e45257748cd0a07a99712906deb2016580cedcb389e4b7ea7590c10d20aabdbba9e23734362d27471151ab1afa84cf17177396b6d0e211242238ee650f222e7d8b2d96d6fbbd0357246fd4428876ebe107eb78a3f5e576355ded28d995a148aaa6ff1689912f3cf2fda027ad986a58579b3d761300863546dff8c51362c8e6214268a61c03bcdb904a5f97aa9ab36222807777594328e4d6f68b342cdccac561ae25511688d92d6ea7b34ffa4eb1cf27c00b6a15cf4649c8c3f1b703892ccbbcd4b3ac703c26ed523a6bf48f87b960321acdec4f51ed1daa65cb5c6b775eea04e99cedcff5e4eff41f1fc3ba96a2eedd4edb5c51164aacd96968cf83291c2810cd03b4d330b6c8453b94feb1449bafda17489c0a6012ec109d972adec657faeaddd92d46358580a4b2c92753ebad2fbe95b4db6c273e60b982cadddf10f204c75be3cff0fde55762c2546bbeff189e24cbc419359e7c345618" } }, { "event_id": "evt-52bc5a361ac649d47502e9cf", "kind": "unclassified_tcp", "frame_number": 10342, "timestamp_epoch": "1732596620.195353000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "735d4759022281668897a91595ab18a2b46c79eefa83fe0a8d4478b87f1088e466338ef3db49f5834487ec96857f8f4a7e25b555ff43d1d34cfb643f408618c8cf34efe0407648a2c6e300a270a31ee8b85f72c1ea47158bdcbc73def0193f6ba8e126c4d687fe9d8ca278aa8f2acd4d0b0f93c0a5d59f3fbecaedd2bad1ecb7c6f6f445bc0a0cf4a6981da37fdc4ee951749f1e5759fa5eee8c1c5150536719556214728d78c9422a833b5bff80288f18433e9786b45e9168c022d8e3380a0de6179289bbb0e32bc1c0ec750dedd4442c698575ac233be207a483f748f1f6b18512b920e6975a3715c38a4f812acad5730334e93c708a4ad88adbf716d357e1f91120d78b5e2f6641b54eb57d5f0ce081a26b0b50c1406d8c62af412e88e431e5e00a4c61d0c66b5df6ed5f9150c35dc9ff10424e8f8365500f6424b18b86c6dccf68f3b43f233e319e0eeb3b4296cb050938431a61424b43814edb4a4a85f685a2f51e0695a836947fc85964cd7fd47ea7eb0d9a9ddc3edab22e5036cefdffe3232bebaf8f616b06805635be71f22094759589e1dc6fd2c2c4be5fa32c468ece41a96ed99c2849e250c1737481e5378fd6b42c38f2916fee06b3a798577ada4dc2c41fa2616d2e05bb543d7cfea6423fa19ccb0c78774ff54a279f2f91a3632f8b0777aabdb75ef8f63df9c49e217151148fb76189244b9b0316fe25b44d1346585887f1db5c86232a944ec43728d720d8f0e113e7c11a2433dbbd5972f536d0202728628225bf64e6d93b4ad1a59ae35c1655cb2acb6640f7ec0b43cb903e481cf0f03b90f9ea1d2169ec45aeeede8705915289887291aebb899445766e161e23abea3871739182cc1c7d87af27e38a16972d6276dfcfc344db3703658fd5c030073143d541a44a5ada531eee7f57d9d99ca3dbdaec29086e93bb3217be34f78da8241cc39c363bb61fe400aae4d0eaf901ce4b0f7d81ae12eb80012d1e902522a6a9ef66679a95a599dc424127f79efea0c48df4672dee140ae77f84c30112116cfa609364ac218c10e8ef37ced9614a33aeffca00e8e49dd829baa57dca26cedf785fe76bd5897e30e1061f92812d5adf652a42e4616d15f7ea2afd941a1ab8497bf5c4b10360b2e841a9aee30b68356a6305be42d55e40c33359c0293054a48087d68012de03c3d0291f887f57b3ab0f76aa08b401080dbe9ed30ffaf1d813d7ed52b58b89d95542e2b5db5db09843674e51a45878fb1126e12195cf067e0e6380fa4d3c15fe7834edd60b84bacab04d57c51d7bb00e1c5cdfc1df9e8c9a8b71abc9cf22360000690b205afce2f23f37f95cbc1da2c2346a87612d34c47dca4457e1679dc3199c67f6bb31de8c05555156db4c47f35ef68aa65e8f5b49577b4bb58ce62facaf8a8c91faa8d644adad0fd749e3868f1146ec8322497cd5ce8a4158c254ca6214dd8c6dafdb708a77bb00f812805fea350fc6388a26cbe539bd6310bcfb156e5beb4a08b8edcace3d1b38bb9d9d49b9c557558a0a818471f2bc57172c75d01e3c431b49f0fdc373ed68c005469ca17235bd1d8d0138a1bdf6740c8e6e20393badd65d0cc8b17ba1a1b2ea7ad1e10da47844a3b86d5c9ee10677029dfdff0f6855ecce80c82c16b1ff2afbe96cd7d29c875e3b829565330c330a9ecb97aa2c646de09c5ef63e56e0eaf9b1e3c781a5922ce6e27c1b8cef604afb6ea38800a607e44a890984e5c0acca314f8a16960c18c3054d133e7d92905530de73a5f1fd554dbfd856f60caa3ebdc3d6b4df6b14ab236eaec1e24bef8822dee33ea60c4ad24987cbd4b818c801ae5334bdceb9261084c549382e5ad547b17697e1edde6cadce42c90990191706ad03f24acab740c7e65015ad2e0bec7ec8096f9b94d7a003182d9db363750747dc46b5c3adea7f6c0a498514bca19f8c" } }, { "event_id": "evt-dd8b61cac046e7d52a2fdf2a", "kind": "unclassified_tcp", "frame_number": 10387, "timestamp_epoch": "1732596620.208972000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "6f5e3a215e20fe01130c0b5284684570734c24222d18e96ab9dbac4d34650535370cf71039748b9230ea1ea0e4d4e1e3d32096936eb65793e15a5ed93d95f1b6bcf30867fff2bfb74673cb0e9b4310ea3751bb07dc606459408dd3be2233626db31907c300e56edcd5698ebeb0e46ec251e82c5eee24c93ccf5af7ab92bc7a76c8074ce2627389170120078dbf589c97fccafac833f0af26e6450b176312100e94112f288ba1757d38f0022a3e2fe2b808ef136161f83c30c32adfc3f9094378a5dc88c59f625abdd5a1552aab77c0fb86483d5a69261636535ab9a5f3bd4f4a537cd96b81b69f1ef2ff810128f521b9989eea3024322b6541ba73873f85b44f0d0f526d6b7e06655bc502857cfc10208468554a6d8094efa2c6586d9a1f1745e98df50787027035c6fc72b0a1c07feea0ba0d4174494fcd58ef74fe70f717694b8055432d79b40e66abd984110467e4a834d473a3c845e097ad962a3cbce2949beb7a08df6d3a3a8cba711c68862920c5d115b3a48de5b173ada491bbfb1756c4ddf17f1a399a112822b1cf3033b74ead8373a912b4eae7c06359e8d0b5d3a1ca9d9aaf327e69bd60291e7d7aecfc603e1658fa42a20ad5544a8cf5935fdac2f70848eaec6d0fced8e4469e4908d8c2558e60da4aeef7026822d4856fb3460b3dfac6e777eda3202087db0d7b3f88f9111beda6c0fa2ae02dd5d166c94876d33e334a82249fc888c92b4e51d5087ddd1fddce18d8975482a964d2fc878e460cbc2e110e8f4ed6b7848d84906de0f6de18df2eb8a3c3d5a13a7485d0ea84e03d9e55df768d43a822cc5b16c5c729356837692ccd2db282915e0560ff8839616decc79a67faf4dc0def5f2ad0049951728a2067aad5dc8975c2afb9ad8601b0e16fa66ef3f44f2ce2bfe3a71f6f0b461e40cbf89b9f4dc6dd92f87b3900bcdd62e7cbcdc7198b1af3f7b5fc4cfb5cfc27f10d59b207b4ec7c1e1cebea9b6123bdf91f780409ecf9aba95f069835ed6d364c773de226743d584faa3003e967a74720b034c8496bc7443de16a39e9b9fcd61a71bbc88527fe7e62f0f4414c9e0dba4599ee3e43f6979b697e504266c0ebe8cedb37b7bcb91b428c6ed541807ce7431672830991a076aa017f5dac1c83ecd9cd42e1fea8eb8e86c8a3fa2970f34df7103ad5a2735f70ac9f4c058e190d04d019d8d0710c05c86ee508a6144580f976972eb860e0810d71c9153a7adcaa13f4c6eb2ccc8a863b630d91270994c5e296a8fb2fa9824fe9ab860c343cea66804b0db680e87684254208b83a8668ebaf7b06aca44ec197056ef92fb2049f7d0595a8b89093efd92e5741462a6250c7e284c37b839102b65fc12858b4723bdc9cdf340245ce0f079a43eff8a47bb1e48de1105073d4ce6aeb082d400a77e8b6ac77e5a4dfe871f3529fdf189495045400fbdc1bb5dfe76bdd27960c606b7f4afeb4e7eafa1829ef11f97eaa210cf2bc62f5cffe6db697acab151a115a70442833d6a4d4efee7b511ed0dcbede0b5b2a70e904b21b74548eef8f124ea281b7b887c5b225b511aa250c271ec4e86ba0a3feabe4d3b1b324cbfd2776183441dea452c70bac41f53553c8ebb751ce773ad9625c059edd38c098d4cdb216d1be871b456086233842d88f57bc674573b178a39a9668a373bc6f5b5d8501146070c7b1802737a2fa0d533f7710b02f5e44b4fd94bd69239bb1142bfcb104a765038b1e253faa9c878dff5c42f6030929ad273fe529bd1de38bf8e2526b26ac45f1dcc9332a4fce59d82e2705b0305cce1ea2439a90dd967781e145825aba68539734366d8cd2b8d97c87f0b1097627c8c7f5a9013975d079b93f5dadaffe7a6f602d322358b0b88552df014ed761defdf50381fed1e269c2bd3449eb88351bb7617d2452147c58df67ec5da7be0197b0ad814482ed" } }, { "event_id": "evt-dd384da2bf205722faa8499e", "kind": "unclassified_tcp", "frame_number": 10459, "timestamp_epoch": "1732596620.279059000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "656f725b798b58b85e24821376fb2477aec6c9fb8ecbb071b0c4053b7071b43dc333d925c603e701927a9c1c3340cc6ff249cc56820ce4ce894a35646019300fc29dd0ac89c5da89e2ac7ace1f77f82b173e30b998ad794ed8e50b5ddab116094d1a4dd8f09f5f26498aaefc14b9f086069d4b9f52137113c75b6c76ddb76a4d5534ff337418815d14bd2e9337fa3cd021b11b22a09812a8a9fae59739d022432eb2e5065475288f7c8feae83b1219d9a1510743c748a03cbf3edcfa25958f44e5c4c3d6d110477279ddefeb4f56d3dd18af4a00fc9a814c5470be040eeaf96728f01858cff79d574585e2d522b166660f48a7e94930a5d8ed768d8826c040694a8ead1f467ce1659827852817d3b2695a63559603eafb8f84f98ca5d4c87643871b04b19c1b0ad53cd974137b685b48955ba06a255e7184c9fd06414c52b7e17b74ea87f1714e73b5f79c5c34d0deec9b48def584386a114cc09f39bbf7fc48a57f91c2403d71a2317dca8ba90c2fe1773e8c5329aa51f6af1515b7d8b7f0506e3fae9708ae113cd9ad328d66fb7362b5bc773f914dd9ae86c6de4155349cf51eb45fda7ca1e80046c15a33bf7d13af9eccd88541d4e626babcf2eac7e0f8ae3e57e697bcb7ba2e619c53de7c57715e418f9f5e8442c65758122a2899fdfae05d545631ff8660a7715ddc42b67430c5ba4736bad4fcd3e7ad74872212f8b36366f37312a76c57d072e4b7cc6706ea104efff6a4a8a3d7d9a84b0f25acb76956f9a261a5b7818453d1c88a50a060c046a1a7f01ddf1b220b1ede4dcd0ce256b43268f984178b57fa1df742202b1b7d514971745d3ed6d3b92daab51886e43ffcdb100976f128826144d66e8e45c46cf8a82872c32964cee32c9a450b632ec86778ee048ac650e82eedcb8900569491aaa401fcc3f78c1d6a8fb155a350d1946551a8c470c67a71a206438bdcddaf83c1fe104832c13d51923f13d120b9795e08afcde3e4f99862c445f134a2d9e934758a377febfe317685c4f03c1ef348f37575b9d7c513d0d1c2abd407743fd431d457cd6a8a1bff1d7fab3b4d2c9d32dc6f8ec3565a2bbed7e32e20a9c3799eadab838f43fda3c48c5aa603ef9303597980bbf1a8e0b2b981cab2269a181f4fed352ef8fbd0f3fe7f7c4ec40f874f7ad592a01dd56c08f31fd0d70f84fa21b6d61436c4518a055e256ad17305b7531b74e51d284fd05565302bb9867d2783ebbaf5eda224c39e6286c425c7774b00fca2b639b1d0c680ee6f56a5df16af6ede6bffb58696032b50bd543299f771bc4b416cd71f0f96771c56a1b2320f50bdb1cf67bdd12809f781c98937b178b31da0ad9a440078e56e7da172ed95924495eb730db26614b1fcccbee7312012b5cb5a553b11d483a8184a3fdff2914f24844c2c5a2b37f3e21b1e93533015f6341f8a8593fe3d1ec30b046846c6fd6f6ccb2c1fe3be3d125ef63bac0482ea35447745795e04e66efce253ca316bbeb21c73f845e2a7ed2e886be15f76e2477b02b8150a2be00929c59d0025df8bac942bc190e9afdd40d915c2bee38ff8711492c49110b1c1871398f03099f913f0cef4b5ea3c62a8826d423cc47f289e9ff6e67250c65ebdf6224e1fa5a3d56fd0036e14350e050cb9c6ab4b1e735e678deb5f3b4a46e23c899893231ed8b3eea739876b0e18c3d619ded67567db337ccc53c62b6da0f6d174deae0dd855992a0467792d525405c9be4b102ecaa2fb083e75d12058eac4654748e4c7201a28b390df8f294791e3e484537623952ffd0e89e819753a4f1abb3cfac48c1ee6b25c17bc00a95694031bafc5836c41b3d04e4845eac05c1dfbb94033ebdf8f7a041b19ba591cf013b651729153c84b234bd4722a6cc5d9ebd9dc4477cb671f15f4599171ffe713a01c41a7b390412edae03ff9fef9c6ce7d6a" } }, { "event_id": "evt-c21c8e71878e1eab4483fec6", "kind": "unclassified_tcp", "frame_number": 10665, "timestamp_epoch": "1732596620.456451000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "20457d6fcddbaa95c31a0ef84e4b4f64b0876a6c9b05057992bed642ed90d2ddf7846b389c43cdf4e646c15ebb924ced14b72155634cd33f74ba1c5b7f7f89cacbec83c3d282f9696a11ff5fc54ac5e0f583231bd3650ba64ce7603d7ad7892b1beeb21f0e9875222054e485751e5d780531a12b86477995cddba0bc5e9344da1057ff7bbef83c2624d53b54a379c4e3e3aad020ab080e886a54c0d5ddd6f5b244dd49e805d83c4d03e64c286238f0e3fd0a5a4a7758645defa851c3bedc9e72cb54c2ef61019127167300d85d87762bc315e91cc939489048631abeb94be6de75ed4a810627baa26ff1b33808200303517c977fcb2c65ff97f11e607fd39814faee6db8fbd8dac597d17c7b19daede69cc7a7178bcc780153eb6e48a3a0c46c94085929c1ddccac7744eb903897d534addbdf71e8dcc7e205e559cfc2b9c4f598784b9efe7a1d5d2cb7a537fea7f9b4a0e52c60e40a33556f54c2678b32fdf06077ac862f051ff5a1ba195d7743651e574be36010fd4ae85f1cca0be92ff38ee653530e65683e9b8ae4db17eb653d1eb94ee5d4df1944556965b366d83d4337b7fd9afc0366cadfd65cff0c1262bdee81da27fab84feeac7596e036a561febccba1b7bb2bb8537424f849f43e2632a7e9ca5e2d1b318e2b0e67fe89302344f900f1cb77904882348c3b9d18f55b03b5653f2ecdfe0c21d9dc89f1b8ba5bedfb4df17a0fbcb15ca90db12e12edfd6fe237772a718fb84574f1143ee419d0f36e07cc0aec54edfde65cddeebf0d79525f04894874d1c7ba0d630eaa66a9d5f4decee6be6a4bde8fc71b1a316cb9b75cad9a4774d77f7ad28e26a7eb4b8a8fcb86f2d0545264f65271a22395d4fd13904725700f0a9b94b834741de9a0d2a2702b05572f3c68401e9ebdebd8b693e5e5ed8dc9cfb2493142f56f729164b30d29f30d5c1f3145c6e4120b157824091eacf2a2cd8f4cdd20305937b9d227064b9754895bb83dc61adb751bf58053278d5cfaf2b3e397798a0767374a23c8b48183e60edfb93a69377aaa49b2c1122174e8c421366d8127f9054aac4fc2ea7d666848615395dfcc95a90a4e77d3f9014b2d309ed083c94416432421304460373f891e9fca3bd3be1b3af9bf0cebf83c2f467c867651018a1b524a90f69b0196175460334cbd6f778136fd479a9ff23d6e2c53f7218ad0163efdc5556627872fc48af1a78c8798e9b3802a03f4c6c1bc2e3d37635788d18b3df3f2ff450f8ca4682720380a34e8dda28438b9c062dfd52a7541a74897271880de2a7e4693057d83c3a0daf7a19d48950c4a087275ecfc9c6d2936d060c7f7582a81b359781076069558312013e3c9c209caae6746d4e230f8f2d741493cc77484f14fad049c8e18f23a7bb1385796d70accab39c5ba1784a10e5a81aba1ae66e791020484671e3f3637a324bc6b2faf62aa3f998a490df0c48955bde775d8fc9e443d49d043b184044328849ceb2a6fe636d60f2361e7304aa623a103119ecf54373086cdc63756fa891ac3aa3d56ff494078532857464af167af1ae3c218783b777b764cb87b1a2ce939b761a913e8dfdeb970f48986a71eeb126780a61404afd7725083c4b5fe05cb67e3e6173a2f3ad0481851fb91d6bc4d62638e2cc2d4fbcf9cbba920f1ac137790c2fc4069eed999f43eb3fa70d4c29b9390b7666d3b9ed6a99cb1b8e0d16e8b38b15bf4a839d84de0b2d964ec3b63c51e4755103546355428c83e5a3181a6f3a1b81d7f12878c1dd90495b714de96847a02b8bdc89875313a2fe3edb5aa840089d52b858aeb9c2818775575ed01285cd309abc51ba0c20c78d668a4c7061879d3082450c0db2d17c95aa126cae90097959a48bfd25c0f6979bd5c66f94e3b43d6370d0c33780e29325987d6df447cbfb6e90a18115a3bbf9f8ef530fc02bc3f" } }, { "event_id": "evt-eaff13939400d6adcd8fd20a", "kind": "unclassified_tcp", "frame_number": 10735, "timestamp_epoch": "1732596620.472228000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "355223495e56553d16ed9138a03176ae0d2374b4b284a419cd972fe5ebf66fc3cd66cfac732c62bb2649c6e203a761925d3815b4f723cebfaac13bb7303972b70594434fbbbd3869a12cb91dfeb637d1118ff58b3d85b835051dafe4bbcc9283b00283a097841833a2f4740f80502d3b4487f55bd99c7cc728da13d1e2cba8873aa8fa5aaf5ab1f0ad55bb7767806c13746e3814db1bad8530f3a9187f1f816cddc9322b4d408e2d31779efa6067757b44d4fafa057092cc118b296a08da5ce05057a66f76683d187f2937ca4c8e28c144b598401b1617c676136c4f366aef22653c161498a3a667c36575f54e5e91db8e19556679b455aeb29ca2f696a63d264d051c1db99c4283dd6b477918512164b2fff7c83bf2096a9d445a6bfd9dc409f3a603bae2bf21d490854440594289fff2000bc90f56b2c221c98ec2d8d0face232d4fac9efa0d99386a86e6b7554ac2ec3a4415d9ed0fcdcd48b9b568eac74d28e204de52186207303af56c8cc1f1e8768e899bf061a2b3b989fe4a76fc38798692448f6825e80cdac3ded086f338f062a9f3cdf727d649924e75a1aafaf06db7252fabf6984af6a8f0823e30b821e24508da08a10c20b263a6afdaab2ba05da468d70b00d2b39b008ee3c87d172f9fd02c282f15ef2bee7c343dbb83bd6df3feace8d84e788e43c45463f35cfc9e66da2348555bcc75851f2410afc926a6fc0c941818bd7fa1ccfa58d2aa15306a30c50dd2db025b83b7656837681434835ff89528e75240b9d494d669260a19de8ae75bff549f9886ff3f5401f73d456dbfee0e5e40b0c0082184715902868408bf235b0eea43a108c4f7111ce7465dc911fbdeea0bdc9dce8dd2e8f4f22c35fabdd8b105c772c472816eb7994dfd03d9b4c8f2c535756dbd0f1a5fea27e50b3687cb85996d8b8fbbd52393b6f751c2c3f5b8a93108a4aa797b87897cb88365fae16e23d108cd651c08d4989786ef45f4e390a85b34a1c251b0e0ad6eb7bd7f7388d2ad13cb21620a4d033b568872a71e388fccd45f473208a458d1dd8e06967dae47b90942f720e988caf415de0aa0efd7335d528fa051476d2708bbbac9c5eccb8d9b459102fbc83e52d8ade5265b9e52883dbbd7b4d1a6fa3ff3d2d3a666f991f68692a20f2ee53d3ee3d36989818f92c82a2e318684eece5b88570232f47a211a66695868c7ca9abb4854e87b23e8e49a2fa82e1947617c0d81e72f09a43ed5a65c0bf82675fd0aeec45b2a6dac02b69573f307334de38a67eaf3b8f2f04734332d15f26b822736f24f0a66a3a5f58c49b9b44f0e088c0e9aaff0a6c5acb5daf4655af244e1983e37b81a3521ac7bbdca87c99effd980b134b4e8725ce7d34aa917068a3964e7001060cf4420abfaabd488207041a8e57e65bebf947cf005cca4a7d396fce131ce45be78580787d80c8664bbabb6d012331312952193e87aba03ee0e341234a97bcf0ee3cd1e08fe156d011cdf7895f3c5fa83707229e8e9584671889413d4aa9bc3f50b3f0d35448c1b33c88082b4ee10039354490d59fa5d7d0a739b537ef6737511dd160413fd7d314394d1aefb78009f430c929de490bc4e34320d7f6695b996c5b057112e439b6708a643a03d8fa7fc46e5a4b2854e33304240e323a25716daf2df72a5affde47dcda0b64d549697adc602dbf013a47da973c5d25a30efde722c282fb77ec75f177c05ee0fc123ff439a363d98de611e5b1c9d932b6f2ebff306236b91a398fdeb0769701bfd52925e92ddf78f28cce20aa7c1ae99c90e27faa35cbf2b54ad82441c5534b9dbca354956756fffc968c1723df460aaaac5eeba13c3608e392d4477ca4af7a4c3468f9ba83577312b05cfe177d1c74d83789c538da675cc2ffd87a944f8c87f34434914ab77ad81f293bd63cbfeb98898373a8519475e8ec7267f" } }, { "event_id": "evt-bbedc05a7747fd486d16abdc", "kind": "unclassified_tcp", "frame_number": 10819, "timestamp_epoch": "1732596620.564412000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "2754712c4af63ac0afbef2ba19cc0eb1156428a0efa297d1e326b53bde7c4c9284dbbb1adea132700df5762c462d604463feeb5aff72fa76a1ac329232c97865bde12b077a595024105d0a92b7c25ffcad0641a100bb4b407128a7301aca09b95b49987de8997d4291edd6abd7de231e0bd32c221d3b9d52a0fb27a717f7650fe69422fcb16c82d5997b5a57a348d17c2e35cf8b17c736c61e814045744e6f3f36242a82db152cedda92a39ac05ba07bca84427b9f231a13f0f05c7016af6215063221ca92e300bda24fc519bbfd5db4794b60d408b5073cfebbaaed60ee88d3302ed38967659b39a69e42a286cb56d7b67dc1fe4eab5f6933bd3a559f46158be2f154b0a8e7f6fed152e2c0ec061058059b2b181c10c47ac15189a3e50eeb00c1c33307854a5c913d64dc3da72b792dfbfcf779ce3db31b7e307ce872597c8e6c1d51b8712bdae8509871ae1b4c48946a18a1ebc85f0398fe1668739c0c6f1660435debfa2e5cb48cc43797065edc7a486b7e9653e46dc263c817abc8ef88207285016bf08760dc8a778b46be16ab6fbe6888eb7145fad505aa4c011d3d64aaf140e0f7e6ae472a3eba7627377424dfa771a01f50b044a95725bc8e60ee7d2ffe9ac482061394d52cf0bba9da87790246dba9f90e0e080bbadf339c0b42846d0d84e14d791974ca1df1bad3c174f9993ed5f08e6c71dedbad1ffd72f62385561bc5dcdb3faf148c06f376cded8ccd8d3f7a632fe3ca6365a9c7619a231dc6536c42c87b420ec7f077c51bc819519982754535c57e400bc80c19005c48dfaf473d4ae502d21ea57965d2ec0c24d5f6f2738490813b3f4293f4dd69bc19ffb7258e5196167b1d3fbb2225a072566f13d5f0f8e1ec4fb300b2d1713d717c83c7fe2002e6441ae1ed3b1b240cc7e958ad5c4b13484484840c250d50f419c1eea35ec23b4632645509143491c29a16f618de1b98739c379140aa90d8bb113f1995dacd25e884f8c93ef44c41a9a649a84dc009b48712f1ab90b23567fa10f4422308e647401043559484a0cbf290af31029d06c470912682bbb1b9e028b68572e980dd7f84a76fea685c80ee9169ca76dff369e865bb973dd0caeff6141bb4a822f20b5e34bc666841f6e2f0c55639078509b69dd03e26943ec3d6be1c9069b11c7c6a5e2bdb3b9dc34f2cd7e054614b30e460b280737d8166e146deaaec017930fd50da68a0af3ab9e248eed9628196c51ade4b90c9fc5a59c82b2dae67a9413c22d12bd10cef7a9303ffe61c0629628760f825dd6502fd73b93ecd7d07310f687031c800a483b886950865f479d115018271d9922d18e7943f3ac1426bf45d71c07bd0929855196e3e3a6dd8191a94fcdc3c275d49ca469d54337184070dad4c130d7e54b33fb01f3985cde882a7fbafec63e71982fed4ad7f114bf87d1d9bb92988f9f423c23e20e9a830c3cb165087e68c5e66e990d8796672aa5dc47bbc45e4b39cdeff8aecbb70b495ed1d15144e74339db37e96d8ae202f37c702f6585f6bd09f0a9f4082f06857ea7f448eb4f695d67bf92b5201af83909c4f9ffe52338411d19ba6cb34294f00b6cea5aded81548253dfed949c7ddbacac6a5c03317d1d5e3f5b4c79598d0f5b5c6796e750858b471be6111c339892639c4c98ae280f5b215c7662ee4479b4fec0fec61aa5c5a153454ec853f45d5b09a88057cf52c1634fa485193c7a29f5bbc1e927a966da91dde857ac58665741966576c9ccdf0d99243965b3380d697e7f116f49834600be2aecef210aded2d24955337b79f50ed24db9dc95c152272d867617590c64c07e0e3433a3920f3fd49796324269257b69ec7998306a76eeeb870c08d1d4dae0d3aabbcae40a5d0f11d6adcb7b7ed2295f777c5381dc4087395098173dcc49f16e718609d912dad3522b9a8644cc688821" } }, { "event_id": "evt-011a2b0ff9ebb24538ef4114", "kind": "unclassified_tcp", "frame_number": 11150, "timestamp_epoch": "1732596620.778491000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "5654674a60fdf0d61cb7da7d390d0044de70c5f68a0b53416628cb22731a2efedb3f846e5e286537573714172d9cc060e3625da43b14f73482f5d0cba1d6f4552b2ff0c31b9330b128814b3cf943be2d88f2c713233691423073aa48601f4005140e0d2fdccd91bbec2c7e9d0e591d57f6bfe04baf23f92ced12dd5d911a0d59d2cffb7511fdb881a649b302dc9af49bc6e3aabe01a9a767f3e1365be2893e02f86621ec432c02b82d4c0523f45533c50017600e51cf76ee27302211e5f0adef098692770351e1095850693e657a68a3a4d9ebc80ff56075c33466317022d9abfccfb5f5a2a022c89a12f150243ce3fe1e512594e173f06afb051b48a1881df87d7e9bfe6ead9c6ad194506d466c1bbef1b70bbcbb9df8210a40c6c0355d2298a6be4af9c11298d52658c5693fef5c8d32af1195db2a85da83c4e1e8144ebf007eaa86806f9a39668403984a2b0c6809035054357f49d2fbf8187e62757c869955fdcb0f0ce06fdc22300ee43b5e4d76e8f28afb25aa86359fd3ebb57786b6e187b3a8101713334467dd42b7e6d36326290fdff84321887e652bf5cb388ccff8a961e4fbe300323d28b5490ff452debd989c141b7ccd080cd38193532a49cf1710d2761d490499c0954218f975046134a084459357843a11c3df7e1daea3b8b40196a7be6fef92881598ecb4a6ab5cfca2fa63d32775390e0e4234ef71a46480551dcd98708bdd087dbbf7ec9022bc43905645df7601d076f1c01b93677d5cdd9e3f6eaffa445342be5f09fe999bfffdb3080981b76f5f42e0b776c247684e43e3b201dfad232085f694b7e28ecae276df8bad521ed691ce1fb5cf5bc92c50a659c2c02a876fdac2ca425ce3bd4b9cefc8159f8a02083f91f8b47743cf71a3321b3da4c600a34bb14f85a1a6508d511a4dcf1accdf8074ec0d99b655c4d31295a643b2f51a4c33ac1c9e48091c0b76ce264fb9387e3b6aa0d87bc5bff4dfddf92135b67d9c9f83519be5ad9f39f8863533fd50e9a31357f3a05d680e5ed742c2c83c08435b487af4421ded4445bcfc5e54651ac8eab74d030a478d5e1d072f13ef6adbccee00727e428b7fde567a9b669ae1e2fc8b6e017eb02a59673e951a8bb7e169094d69292ca9461a2835a9ab5c0a10e7161cf26aec5bf22ba7fab76aa0fbd39b1fbf1afdccfea9a2ef7e9d108467e32d71643c9d2f00c4250ddf21099156ef83f5b0f6db4e2465765b0348a19d260b7cd507b9e763a7d0506175cb60bdd0881e910e4e16ccfa585d1a07dd52bd0d3508bd40edf506e6b30b0f993b5b8d3fb85fb78ce1d47376f4ed760f3a4587a75d66389f7e1447c1ca0c7b3fb4d4a3e8cb7f98694336f4b4f4ee3794a50311f2284b491aace89578ac0261df8db28c0cd3e82ff049965fc8a7a12170b52ec1314cb6d11ba7bbcbff233d15bbd7d1aed3594e3e6085e0dc813fbe4218f9d74b0ffb8bbea859eb851438d133790f4e5e4a2674710373a964d161f828e1dbb93d028feecada8c5f70836edae408048faf0a27def961eb0c0bf93c132b1203ab5b8d3ec4a2e54d8f73d9a7e082549b89321002fd9634cdae67b7099e499e2154edccacf19101d1707b95ecb178e08bc445a51ec688d11d82397ee6cb5b1fdec4d9bf2d8bb33a77b6ee04117d28db8fdd30e56c2657c9d8ad9e1b0e08fcd5b7e3b3f5bfa9b309a07dc6722a519f99687682ca8b1418de56b0f6c5ec5972b82e3ff9e5ea5cf6310705fb8deabb6e10519fe778fa8fda90d522928b66534c711f30af82f191bcc942d7b6fff5887e5f3372bbc21668ace690b91b612f6e67d7ab9467cc589a20dcdbf3b79c6de517f50ea97d65d4a185652c9fee4ede41429a84e0d0a1627ea3569fb97b4b7f538839c011f3216e7ad9ce40f9152ed5f67a9fa13312321f35020ada993f2b1f85769facee33" } }, { "event_id": "evt-8d403b13f920aac13e287660", "kind": "unclassified_tcp", "frame_number": 11256, "timestamp_epoch": "1732596620.882606000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "28513754a0cae9047e4247f5ff4586006b8a88ab0cfd5db60c61afb199e4c238ed0a9c0f5cbbaaf3a5c013de43d8fd0ef64bf47669d7377917bd5c68c78dd48600314294971b23fcc8b3d225979b9aeb92578ba5284fa6d09b13e8f88914957189e23e5d05f5e5fe9f0cb622f7d155f5752e9f42e751ddc87275bd0c306bbeff768ae0ff69d6dbee5cc7c4211b1fadcfdc2f985aae7f342e2637a87a845ae3108f431b51599bd3ab5213cc405854a6fd053e8d3ed32a92bfd8f620a87bc3e885562f9c533b7f8e68346ebd29a0309ccab3f1c2517f792740e299510c8d92fa056ccfff0be7466064da8dbd7c01a40012c084da4707718b7f6193877074820783be8f2b04862997b815f2d6ef608a89e38cbd50f983151829d1411a34b2b42bed18ac8f2bcfd26d8b4c48c3e153ba23b384aa96683f95c3788db5a1a81064d1800c204b5dbdfc469d1eca6ed46f160b678f5110268e66455bae4163c91a43186334eb2695b417ba39fb2ded00d3cd1280cf4f466379808228c0567db21370738c26d01512adfa2fd897a8eb597b2f96107cabd5d750ce725784c980bb576baddde4404f6aa58fa5f2c82296cec81eac43b13cb175151ad526acf50e972bb84938586133c00fea3458dbe462c2140625a14ecb0c1d31bd473180d06dce3424c5b842ed9dede61d38232809034fe01982c44748c0e68a6307413855dabe1f5d9458106d16d6a1b2880747d1b4d66b356f3f97972d83c96f21b49c7f1bea1a739ae29eda7da6f92579798097ac5ffcabab9d5ce445c5349e05a3e02b5d7f53291c43511f0bcf26cdbc1642573ce4774fe868062517fa8e2a5575ac04c90b68682fa53e8082e10c7459a01024657e4bbea676566f7b74b4d8419e0f3f231756aec4f7717c91abbf7bfef5d96373d95fb0590a2ccd162931fed8f7a0cf65e49b9f23c18d8183386554817fbc89497270c1e6eb6aabad82d76fdbd5152d1a1e878c6cd744b9dd97929782d605127b20498387d594f01b1e2a3d67b8cdca7d86b8ae37b89cf60feff02c0b71a607086f4f4cfce79c66cf46ac275b394b030247fb0928f512a85dda6b0d06807b0e6b32a04ef41cd5a6ca000e61c55916183a8f3e7577f1d5cd32c67e714f483a3b5eb2fbe4fa04fb6b8e3b9bf3979fdc3acdd05b8a0ad5c9c127acd71c4dfda0f77497ef81db8766d6d57fc2f0b29741663dba867a6eeec71ea7bfef71ffe4eb21b2688a099699a725a54a0f746e5a0c95cf5bbf0f25acc3a9b6d1722a77d4ecbe1aef96aae690a12a9a96cfd8b97e0a78ab9824d05fda9952d644e6f7b869ce2a06abb8e16920ec101e04acd3b48530df345fbd1c4416d7801e5b5c10aa9adb953e0d2d0f5e9c4a29baeeb2559ebab284f9b696488e1d990c3e9f372760341d8c978aaa82df91838bfee6f299c2a7bcf4eb4eb9b46b4f85707f8366a392b772b0d260d6776de9b7b893523f08ca1531161907b23c650e3e832fd00232696297f4031db6dfadafc4b5f9ee149ef3dc1421dfbc8f7f20181781719ae15aca533af258043afd937ad6c3751c2b7d23c3022eefb6777164c336636cf41bcbadb8de1e4f3c808f9d9a3c4156e3e829f32bf341aa353c6203b9adc0030446b839ca6bced8cfdf34dc66c0348a951054b1c5fde84848107648d99c26670ed55c22667465340279b33d48d04afdfa2ab24fa60a98034e8360343212544d4d8f82efcae327a80c37e0c153e1aa1b4678f8506a81c4aaad1c3e4b62dc796aacdefa5c479fac149ca24b5e56bb214b810b90f8525e4faf3b7429c9633eadbd93993fb9f16640d7021f0cfef6b3d8331801060ceffaaac2cae34908d697bfc1ab15e1e6f55b368b91f8cbb8e5cd29d9eef433df22b833d11eea5349dd7a3af51df99e44bd39a61ea155d0eded3a5c9cbec5f936b7a8f182f7c88504f5" } }, { "event_id": "evt-8a1688131907346078c00856", "kind": "unclassified_tcp", "frame_number": 11338, "timestamp_epoch": "1732596620.962248000", "src_ip": "193.42.38.139", "dst_ip": "10.11.26.183", "src_port": 443, "dst_port": 53337, "tcp_stream": 54, "udp_stream": null, "fields": { "tcp.payload": "2b3e525f94ccfb3e81535ff95ec01c2a8e31f26d01266feb6265e5eef5cfa46f2612add3e85860f1e5ca6a2d687af3a457f50a0c641112ccc136b8aa38936a1b66446605abcecf0c90d68ff31d9b44ecf27e509c9c999a6b84df3be3de1825c548614d0ad98726b99eed28e277b8a03c6f1a3594f9977459484d17e948986f44de65ddeacb7b4726fc23f188d7f6ad06a68534efab1d1f956fa6926d6acb69af007e634e7744aa9fa7fab6d636def24438b926d6e7d4d3d92494b55bb508b6d5087bfcfaa4f61b6d8870f4c06025a8e1f4b852cf39dfc508fb867554e859daa9d3c085814b413f4d155da32d8ca4e17fb7761155933fa66d00b0dcedecf24e27e83be9f761f0e45ebf7c764be00d57e6290270b2e7bbacf395bf2eb70adfd369a65c0c0dce3a3b2e7c277fe58e8bd3d42e85832a6b01e022152c4817945d68994a7b3132754b5cc5bac58fa80edee634d5f19b9f47f69958b2f3523d607322b65fac9165736f7635b327c9e9577d67c90994b44cd39873259e68c57908f37b291ade09382179dbd05d9727b5485a90e201988a68a3a67f462c356da2967a6839479c8c415efd7a33a68e4cf606d7b26b8675eeae2570f31e7f6d2517acd0162b9bc6935e58e5104ca210235d5f4f70e7ccaaa0fe1800f5aec4548afd2dd59d1121d366a4a5c905ad89efabe5779d30bf8ad5a6316d1a1477022dac33cc52ebbd07d628747a315c557c9958596ec5f789366158f95932e01f5c8ce279f3c2cfc47c50a762e6c47c5a64e95f1a915a282aa722f272f7cc5889e707399642c4965bfc73b84bf5639e6c8dfdb0915bb3bba7df5a58b7bb88641dc36db387c3f74688d5ad98be526f46addf622a827d7b4c8352d4b3391bb44a513d19d22eb805f53f39e51281b634594f45eca2dd4965a0bffb2a5b74c38a2e650abd5febf3c12e3bb03fa3d46dc1ce2095c3a56c59767afe9cf3884cb5147945f79d47747a74c402aba780b63eb15634cd169f9bd775c4d952763723a4e2002061efe85e1f335f4d0c40cb75d02b221576f200edb5efa0a3e1f96b4a63138bf968f878f4832cab777a8754b8a241cbf3a1079829d0af254b8d543276f4096bf93cda61af859f77d911c80dd15a74f01d99e04c66218da0ee7a22dc55397f8644aaf7ca52ac448723fcd7b41bd6c00dae5b673cba1fbfc9863928744941699ff5e7b521dc2babc5decd067f8860d42590410a0d20ec583fd8d00a80480821ebf39bd1975fd53c82b11c4a3118015ff907e54ada8222816de9b1de50d5050082d3c2e356542d63530c8bcc3295ed858be7b218cf6ce1228189f034366b44bd3cd108c6ebd89b717ef3c46f1fb99b407f10db8f07c07dcd0616a68f6398bfd25eeb7fcffe39b1f1e08d78b89237ca3ea617fe0b69e185481161e96ee2c6323702df70cd6c02a246c0e22c3766513140ab7f637eb2f3650abf1b709491dc0e30f836d2dcccafcc68d8367199f0d16f4c6db1e1cb6a41622d65bc2b0bb4f4e727751d2800fc36aceea54ab5142d99d29eccbefbffd6ff1f581a95748c8cb1d7a5e7d65fac752418f2fefa6c9144f36e2f0ac765b6bc6bab0bc37f49738289836915465fba61ee2be6f073b5988d39ea09e646c1ad7e548c4cada69c7b16182ad217ff9097b6572006dfeb9f84ef7b674b4ae6fa7f28ef2df397404a8b85c38afa023510cd4ae2f2f44233ccf2599600e40b54004d76881328be2f1afc1aa384be2cf3b047b4bfee93b8aabbf2ba0972e6fa4904a2109083b895e50bf2fa2d754dc99a7e009d33f9ad23e84db4a1a1364871d1dddbf52d6efa7a3c785b0ff6590869e12fbe80cba763fe2ab7a32516baf2ad84a30806eb0e0a352c2f681976ac9f46c520a20f31560e632bf676d53f16d7266f9497401cc253711a6a193a76e1b2e78c8ffb0c9ba5df957f" } }, { "event_id": "evt-a849f1e64299e41e982d0d5a", "kind": "unclassified_tcp", "frame_number": 12586, "timestamp_epoch": "1732596628.739506000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f4dbc49e7baffb94b15d41b5", "kind": "unclassified_tcp", "frame_number": 20515, "timestamp_epoch": "1732596665.083596000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d88e4b77f561ea0bed50ad94", "kind": "unclassified_tcp", "frame_number": 20549, "timestamp_epoch": "1732596695.087792000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f79f5015695ee69af2084f40", "kind": "unclassified_tcp", "frame_number": 21138, "timestamp_epoch": "1732596755.129385000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b7ee3dead1835ebec4602485", "kind": "unclassified_tcp", "frame_number": 21236, "timestamp_epoch": "1732596847.843513000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-637a65ad6a572a5413a973a5", "kind": "unclassified_tcp", "frame_number": 21240, "timestamp_epoch": "1732596875.134499000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-33d98f0c608949f874271724", "kind": "unclassified_tcp", "frame_number": 21291, "timestamp_epoch": "1732596935.402780000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d3fee91d419e6a9a6d4961fd", "kind": "unclassified_tcp", "frame_number": 21329, "timestamp_epoch": "1732596965.403248000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-333d4fd23b9b2478586af2e4", "kind": "unclassified_tcp", "frame_number": 21343, "timestamp_epoch": "1732597025.431749000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c5c60bf11e76b7a3e61f42e3", "kind": "unclassified_tcp", "frame_number": 21358, "timestamp_epoch": "1732597092.937498000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1ddda6616599c5c5278d5e3a", "kind": "unclassified_tcp", "frame_number": 21368, "timestamp_epoch": "1732597145.436402000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2402acfcd34837d28d09fc16", "kind": "unclassified_tcp", "frame_number": 21705, "timestamp_epoch": "1732597265.451841000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-925bc280065b63be74aa98eb", "kind": "unclassified_tcp", "frame_number": 21780, "timestamp_epoch": "1732597338.012748000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a295b49b1f4384d4d3a5eac9", "kind": "unclassified_tcp", "frame_number": 21788, "timestamp_epoch": "1732597385.462117000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ec961913bebc61831ab16133", "kind": "unclassified_tcp", "frame_number": 25835, "timestamp_epoch": "1732597505.466735000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c778a667999f7b6f24b1b998", "kind": "unclassified_tcp", "frame_number": 25851, "timestamp_epoch": "1732597535.735858000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d50fe2250cacf51a9325021c", "kind": "unclassified_tcp", "frame_number": 25884, "timestamp_epoch": "1732597565.746948000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-042557c5df597ce003481ae0", "kind": "unclassified_tcp", "frame_number": 25886, "timestamp_epoch": "1732597583.090007000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0192ae9d8a3653a75b3b3c97", "kind": "unclassified_tcp", "frame_number": 25930, "timestamp_epoch": "1732597625.770702000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6087c280602b1b841dfc4f9b", "kind": "unclassified_tcp", "frame_number": 25972, "timestamp_epoch": "1732597745.780827000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-16e1911f45ae8d3d320810db", "kind": "unclassified_tcp", "frame_number": 26038, "timestamp_epoch": "1732597865.790935000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-723827ceb354059babc5be47", "kind": "unclassified_tcp", "frame_number": 26061, "timestamp_epoch": "1732597985.801063000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a158f8ca491bba94a8630df8", "kind": "unclassified_tcp", "frame_number": 26072, "timestamp_epoch": "1732598036.936198000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e8b1aa317a9c4f96a941fcd8", "kind": "unclassified_tcp", "frame_number": 26080, "timestamp_epoch": "1732598105.816240000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-de1c5f9848ad8db84d8a0f7a", "kind": "unclassified_tcp", "frame_number": 26085, "timestamp_epoch": "1732598136.076806000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-692740f96f91617469f09b71", "kind": "unclassified_tcp", "frame_number": 26093, "timestamp_epoch": "1732598166.082073000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-80475693c8a8b256c51d0807", "kind": "unclassified_tcp", "frame_number": 26103, "timestamp_epoch": "1732598226.125353000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a2a4bef2b2862d0e028e746b", "kind": "unclassified_tcp", "frame_number": 26113, "timestamp_epoch": "1732598282.011405000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9bd5a7cce8ee135063593623", "kind": "unclassified_tcp", "frame_number": 26125, "timestamp_epoch": "1732598346.135533000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-713cc9f73fcda0bb08ffff9e", "kind": "unclassified_tcp", "frame_number": 26229, "timestamp_epoch": "1732598466.146913000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-389363fce8198fca87679cf2", "kind": "unclassified_tcp", "frame_number": 26299, "timestamp_epoch": "1732598527.099399000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2159a6a08b16df8186d589fe", "kind": "unclassified_tcp", "frame_number": 26307, "timestamp_epoch": "1732598586.158067000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-963cee4384a3685ec16ab707", "kind": "unclassified_tcp", "frame_number": 26331, "timestamp_epoch": "1732598706.159267000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e092a793f72076948bb5eb95", "kind": "unclassified_tcp", "frame_number": 26336, "timestamp_epoch": "1732598736.393458000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-53a17ff95fbb7b3704624238", "kind": "unclassified_tcp", "frame_number": 26345, "timestamp_epoch": "1732598766.404288000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ca52c994f1d99eaaeecf5a97", "kind": "unclassified_tcp", "frame_number": 26349, "timestamp_epoch": "1732598772.309546000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5fc48bfc35fc50b295bd5cbf", "kind": "unclassified_tcp", "frame_number": 26365, "timestamp_epoch": "1732598826.444069000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-707e855698c9b8cffa113c52", "kind": "unclassified_tcp", "frame_number": 26385, "timestamp_epoch": "1732598946.451284000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-eb6440d04d5532691848911d", "kind": "unclassified_tcp", "frame_number": 26401, "timestamp_epoch": "1732599017.506819000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-74872b4631a05af95048502a", "kind": "unclassified_tcp", "frame_number": 26423, "timestamp_epoch": "1732599066.458330000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-18fa7d1e22c140455895dbf3", "kind": "unclassified_tcp", "frame_number": 26437, "timestamp_epoch": "1732599186.469768000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f5b8aaefe5614d30fc54b60c", "kind": "unclassified_tcp", "frame_number": 26447, "timestamp_epoch": "1732599262.575017000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ab3dda4fc4ea8f515ff594ca", "kind": "unclassified_tcp", "frame_number": 26477, "timestamp_epoch": "1732599306.482928000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-603617bc2fd5d24de857c074", "kind": "unclassified_tcp", "frame_number": 26482, "timestamp_epoch": "1732599336.727776000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-031b2320bc23e9f88b4fd5bb", "kind": "unclassified_tcp", "frame_number": 26524, "timestamp_epoch": "1732599366.736017000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53298, "dst_port": 445, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6d8e66d916efa28df861b66e", "kind": "unclassified_tcp", "frame_number": 26540, "timestamp_epoch": "1732599426.780401000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b6d95f0498cd9461e2efa4fd", "kind": "unclassified_tcp", "frame_number": 26583, "timestamp_epoch": "1732599546.787789000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fb4af79ab478026fa231213a", "kind": "unclassified_tcp", "frame_number": 26802, "timestamp_epoch": "1732599628.044923000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9005a1d9dfea78823a956360", "kind": "unclassified_tcp", "frame_number": 26824, "timestamp_epoch": "1732599658.054972000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-870b4c5b05ccc78ce72681a2", "kind": "unclassified_tcp", "frame_number": 26836, "timestamp_epoch": "1732599666.804037000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-122fa38ba8fd954021e08615", "kind": "unclassified_tcp", "frame_number": 26840, "timestamp_epoch": "1732599688.061062000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-80a8f86a8f38db4bb1144d22", "kind": "unclassified_tcp", "frame_number": 26852, "timestamp_epoch": "1732599716.885690000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-291be6ce82cb1fda36f44d09", "kind": "unclassified_tcp", "frame_number": 26853, "timestamp_epoch": "1732599718.063228000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5431bbfaecf6aace4eb45aa9", "kind": "unclassified_tcp", "frame_number": 26855, "timestamp_epoch": "1732599718.098143000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53497, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bc9bfbd568782d697eb877e4", "kind": "unclassified_tcp", "frame_number": 26857, "timestamp_epoch": "1732599719.885620000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4e91892a6c26170999b7e245", "kind": "unclassified_tcp", "frame_number": 26858, "timestamp_epoch": "1732599722.887332000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9b263f7c1eec90ffc88247b6", "kind": "unclassified_tcp", "frame_number": 26859, "timestamp_epoch": "1732599725.887257000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-600c80c741d5ad48464f2c6b", "kind": "unclassified_tcp", "frame_number": 26860, "timestamp_epoch": "1732599728.887225000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d2e25d52076c923a685b14e2", "kind": "unclassified_tcp", "frame_number": 26863, "timestamp_epoch": "1732599731.887178000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5af00f44d7da9cb9201b8586", "kind": "unclassified_tcp", "frame_number": 26864, "timestamp_epoch": "1732599734.887094000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a9441e62df3efdea0d7f9cb7", "kind": "unclassified_tcp", "frame_number": 26865, "timestamp_epoch": "1732599737.887035000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4fd358b6ededd675aede5cdd", "kind": "unclassified_tcp", "frame_number": 26866, "timestamp_epoch": "1732599740.887471000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-48bcafa29e39a4713f01e6a8", "kind": "unclassified_tcp", "frame_number": 26867, "timestamp_epoch": "1732599743.888712000", "src_ip": "10.11.26.183", "dst_ip": "20.7.2.167", "src_port": 53284, "dst_port": 443, "tcp_stream": 5, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d24a4faf78b2ccd9619b06b9", "kind": "unclassified_tcp", "frame_number": 26899, "timestamp_epoch": "1732599748.075465000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27d1323d8187913f2edfa681", "kind": "unclassified_tcp", "frame_number": 26905, "timestamp_epoch": "1732599778.088049000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6270d8043cdb83a2c26c0cf8", "kind": "unclassified_tcp", "frame_number": 26909, "timestamp_epoch": "1732599786.817435000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53298, "tcp_stream": 18, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2dc85b20e5f2d53929264cbc", "kind": "unclassified_tcp", "frame_number": 26911, "timestamp_epoch": "1732599808.089623000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a7877c1015a59b0547feeea7", "kind": "unclassified_tcp", "frame_number": 26919, "timestamp_epoch": "1732599838.095836000", "src_ip": "10.11.26.183", "dst_ip": "10.11.26.3", "src_port": 53497, "dst_port": 445, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-13c8da1f5fd678426e1e454e", "kind": "unclassified_tcp", "frame_number": 26921, "timestamp_epoch": "1732599838.109180000", "src_ip": "10.11.26.3", "dst_ip": "10.11.26.183", "src_port": 445, "dst_port": 53497, "tcp_stream": 139, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-f74a886bbea2a330f4d65651", "type": "http-exported-object", "filename": "MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D", "filenames": [ "MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 504, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 504, "sha256": "cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-97efc5cd34a046313da7c210", "type": "http-exported-object", "filename": "fakeurl(2).htm", "filenames": [ "fakeurl(2).htm", "fakeurl(56).htm" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 250, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 250, "sha256": "839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-5a9ba1b214d7efe4b7932b0e", "type": "http-exported-object", "filename": "fakeurl(3).htm", "filenames": [ "fakeurl(3).htm", "fakeurl(57).htm" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 152, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 152, "sha256": "a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-fa987e65729b7bbc996cb52c", "type": "http-exported-object", "filename": "fakeurl(5).htm", "filenames": [ "fakeurl(5).htm", "fakeurl(58).htm" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 84, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 84, "sha256": "59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ef0e7e08ce1dfd18b2d49737", "type": "http-exported-object", "filename": "fakeurl(4).htm", "filenames": [ "fakeurl(4).htm" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 76, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 76, "sha256": "f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f5ee19f48ebb7f4b5cf36dee", "type": "http-exported-object", "filename": "fakeurl(1).htm", "filenames": [ "fakeurl(1).htm", "fakeurl(55).htm" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 61, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 61, "sha256": "79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-e4bed6f90635e4518afc6182", "type": "http-exported-object", "filename": "fakeurl(10).htm", "filenames": [ "fakeurl(10).htm", "fakeurl(11).htm", "fakeurl(12).htm", "fakeurl(13).htm", "fakeurl(14).htm", "fakeurl(15).htm", "fakeurl(16).htm", "fakeurl(17).htm", "fakeurl(18).htm", "fakeurl(19).htm", "fakeurl(20).htm", "fakeurl(21).htm", "fakeurl(22).htm", "fakeurl(23).htm", "fakeurl(24).htm", "fakeurl(25).htm", "fakeurl(26).htm", "fakeurl(27).htm", "fakeurl(28).htm", "fakeurl(29).htm", "fakeurl(30).htm", "fakeurl(31).htm", "fakeurl(32).htm", "fakeurl(33).htm", "fakeurl(34).htm", "fakeurl(35).htm", "fakeurl(36).htm", "fakeurl(37).htm", "fakeurl(38).htm", "fakeurl(39).htm" ], "occurrences": 51, "static_features": { "content_kind": "unclassified", "inspected_bytes": 36, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 36, "sha256": "975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-e4d376cccfe6c5ce635d3c78", "type": "http-exported-object", "filename": "fakeurl(54).htm", "filenames": [ "fakeurl(54).htm", "fakeurl.htm" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 22, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 22, "sha256": "2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9", "media_type": "text/html", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-c953bbb4ee0b46fd26e2f2e8", "type": "http-exported-object", "filename": "connecttest.txt", "filenames": [ "connecttest.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 22, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 22, "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-e09b8d6347b7b6beb1cd03b3", "type": "http-exported-object", "filename": "loca.asp", "filenames": [ "loca.asp" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 16, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 16, "sha256": "af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-5ffe760eae605b04408a10c1", "type": "http-exported-object", "filename": "ProcessMAU.txt", "filenames": [ "ProcessMAU.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 4, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 4, "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-d31048d3862c67096c951497", "type": "domain", "value": "a1834.dscg2.akamai.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1732596718.620959000", "last_seen_epoch": "1732596718.630938000", "evidence": [ { "frame_number": 20692, "timestamp_epoch": "1732596718.620959000", "display_filter": "frame.number == 20692", "udp_stream": 93 }, { "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "display_filter": "frame.number == 20693", "udp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6d02a253278734183374d234", "type": "domain", "value": "acroipm2.adobe.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1732597316.691521000", "last_seen_epoch": "1732597316.726360000", "evidence": [ { "frame_number": 21714, "timestamp_epoch": "1732597316.691521000", "display_filter": "frame.number == 21714", "udp_stream": 109 }, { "frame_number": 21715, "timestamp_epoch": "1732597316.698604000", "display_filter": "frame.number == 21715", "udp_stream": 109 }, { "frame_number": 21719, "timestamp_epoch": "1732597316.726360000", "display_filter": "frame.number == 21719", "tcp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d5d66457c626938aeaf8767d", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596718.678308000", "last_seen_epoch": "1732596718.861647000", "evidence": [ { "frame_number": 20707, "timestamp_epoch": "1732596718.678308000", "display_filter": "frame.number == 20707", "udp_stream": 96 }, { "frame_number": 20708, "timestamp_epoch": "1732596718.678375000", "display_filter": "frame.number == 20708", "udp_stream": 97 }, { "frame_number": 20743, "timestamp_epoch": "1732596718.731588000", "display_filter": "frame.number == 20743", "udp_stream": 97 }, { "frame_number": 20750, "timestamp_epoch": "1732596718.732640000", "display_filter": "frame.number == 20750", "udp_stream": 96 }, { "frame_number": 20772, "timestamp_epoch": "1732596718.792127000", "display_filter": "frame.number == 20772", "tcp_stream": 90 }, { "frame_number": 20779, "timestamp_epoch": "1732596718.861647000", "display_filter": "frame.number == 20779", "tcp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1eb49437069dbbad4b22b402", "type": "domain", "value": "armmf.adobe.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597316.907959000", "last_seen_epoch": "1732597316.941078000", "evidence": [ { "frame_number": 21723, "timestamp_epoch": "1732597316.907959000", "display_filter": "frame.number == 21723", "udp_stream": 111 }, { "frame_number": 21724, "timestamp_epoch": "1732597316.912599000", "display_filter": "frame.number == 21724", "udp_stream": 111 }, { "frame_number": 21728, "timestamp_epoch": "1732597316.941078000", "display_filter": "frame.number == 21728", "tcp_stream": 109 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-58a6907a1de680da8f9e14b0", "type": "domain", "value": "assets.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596598.238793000", "last_seen_epoch": "1732596719.047376000", "evidence": [ { "frame_number": 752, "timestamp_epoch": "1732596598.238793000", "display_filter": "frame.number == 752", "udp_stream": 25 }, { "frame_number": 753, "timestamp_epoch": "1732596598.267834000", "display_filter": "frame.number == 753", "udp_stream": 25 }, { "frame_number": 20709, "timestamp_epoch": "1732596718.678622000", "display_filter": "frame.number == 20709", "udp_stream": 98 }, { "frame_number": 20710, "timestamp_epoch": "1732596718.678664000", "display_filter": "frame.number == 20710", "udp_stream": 99 }, { "frame_number": 20744, "timestamp_epoch": "1732596718.732010000", "display_filter": "frame.number == 20744", "udp_stream": 99 }, { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 }, { "frame_number": 757, "timestamp_epoch": "1732596598.308291000", "display_filter": "frame.number == 757", "tcp_stream": 30 }, { "frame_number": 20752, "timestamp_epoch": "1732596718.733572000", "display_filter": "frame.number == 20752" }, { "frame_number": 20833, "timestamp_epoch": "1732596719.047376000", "display_filter": "frame.number == 20833" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ae266a3254530fd4a74959da", "type": "domain", "value": "checkappexec.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596638.014376000", "last_seen_epoch": "1732596638.149298000", "evidence": [ { "frame_number": 12720, "timestamp_epoch": "1732596638.014376000", "display_filter": "frame.number == 12720", "udp_stream": 32 }, { "frame_number": 12721, "timestamp_epoch": "1732596638.033346000", "display_filter": "frame.number == 12721", "udp_stream": 32 }, { "frame_number": 12725, "timestamp_epoch": "1732596638.149298000", "display_filter": "frame.number == 12725", "tcp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5e70ddc467db0cb3d39f260a", "type": "domain", "value": "classicgrand.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596611.288227000", "last_seen_epoch": "1732596626.773909000", "evidence": [ { "frame_number": 1173, "timestamp_epoch": "1732596611.288227000", "display_filter": "frame.number == 1173", "udp_stream": 33 }, { "frame_number": 1174, "timestamp_epoch": "1732596611.288325000", "display_filter": "frame.number == 1174", "udp_stream": 34 }, { "frame_number": 1177, "timestamp_epoch": "1732596611.291652000", "display_filter": "frame.number == 1177", "udp_stream": 37 }, { "frame_number": 1178, "timestamp_epoch": "1732596611.291741000", "display_filter": "frame.number == 1178", "udp_stream": 38 }, { "frame_number": 1179, "timestamp_epoch": "1732596611.333612000", "display_filter": "frame.number == 1179", "udp_stream": 37 }, { "frame_number": 1181, "timestamp_epoch": "1732596611.333665000", "display_filter": "frame.number == 1181", "udp_stream": 33 }, { "frame_number": 1189, "timestamp_epoch": "1732596611.444471000", "display_filter": "frame.number == 1189", "udp_stream": 38 }, { "frame_number": 1190, "timestamp_epoch": "1732596611.444524000", "display_filter": "frame.number == 1190", "udp_stream": 34 }, { "frame_number": 1206, "timestamp_epoch": "1732596611.512916000", "display_filter": "frame.number == 1206", "tcp_stream": 41 }, { "frame_number": 12376, "timestamp_epoch": "1732596626.773909000", "display_filter": "frame.number == 12376", "tcp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-810d6030a9f6aa549cb7efaa", "type": "domain", "value": "client.wns.windows.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596582.134433000", "last_seen_epoch": "1732599747.624130000", "evidence": [ { "frame_number": 147, "timestamp_epoch": "1732596582.134433000", "display_filter": "frame.number == 147", "udp_stream": 15 }, { "frame_number": 148, "timestamp_epoch": "1732596582.155551000", "display_filter": "frame.number == 148", "udp_stream": 15 }, { "frame_number": 26869, "timestamp_epoch": "1732599747.537533000", "display_filter": "frame.number == 26869", "udp_stream": 131 }, { "frame_number": 26870, "timestamp_epoch": "1732599747.553388000", "display_filter": "frame.number == 26870", "udp_stream": 131 }, { "frame_number": 152, "timestamp_epoch": "1732596582.235129000", "display_filter": "frame.number == 152", "tcp_stream": 5 }, { "frame_number": 26874, "timestamp_epoch": "1732599747.624130000", "display_filter": "frame.number == 26874", "tcp_stream": 141 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-60ac35f209b8c51daf0287cf", "type": "domain", "value": "code.jquery.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596616.731036000", "last_seen_epoch": "1732596616.816199000", "evidence": [ { "frame_number": 3939, "timestamp_epoch": "1732596616.731036000", "display_filter": "frame.number == 3939", "udp_stream": 71 }, { "frame_number": 3940, "timestamp_epoch": "1732596616.731109000", "display_filter": "frame.number == 3940", "udp_stream": 72 }, { "frame_number": 4018, "timestamp_epoch": "1732596616.780201000", "display_filter": "frame.number == 4018", "udp_stream": 72 }, { "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "display_filter": "frame.number == 4022", "udp_stream": 71 }, { "frame_number": 4120, "timestamp_epoch": "1732596616.816199000", "display_filter": "frame.number == 4120", "tcp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-45d8a7db84e09bdb941f6ff0", "type": "domain", "value": "confirmsubscription.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596614.150461000", "last_seen_epoch": "1732596615.846763000", "evidence": [ { "frame_number": 1334, "timestamp_epoch": "1732596614.150461000", "display_filter": "frame.number == 1334", "udp_stream": 41 }, { "frame_number": 1335, "timestamp_epoch": "1732596614.150571000", "display_filter": "frame.number == 1335", "udp_stream": 42 }, { "frame_number": 1336, "timestamp_epoch": "1732596614.234653000", "display_filter": "frame.number == 1336", "udp_stream": 42 }, { "frame_number": 1337, "timestamp_epoch": "1732596614.236416000", "display_filter": "frame.number == 1337", "udp_stream": 41 }, { "frame_number": 2683, "timestamp_epoch": "1732596615.759516000", "display_filter": "frame.number == 2683", "udp_stream": 57 }, { "frame_number": 2684, "timestamp_epoch": "1732596615.759609000", "display_filter": "frame.number == 2684", "udp_stream": 58 }, { "frame_number": 2685, "timestamp_epoch": "1732596615.759828000", "display_filter": "frame.number == 2685", "udp_stream": 57 }, { "frame_number": 2686, "timestamp_epoch": "1732596615.759949000", "display_filter": "frame.number == 2686", "udp_stream": 58 }, { "frame_number": 1366, "timestamp_epoch": "1732596614.310565000", "display_filter": "frame.number == 1366", "tcp_stream": 42 }, { "frame_number": 3068, "timestamp_epoch": "1732596615.846763000", "display_filter": "frame.number == 3068", "tcp_stream": 56 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-83b9a3fc11191e2ff88f75f9", "type": "domain", "value": "css.createsend1.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596616.137502000", "last_seen_epoch": "1732596616.274241000", "evidence": [ { "frame_number": 3366, "timestamp_epoch": "1732596616.137502000", "display_filter": "frame.number == 3366", "udp_stream": 59 }, { "frame_number": 3367, "timestamp_epoch": "1732596616.137576000", "display_filter": "frame.number == 3367", "udp_stream": 60 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 }, { "frame_number": 3604, "timestamp_epoch": "1732596616.233588000", "display_filter": "frame.number == 3604", "udp_stream": 60 }, { "frame_number": 3611, "timestamp_epoch": "1732596616.274241000", "display_filter": "frame.number == 3611", "tcp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9fdcc3458871c29d2cefa776", "type": "domain", "value": "ctldl.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1732599354.351479000", "last_seen_epoch": "1732599354.546751000", "evidence": [ { "frame_number": 26510, "timestamp_epoch": "1732599354.351479000", "display_filter": "frame.number == 26510", "udp_stream": 128 }, { "frame_number": 26511, "timestamp_epoch": "1732599354.427394000", "display_filter": "frame.number == 26511", "udp_stream": 128 }, { "frame_number": 26515, "timestamp_epoch": "1732599354.476422000", "display_filter": "frame.number == 26515", "tcp_stream": 134 }, { "frame_number": 26518, "timestamp_epoch": "1732599354.546751000", "display_filter": "frame.number == 26518", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8db0754adec7629a54e6e851", "type": "domain", "value": "d33w6v2v5ta015.cloudfront.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1732596616.223537000", "last_seen_epoch": "1732596616.233588000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 }, { "frame_number": 3601, "timestamp_epoch": "1732596616.223586000", "display_filter": "frame.number == 3601", "udp_stream": 62 }, { "frame_number": 3604, "timestamp_epoch": "1732596616.233588000", "display_filter": "frame.number == 3604", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eab8d6b7e1f118b5f47de0e5", "type": "domain", "value": "data-edge.smartscreen.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596600.650450000", "last_seen_epoch": "1732596600.839005000", "evidence": [ { "frame_number": 924, "timestamp_epoch": "1732596600.650450000", "display_filter": "frame.number == 924", "udp_stream": 27 }, { "frame_number": 925, "timestamp_epoch": "1732596600.688712000", "display_filter": "frame.number == 925", "udp_stream": 27 }, { "frame_number": 932, "timestamp_epoch": "1732596600.839005000", "display_filter": "frame.number == 932", "tcp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e2bf1110a8718529350a72bd", "type": "domain", "value": "default.exp-tas.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596600.995682000", "last_seen_epoch": "1732596602.917874000", "evidence": [ { "frame_number": 942, "timestamp_epoch": "1732596600.995682000", "display_filter": "frame.number == 942", "udp_stream": 28 }, { "frame_number": 945, "timestamp_epoch": "1732596601.007532000", "display_filter": "frame.number == 945", "udp_stream": 28 }, { "frame_number": 953, "timestamp_epoch": "1732596601.071650000", "display_filter": "frame.number == 953", "tcp_stream": 33 }, { "frame_number": 965, "timestamp_epoch": "1732596601.137006000", "display_filter": "frame.number == 965", "tcp_stream": 33 }, { "frame_number": 1022, "timestamp_epoch": "1732596602.849797000", "display_filter": "frame.number == 1022", "tcp_stream": 35 }, { "frame_number": 1028, "timestamp_epoch": "1732596602.917874000", "display_filter": "frame.number == 1028", "tcp_stream": 35 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-429185f86e685ce1233588b8", "type": "domain", "value": "displaycatalog.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597237.655349000", "last_seen_epoch": "1732597237.792870000", "evidence": [ { "frame_number": 21419, "timestamp_epoch": "1732597237.655349000", "display_filter": "frame.number == 21419", "udp_stream": 105 }, { "frame_number": 21420, "timestamp_epoch": "1732597237.686162000", "display_filter": "frame.number == 21420", "udp_stream": 105 }, { "frame_number": 21437, "timestamp_epoch": "1732597237.792870000", "display_filter": "frame.number == 21437", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-df5e4c24f226504816dd1dc4", "type": "domain", "value": "dns.msftncsi.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1732597158.403809000", "last_seen_epoch": "1732599663.325324000", "evidence": [ { "frame_number": 21374, "timestamp_epoch": "1732597158.403809000", "display_filter": "frame.number == 21374", "udp_stream": 17 }, { "frame_number": 21375, "timestamp_epoch": "1732597158.422564000", "display_filter": "frame.number == 21375", "udp_stream": 17 }, { "frame_number": 25849, "timestamp_epoch": "1732597533.406949000", "display_filter": "frame.number == 25849", "udp_stream": 110 }, { "frame_number": 25850, "timestamp_epoch": "1732597533.438034000", "display_filter": "frame.number == 25850", "udp_stream": 110 }, { "frame_number": 26020, "timestamp_epoch": "1732597848.394016000", "display_filter": "frame.number == 26020", "udp_stream": 122 }, { "frame_number": 26021, "timestamp_epoch": "1732597848.410925000", "display_filter": "frame.number == 26021", "udp_stream": 122 }, { "frame_number": 26208, "timestamp_epoch": "1732598448.347107000", "display_filter": "frame.number == 26208", "udp_stream": 124 }, { "frame_number": 26209, "timestamp_epoch": "1732598448.372475000", "display_filter": "frame.number == 26209", "udp_stream": 124 }, { "frame_number": 26355, "timestamp_epoch": "1732598808.369148000", "display_filter": "frame.number == 26355", "udp_stream": 126 }, { "frame_number": 26356, "timestamp_epoch": "1732598808.377331000", "display_filter": "frame.number == 26356", "udp_stream": 126 }, { "frame_number": 26546, "timestamp_epoch": "1732599453.328109000", "display_filter": "frame.number == 26546", "udp_stream": 127 }, { "frame_number": 26547, "timestamp_epoch": "1732599453.343164000", "display_filter": "frame.number == 26547", "udp_stream": 127 }, { "frame_number": 26564, "timestamp_epoch": "1732599520.362771000", "display_filter": "frame.number == 26564", "udp_stream": 129 }, { "frame_number": 26565, "timestamp_epoch": "1732599520.744444000", "display_filter": "frame.number == 26565", "udp_stream": 129 }, { "frame_number": 26834, "timestamp_epoch": "1732599663.309490000", "display_filter": "frame.number == 26834", "udp_stream": 133 }, { "frame_number": 26835, "timestamp_epoch": "1732599663.325324000", "display_filter": "frame.number == 26835", "udp_stream": 133 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-19aed362e3d0d18b54da1879", "type": "domain", "value": "ecs.office.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596662.909942000", "last_seen_epoch": "1732598497.372599000", "evidence": [ { "frame_number": 20496, "timestamp_epoch": "1732596662.909942000", "display_filter": "frame.number == 20496", "udp_stream": 81 }, { "frame_number": 20497, "timestamp_epoch": "1732596662.927869000", "display_filter": "frame.number == 20497", "udp_stream": 81 }, { "frame_number": 21853, "timestamp_epoch": "1732597496.836510000", "display_filter": "frame.number == 21853", "udp_stream": 114 }, { "frame_number": 21854, "timestamp_epoch": "1732597496.869223000", "display_filter": "frame.number == 21854", "udp_stream": 114 }, { "frame_number": 26233, "timestamp_epoch": "1732598497.286225000", "display_filter": "frame.number == 26233", "udp_stream": 125 }, { "frame_number": 26234, "timestamp_epoch": "1732598497.311858000", "display_filter": "frame.number == 26234", "udp_stream": 125 }, { "frame_number": 20501, "timestamp_epoch": "1732596662.988273000", "display_filter": "frame.number == 20501", "tcp_stream": 84 }, { "frame_number": 20505, "timestamp_epoch": "1732596663.054999000", "display_filter": "frame.number == 20505", "tcp_stream": 84 }, { "frame_number": 21305, "timestamp_epoch": "1732596963.469275000", "display_filter": "frame.number == 21305", "tcp_stream": 99 }, { "frame_number": 21309, "timestamp_epoch": "1732596963.539605000", "display_filter": "frame.number == 21309", "tcp_stream": 99 }, { "frame_number": 21673, "timestamp_epoch": "1732597263.857546000", "display_filter": "frame.number == 21673", "tcp_stream": 107 }, { "frame_number": 21677, "timestamp_epoch": "1732597263.938947000", "display_filter": "frame.number == 21677", "tcp_stream": 107 }, { "frame_number": 21859, "timestamp_epoch": "1732597496.939407000", "display_filter": "frame.number == 21859", "tcp_stream": 113 }, { "frame_number": 21862, "timestamp_epoch": "1732597496.954561000", "display_filter": "frame.number == 21862", "tcp_stream": 114 }, { "frame_number": 21970, "timestamp_epoch": "1732597497.854417000", "display_filter": "frame.number == 21970", "tcp_stream": 118 }, { "frame_number": 21971, "timestamp_epoch": "1732597497.854462000", "display_filter": "frame.number == 21971", "tcp_stream": 116 }, { "frame_number": 21972, "timestamp_epoch": "1732597497.854602000", "display_filter": "frame.number == 21972", "tcp_stream": 115 }, { "frame_number": 21973, "timestamp_epoch": "1732597497.854883000", "display_filter": "frame.number == 21973", "tcp_stream": 117 }, { "frame_number": 26238, "timestamp_epoch": "1732598497.372599000", "display_filter": "frame.number == 26238", "tcp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-03f0e1f4594e7495815d9881", "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1732596611.333665000", "last_seen_epoch": "1732596611.333665000", "evidence": [ { "frame_number": 1180, "timestamp_epoch": "1732596611.333665000", "display_filter": "frame.number == 1180", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff78f582198b604135c8643e", "type": "domain", "value": "edge.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596611.288517000", "last_seen_epoch": "1732596623.379240000", "evidence": [ { "frame_number": 1175, "timestamp_epoch": "1732596611.288517000", "display_filter": "frame.number == 1175", "udp_stream": 35 }, { "frame_number": 1176, "timestamp_epoch": "1732596611.288580000", "display_filter": "frame.number == 1176", "udp_stream": 36 }, { "frame_number": 1180, "timestamp_epoch": "1732596611.333665000", "display_filter": "frame.number == 1180", "udp_stream": 36 }, { "frame_number": 1182, "timestamp_epoch": "1732596611.333799000", "display_filter": "frame.number == 1182", "udp_stream": 35 }, { "frame_number": 2548, "timestamp_epoch": "1732596615.737596000", "display_filter": "frame.number == 2548", "udp_stream": 55 }, { "frame_number": 2551, "timestamp_epoch": "1732596615.737637000", "display_filter": "frame.number == 2551", "udp_stream": 56 }, { "frame_number": 2564, "timestamp_epoch": "1732596615.738378000", "display_filter": "frame.number == 2564", "udp_stream": 55 }, { "frame_number": 2727, "timestamp_epoch": "1732596615.779927000", "display_filter": "frame.number == 2727", "udp_stream": 56 }, { "frame_number": 3761, "timestamp_epoch": "1732596616.459272000", "display_filter": "frame.number == 3761", "udp_stream": 63 }, { "frame_number": 3762, "timestamp_epoch": "1732596616.459352000", "display_filter": "frame.number == 3762", "udp_stream": 64 }, { "frame_number": 3763, "timestamp_epoch": "1732596616.459658000", "display_filter": "frame.number == 3763", "udp_stream": 63 }, { "frame_number": 3764, "timestamp_epoch": "1732596616.459754000", "display_filter": "frame.number == 3764", "udp_stream": 64 }, { "frame_number": 11991, "timestamp_epoch": "1732596623.131197000", "display_filter": "frame.number == 11991", "udp_stream": 76 }, { "frame_number": 11992, "timestamp_epoch": "1732596623.131278000", "display_filter": "frame.number == 11992", "udp_stream": 77 }, { "frame_number": 11993, "timestamp_epoch": "1732596623.131584000", "display_filter": "frame.number == 11993", "udp_stream": 76 }, { "frame_number": 11994, "timestamp_epoch": "1732596623.131700000", "display_filter": "frame.number == 11994", "udp_stream": 77 }, { "frame_number": 1188, "timestamp_epoch": "1732596611.399775000", "display_filter": "frame.number == 1188", "tcp_stream": 40 }, { "frame_number": 2739, "timestamp_epoch": "1732596615.797852000", "display_filter": "frame.number == 2739", "tcp_stream": 55 }, { "frame_number": 3795, "timestamp_epoch": "1732596616.533605000", "display_filter": "frame.number == 3795", "tcp_stream": 59 }, { "frame_number": 12083, "timestamp_epoch": "1732596623.254432000", "display_filter": "frame.number == 12083", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3097b97f6e1a84aa90d15831", "type": "domain", "value": "fa000000002.resources.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597499.619497000", "last_seen_epoch": "1732597499.694523000", "evidence": [ { "frame_number": 22384, "timestamp_epoch": "1732597499.619497000", "display_filter": "frame.number == 22384", "udp_stream": 116 }, { "frame_number": 22387, "timestamp_epoch": "1732597499.634256000", "display_filter": "frame.number == 22387", "udp_stream": 116 }, { "frame_number": 22395, "timestamp_epoch": "1732597499.694523000", "display_filter": "frame.number == 22395", "tcp_stream": 121 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e90070f4fe71a5fbb229a264", "type": "domain", "value": "fa000000005.resources.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597499.619497000", "last_seen_epoch": "1732597499.674632000", "evidence": [ { "frame_number": 22385, "timestamp_epoch": "1732597499.619497000", "display_filter": "frame.number == 22385", "udp_stream": 117 }, { "frame_number": 22386, "timestamp_epoch": "1732597499.634228000", "display_filter": "frame.number == 22386", "udp_stream": 117 }, { "frame_number": 22392, "timestamp_epoch": "1732597499.674632000", "display_filter": "frame.number == 22392", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c19f8a387d01f114bcb447b0", "type": "domain", "value": "fa000000116.resources.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597500.387511000", "last_seen_epoch": "1732597500.461778000", "evidence": [ { "frame_number": 23573, "timestamp_epoch": "1732597500.387511000", "display_filter": "frame.number == 23573", "udp_stream": 118 }, { "frame_number": 23574, "timestamp_epoch": "1732597500.418189000", "display_filter": "frame.number == 23574", "udp_stream": 118 }, { "frame_number": 23578, "timestamp_epoch": "1732597500.461778000", "display_filter": "frame.number == 23578", "tcp_stream": 122 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-072d2ee59840f566b60de063", "type": "domain", "value": "fa000000128.resources.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597500.557158000", "last_seen_epoch": "1732597500.614675000", "evidence": [ { "frame_number": 23587, "timestamp_epoch": "1732597500.557158000", "display_filter": "frame.number == 23587", "udp_stream": 119 }, { "frame_number": 23589, "timestamp_epoch": "1732597500.574101000", "display_filter": "frame.number == 23589", "udp_stream": 119 }, { "frame_number": 23594, "timestamp_epoch": "1732597500.614675000", "display_filter": "frame.number == 23594", "tcp_stream": 123 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-197cea52955c4921e095fe07", "type": "domain", "value": "fa000000163.resources.office.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597500.817685000", "last_seen_epoch": "1732597500.938703000", "evidence": [ { "frame_number": 23964, "timestamp_epoch": "1732597500.817685000", "display_filter": "frame.number == 23964", "udp_stream": 120 }, { "frame_number": 24030, "timestamp_epoch": "1732597500.835461000", "display_filter": "frame.number == 24030", "udp_stream": 120 }, { "frame_number": 24468, "timestamp_epoch": "1732597500.938703000", "display_filter": "frame.number == 24468", "tcp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f4297e125d99bf1e0b8ee636", "type": "domain", "value": "fd.api.iris.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596828.312934000", "last_seen_epoch": "1732596828.451764000", "evidence": [ { "frame_number": 21201, "timestamp_epoch": "1732596828.312934000", "display_filter": "frame.number == 21201", "udp_stream": 83 }, { "frame_number": 21202, "timestamp_epoch": "1732596828.368686000", "display_filter": "frame.number == 21202", "udp_stream": 83 }, { "frame_number": 21206, "timestamp_epoch": "1732596828.451764000", "display_filter": "frame.number == 21206", "tcp_stream": 96 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b567a279599ff0719ed3e10d", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597242.931032000", "last_seen_epoch": "1732597243.035063000", "evidence": [ { "frame_number": 21474, "timestamp_epoch": "1732597242.931032000", "display_filter": "frame.number == 21474", "udp_stream": 107 }, { "frame_number": 21475, "timestamp_epoch": "1732597242.954335000", "display_filter": "frame.number == 21475", "udp_stream": 107 }, { "frame_number": 21479, "timestamp_epoch": "1732597243.035063000", "display_filter": "frame.number == 21479", "tcp_stream": 103 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-29896fc5293b6afb7db4a657", "type": "domain", "value": "fonts.googleapis.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596614.714156000", "last_seen_epoch": "1732596616.518575000", "evidence": [ { "frame_number": 1718, "timestamp_epoch": "1732596614.714156000", "display_filter": "frame.number == 1718", "udp_stream": 43 }, { "frame_number": 1719, "timestamp_epoch": "1732596614.714254000", "display_filter": "frame.number == 1719", "udp_stream": 44 }, { "frame_number": 1754, "timestamp_epoch": "1732596614.763708000", "display_filter": "frame.number == 1754", "udp_stream": 44 }, { "frame_number": 1755, "timestamp_epoch": "1732596614.766334000", "display_filter": "frame.number == 1755", "udp_stream": 43 }, { "frame_number": 3767, "timestamp_epoch": "1732596616.461213000", "display_filter": "frame.number == 3767", "udp_stream": 65 }, { "frame_number": 3768, "timestamp_epoch": "1732596616.461279000", "display_filter": "frame.number == 3768", "udp_stream": 66 }, { "frame_number": 3769, "timestamp_epoch": "1732596616.461508000", "display_filter": "frame.number == 3769", "udp_stream": 65 }, { "frame_number": 3770, "timestamp_epoch": "1732596616.461644000", "display_filter": "frame.number == 3770", "udp_stream": 66 }, { "frame_number": 1768, "timestamp_epoch": "1732596614.821985000", "display_filter": "frame.number == 1768", "tcp_stream": 45 }, { "frame_number": 3789, "timestamp_epoch": "1732596616.518575000", "display_filter": "frame.number == 3789", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e30de936cb0048d63a95c202", "type": "domain", "value": "fonts.gstatic.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596614.747884000", "last_seen_epoch": "1732596616.694694000", "evidence": [ { "frame_number": 1751, "timestamp_epoch": "1732596614.747884000", "display_filter": "frame.number == 1751", "udp_stream": 45 }, { "frame_number": 1752, "timestamp_epoch": "1732596614.747965000", "display_filter": "frame.number == 1752", "udp_stream": 46 }, { "frame_number": 1753, "timestamp_epoch": "1732596614.748250000", "display_filter": "frame.number == 1753", "udp_stream": 46 }, { "frame_number": 1757, "timestamp_epoch": "1732596614.804739000", "display_filter": "frame.number == 1757", "udp_stream": 45 }, { "frame_number": 3850, "timestamp_epoch": "1732596616.649524000", "display_filter": "frame.number == 3850", "udp_stream": 69 }, { "frame_number": 3851, "timestamp_epoch": "1732596616.649593000", "display_filter": "frame.number == 3851", "udp_stream": 70 }, { "frame_number": 3852, "timestamp_epoch": "1732596616.649854000", "display_filter": "frame.number == 3852", "udp_stream": 69 }, { "frame_number": 3853, "timestamp_epoch": "1732596616.649948000", "display_filter": "frame.number == 3853", "udp_stream": 70 }, { "frame_number": 1772, "timestamp_epoch": "1732596614.849040000", "display_filter": "frame.number == 1772", "tcp_stream": 46 }, { "frame_number": 1779, "timestamp_epoch": "1732596614.856007000", "display_filter": "frame.number == 1779", "tcp_stream": 47 }, { "frame_number": 1783, "timestamp_epoch": "1732596614.859109000", "display_filter": "frame.number == 1783", "tcp_stream": 48 }, { "frame_number": 3885, "timestamp_epoch": "1732596616.694694000", "display_filter": "frame.number == 3885", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3202b09be9fdbc564fc46718", "type": "domain", "value": "geo.netsupportsoftware.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1732596645.646175000", "last_seen_epoch": "1732596645.744628000", "evidence": [ { "frame_number": 20331, "timestamp_epoch": "1732596645.646175000", "display_filter": "frame.number == 20331", "udp_stream": 79 }, { "frame_number": 20332, "timestamp_epoch": "1732596645.678408000", "display_filter": "frame.number == 20332", "udp_stream": 79 }, { "frame_number": 20336, "timestamp_epoch": "1732596645.744628000", "display_filter": "frame.number == 20336", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1444dc65042095d920ebfce8", "type": "domain", "value": "img-s-msn-com.akamaized.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596718.576293000", "last_seen_epoch": "1732596718.671608000", "evidence": [ { "frame_number": 20690, "timestamp_epoch": "1732596718.576293000", "display_filter": "frame.number == 20690", "udp_stream": 92 }, { "frame_number": 20691, "timestamp_epoch": "1732596718.576331000", "display_filter": "frame.number == 20691", "udp_stream": 93 }, { "frame_number": 20692, "timestamp_epoch": "1732596718.620959000", "display_filter": "frame.number == 20692", "udp_stream": 93 }, { "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "display_filter": "frame.number == 20693", "udp_stream": 92 }, { "frame_number": 20706, "timestamp_epoch": "1732596718.671608000", "display_filter": "frame.number == 20706", "tcp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2e841dfb79d3a154940ed0a5", "type": "domain", "value": "inputsuggestions.msdxcdn.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596606.742134000", "last_seen_epoch": "1732596606.889860000", "evidence": [ { "frame_number": 1052, "timestamp_epoch": "1732596606.742134000", "display_filter": "frame.number == 1052", "udp_stream": 30 }, { "frame_number": 1053, "timestamp_epoch": "1732596606.771681000", "display_filter": "frame.number == 1053", "udp_stream": 30 }, { "frame_number": 1054, "timestamp_epoch": "1732596606.794448000", "display_filter": "frame.number == 1054", "udp_stream": 30 }, { "frame_number": 1058, "timestamp_epoch": "1732596606.840908000", "display_filter": "frame.number == 1058", "tcp_stream": 36 }, { "frame_number": 1062, "timestamp_epoch": "1732596606.889860000", "display_filter": "frame.number == 1062", "tcp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f2a1a2cfbe987869bfc596c", "type": "domain", "value": "js.createsend1.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596616.137890000", "last_seen_epoch": "1732596616.274450000", "evidence": [ { "frame_number": 3368, "timestamp_epoch": "1732596616.137890000", "display_filter": "frame.number == 3368", "udp_stream": 61 }, { "frame_number": 3369, "timestamp_epoch": "1732596616.137958000", "display_filter": "frame.number == 3369", "udp_stream": 62 }, { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3601, "timestamp_epoch": "1732596616.223586000", "display_filter": "frame.number == 3601", "udp_stream": 62 }, { "frame_number": 3613, "timestamp_epoch": "1732596616.274450000", "display_filter": "frame.number == 3613", "tcp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-aa5349935a7c17450824c5a4", "type": "domain", "value": "licensing.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596581.134947000", "last_seen_epoch": "1732596581.686056000", "evidence": [ { "frame_number": 59, "timestamp_epoch": "1732596581.134947000", "display_filter": "frame.number == 59", "udp_stream": 10 }, { "frame_number": 60, "timestamp_epoch": "1732596581.194894000", "display_filter": "frame.number == 60", "udp_stream": 10 }, { "frame_number": 68, "timestamp_epoch": "1732596581.290159000", "display_filter": "frame.number == 68", "tcp_stream": 3 }, { "frame_number": 109, "timestamp_epoch": "1732596581.686056000", "display_filter": "frame.number == 109", "tcp_stream": 4 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-676e6cd99d178727ae68dd37", "type": "domain", "value": "login.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596601.011261000", "last_seen_epoch": "1732596601.100903000", "evidence": [ { "frame_number": 947, "timestamp_epoch": "1732596601.011261000", "display_filter": "frame.number == 947", "udp_stream": 29 }, { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 }, { "frame_number": 962, "timestamp_epoch": "1732596601.100903000", "display_filter": "frame.number == 962", "tcp_stream": 34 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a2fc5925f867a6c100db2cb5", "type": "domain", "value": "login.microsoftonline.com", "roles": [ "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.556517000", "last_seen_epoch": "1732596597.615857000", "evidence": [ { "frame_number": 588, "timestamp_epoch": "1732596597.556517000", "display_filter": "frame.number == 588", "tcp_stream": 27 }, { "frame_number": 623, "timestamp_epoch": "1732596597.615857000", "display_filter": "frame.number == 623", "tcp_stream": 27 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-860f3dec3cf4d965908b50c2", "type": "domain", "value": "maps.googleapis.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596615.298818000", "last_seen_epoch": "1732596615.726675000", "evidence": [ { "frame_number": 2095, "timestamp_epoch": "1732596615.298818000", "display_filter": "frame.number == 2095", "udp_stream": 51 }, { "frame_number": 2096, "timestamp_epoch": "1732596615.298882000", "display_filter": "frame.number == 2096", "udp_stream": 52 }, { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 }, { "frame_number": 2114, "timestamp_epoch": "1732596615.346197000", "display_filter": "frame.number == 2114", "udp_stream": 52 }, { "frame_number": 2153, "timestamp_epoch": "1732596615.396979000", "display_filter": "frame.number == 2153", "tcp_stream": 52 }, { "frame_number": 2510, "timestamp_epoch": "1732596615.726675000", "display_filter": "frame.number == 2510", "tcp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a7aababcbe387fdbdfbbbb12", "type": "domain", "value": "maps.gstatic.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596615.297504000", "last_seen_epoch": "1732596615.382036000", "evidence": [ { "frame_number": 2093, "timestamp_epoch": "1732596615.297504000", "display_filter": "frame.number == 2093", "udp_stream": 49 }, { "frame_number": 2094, "timestamp_epoch": "1732596615.297574000", "display_filter": "frame.number == 2094", "udp_stream": 50 }, { "frame_number": 2108, "timestamp_epoch": "1732596615.339531000", "display_filter": "frame.number == 2108", "udp_stream": 49 }, { "frame_number": 2110, "timestamp_epoch": "1732596615.341209000", "display_filter": "frame.number == 2110", "udp_stream": 50 }, { "frame_number": 2149, "timestamp_epoch": "1732596615.382036000", "display_filter": "frame.number == 2149", "tcp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-452949a9788edbae8fb448dc", "type": "domain", "value": "mobile.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597494.129895000", "last_seen_epoch": "1732599294.200453000", "evidence": [ { "frame_number": 21827, "timestamp_epoch": "1732597494.129895000", "display_filter": "frame.number == 21827", "udp_stream": 113 }, { "frame_number": 21828, "timestamp_epoch": "1732597494.149055000", "display_filter": "frame.number == 21828", "udp_stream": 113 }, { "frame_number": 25976, "timestamp_epoch": "1732597789.025745000", "display_filter": "frame.number == 25976", "udp_stream": 121 }, { "frame_number": 25977, "timestamp_epoch": "1732597789.027193000", "display_filter": "frame.number == 25977", "udp_stream": 121 }, { "frame_number": 21832, "timestamp_epoch": "1732597494.231822000", "display_filter": "frame.number == 21832", "tcp_stream": 112 }, { "frame_number": 21835, "timestamp_epoch": "1732597494.315214000", "display_filter": "frame.number == 21835", "tcp_stream": 112 }, { "frame_number": 25981, "timestamp_epoch": "1732597789.105406000", "display_filter": "frame.number == 25981", "tcp_stream": 128 }, { "frame_number": 25984, "timestamp_epoch": "1732597789.178852000", "display_filter": "frame.number == 25984", "tcp_stream": 128 }, { "frame_number": 26454, "timestamp_epoch": "1732599294.111943000", "display_filter": "frame.number == 26454", "tcp_stream": 132 }, { "frame_number": 26457, "timestamp_epoch": "1732599294.200453000", "display_filter": "frame.number == 26457", "tcp_stream": 132 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a99ab79e0f86c1dbabd3502", "type": "domain", "value": "modandcrackedapk.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596614.145454000", "last_seen_epoch": "1732596640.624765000", "evidence": [ { "frame_number": 1332, "timestamp_epoch": "1732596614.145454000", "display_filter": "frame.number == 1332", "udp_stream": 39 }, { "frame_number": 1333, "timestamp_epoch": "1732596614.145534000", "display_filter": "frame.number == 1333", "udp_stream": 40 }, { "frame_number": 1374, "timestamp_epoch": "1732596614.315055000", "display_filter": "frame.number == 1374", "udp_stream": 39 }, { "frame_number": 1377, "timestamp_epoch": "1732596614.319904000", "display_filter": "frame.number == 1377", "udp_stream": 40 }, { "frame_number": 2512, "timestamp_epoch": "1732596615.731544000", "display_filter": "frame.number == 2512", "udp_stream": 53 }, { "frame_number": 2513, "timestamp_epoch": "1732596615.731619000", "display_filter": "frame.number == 2513", "udp_stream": 54 }, { "frame_number": 2514, "timestamp_epoch": "1732596615.731901000", "display_filter": "frame.number == 2514", "udp_stream": 53 }, { "frame_number": 2515, "timestamp_epoch": "1732596615.731944000", "display_filter": "frame.number == 2515", "udp_stream": 54 }, { "frame_number": 12766, "timestamp_epoch": "1732596640.541323000", "display_filter": "frame.number == 12766", "udp_stream": 78 }, { "frame_number": 12767, "timestamp_epoch": "1732596640.541627000", "display_filter": "frame.number == 12767", "udp_stream": 78 }, { "frame_number": 1407, "timestamp_epoch": "1732596614.403860000", "display_filter": "frame.number == 1407", "tcp_stream": 43 }, { "frame_number": 1490, "timestamp_epoch": "1732596614.488757000", "display_filter": "frame.number == 1490", "tcp_stream": 44 }, { "frame_number": 2983, "timestamp_epoch": "1732596615.827162000", "display_filter": "frame.number == 2983", "tcp_stream": 54 }, { "frame_number": 4118, "timestamp_epoch": "1732596616.815810000", "display_filter": "frame.number == 4118", "tcp_stream": 64 }, { "frame_number": 4143, "timestamp_epoch": "1732596616.818773000", "display_filter": "frame.number == 4143", "tcp_stream": 63 }, { "frame_number": 4147, "timestamp_epoch": "1732596616.819151000", "display_filter": "frame.number == 4147", "tcp_stream": 65 }, { "frame_number": 4149, "timestamp_epoch": "1732596616.819307000", "display_filter": "frame.number == 4149", "tcp_stream": 66 }, { "frame_number": 12771, "timestamp_epoch": "1732596640.624765000", "display_filter": "frame.number == 12771", "tcp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-947d42d873d4b3c948b2ce8a", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597498.252993000", "last_seen_epoch": "1732597498.334994000", "evidence": [ { "frame_number": 22276, "timestamp_epoch": "1732597498.252993000", "display_filter": "frame.number == 22276", "udp_stream": 115 }, { "frame_number": 22277, "timestamp_epoch": "1732597498.258597000", "display_filter": "frame.number == 22277", "udp_stream": 115 }, { "frame_number": 22314, "timestamp_epoch": "1732597498.334994000", "display_filter": "frame.number == 22314", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-db14c619d681336c56528859", "type": "domain", "value": "nav.smartscreen.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596600.178840000", "last_seen_epoch": "1732596600.384384000", "evidence": [ { "frame_number": 904, "timestamp_epoch": "1732596600.178840000", "display_filter": "frame.number == 904", "udp_stream": 26 }, { "frame_number": 905, "timestamp_epoch": "1732596600.218910000", "display_filter": "frame.number == 905", "udp_stream": 26 }, { "frame_number": 909, "timestamp_epoch": "1732596600.384384000", "display_filter": "frame.number == 909", "tcp_stream": 31 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-848820a5a372e14aba596b2c", "type": "domain", "value": "nemotodes-dc.nemotoads.health", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1732599597.736612000", "last_seen_epoch": "1732599597.736954000", "evidence": [ { "frame_number": 26594, "timestamp_epoch": "1732599597.736612000", "display_filter": "frame.number == 26594", "udp_stream": 131 }, { "frame_number": 26595, "timestamp_epoch": "1732599597.736954000", "display_filter": "frame.number == 26595", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b1f18d83a88cbdebab665d98", "type": "domain", "value": "odc.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.846695000", "last_seen_epoch": "1732596597.935163000", "evidence": [ { "frame_number": 681, "timestamp_epoch": "1732596597.846695000", "display_filter": "frame.number == 681", "udp_stream": 24 }, { "frame_number": 691, "timestamp_epoch": "1732596597.879751000", "display_filter": "frame.number == 691", "udp_stream": 24 }, { "frame_number": 715, "timestamp_epoch": "1732596597.935163000", "display_filter": "frame.number == 715", "tcp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e8745c433381cd46ceb4cd6a", "type": "domain", "value": "officeclient.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.320330000", "last_seen_epoch": "1732596597.451002000", "evidence": [ { "frame_number": 445, "timestamp_epoch": "1732596597.320330000", "display_filter": "frame.number == 445", "udp_stream": 21 }, { "frame_number": 455, "timestamp_epoch": "1732596597.374256000", "display_filter": "frame.number == 455", "udp_stream": 21 }, { "frame_number": 530, "timestamp_epoch": "1732596597.451002000", "display_filter": "frame.number == 530", "tcp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-48605d0b389e84b7c4bb8789", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1732597498.258597000", "last_seen_epoch": "1732597498.258597000", "evidence": [ { "frame_number": 22277, "timestamp_epoch": "1732597498.258597000", "display_filter": "frame.number == 22277", "udp_stream": 115 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-36142d9ba0797ff6302194e9", "type": "domain", "value": "r10.o.lencr.org", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1732596640.759860000", "last_seen_epoch": "1732596640.833231000", "evidence": [ { "frame_number": 12779, "timestamp_epoch": "1732596640.759860000", "display_filter": "frame.number == 12779", "udp_stream": 78 }, { "frame_number": 12780, "timestamp_epoch": "1732596640.793456000", "display_filter": "frame.number == 12780", "udp_stream": 78 }, { "frame_number": 12788, "timestamp_epoch": "1732596640.833231000", "display_filter": "frame.number == 12788", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-85c040415cb8b90a71b70945", "type": "domain", "value": "srtb.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596718.967648000", "last_seen_epoch": "1732596719.092213000", "evidence": [ { "frame_number": 20803, "timestamp_epoch": "1732596718.967648000", "display_filter": "frame.number == 20803", "udp_stream": 101 }, { "frame_number": 20804, "timestamp_epoch": "1732596718.967691000", "display_filter": "frame.number == 20804", "udp_stream": 102 }, { "frame_number": 20805, "timestamp_epoch": "1732596718.968097000", "display_filter": "frame.number == 20805", "udp_stream": 102 }, { "frame_number": 20806, "timestamp_epoch": "1732596718.968116000", "display_filter": "frame.number == 20806", "udp_stream": 101 }, { "frame_number": 20822, "timestamp_epoch": "1732596719.021655000", "display_filter": "frame.number == 20822", "tcp_stream": 91 }, { "frame_number": 20842, "timestamp_epoch": "1732596719.092213000", "display_filter": "frame.number == 20842", "tcp_stream": 91 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c1f52c89191b16d2de8fe74e", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732597237.702147000", "last_seen_epoch": "1732597237.746118000", "evidence": [ { "frame_number": 21422, "timestamp_epoch": "1732597237.702147000", "display_filter": "frame.number == 21422", "udp_stream": 106 }, { "frame_number": 21423, "timestamp_epoch": "1732597237.705023000", "display_filter": "frame.number == 21423", "udp_stream": 106 }, { "frame_number": 21427, "timestamp_epoch": "1732597237.746118000", "display_filter": "frame.number == 21427", "tcp_stream": 102 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5b1c24a62996c071af2d21a2", "type": "domain", "value": "th.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596718.573908000", "last_seen_epoch": "1732596718.643146000", "evidence": [ { "frame_number": 20686, "timestamp_epoch": "1732596718.573908000", "display_filter": "frame.number == 20686", "udp_stream": 88 }, { "frame_number": 20687, "timestamp_epoch": "1732596718.574019000", "display_filter": "frame.number == 20687", "udp_stream": 89 }, { "frame_number": 20696, "timestamp_epoch": "1732596718.632512000", "display_filter": "frame.number == 20696", "udp_stream": 89 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 }, { "frame_number": 20702, "timestamp_epoch": "1732596718.643146000", "display_filter": "frame.number == 20702" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-154488f9714235558deaf436", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596648.371153000", "last_seen_epoch": "1732598406.354950000", "evidence": [ { "frame_number": 20352, "timestamp_epoch": "1732596648.371153000", "display_filter": "frame.number == 20352", "udp_stream": 80 }, { "frame_number": 20353, "timestamp_epoch": "1732596648.381164000", "display_filter": "frame.number == 20353", "udp_stream": 80 }, { "frame_number": 21376, "timestamp_epoch": "1732597162.341944000", "display_filter": "frame.number == 21376", "udp_stream": 104 }, { "frame_number": 21377, "timestamp_epoch": "1732597162.367264000", "display_filter": "frame.number == 21377", "udp_stream": 104 }, { "frame_number": 21610, "timestamp_epoch": "1732597249.477051000", "display_filter": "frame.number == 21610", "udp_stream": 108 }, { "frame_number": 21611, "timestamp_epoch": "1732597249.499839000", "display_filter": "frame.number == 21611", "udp_stream": 108 }, { "frame_number": 21757, "timestamp_epoch": "1732597328.392326000", "display_filter": "frame.number == 21757", "udp_stream": 112 }, { "frame_number": 21758, "timestamp_epoch": "1732597328.412034000", "display_filter": "frame.number == 21758", "udp_stream": 112 }, { "frame_number": 26139, "timestamp_epoch": "1732598406.258526000", "display_filter": "frame.number == 26139", "udp_stream": 123 }, { "frame_number": 26140, "timestamp_epoch": "1732598406.273953000", "display_filter": "frame.number == 26140", "udp_stream": 123 }, { "frame_number": 20357, "timestamp_epoch": "1732596648.472268000", "display_filter": "frame.number == 20357", "tcp_stream": 79 }, { "frame_number": 21381, "timestamp_epoch": "1732597162.443203000", "display_filter": "frame.number == 21381", "tcp_stream": 100 }, { "frame_number": 21615, "timestamp_epoch": "1732597249.594804000", "display_filter": "frame.number == 21615", "tcp_stream": 104 }, { "frame_number": 21762, "timestamp_epoch": "1732597328.483720000", "display_filter": "frame.number == 21762", "tcp_stream": 110 }, { "frame_number": 21804, "timestamp_epoch": "1732597442.804139000", "display_filter": "frame.number == 21804", "tcp_stream": 111 }, { "frame_number": 25940, "timestamp_epoch": "1732597669.045614000", "display_filter": "frame.number == 25940", "tcp_stream": 127 }, { "frame_number": 26144, "timestamp_epoch": "1732598406.354950000", "display_filter": "frame.number == 26144", "tcp_stream": 129 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff35a2b36c25f358e6468822", "type": "domain", "value": "windows.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.210181000", "last_seen_epoch": "1732597616.838060000", "evidence": [ { "frame_number": 439, "timestamp_epoch": "1732596597.210181000", "display_filter": "frame.number == 439", "udp_stream": 16 }, { "frame_number": 440, "timestamp_epoch": "1732596597.228818000", "display_filter": "frame.number == 440", "udp_stream": 16 }, { "frame_number": 20615, "timestamp_epoch": "1732596717.771245000", "display_filter": "frame.number == 20615", "udp_stream": 84 }, { "frame_number": 20616, "timestamp_epoch": "1732596717.771348000", "display_filter": "frame.number == 20616", "udp_stream": 85 }, { "frame_number": 20617, "timestamp_epoch": "1732596717.771656000", "display_filter": "frame.number == 20617", "udp_stream": 84 }, { "frame_number": 20619, "timestamp_epoch": "1732596717.811936000", "display_filter": "frame.number == 20619", "udp_stream": 85 }, { "frame_number": 444, "timestamp_epoch": "1732596597.286707000", "display_filter": "frame.number == 444", "tcp_stream": 20 }, { "frame_number": 452, "timestamp_epoch": "1732596597.357302000", "display_filter": "frame.number == 452", "tcp_stream": 20 }, { "frame_number": 20623, "timestamp_epoch": "1732596717.846942000", "display_filter": "frame.number == 20623", "tcp_stream": 87 }, { "frame_number": 20627, "timestamp_epoch": "1732596717.911883000", "display_filter": "frame.number == 20627", "tcp_stream": 87 }, { "frame_number": 25900, "timestamp_epoch": "1732597616.759687000", "display_filter": "frame.number == 25900", "tcp_stream": 126 }, { "frame_number": 25904, "timestamp_epoch": "1732597616.838060000", "display_filter": "frame.number == 25904", "tcp_stream": 126 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-85197f0f335b4a70d0e5da50", "type": "domain", "value": "wns.notify.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1732596582.155551000", "last_seen_epoch": "1732599747.553388000", "evidence": [ { "frame_number": 148, "timestamp_epoch": "1732596582.155551000", "display_filter": "frame.number == 148", "udp_stream": 15 }, { "frame_number": 26870, "timestamp_epoch": "1732599747.553388000", "display_filter": "frame.number == 26870", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bee8f3cb038d6fd7fef9213e", "type": "domain", "value": "wpad.mshome.net", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1732596578.919273000", "last_seen_epoch": "1732599660.031369000", "evidence": [ { "frame_number": 21, "timestamp_epoch": "1732596578.919273000", "display_filter": "frame.number == 21", "udp_stream": 4 }, { "frame_number": 22, "timestamp_epoch": "1732596578.919350000", "display_filter": "frame.number == 22", "udp_stream": 3 }, { "frame_number": 23, "timestamp_epoch": "1732596578.919448000", "display_filter": "frame.number == 23", "udp_stream": 4 }, { "frame_number": 25, "timestamp_epoch": "1732596578.919535000", "display_filter": "frame.number == 25", "udp_stream": 3 }, { "frame_number": 187, "timestamp_epoch": "1732596584.252838000", "display_filter": "frame.number == 187", "udp_stream": 17 }, { "frame_number": 188, "timestamp_epoch": "1732596584.252881000", "display_filter": "frame.number == 188", "udp_stream": 16 }, { "frame_number": 189, "timestamp_epoch": "1732596584.253026000", "display_filter": "frame.number == 189", "udp_stream": 17 }, { "frame_number": 190, "timestamp_epoch": "1732596584.253067000", "display_filter": "frame.number == 190", "udp_stream": 16 }, { "frame_number": 900, "timestamp_epoch": "1732596599.779113000", "display_filter": "frame.number == 900", "udp_stream": 26 }, { "frame_number": 901, "timestamp_epoch": "1732596599.779148000", "display_filter": "frame.number == 901", "udp_stream": 17 }, { "frame_number": 902, "timestamp_epoch": "1732596599.779310000", "display_filter": "frame.number == 902", "udp_stream": 26 }, { "frame_number": 903, "timestamp_epoch": "1732596599.779345000", "display_filter": "frame.number == 903", "udp_stream": 17 }, { "frame_number": 1116, "timestamp_epoch": "1732596610.942299000", "display_filter": "frame.number == 1116", "udp_stream": 32 }, { "frame_number": 1117, "timestamp_epoch": "1732596610.942457000", "display_filter": "frame.number == 1117", "udp_stream": 32 }, { "frame_number": 8689, "timestamp_epoch": "1732596618.945228000", "display_filter": "frame.number == 8689", "udp_stream": 32 }, { "frame_number": 8691, "timestamp_epoch": "1732596618.945400000", "display_filter": "frame.number == 8691", "udp_stream": 32 }, { "frame_number": 20492, "timestamp_epoch": "1732596659.782325000", "display_filter": "frame.number == 20492", "udp_stream": 81 }, { "frame_number": 20493, "timestamp_epoch": "1732596659.782369000", "display_filter": "frame.number == 20493", "udp_stream": 17 }, { "frame_number": 20494, "timestamp_epoch": "1732596659.836575000", "display_filter": "frame.number == 20494", "udp_stream": 17 }, { "frame_number": 20495, "timestamp_epoch": "1732596659.836636000", "display_filter": "frame.number == 20495", "udp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b3c7c5b3bcb9391b3bb3ebc3", "type": "domain", "value": "wpad.nemotoads.health", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1732596578.918790000", "last_seen_epoch": "1732599659.986270000", "evidence": [ { "frame_number": 15, "timestamp_epoch": "1732596578.918790000", "display_filter": "frame.number == 15", "udp_stream": 3 }, { "frame_number": 16, "timestamp_epoch": "1732596578.918835000", "display_filter": "frame.number == 16", "udp_stream": 4 }, { "frame_number": 19, "timestamp_epoch": "1732596578.919159000", "display_filter": "frame.number == 19", "udp_stream": 4 }, { "frame_number": 20, "timestamp_epoch": "1732596578.919159000", "display_filter": "frame.number == 20", "udp_stream": 3 }, { "frame_number": 183, "timestamp_epoch": "1732596584.252200000", "display_filter": "frame.number == 183", "udp_stream": 16 }, { "frame_number": 184, "timestamp_epoch": "1732596584.252200000", "display_filter": "frame.number == 184", "udp_stream": 17 }, { "frame_number": 185, "timestamp_epoch": "1732596584.252589000", "display_filter": "frame.number == 185", "udp_stream": 17 }, { "frame_number": 186, "timestamp_epoch": "1732596584.252645000", "display_filter": "frame.number == 186", "udp_stream": 16 }, { "frame_number": 896, "timestamp_epoch": "1732596599.778439000", "display_filter": "frame.number == 896", "udp_stream": 17 }, { "frame_number": 897, "timestamp_epoch": "1732596599.778525000", "display_filter": "frame.number == 897", "udp_stream": 26 }, { "frame_number": 898, "timestamp_epoch": "1732596599.778838000", "display_filter": "frame.number == 898", "udp_stream": 26 }, { "frame_number": 899, "timestamp_epoch": "1732596599.778882000", "display_filter": "frame.number == 899", "udp_stream": 17 }, { "frame_number": 1114, "timestamp_epoch": "1732596610.941790000", "display_filter": "frame.number == 1114", "udp_stream": 32 }, { "frame_number": 1115, "timestamp_epoch": "1732596610.942148000", "display_filter": "frame.number == 1115", "udp_stream": 32 }, { "frame_number": 8687, "timestamp_epoch": "1732596618.944669000", "display_filter": "frame.number == 8687", "udp_stream": 32 }, { "frame_number": 8688, "timestamp_epoch": "1732596618.944965000", "display_filter": "frame.number == 8688", "udp_stream": 32 }, { "frame_number": 20488, "timestamp_epoch": "1732596659.781734000", "display_filter": "frame.number == 20488", "udp_stream": 81 }, { "frame_number": 20489, "timestamp_epoch": "1732596659.781734000", "display_filter": "frame.number == 20489", "udp_stream": 17 }, { "frame_number": 20490, "timestamp_epoch": "1732596659.782088000", "display_filter": "frame.number == 20490", "udp_stream": 81 }, { "frame_number": 20491, "timestamp_epoch": "1732596659.782134000", "display_filter": "frame.number == 20491", "udp_stream": 17 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9675f34a4c66e7a3b0de4dad", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.320399000", "last_seen_epoch": "1732596718.634150000", "evidence": [ { "frame_number": 446, "timestamp_epoch": "1732596597.320399000", "display_filter": "frame.number == 446", "udp_stream": 22 }, { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 11968, "timestamp_epoch": "1732596622.974195000", "display_filter": "frame.number == 11968", "udp_stream": 74 }, { "frame_number": 11969, "timestamp_epoch": "1732596622.974289000", "display_filter": "frame.number == 11969", "udp_stream": 75 }, { "frame_number": 11970, "timestamp_epoch": "1732596622.974687000", "display_filter": "frame.number == 11970", "udp_stream": 75 }, { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 }, { "frame_number": 20688, "timestamp_epoch": "1732596718.574687000", "display_filter": "frame.number == 20688", "udp_stream": 90 }, { "frame_number": 20689, "timestamp_epoch": "1732596718.574755000", "display_filter": "frame.number == 20689", "udp_stream": 91 }, { "frame_number": 20694, "timestamp_epoch": "1732596718.631155000", "display_filter": "frame.number == 20694", "udp_stream": 91 }, { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 457, "timestamp_epoch": "1732596597.376532000", "display_filter": "frame.number == 457", "tcp_stream": 21 }, { "frame_number": 11988, "timestamp_epoch": "1732596623.093978000", "display_filter": "frame.number == 11988", "tcp_stream": 68 }, { "frame_number": 20699, "timestamp_epoch": "1732596718.634150000", "display_filter": "frame.number == 20699" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dbdb9933d49a8305fb857712", "type": "domain", "value": "www.google.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596614.805541000", "last_seen_epoch": "1732596614.915243000", "evidence": [ { "frame_number": 1759, "timestamp_epoch": "1732596614.805541000", "display_filter": "frame.number == 1759", "udp_stream": 47 }, { "frame_number": 1760, "timestamp_epoch": "1732596614.805661000", "display_filter": "frame.number == 1760", "udp_stream": 48 }, { "frame_number": 1761, "timestamp_epoch": "1732596614.806012000", "display_filter": "frame.number == 1761", "udp_stream": 48 }, { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 }, { "frame_number": 1823, "timestamp_epoch": "1732596614.914670000", "display_filter": "frame.number == 1823", "tcp_stream": 49 }, { "frame_number": 1828, "timestamp_epoch": "1732596614.915243000", "display_filter": "frame.number == 1828", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-25e07390de0db57fef6ab014", "type": "domain", "value": "www.gstatic.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596616.467169000", "last_seen_epoch": "1732596616.574611000", "evidence": [ { "frame_number": 3781, "timestamp_epoch": "1732596616.467169000", "display_filter": "frame.number == 3781", "udp_stream": 67 }, { "frame_number": 3782, "timestamp_epoch": "1732596616.467247000", "display_filter": "frame.number == 3782", "udp_stream": 68 }, { "frame_number": 3783, "timestamp_epoch": "1732596616.467534000", "display_filter": "frame.number == 3783", "udp_stream": 68 }, { "frame_number": 3790, "timestamp_epoch": "1732596616.527922000", "display_filter": "frame.number == 3790", "udp_stream": 67 }, { "frame_number": 3810, "timestamp_epoch": "1732596616.574611000", "display_filter": "frame.number == 3810", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2e404584220855a8049723c4", "type": "domain", "value": "www.msftconnecttest.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1732596578.458138000", "last_seen_epoch": "1732596578.525014000", "evidence": [ { "frame_number": 1, "timestamp_epoch": "1732596578.458138000", "display_filter": "frame.number == 1", "udp_stream": 0 }, { "frame_number": 2, "timestamp_epoch": "1732596578.487199000", "display_filter": "frame.number == 2", "udp_stream": 0 }, { "frame_number": 6, "timestamp_epoch": "1732596578.525014000", "display_filter": "frame.number == 6", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-754c01882b90bfb2a48690e3", "type": "domain", "value": "www.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1732596597.587503000", "last_seen_epoch": "1732596718.372163000", "evidence": [ { "frame_number": 612, "timestamp_epoch": "1732596597.587503000", "display_filter": "frame.number == 612", "udp_stream": 23 }, { "frame_number": 619, "timestamp_epoch": "1732596597.598735000", "display_filter": "frame.number == 619", "udp_stream": 23 }, { "frame_number": 20641, "timestamp_epoch": "1732596718.245175000", "display_filter": "frame.number == 20641", "udp_stream": 86 }, { "frame_number": 20642, "timestamp_epoch": "1732596718.245257000", "display_filter": "frame.number == 20642", "udp_stream": 87 }, { "frame_number": 20643, "timestamp_epoch": "1732596718.245558000", "display_filter": "frame.number == 20643", "udp_stream": 86 }, { "frame_number": 20644, "timestamp_epoch": "1732596718.245677000", "display_filter": "frame.number == 20644", "udp_stream": 87 }, { "frame_number": 634, "timestamp_epoch": "1732596597.664239000", "display_filter": "frame.number == 634", "tcp_stream": 28 }, { "frame_number": 647, "timestamp_epoch": "1732596597.726676000", "display_filter": "frame.number == 647", "tcp_stream": 28 }, { "frame_number": 20649, "timestamp_epoch": "1732596718.304948000", "display_filter": "frame.number == 20649", "tcp_stream": 88 }, { "frame_number": 20653, "timestamp_epoch": "1732596718.372163000", "display_filter": "frame.number == 20653", "tcp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-781d55eb37e8648ba4d956ef", "type": "ipv4", "value": "10.11.26.183", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-42d7f06dc09bf95af1428436", "type": "ipv4", "value": "10.11.26.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-39d1480c677773ed7757d027", "type": "ipv4", "value": "10.11.26.3", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1732596578.919063000", "last_seen_epoch": "1732599597.736954000", "evidence": [ { "frame_number": 17, "timestamp_epoch": "1732596578.919063000", "display_filter": "frame.number == 17", "udp_stream": 2 }, { "frame_number": 18, "timestamp_epoch": "1732596578.919107000", "display_filter": "frame.number == 18", "udp_stream": 1 }, { "frame_number": 20414, "timestamp_epoch": "1732596656.408916000", "display_filter": "frame.number == 20414", "udp_stream": 81 }, { "frame_number": 26595, "timestamp_epoch": "1732599597.736954000", "display_filter": "frame.number == 26595", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-522bd8c8c8d1cf460bb3c903", "type": "ipv4", "value": "104.117.244.104", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596597.339044000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9532858ccea9270001bf0185", "type": "ipv4", "value": "104.117.244.105", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596623.053128000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 }, { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1f3ebd81dbb2d4618430d932", "type": "ipv4", "value": "104.117.244.106", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-501ecfc34c211f34942f1326", "type": "ipv4", "value": "104.117.244.107", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b002df9c6cc25355da896d0a", "type": "ipv4", "value": "104.117.244.112", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596597.339044000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-36621837c291057562e9b272", "type": "ipv4", "value": "104.117.244.114", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596623.053128000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-002c2e0f8964137896c9aaca", "type": "ipv4", "value": "104.117.244.72", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9955f77e666cda8d972d5f08", "type": "ipv4", "value": "104.117.244.74", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-22505298735f644321e6227b", "type": "ipv4", "value": "104.117.244.81", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596623.053128000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e69266f3740a823df7d27630", "type": "ipv4", "value": "104.117.244.82", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe65d2e880f4b07d682a7b8a", "type": "ipv4", "value": "104.117.244.88", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f7dda70dbaacf91a88828091", "type": "ipv4", "value": "104.117.244.89", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596623.053128000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 }, { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-23ab9240379d84e4a5514f8c", "type": "ipv4", "value": "104.117.244.91", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596597.339044000", "last_seen_epoch": "1732596597.339044000", "evidence": [ { "frame_number": 447, "timestamp_epoch": "1732596597.339044000", "display_filter": "frame.number == 447", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a1c8cfceeada5570d6b9aeb2", "type": "ipv4", "value": "104.117.244.96", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596623.053128000", "last_seen_epoch": "1732596623.053128000", "evidence": [ { "frame_number": 11973, "timestamp_epoch": "1732596623.053128000", "display_filter": "frame.number == 11973", "udp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-28a24b620339dc857ef5765b", "type": "ipv4", "value": "104.117.244.97", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-74cc08495ff73a9294a5f355", "type": "ipv4", "value": "104.117.244.99", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.632694000", "last_seen_epoch": "1732596718.642054000", "evidence": [ { "frame_number": 20697, "timestamp_epoch": "1732596718.632694000", "display_filter": "frame.number == 20697", "udp_stream": 90 }, { "frame_number": 20700, "timestamp_epoch": "1732596718.642054000", "display_filter": "frame.number == 20700", "udp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-53ab099aa02e7a757e9b130a", "type": "ipv4", "value": "104.117.247.139", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.630938000", "last_seen_epoch": "1732596718.630938000", "evidence": [ { "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "display_filter": "frame.number == 20693", "udp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fb00ccefaa3371202a2f4175", "type": "ipv4", "value": "104.117.247.144", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596578.487199000", "last_seen_epoch": "1732596578.487199000", "evidence": [ { "frame_number": 2, "timestamp_epoch": "1732596578.487199000", "display_filter": "frame.number == 2", "udp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4894edafc1e7f65b3ad49450", "type": "ipv4", "value": "104.117.247.162", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596718.630938000", "last_seen_epoch": "1732596718.630938000", "evidence": [ { "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "display_filter": "frame.number == 20693", "udp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0ee10cdb741ab12eae2dd214", "type": "ipv4", "value": "104.117.247.184", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596578.487199000", "last_seen_epoch": "1732596578.487199000", "evidence": [ { "frame_number": 2, "timestamp_epoch": "1732596578.487199000", "display_filter": "frame.number == 2", "udp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bbc0fa1c4636636ecdd92e0b", "type": "ipv4", "value": "104.117.247.186", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.630938000", "last_seen_epoch": "1732596718.630938000", "evidence": [ { "frame_number": 20693, "timestamp_epoch": "1732596718.630938000", "display_filter": "frame.number == 20693", "udp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f1778274d8ba5ccefeef92d3", "type": "ipv4", "value": "104.117.247.67", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596640.793456000", "last_seen_epoch": "1732596640.793456000", "evidence": [ { "frame_number": 12780, "timestamp_epoch": "1732596640.793456000", "display_filter": "frame.number == 12780", "udp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b607e972c4e72038ec8fb69", "type": "ipv4", "value": "104.117.247.99", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596640.793456000", "last_seen_epoch": "1732596640.793456000", "evidence": [ { "frame_number": 12780, "timestamp_epoch": "1732596640.793456000", "display_filter": "frame.number == 12780", "udp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-356562b0cdd251912d60ccbe", "type": "ipv4", "value": "104.26.0.231", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596645.678408000", "last_seen_epoch": "1732596645.678408000", "evidence": [ { "frame_number": 20332, "timestamp_epoch": "1732596645.678408000", "display_filter": "frame.number == 20332", "udp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-507e9ca4cd5ebeb9d63378e4", "type": "ipv4", "value": "104.26.1.231", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596645.678408000", "last_seen_epoch": "1732596645.678408000", "evidence": [ { "frame_number": 20332, "timestamp_epoch": "1732596645.678408000", "display_filter": "frame.number == 20332", "udp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9dcf421b663cac6daea56650", "type": "ipv4", "value": "13.107.21.239", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596611.333799000", "last_seen_epoch": "1732596623.131584000", "evidence": [ { "frame_number": 1182, "timestamp_epoch": "1732596611.333799000", "display_filter": "frame.number == 1182", "udp_stream": 35 }, { "frame_number": 2564, "timestamp_epoch": "1732596615.738378000", "display_filter": "frame.number == 2564", "udp_stream": 55 }, { "frame_number": 3763, "timestamp_epoch": "1732596616.459658000", "display_filter": "frame.number == 3763", "udp_stream": 63 }, { "frame_number": 11993, "timestamp_epoch": "1732596623.131584000", "display_filter": "frame.number == 11993", "udp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-02f24f7b77027b8fbb5f401a", "type": "ipv4", "value": "13.107.246.57", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596606.794448000", "last_seen_epoch": "1732596606.794448000", "evidence": [ { "frame_number": 1054, "timestamp_epoch": "1732596606.794448000", "display_filter": "frame.number == 1054", "udp_stream": 30 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-921f3b3571a7082bbb4f1827", "type": "ipv4", "value": "13.107.5.93", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596601.007532000", "last_seen_epoch": "1732596601.007532000", "evidence": [ { "frame_number": 945, "timestamp_epoch": "1732596601.007532000", "display_filter": "frame.number == 945", "udp_stream": 28 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e3f47fa68fe8844b1571e89e", "type": "ipv4", "value": "13.56.30.207", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.236416000", "last_seen_epoch": "1732596615.759828000", "evidence": [ { "frame_number": 1337, "timestamp_epoch": "1732596614.236416000", "display_filter": "frame.number == 1337", "udp_stream": 41 }, { "frame_number": 2685, "timestamp_epoch": "1732596615.759828000", "display_filter": "frame.number == 2685", "udp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-28344dfab185ee79f1b98ee5", "type": "ipv4", "value": "131.107.255.255", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732597158.422564000", "last_seen_epoch": "1732599663.325324000", "evidence": [ { "frame_number": 21375, "timestamp_epoch": "1732597158.422564000", "display_filter": "frame.number == 21375", "udp_stream": 17 }, { "frame_number": 25850, "timestamp_epoch": "1732597533.438034000", "display_filter": "frame.number == 25850", "udp_stream": 110 }, { "frame_number": 26021, "timestamp_epoch": "1732597848.410925000", "display_filter": "frame.number == 26021", "udp_stream": 122 }, { "frame_number": 26209, "timestamp_epoch": "1732598448.372475000", "display_filter": "frame.number == 26209", "udp_stream": 124 }, { "frame_number": 26356, "timestamp_epoch": "1732598808.377331000", "display_filter": "frame.number == 26356", "udp_stream": 126 }, { "frame_number": 26547, "timestamp_epoch": "1732599453.343164000", "display_filter": "frame.number == 26547", "udp_stream": 127 }, { "frame_number": 26565, "timestamp_epoch": "1732599520.744444000", "display_filter": "frame.number == 26565", "udp_stream": 129 }, { "frame_number": 26835, "timestamp_epoch": "1732599663.325324000", "display_filter": "frame.number == 26835", "udp_stream": 133 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c9b32c1306c62735f8177e91", "type": "ipv4", "value": "142.250.113.120", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596615.339531000", "last_seen_epoch": "1732596615.339531000", "evidence": [ { "frame_number": 2108, "timestamp_epoch": "1732596615.339531000", "display_filter": "frame.number == 2108", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-81cf42df5f50d0683f03fb99", "type": "ipv4", "value": "142.250.113.94", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596615.339531000", "last_seen_epoch": "1732596616.527922000", "evidence": [ { "frame_number": 2108, "timestamp_epoch": "1732596615.339531000", "display_filter": "frame.number == 2108", "udp_stream": 49 }, { "frame_number": 3790, "timestamp_epoch": "1732596616.527922000", "display_filter": "frame.number == 3790", "udp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a9879e799e16237caaec6e98", "type": "ipv4", "value": "142.250.113.95", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596615.339589000", "last_seen_epoch": "1732596615.339589000", "evidence": [ { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4a64e60e215946912489220c", "type": "ipv4", "value": "142.250.114.95", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596615.339589000", "last_seen_epoch": "1732596615.339589000", "evidence": [ { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-88633d07fab5ec9ba66902cc", "type": "ipv4", "value": "142.250.115.95", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596615.339589000", "last_seen_epoch": "1732596615.339589000", "evidence": [ { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2d791bd09eb9436bf13a4ea9", "type": "ipv4", "value": "142.250.138.94", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.804739000", "last_seen_epoch": "1732596616.649854000", "evidence": [ { "frame_number": 1757, "timestamp_epoch": "1732596614.804739000", "display_filter": "frame.number == 1757", "udp_stream": 45 }, { "frame_number": 3852, "timestamp_epoch": "1732596616.649854000", "display_filter": "frame.number == 3852", "udp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c822a6d1b6e7c4de7d7927b9", "type": "ipv4", "value": "142.251.116.95", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596615.339589000", "last_seen_epoch": "1732596615.339589000", "evidence": [ { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e9b72878d05d5fcad7e8f341", "type": "ipv4", "value": "142.251.186.103", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5233f30c6f032cfae673aaea", "type": "ipv4", "value": "142.251.186.104", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-112eddca892b72e0ace1e66a", "type": "ipv4", "value": "142.251.186.105", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4a76ec8ba59345628a2ebad0", "type": "ipv4", "value": "142.251.186.106", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-df1437a82cfbe03d16d14c1e", "type": "ipv4", "value": "142.251.186.147", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dac5f9956f60f17034966f99", "type": "ipv4", "value": "142.251.186.95", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.766334000", "last_seen_epoch": "1732596616.461508000", "evidence": [ { "frame_number": 1755, "timestamp_epoch": "1732596614.766334000", "display_filter": "frame.number == 1755", "udp_stream": 43 }, { "frame_number": 2109, "timestamp_epoch": "1732596615.339589000", "display_filter": "frame.number == 2109", "udp_stream": 51 }, { "frame_number": 3769, "timestamp_epoch": "1732596616.461508000", "display_filter": "frame.number == 3769", "udp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a85ff709b4549d54d0c4030a", "type": "ipv4", "value": "142.251.186.99", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596614.853623000", "last_seen_epoch": "1732596614.853623000", "evidence": [ { "frame_number": 1773, "timestamp_epoch": "1732596614.853623000", "display_filter": "frame.number == 1773", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4389671a96c414493eca2968", "type": "ipv4", "value": "151.101.130.137", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596616.783489000", "last_seen_epoch": "1732596616.783489000", "evidence": [ { "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "display_filter": "frame.number == 4022", "udp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cbec94813d37f7a9429f4bb8", "type": "ipv4", "value": "151.101.194.137", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596616.783489000", "last_seen_epoch": "1732596616.783489000", "evidence": [ { "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "display_filter": "frame.number == 4022", "udp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c1ccfbc678bf3f45a886e15a", "type": "ipv4", "value": "151.101.2.137", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596616.783489000", "last_seen_epoch": "1732596616.783489000", "evidence": [ { "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "display_filter": "frame.number == 4022", "udp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-302d7e260e277eca5a974f17", "type": "ipv4", "value": "151.101.66.137", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596616.783489000", "last_seen_epoch": "1732596616.783489000", "evidence": [ { "frame_number": 4022, "timestamp_epoch": "1732596616.783489000", "display_filter": "frame.number == 4022", "udp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-48263876bcb8358231df60dc", "type": "ipv4", "value": "172.67.68.212", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596645.678408000", "last_seen_epoch": "1732596645.678408000", "evidence": [ { "frame_number": 20332, "timestamp_epoch": "1732596645.678408000", "display_filter": "frame.number == 20332", "udp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b3619ef5e511c17e6277df1c", "type": "ipv4", "value": "173.222.49.101", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597499.634228000", "last_seen_epoch": "1732597500.835461000", "evidence": [ { "frame_number": 22386, "timestamp_epoch": "1732597499.634228000", "display_filter": "frame.number == 22386", "udp_stream": 117 }, { "frame_number": 22387, "timestamp_epoch": "1732597499.634256000", "display_filter": "frame.number == 22387", "udp_stream": 116 }, { "frame_number": 23574, "timestamp_epoch": "1732597500.418189000", "display_filter": "frame.number == 23574", "udp_stream": 118 }, { "frame_number": 23589, "timestamp_epoch": "1732597500.574101000", "display_filter": "frame.number == 23589", "udp_stream": 119 }, { "frame_number": 24030, "timestamp_epoch": "1732597500.835461000", "display_filter": "frame.number == 24030", "udp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f9a55c5145c590a64e4e5217", "type": "ipv4", "value": "18.160.156.103", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596616.223537000", "last_seen_epoch": "1732596616.223537000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-167373273fd7221662f525c2", "type": "ipv4", "value": "18.160.156.61", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596616.223537000", "last_seen_epoch": "1732596616.223537000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4bad0d39791be8e7ebb33aeb", "type": "ipv4", "value": "18.160.156.77", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596616.223537000", "last_seen_epoch": "1732596616.223537000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fdab8183bb419ae2998198cf", "type": "ipv4", "value": "18.160.156.92", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596616.223537000", "last_seen_epoch": "1732596616.223537000", "evidence": [ { "frame_number": 3599, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3599", "udp_stream": 61 }, { "frame_number": 3600, "timestamp_epoch": "1732596616.223537000", "display_filter": "frame.number == 3600", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2a90842a4a203b81336943c5", "type": "ipv4", "value": "193.42.38.139", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.315055000", "last_seen_epoch": "1732596640.541627000", "evidence": [ { "frame_number": 1374, "timestamp_epoch": "1732596614.315055000", "display_filter": "frame.number == 1374", "udp_stream": 39 }, { "frame_number": 2514, "timestamp_epoch": "1732596615.731901000", "display_filter": "frame.number == 2514", "udp_stream": 53 }, { "frame_number": 12767, "timestamp_epoch": "1732596640.541627000", "display_filter": "frame.number == 12767", "udp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-40f20ff4827d29951f495d4f", "type": "ipv4", "value": "194.180.191.64", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596645.849438000", "last_seen_epoch": "1732599809.682016000", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6622949f867fc33075372d81", "type": "ipv4", "value": "20.189.173.16", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597789.027193000", "last_seen_epoch": "1732597789.027193000", "evidence": [ { "frame_number": 25977, "timestamp_epoch": "1732597789.027193000", "display_filter": "frame.number == 25977", "udp_stream": 121 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0421d7b3e84ddb0b3f70aa7c", "type": "ipv4", "value": "20.189.173.23", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597328.412034000", "last_seen_epoch": "1732597328.412034000", "evidence": [ { "frame_number": 21758, "timestamp_epoch": "1732597328.412034000", "display_filter": "frame.number == 21758", "udp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-696863a7cab46cc497409fe1", "type": "ipv4", "value": "20.189.173.26", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597494.149055000", "last_seen_epoch": "1732597494.149055000", "evidence": [ { "frame_number": 21828, "timestamp_epoch": "1732597494.149055000", "display_filter": "frame.number == 21828", "udp_stream": 113 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e68bb5c6d929bb7e9deee577", "type": "ipv4", "value": "20.189.173.6", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597162.367264000", "last_seen_epoch": "1732597162.367264000", "evidence": [ { "frame_number": 21377, "timestamp_epoch": "1732597162.367264000", "display_filter": "frame.number == 21377", "udp_stream": 104 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8f7c8ae9571a525ed7428aa1", "type": "ipv4", "value": "20.190.135.2", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f546119db518dc7be2e20e21", "type": "ipv4", "value": "20.190.135.3", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-666e4dc4f72282362ae93529", "type": "ipv4", "value": "20.190.135.6", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70f6c3ca07cbd3f46932cd11", "type": "ipv4", "value": "20.190.135.7", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6b8d52df1af1299b39d000bc", "type": "ipv4", "value": "20.42.73.25", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732598406.273953000", "last_seen_epoch": "1732598406.273953000", "evidence": [ { "frame_number": 26140, "timestamp_epoch": "1732598406.273953000", "display_filter": "frame.number == 26140", "udp_stream": 123 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e0bdc717428f75ec01cf2dd7", "type": "ipv4", "value": "20.42.73.28", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597249.499839000", "last_seen_epoch": "1732597249.499839000", "evidence": [ { "frame_number": 21611, "timestamp_epoch": "1732597249.499839000", "display_filter": "frame.number == 21611", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6155678ef6be82f7b5bad05d", "type": "ipv4", "value": "20.7.1.246", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732599747.553388000", "last_seen_epoch": "1732599747.553388000", "evidence": [ { "frame_number": 26870, "timestamp_epoch": "1732599747.553388000", "display_filter": "frame.number == 26870", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d092d667958a790b7c451f5", "type": "ipv4", "value": "20.7.2.167", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596582.155551000", "last_seen_epoch": "1732596582.155551000", "evidence": [ { "frame_number": 148, "timestamp_epoch": "1732596582.155551000", "display_filter": "frame.number == 148", "udp_stream": 15 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ca5672f60375288d60afdd64", "type": "ipv4", "value": "20.96.153.111", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596828.368686000", "last_seen_epoch": "1732596828.368686000", "evidence": [ { "frame_number": 21202, "timestamp_epoch": "1732596828.368686000", "display_filter": "frame.number == 21202", "udp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4cb7b5888e953b14310a2b08", "type": "ipv4", "value": "20.99.184.37", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597237.686162000", "last_seen_epoch": "1732597237.686162000", "evidence": [ { "frame_number": 21420, "timestamp_epoch": "1732597237.686162000", "display_filter": "frame.number == 21420", "udp_stream": 105 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4431b2c39b6aa27dab72a3f6", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596597.228818000", "last_seen_epoch": "1732596718.968116000", "evidence": [ { "frame_number": 440, "timestamp_epoch": "1732596597.228818000", "display_filter": "frame.number == 440", "udp_stream": 16 }, { "frame_number": 619, "timestamp_epoch": "1732596597.598735000", "display_filter": "frame.number == 619", "udp_stream": 23 }, { "frame_number": 20617, "timestamp_epoch": "1732596717.771656000", "display_filter": "frame.number == 20617", "udp_stream": 84 }, { "frame_number": 20643, "timestamp_epoch": "1732596718.245558000", "display_filter": "frame.number == 20643", "udp_stream": 86 }, { "frame_number": 20750, "timestamp_epoch": "1732596718.732640000", "display_filter": "frame.number == 20750", "udp_stream": 96 }, { "frame_number": 20806, "timestamp_epoch": "1732596718.968116000", "display_filter": "frame.number == 20806", "udp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-942f4a91aa79e79d09ac7cbf", "type": "ipv4", "value": "204.79.197.239", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596611.333799000", "last_seen_epoch": "1732596623.131584000", "evidence": [ { "frame_number": 1182, "timestamp_epoch": "1732596611.333799000", "display_filter": "frame.number == 1182", "udp_stream": 35 }, { "frame_number": 2564, "timestamp_epoch": "1732596615.738378000", "display_filter": "frame.number == 2564", "udp_stream": 55 }, { "frame_number": 3763, "timestamp_epoch": "1732596616.459658000", "display_filter": "frame.number == 3763", "udp_stream": 63 }, { "frame_number": 11993, "timestamp_epoch": "1732596623.131584000", "display_filter": "frame.number == 11993", "udp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fbfd503b9d77144c774dd69b", "type": "ipv4", "value": "213.246.109.5", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596611.333612000", "last_seen_epoch": "1732596611.333665000", "evidence": [ { "frame_number": 1179, "timestamp_epoch": "1732596611.333612000", "display_filter": "frame.number == 1179", "udp_stream": 37 }, { "frame_number": 1181, "timestamp_epoch": "1732596611.333665000", "display_filter": "frame.number == 1181", "udp_stream": 33 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3665857254d000ba80b56100", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5e1956ba1fc0a488e4fd8507", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-7615aec2585ad0a765dcb2fc", "type": "ipv4", "value": "23.201.68.167", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597316.912599000", "last_seen_epoch": "1732597316.912599000", "evidence": [ { "frame_number": 21724, "timestamp_epoch": "1732597316.912599000", "display_filter": "frame.number == 21724", "udp_stream": 111 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-adef42fe7a37844fc981281b", "type": "ipv4", "value": "23.204.171.61", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597237.705023000", "last_seen_epoch": "1732597237.705023000", "evidence": [ { "frame_number": 21423, "timestamp_epoch": "1732597237.705023000", "display_filter": "frame.number == 21423", "udp_stream": 106 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5830ef3d1e8d9e0891a9688a", "type": "ipv4", "value": "23.219.87.81", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732599354.427394000", "last_seen_epoch": "1732599354.427394000", "evidence": [ { "frame_number": 26511, "timestamp_epoch": "1732599354.427394000", "display_filter": "frame.number == 26511", "udp_stream": 128 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0c18fe1bbc619284eb898b11", "type": "ipv4", "value": "23.221.22.196", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a5f5e8fb0388ea4714f9c31d", "type": "ipv4", "value": "23.221.22.205", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cf60874eecf30a630c489e0a", "type": "ipv4", "value": "23.221.22.206", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ec192dd27102f08ea504a86d", "type": "ipv4", "value": "23.221.22.207", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3731b957987a3fcbdac8442f", "type": "ipv4", "value": "23.221.22.208", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-430b3d129fb2cf9bf79f4ab9", "type": "ipv4", "value": "23.221.22.209", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dbc8d83ea3b8be953deac7e6", "type": "ipv4", "value": "23.221.22.217", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0d9caa9c4e0f6162da4e89e5", "type": "ipv4", "value": "23.221.22.218", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b9b385f1fa9bf09118bcd3b5", "type": "ipv4", "value": "23.221.22.219", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596718.732622000", "last_seen_epoch": "1732596718.732622000", "evidence": [ { "frame_number": 20749, "timestamp_epoch": "1732596718.732622000", "display_filter": "frame.number == 20749", "udp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c84078b07ab02c909485a8dd", "type": "ipv4", "value": "23.221.22.46", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596598.267834000", "last_seen_epoch": "1732596598.267834000", "evidence": [ { "frame_number": 753, "timestamp_epoch": "1732596598.267834000", "display_filter": "frame.number == 753", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c2a3b086722b0f77dbbb16e1", "type": "ipv4", "value": "23.221.22.57", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596598.267834000", "last_seen_epoch": "1732596598.267834000", "evidence": [ { "frame_number": 753, "timestamp_epoch": "1732596598.267834000", "display_filter": "frame.number == 753", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1c1dc566439ee4c46b5af50b", "type": "ipv4", "value": "23.53.127.105", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597316.698604000", "last_seen_epoch": "1732597316.698604000", "evidence": [ { "frame_number": 21715, "timestamp_epoch": "1732597316.698604000", "display_filter": "frame.number == 21715", "udp_stream": 109 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70515a9832e7b98401922761", "type": "ipv4", "value": "23.53.127.114", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732597316.698604000", "last_seen_epoch": "1732597316.698604000", "evidence": [ { "frame_number": 21715, "timestamp_epoch": "1732597316.698604000", "display_filter": "frame.number == 21715", "udp_stream": 109 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-44c46577db2be113acd049bd", "type": "ipv4", "value": "23.53.127.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732599354.427394000", "last_seen_epoch": "1732599354.427394000", "evidence": [ { "frame_number": 26511, "timestamp_epoch": "1732599354.427394000", "display_filter": "frame.number == 26511", "udp_stream": 128 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-810a10708cbce45d655a2399", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596581.464546000", "last_seen_epoch": "1732597253.847522000", "evidence": [ { "frame_number": 82, "timestamp_epoch": "1732596581.464546000", "display_filter": "frame.number == 82" }, { "frame_number": 161, "timestamp_epoch": "1732596582.399669000", "display_filter": "frame.number == 161" }, { "frame_number": 192, "timestamp_epoch": "1732596584.470841000", "display_filter": "frame.number == 192" }, { "frame_number": 194, "timestamp_epoch": "1732596585.414782000", "display_filter": "frame.number == 194" }, { "frame_number": 198, "timestamp_epoch": "1732596586.393845000", "display_filter": "frame.number == 198" }, { "frame_number": 202, "timestamp_epoch": "1732596589.396641000", "display_filter": "frame.number == 202" }, { "frame_number": 205, "timestamp_epoch": "1732596592.396657000", "display_filter": "frame.number == 205" }, { "frame_number": 21604, "timestamp_epoch": "1732597247.829451000", "display_filter": "frame.number == 21604" }, { "frame_number": 21640, "timestamp_epoch": "1732597250.834538000", "display_filter": "frame.number == 21640" }, { "frame_number": 21661, "timestamp_epoch": "1732597253.847522000", "display_filter": "frame.number == 21661" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8cb299907f016cb25eabe833", "type": "ipv4", "value": "4.149.227.78", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596581.194894000", "last_seen_epoch": "1732596581.194894000", "evidence": [ { "frame_number": 60, "timestamp_epoch": "1732596581.194894000", "display_filter": "frame.number == 60", "udp_stream": 10 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-86a7a6352e41b8a4f4c7931d", "type": "ipv4", "value": "4.150.155.223", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596600.218910000", "last_seen_epoch": "1732596600.688712000", "evidence": [ { "frame_number": 905, "timestamp_epoch": "1732596600.218910000", "display_filter": "frame.number == 905", "udp_stream": 26 }, { "frame_number": 925, "timestamp_epoch": "1732596600.688712000", "display_filter": "frame.number == 925", "udp_stream": 27 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-699bc7b3483e69e36e725a5a", "type": "ipv4", "value": "40.118.171.167", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596638.033346000", "last_seen_epoch": "1732596638.033346000", "evidence": [ { "frame_number": 12721, "timestamp_epoch": "1732596638.033346000", "display_filter": "frame.number == 12721", "udp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5d9f6c41d09ee5ab0f7504c6", "type": "ipv4", "value": "40.126.28.11", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-688d788c801743e2347d964d", "type": "ipv4", "value": "40.126.28.14", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6f587a0a79b14ba0b81befc4", "type": "ipv4", "value": "40.126.28.22", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b4b9bbee4dd324a290be7c9", "type": "ipv4", "value": "40.126.29.9", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-803a9204459ed15119691b7a", "type": "ipv4", "value": "40.126.7.32", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1732596601.038842000", "last_seen_epoch": "1732596601.038842000", "evidence": [ { "frame_number": 949, "timestamp_epoch": "1732596601.038842000", "display_filter": "frame.number == 949", "udp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-623c49154ef99e149c55eae7", "type": "ipv4", "value": "52.109.0.136", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597498.258597000", "last_seen_epoch": "1732597498.258597000", "evidence": [ { "frame_number": 22277, "timestamp_epoch": "1732597498.258597000", "display_filter": "frame.number == 22277", "udp_stream": 115 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-848b1a077d07a4cc991617f2", "type": "ipv4", "value": "52.109.20.47", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596597.879751000", "last_seen_epoch": "1732596597.879751000", "evidence": [ { "frame_number": 691, "timestamp_epoch": "1732596597.879751000", "display_filter": "frame.number == 691", "udp_stream": 24 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0ca755c692f5c8e4452d9245", "type": "ipv4", "value": "52.109.8.89", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596597.374256000", "last_seen_epoch": "1732596597.374256000", "evidence": [ { "frame_number": 455, "timestamp_epoch": "1732596597.374256000", "display_filter": "frame.number == 455", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a0fc73016c98094fbf1e537", "type": "ipv4", "value": "52.113.194.132", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596662.927869000", "last_seen_epoch": "1732598497.311858000", "evidence": [ { "frame_number": 20497, "timestamp_epoch": "1732596662.927869000", "display_filter": "frame.number == 20497", "udp_stream": 81 }, { "frame_number": 21854, "timestamp_epoch": "1732597496.869223000", "display_filter": "frame.number == 21854", "udp_stream": 114 }, { "frame_number": 26234, "timestamp_epoch": "1732598497.311858000", "display_filter": "frame.number == 26234", "udp_stream": 125 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0182f1ad5c76992debbfb47c", "type": "ipv4", "value": "52.165.164.15", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732597242.954335000", "last_seen_epoch": "1732597242.954335000", "evidence": [ { "frame_number": 21475, "timestamp_epoch": "1732597242.954335000", "display_filter": "frame.number == 21475", "udp_stream": 107 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b059784db20259ca6e5707b8", "type": "ipv4", "value": "52.168.112.67", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596648.381164000", "last_seen_epoch": "1732596648.381164000", "evidence": [ { "frame_number": 20353, "timestamp_epoch": "1732596648.381164000", "display_filter": "frame.number == 20353", "udp_stream": 80 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2129035734a1b55487515570", "type": "ipv4", "value": "52.8.34.0", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1732596614.236416000", "last_seen_epoch": "1732596615.759828000", "evidence": [ { "frame_number": 1337, "timestamp_epoch": "1732596614.236416000", "display_filter": "frame.number == 1337", "udp_stream": 41 }, { "frame_number": 2685, "timestamp_epoch": "1732596615.759828000", "display_filter": "frame.number == 2685", "udp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6db4afee96b758a11ab5d2ba", "type": "ja3", "value": "0652c09be13a164e73c3c66e2d5cd600", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.815810000", "last_seen_epoch": "1732596616.815810000", "evidence": [ { "frame_number": 4118, "timestamp_epoch": "1732596616.815810000", "display_filter": "frame.number == 4118", "tcp_stream": 64 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6714945404dd8940ebac3ca8", "type": "ja3", "value": "089117d8abb9d0685ac2756412f44d8c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.643146000", "last_seen_epoch": "1732596718.643146000", "evidence": [ { "frame_number": 20702, "timestamp_epoch": "1732596718.643146000", "display_filter": "frame.number == 20702" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c94c4ab49280952bd4f6271f", "type": "ja3", "value": "091f51a7a1c3a4504a224cc081ce9cee", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596600.384384000", "last_seen_epoch": "1732598497.372599000", "evidence": [ { "frame_number": 909, "timestamp_epoch": "1732596600.384384000", "display_filter": "frame.number == 909", "tcp_stream": 31 }, { "frame_number": 932, "timestamp_epoch": "1732596600.839005000", "display_filter": "frame.number == 932", "tcp_stream": 32 }, { "frame_number": 12725, "timestamp_epoch": "1732596638.149298000", "display_filter": "frame.number == 12725", "tcp_stream": 73 }, { "frame_number": 20357, "timestamp_epoch": "1732596648.472268000", "display_filter": "frame.number == 20357", "tcp_stream": 79 }, { "frame_number": 21381, "timestamp_epoch": "1732597162.443203000", "display_filter": "frame.number == 21381", "tcp_stream": 100 }, { "frame_number": 21479, "timestamp_epoch": "1732597243.035063000", "display_filter": "frame.number == 21479", "tcp_stream": 103 }, { "frame_number": 21615, "timestamp_epoch": "1732597249.594804000", "display_filter": "frame.number == 21615", "tcp_stream": 104 }, { "frame_number": 21762, "timestamp_epoch": "1732597328.483720000", "display_filter": "frame.number == 21762", "tcp_stream": 110 }, { "frame_number": 21804, "timestamp_epoch": "1732597442.804139000", "display_filter": "frame.number == 21804", "tcp_stream": 111 }, { "frame_number": 25940, "timestamp_epoch": "1732597669.045614000", "display_filter": "frame.number == 25940", "tcp_stream": 127 }, { "frame_number": 26144, "timestamp_epoch": "1732598406.354950000", "display_filter": "frame.number == 26144", "tcp_stream": 129 }, { "frame_number": 26238, "timestamp_epoch": "1732598497.372599000", "display_filter": "frame.number == 26238", "tcp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-56c9dfcf3c200e96bc43d812", "type": "ja3", "value": "0d7e324cc471d537395a5a84963ff4c0", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.274450000", "last_seen_epoch": "1732596616.274450000", "evidence": [ { "frame_number": 3613, "timestamp_epoch": "1732596616.274450000", "display_filter": "frame.number == 3613", "tcp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eaaa577a53c9623baaeb97ab", "type": "ja3", "value": "10b3abe91219287930575e96187aab46", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596717.846942000", "last_seen_epoch": "1732596717.911883000", "evidence": [ { "frame_number": 20623, "timestamp_epoch": "1732596717.846942000", "display_filter": "frame.number == 20623", "tcp_stream": 87 }, { "frame_number": 20627, "timestamp_epoch": "1732596717.911883000", "display_filter": "frame.number == 20627", "tcp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5c24f01ba2088f51279e0f76", "type": "ja3", "value": "129a4a4460936a7d35cf0b4a876c02c5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596611.512916000", "last_seen_epoch": "1732596611.512916000", "evidence": [ { "frame_number": 1206, "timestamp_epoch": "1732596611.512916000", "display_filter": "frame.number == 1206", "tcp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e8827077e79b43442ba69645", "type": "ja3", "value": "1a41c18f74e0a1125e7eb86dc20da423", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.856007000", "last_seen_epoch": "1732596614.856007000", "evidence": [ { "frame_number": 1779, "timestamp_epoch": "1732596614.856007000", "display_filter": "frame.number == 1779", "tcp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-28337f9374882faa4f70378a", "type": "ja3", "value": "1aef2a0442d1535b67c961be49fbd9b0", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.518575000", "last_seen_epoch": "1732596616.518575000", "evidence": [ { "frame_number": 3789, "timestamp_epoch": "1732596616.518575000", "display_filter": "frame.number == 3789", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3e48a38e716ea7f0f1dc0220", "type": "ja3", "value": "1d2c110dc93a519d4c14a15898f20f6c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.310565000", "last_seen_epoch": "1732596614.310565000", "evidence": [ { "frame_number": 1366, "timestamp_epoch": "1732596614.310565000", "display_filter": "frame.number == 1366", "tcp_stream": 42 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-262a9e472a728ddec78bff44", "type": "ja3", "value": "258a5a1e95b8a911872bae9081526644", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732597496.939407000", "last_seen_epoch": "1732597500.938703000", "evidence": [ { "frame_number": 21859, "timestamp_epoch": "1732597496.939407000", "display_filter": "frame.number == 21859", "tcp_stream": 113 }, { "frame_number": 21862, "timestamp_epoch": "1732597496.954561000", "display_filter": "frame.number == 21862", "tcp_stream": 114 }, { "frame_number": 21970, "timestamp_epoch": "1732597497.854417000", "display_filter": "frame.number == 21970", "tcp_stream": 118 }, { "frame_number": 21971, "timestamp_epoch": "1732597497.854462000", "display_filter": "frame.number == 21971", "tcp_stream": 116 }, { "frame_number": 21972, "timestamp_epoch": "1732597497.854602000", "display_filter": "frame.number == 21972", "tcp_stream": 115 }, { "frame_number": 21973, "timestamp_epoch": "1732597497.854883000", "display_filter": "frame.number == 21973", "tcp_stream": 117 }, { "frame_number": 22392, "timestamp_epoch": "1732597499.674632000", "display_filter": "frame.number == 22392", "tcp_stream": 120 }, { "frame_number": 22395, "timestamp_epoch": "1732597499.694523000", "display_filter": "frame.number == 22395", "tcp_stream": 121 }, { "frame_number": 23578, "timestamp_epoch": "1732597500.461778000", "display_filter": "frame.number == 23578", "tcp_stream": 122 }, { "frame_number": 23594, "timestamp_epoch": "1732597500.614675000", "display_filter": "frame.number == 23594", "tcp_stream": 123 }, { "frame_number": 24468, "timestamp_epoch": "1732597500.938703000", "display_filter": "frame.number == 24468", "tcp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bdc952efd477a9f54c60ba5e", "type": "ja3", "value": "2800f914a7a4ba98aa9df62d316a460c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596640.624765000", "last_seen_epoch": "1732597789.178852000", "evidence": [ { "frame_number": 12771, "timestamp_epoch": "1732596640.624765000", "display_filter": "frame.number == 12771", "tcp_stream": 75 }, { "frame_number": 21728, "timestamp_epoch": "1732597316.941078000", "display_filter": "frame.number == 21728", "tcp_stream": 109 }, { "frame_number": 22314, "timestamp_epoch": "1732597498.334994000", "display_filter": "frame.number == 22314", "tcp_stream": 119 }, { "frame_number": 25981, "timestamp_epoch": "1732597789.105406000", "display_filter": "frame.number == 25981", "tcp_stream": 128 }, { "frame_number": 25984, "timestamp_epoch": "1732597789.178852000", "display_filter": "frame.number == 25984", "tcp_stream": 128 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-31d94d1aeec9ec6f5fa9ea30", "type": "ja3", "value": "2dd32544ddd46095f157e79a028dcda9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.818773000", "last_seen_epoch": "1732596616.818773000", "evidence": [ { "frame_number": 4143, "timestamp_epoch": "1732596616.818773000", "display_filter": "frame.number == 4143", "tcp_stream": 63 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1e3ac5af8885d591bb46d35a", "type": "ja3", "value": "2ef63960b5419ce0be770acb72a1e6d5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.821985000", "last_seen_epoch": "1732596614.821985000", "evidence": [ { "frame_number": 1768, "timestamp_epoch": "1732596614.821985000", "display_filter": "frame.number == 1768", "tcp_stream": 45 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-44c0680715281ae0c0b4c195", "type": "ja3", "value": "34578b889dbdfd86b5a0639eb869f9c5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.533605000", "last_seen_epoch": "1732596616.533605000", "evidence": [ { "frame_number": 3795, "timestamp_epoch": "1732596616.533605000", "display_filter": "frame.number == 3795", "tcp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bb2581f3a759fb0e06505712", "type": "ja3", "value": "39a2db8b2473a3d4cfe7cb23a26e03d6", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.574611000", "last_seen_epoch": "1732596616.574611000", "evidence": [ { "frame_number": 3810, "timestamp_epoch": "1732596616.574611000", "display_filter": "frame.number == 3810", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-902498a219b1c2d479285fdd", "type": "ja3", "value": "46181092bc7467ccd870ec99523f7113", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.396979000", "last_seen_epoch": "1732596615.396979000", "evidence": [ { "frame_number": 2153, "timestamp_epoch": "1732596615.396979000", "display_filter": "frame.number == 2153", "tcp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c302353f9b94d31a32c27419", "type": "ja3", "value": "488f29e13a0873e296eb2dcca6ec38d0", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.859109000", "last_seen_epoch": "1732596614.859109000", "evidence": [ { "frame_number": 1783, "timestamp_epoch": "1732596614.859109000", "display_filter": "frame.number == 1783", "tcp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6277cf7d4eb5e42ba7cb0a88", "type": "ja3", "value": "4c24b4903c9a3c9b3c46306472bda896", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.274241000", "last_seen_epoch": "1732596616.274241000", "evidence": [ { "frame_number": 3611, "timestamp_epoch": "1732596616.274241000", "display_filter": "frame.number == 3611", "tcp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d04202a6058fb7b9a485149e", "type": "ja3", "value": "53e42f80bc48a39739f5221b803b1f70", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.726675000", "last_seen_epoch": "1732596615.726675000", "evidence": [ { "frame_number": 2510, "timestamp_epoch": "1732596615.726675000", "display_filter": "frame.number == 2510", "tcp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-30ded1554832b04f1b604614", "type": "ja3", "value": "5c0851e1f7c97a5fdf8ee34bd73a8ff4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596719.021655000", "last_seen_epoch": "1732596719.092213000", "evidence": [ { "frame_number": 20822, "timestamp_epoch": "1732596719.021655000", "display_filter": "frame.number == 20822", "tcp_stream": 91 }, { "frame_number": 20842, "timestamp_epoch": "1732596719.092213000", "display_filter": "frame.number == 20842", "tcp_stream": 91 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-74a4e76691e4860feb9b3e3b", "type": "ja3", "value": "6634ba84945fce7cc2d7864edc49b103", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596662.988273000", "last_seen_epoch": "1732599294.200453000", "evidence": [ { "frame_number": 20501, "timestamp_epoch": "1732596662.988273000", "display_filter": "frame.number == 20501", "tcp_stream": 84 }, { "frame_number": 20505, "timestamp_epoch": "1732596663.054999000", "display_filter": "frame.number == 20505", "tcp_stream": 84 }, { "frame_number": 21305, "timestamp_epoch": "1732596963.469275000", "display_filter": "frame.number == 21305", "tcp_stream": 99 }, { "frame_number": 21309, "timestamp_epoch": "1732596963.539605000", "display_filter": "frame.number == 21309", "tcp_stream": 99 }, { "frame_number": 21673, "timestamp_epoch": "1732597263.857546000", "display_filter": "frame.number == 21673", "tcp_stream": 107 }, { "frame_number": 21677, "timestamp_epoch": "1732597263.938947000", "display_filter": "frame.number == 21677", "tcp_stream": 107 }, { "frame_number": 21832, "timestamp_epoch": "1732597494.231822000", "display_filter": "frame.number == 21832", "tcp_stream": 112 }, { "frame_number": 21835, "timestamp_epoch": "1732597494.315214000", "display_filter": "frame.number == 21835", "tcp_stream": 112 }, { "frame_number": 26454, "timestamp_epoch": "1732599294.111943000", "display_filter": "frame.number == 26454", "tcp_stream": 132 }, { "frame_number": 26457, "timestamp_epoch": "1732599294.200453000", "display_filter": "frame.number == 26457", "tcp_stream": 132 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-917f5477475273d1749e318d", "type": "ja3", "value": "68b3ecfaf0034bb9fcbecd518b5ab8d4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596601.071650000", "last_seen_epoch": "1732596602.917874000", "evidence": [ { "frame_number": 953, "timestamp_epoch": "1732596601.071650000", "display_filter": "frame.number == 953", "tcp_stream": 33 }, { "frame_number": 965, "timestamp_epoch": "1732596601.137006000", "display_filter": "frame.number == 965", "tcp_stream": 33 }, { "frame_number": 1022, "timestamp_epoch": "1732596602.849797000", "display_filter": "frame.number == 1022", "tcp_stream": 35 }, { "frame_number": 1028, "timestamp_epoch": "1732596602.917874000", "display_filter": "frame.number == 1028", "tcp_stream": 35 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-265021f6a27a56355eb87a8c", "type": "ja3", "value": "6a5d235ee78c6aede6a61448b4e9ff1e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596582.235129000", "last_seen_epoch": "1732599747.624130000", "evidence": [ { "frame_number": 152, "timestamp_epoch": "1732596582.235129000", "display_filter": "frame.number == 152", "tcp_stream": 5 }, { "frame_number": 26874, "timestamp_epoch": "1732599747.624130000", "display_filter": "frame.number == 26874", "tcp_stream": 141 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce84109671c45af0121261e2", "type": "ja3", "value": "7117eb033929b913d5dbbef620c9ca24", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.671608000", "last_seen_epoch": "1732596718.671608000", "evidence": [ { "frame_number": 20706, "timestamp_epoch": "1732596718.671608000", "display_filter": "frame.number == 20706", "tcp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-113bd04c4125f09f286b4370", "type": "ja3", "value": "7230db75fbd5472f76d02c10787af505", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596611.399775000", "last_seen_epoch": "1732596611.399775000", "evidence": [ { "frame_number": 1188, "timestamp_epoch": "1732596611.399775000", "display_filter": "frame.number == 1188", "tcp_stream": 40 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-daeb13cd73bc2b68c0f52088", "type": "ja3", "value": "82fc3feb7b73141563a581cb3a02b9e2", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596623.379240000", "last_seen_epoch": "1732596623.379240000", "evidence": [ { "frame_number": 12134, "timestamp_epoch": "1732596623.379240000", "display_filter": "frame.number == 12134", "tcp_stream": 70 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-82e81f933330df9f792edc60", "type": "ja3", "value": "893fda16143345fbd7d6384fd5f69a44", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.694694000", "last_seen_epoch": "1732596616.694694000", "evidence": [ { "frame_number": 3885, "timestamp_epoch": "1732596616.694694000", "display_filter": "frame.number == 3885", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a049b30b6f8674ddec374ac0", "type": "ja3", "value": "8f08a45cb17ce5d331bb4a861f26181f", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.819307000", "last_seen_epoch": "1732596616.819307000", "evidence": [ { "frame_number": 4149, "timestamp_epoch": "1732596616.819307000", "display_filter": "frame.number == 4149", "tcp_stream": 66 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f715e11cd2b81b65474484c7", "type": "ja3", "value": "910d5ef16eeb9c556a6f011876c16d38", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.827162000", "last_seen_epoch": "1732596615.827162000", "evidence": [ { "frame_number": 2983, "timestamp_epoch": "1732596615.827162000", "display_filter": "frame.number == 2983", "tcp_stream": 54 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-071caf2bce5a9d23c5fb0e57", "type": "ja3", "value": "9763df22d3de0549862e28d0f1103365", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.846763000", "last_seen_epoch": "1732596615.846763000", "evidence": [ { "frame_number": 3068, "timestamp_epoch": "1732596615.846763000", "display_filter": "frame.number == 3068", "tcp_stream": 56 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-67e9174d743495c07239fec1", "type": "ja3", "value": "97cdfdfb6ce55b090e5070647c73305e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596623.093978000", "last_seen_epoch": "1732596623.093978000", "evidence": [ { "frame_number": 11988, "timestamp_epoch": "1732596623.093978000", "display_filter": "frame.number == 11988", "tcp_stream": 68 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cdedb3c4c73660d8fe407d71", "type": "ja3", "value": "996d810fbaded0fd221205ee7a391364", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596623.254432000", "last_seen_epoch": "1732596623.254432000", "evidence": [ { "frame_number": 12083, "timestamp_epoch": "1732596623.254432000", "display_filter": "frame.number == 12083", "tcp_stream": 69 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-30d0b0ace65898b27d1e85da", "type": "ja3", "value": "9c5ffd0e64cc58a2ad1806964fe2da4e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.915243000", "last_seen_epoch": "1732596614.915243000", "evidence": [ { "frame_number": 1828, "timestamp_epoch": "1732596614.915243000", "display_filter": "frame.number == 1828", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-350471bbf3cb23c662c5b841", "type": "ja3", "value": "a702db92a1dad8b0a7ddf9ef0fcf3d68", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596719.047376000", "last_seen_epoch": "1732596719.047376000", "evidence": [ { "frame_number": 20833, "timestamp_epoch": "1732596719.047376000", "display_filter": "frame.number == 20833" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-add1c747ea029ac6bfe798df", "type": "ja3", "value": "ab617a1bfb55ac132b8893703d7cfec3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596626.773909000", "last_seen_epoch": "1732596626.773909000", "evidence": [ { "frame_number": 12376, "timestamp_epoch": "1732596626.773909000", "display_filter": "frame.number == 12376", "tcp_stream": 71 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6941def27b49be8c1321d5f0", "type": "ja3", "value": "af5ca235cbec16c4b5ad43da2bd9b40a", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.819151000", "last_seen_epoch": "1732596616.819151000", "evidence": [ { "frame_number": 4147, "timestamp_epoch": "1732596616.819151000", "display_filter": "frame.number == 4147", "tcp_stream": 65 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-65e9604f20fdb346396acbf4", "type": "ja3", "value": "b13922eb23a33bd76cd8442814f25cb5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.792127000", "last_seen_epoch": "1732596718.861647000", "evidence": [ { "frame_number": 20772, "timestamp_epoch": "1732596718.792127000", "display_filter": "frame.number == 20772", "tcp_stream": 90 }, { "frame_number": 20779, "timestamp_epoch": "1732596718.861647000", "display_filter": "frame.number == 20779", "tcp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-95ad61763ea58e0673f9d8b9", "type": "ja3", "value": "b6b910fa2621ea444621910f5e10aa4a", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.914670000", "last_seen_epoch": "1732596614.914670000", "evidence": [ { "frame_number": 1823, "timestamp_epoch": "1732596614.914670000", "display_filter": "frame.number == 1823", "tcp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6eac3a11b7159d3c5c6622cb", "type": "ja3", "value": "b8f7a95293e0d02d297ecef1efcc79d5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.797852000", "last_seen_epoch": "1732596615.797852000", "evidence": [ { "frame_number": 2739, "timestamp_epoch": "1732596615.797852000", "display_filter": "frame.number == 2739", "tcp_stream": 55 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-50a8093c10e0136bd6a2069c", "type": "ja3", "value": "c73376907efd66947a8978eacfd15135", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596616.816199000", "last_seen_epoch": "1732596616.816199000", "evidence": [ { "frame_number": 4120, "timestamp_epoch": "1732596616.816199000", "display_filter": "frame.number == 4120", "tcp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5c8475ba3204e981da9d5b0b", "type": "ja3", "value": "c806504b9d641f3b26d1af269ed474ab", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.733572000", "last_seen_epoch": "1732596718.733572000", "evidence": [ { "frame_number": 20752, "timestamp_epoch": "1732596718.733572000", "display_filter": "frame.number == 20752" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-57e1fe901406e264c545c963", "type": "ja3", "value": "c86423ffed1add9d50dccf646bd7fdbd", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.849040000", "last_seen_epoch": "1732596614.849040000", "evidence": [ { "frame_number": 1772, "timestamp_epoch": "1732596614.849040000", "display_filter": "frame.number == 1772", "tcp_stream": 46 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0ffabb19aa19d35801a6f221", "type": "ja3", "value": "cbcf96af03d431db8e0fd90215b03309", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.488757000", "last_seen_epoch": "1732596614.488757000", "evidence": [ { "frame_number": 1490, "timestamp_epoch": "1732596614.488757000", "display_filter": "frame.number == 1490", "tcp_stream": 44 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a64356c6dc4fb74f3f7ecc2f", "type": "ja3", "value": "d7268fba5c8ebdc86121861931c04402", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732597616.759687000", "last_seen_epoch": "1732597616.838060000", "evidence": [ { "frame_number": 25900, "timestamp_epoch": "1732597616.759687000", "display_filter": "frame.number == 25900", "tcp_stream": 126 }, { "frame_number": 25904, "timestamp_epoch": "1732597616.838060000", "display_filter": "frame.number == 25904", "tcp_stream": 126 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0a6643686a81a9dc65e0a448", "type": "ja3", "value": "e544273138fcf6e7dc137dd4f74d6fd0", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.304948000", "last_seen_epoch": "1732596718.372163000", "evidence": [ { "frame_number": 20649, "timestamp_epoch": "1732596718.304948000", "display_filter": "frame.number == 20649", "tcp_stream": 88 }, { "frame_number": 20653, "timestamp_epoch": "1732596718.372163000", "display_filter": "frame.number == 20653", "tcp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b45ac939d3df25c4b057f237", "type": "ja3", "value": "e71e6cff682837413473fd63dc10f5d4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596718.634150000", "last_seen_epoch": "1732596718.634150000", "evidence": [ { "frame_number": 20699, "timestamp_epoch": "1732596718.634150000", "display_filter": "frame.number == 20699" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-664158de415779a1a46ba37d", "type": "ja3", "value": "f24a7ea8a60779966dc83806405c4091", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596614.403860000", "last_seen_epoch": "1732596614.403860000", "evidence": [ { "frame_number": 1407, "timestamp_epoch": "1732596614.403860000", "display_filter": "frame.number == 1407", "tcp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-15aa3eba2884a64c5676a77c", "type": "ja3", "value": "f82158b828f02d82f1f70fbb0f1d6145", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596615.382036000", "last_seen_epoch": "1732596615.382036000", "evidence": [ { "frame_number": 2149, "timestamp_epoch": "1732596615.382036000", "display_filter": "frame.number == 2149", "tcp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-78759e81773b0ac35678e82a", "type": "ja3", "value": "fae0e5d973c96ae1888b99538efa0363", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1732596581.290159000", "last_seen_epoch": "1732597237.792870000", "evidence": [ { "frame_number": 68, "timestamp_epoch": "1732596581.290159000", "display_filter": "frame.number == 68", "tcp_stream": 3 }, { "frame_number": 109, "timestamp_epoch": "1732596581.686056000", "display_filter": "frame.number == 109", "tcp_stream": 4 }, { "frame_number": 444, "timestamp_epoch": "1732596597.286707000", "display_filter": "frame.number == 444", "tcp_stream": 20 }, { "frame_number": 452, "timestamp_epoch": "1732596597.357302000", "display_filter": "frame.number == 452", "tcp_stream": 20 }, { "frame_number": 457, "timestamp_epoch": "1732596597.376532000", "display_filter": "frame.number == 457", "tcp_stream": 21 }, { "frame_number": 530, "timestamp_epoch": "1732596597.451002000", "display_filter": "frame.number == 530", "tcp_stream": 22 }, { "frame_number": 588, "timestamp_epoch": "1732596597.556517000", "display_filter": "frame.number == 588", "tcp_stream": 27 }, { "frame_number": 623, "timestamp_epoch": "1732596597.615857000", "display_filter": "frame.number == 623", "tcp_stream": 27 }, { "frame_number": 634, "timestamp_epoch": "1732596597.664239000", "display_filter": "frame.number == 634", "tcp_stream": 28 }, { "frame_number": 647, "timestamp_epoch": "1732596597.726676000", "display_filter": "frame.number == 647", "tcp_stream": 28 }, { "frame_number": 715, "timestamp_epoch": "1732596597.935163000", "display_filter": "frame.number == 715", "tcp_stream": 29 }, { "frame_number": 757, "timestamp_epoch": "1732596598.308291000", "display_filter": "frame.number == 757", "tcp_stream": 30 }, { "frame_number": 962, "timestamp_epoch": "1732596601.100903000", "display_filter": "frame.number == 962", "tcp_stream": 34 }, { "frame_number": 1058, "timestamp_epoch": "1732596606.840908000", "display_filter": "frame.number == 1058", "tcp_stream": 36 }, { "frame_number": 1062, "timestamp_epoch": "1732596606.889860000", "display_filter": "frame.number == 1062", "tcp_stream": 36 }, { "frame_number": 21206, "timestamp_epoch": "1732596828.451764000", "display_filter": "frame.number == 21206", "tcp_stream": 96 }, { "frame_number": 21427, "timestamp_epoch": "1732597237.746118000", "display_filter": "frame.number == 21427", "tcp_stream": 102 }, { "frame_number": 21437, "timestamp_epoch": "1732597237.792870000", "display_filter": "frame.number == 21437", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-339e45ff04ad8a97057d7817", "type": "sha256", "value": "2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-87e339a41f9d9cbfdea757b1", "type": "sha256", "value": "59dc18363d5d0313ae94aa0ecad2d06dc77144758eeae2cc5ed8b4eee3923752", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-6782a06e1715b42a1b2993a6", "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-04924a1987dd84a68b8063e5", "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-83e384630c9c19cdc18afaea", "type": "sha256", "value": "79653567106d923034d36a9025d2d37955ff55dae5d77c1a79a321d850235d00", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a6545315d0a281dfbdc4df35", "type": "sha256", "value": "839e234a3a10b60d559ee5679d2019ad4e58d9cd66e6cfd971207c3c6ef8ea4d", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-8acc044b56e807d11f66fc4d", "type": "sha256", "value": "975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2c9d9f6b4c233f1af4f90289", "type": "sha256", "value": "a5a0a597e4b76ebec517a83126dbce37625a763b57307afe7064d9eb0a523956", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1774ff1531c92651bfeda311", "type": "sha256", "value": "af0c1c32558e6dc1e4e8f3e1d151268b8f6eb7cd844c9ac6dfc4b862decc7983", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2a1024655b0f25ed7c5027af", "type": "sha256", "value": "cd6f72bd96cbbad446325f8c2d087283f051ccaf77523dc436eec2d98be29bf7", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-974f44d300c7ec06491b9b26", "type": "sha256", "value": "f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce7810d20801ebacc80e6de0", "type": "url", "value": "http://194.180.191.64/fakeurl.htm", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732596645.849438000", "last_seen_epoch": "1732599809.682016000", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7c5b2ebbcd6f98d403792078", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732596581.464546000", "last_seen_epoch": "1732597253.847522000", "evidence": [ { "frame_number": 82, "timestamp_epoch": "1732596581.464546000", "display_filter": "frame.number == 82" }, { "frame_number": 161, "timestamp_epoch": "1732596582.399669000", "display_filter": "frame.number == 161" }, { "frame_number": 192, "timestamp_epoch": "1732596584.470841000", "display_filter": "frame.number == 192" }, { "frame_number": 194, "timestamp_epoch": "1732596585.414782000", "display_filter": "frame.number == 194" }, { "frame_number": 198, "timestamp_epoch": "1732596586.393845000", "display_filter": "frame.number == 198" }, { "frame_number": 202, "timestamp_epoch": "1732596589.396641000", "display_filter": "frame.number == 202" }, { "frame_number": 205, "timestamp_epoch": "1732596592.396657000", "display_filter": "frame.number == 205" }, { "frame_number": 21604, "timestamp_epoch": "1732597247.829451000", "display_filter": "frame.number == 21604" }, { "frame_number": 21640, "timestamp_epoch": "1732597250.834538000", "display_filter": "frame.number == 21640" }, { "frame_number": 21661, "timestamp_epoch": "1732597253.847522000", "display_filter": "frame.number == 21661" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3a9c575db7b0e83fa50eca50", "type": "url", "value": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732597316.726360000", "last_seen_epoch": "1732597316.726360000", "evidence": [ { "frame_number": 21719, "timestamp_epoch": "1732597316.726360000", "display_filter": "frame.number == 21719", "tcp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2f86cb83a2bcf199cd7c71eb", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?778a0928305752e9", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732599354.546751000", "last_seen_epoch": "1732599354.546751000", "evidence": [ { "frame_number": 26518, "timestamp_epoch": "1732599354.546751000", "display_filter": "frame.number == 26518", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b318cb7b80a083a55f3ad9f", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ce02e9976e1239e1", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732599354.476422000", "last_seen_epoch": "1732599354.476422000", "evidence": [ { "frame_number": 26515, "timestamp_epoch": "1732599354.476422000", "display_filter": "frame.number == 26515", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a8bf180223a2dde4d2a43aa6", "type": "url", "value": "http://geo.netsupportsoftware.com/location/loca.asp", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732596645.744628000", "last_seen_epoch": "1732596645.744628000", "evidence": [ { "frame_number": 20336, "timestamp_epoch": "1732596645.744628000", "display_filter": "frame.number == 20336", "tcp_stream": 78 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-52684923e071913bb6d1e5f4", "type": "url", "value": "http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRSsdGCXQJklJZNbHi669GH4A%3D%3D", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732596640.833231000", "last_seen_epoch": "1732596640.833231000", "evidence": [ { "frame_number": 12788, "timestamp_epoch": "1732596640.833231000", "display_filter": "frame.number == 12788", "tcp_stream": 76 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4e3165bb5b5879febc0cc796", "type": "url", "value": "http://www.msftconnecttest.com/connecttest.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1732596578.525014000", "last_seen_epoch": "1732596578.525014000", "evidence": [ { "frame_number": 6, "timestamp_epoch": "1732596578.525014000", "display_filter": "frame.number == 6", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-98dfd71cc4ab176e745b5b93", "type": "user_agent", "value": "Microsoft NCSI", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1732596578.525014000", "last_seen_epoch": "1732596578.525014000", "evidence": [ { "frame_number": 6, "timestamp_epoch": "1732596578.525014000", "display_filter": "frame.number == 6", "tcp_stream": 0 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-792574b0adbf221f74c245f0", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1732596640.833231000", "last_seen_epoch": "1732599354.546751000", "evidence": [ { "frame_number": 12788, "timestamp_epoch": "1732596640.833231000", "display_filter": "frame.number == 12788", "tcp_stream": 76 }, { "frame_number": 26515, "timestamp_epoch": "1732599354.476422000", "display_filter": "frame.number == 26515", "tcp_stream": 134 }, { "frame_number": 26518, "timestamp_epoch": "1732599354.546751000", "display_filter": "frame.number == 26518", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-58d6e5689bb44942778648a5", "type": "user_agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1732597316.726360000", "last_seen_epoch": "1732597316.726360000", "evidence": [ { "frame_number": 21719, "timestamp_epoch": "1732597316.726360000", "display_filter": "frame.number == 21719", "tcp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8f32dbf9bf4a42fb9a63df02", "type": "user_agent", "value": "NetSupport Manager/1.3", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1732596645.849438000", "last_seen_epoch": "1732599809.682016000", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-826deb5286207c26818905b0", "rule_id": "http-on-tls-port", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Cleartext HTTP observed on TCP/443", "explanation": "The decoded application protocol is HTTP despite use of the conventional TLS port.", "confidence": 0.98, "status": "candidate", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 }, { "frame_number": 25937, "timestamp_epoch": "1732597669.001919000", "display_filter": "frame.number == 25937", "tcp_stream": 77 }, { "frame_number": 25968, "timestamp_epoch": "1732597729.062950000", "display_filter": "frame.number == 25968", "tcp_stream": 77 }, { "frame_number": 25985, "timestamp_epoch": "1732597789.216290000", "display_filter": "frame.number == 25985", "tcp_stream": 77 }, { "frame_number": 26022, "timestamp_epoch": "1732597849.369834000", "display_filter": "frame.number == 26022", "tcp_stream": 77 }, { "frame_number": 26051, "timestamp_epoch": "1732597909.523158000", "display_filter": "frame.number == 26051", "tcp_stream": 77 }, { "frame_number": 26055, "timestamp_epoch": "1732597969.680246000", "display_filter": "frame.number == 26055", "tcp_stream": 77 }, { "frame_number": 26066, "timestamp_epoch": "1732598029.737747000", "display_filter": "frame.number == 26066", "tcp_stream": 77 }, { "frame_number": 26074, "timestamp_epoch": "1732598089.880222000", "display_filter": "frame.number == 26074", "tcp_stream": 77 }, { "frame_number": 26087, "timestamp_epoch": "1732598149.936096000", "display_filter": "frame.number == 26087", "tcp_stream": 77 }, { "frame_number": 26097, "timestamp_epoch": "1732598210.090084000", "display_filter": "frame.number == 26097", "tcp_stream": 77 }, { "frame_number": 26107, "timestamp_epoch": "1732598270.148715000", "display_filter": "frame.number == 26107", "tcp_stream": 77 }, { "frame_number": 26119, "timestamp_epoch": "1732598330.207754000", "display_filter": "frame.number == 26119", "tcp_stream": 77 }, { "frame_number": 26133, "timestamp_epoch": "1732598390.367131000", "display_filter": "frame.number == 26133", "tcp_stream": 77 }, { "frame_number": 26215, "timestamp_epoch": "1732598450.424378000", "display_filter": "frame.number == 26215", "tcp_stream": 77 }, { "frame_number": 26297, "timestamp_epoch": "1732598510.485705000", "display_filter": "frame.number == 26297", "tcp_stream": 77 }, { "frame_number": 26301, "timestamp_epoch": "1732598570.640951000", "display_filter": "frame.number == 26301", "tcp_stream": 77 }, { "frame_number": 26317, "timestamp_epoch": "1732598630.794559000", "display_filter": "frame.number == 26317", "tcp_stream": 77 }, { "frame_number": 26325, "timestamp_epoch": "1732598691.056411000", "display_filter": "frame.number == 26325", "tcp_stream": 77 }, { "frame_number": 26339, "timestamp_epoch": "1732598751.112829000", "display_filter": "frame.number == 26339", "tcp_stream": 77 }, { "frame_number": 26357, "timestamp_epoch": "1732598811.175685000", "display_filter": "frame.number == 26357", "tcp_stream": 77 }, { "frame_number": 26371, "timestamp_epoch": "1732598871.330432000", "display_filter": "frame.number == 26371", "tcp_stream": 77 }, { "frame_number": 26381, "timestamp_epoch": "1732598931.593448000", "display_filter": "frame.number == 26381", "tcp_stream": 77 }, { "frame_number": 26395, "timestamp_epoch": "1732598991.748754000", "display_filter": "frame.number == 26395", "tcp_stream": 77 }, { "frame_number": 26407, "timestamp_epoch": "1732599052.010090000", "display_filter": "frame.number == 26407", "tcp_stream": 77 }, { "frame_number": 26425, "timestamp_epoch": "1732599112.161738000", "display_filter": "frame.number == 26425", "tcp_stream": 77 }, { "frame_number": 26431, "timestamp_epoch": "1732599172.411164000", "display_filter": "frame.number == 26431", "tcp_stream": 77 }, { "frame_number": 26441, "timestamp_epoch": "1732599232.561197000", "display_filter": "frame.number == 26441", "tcp_stream": 77 }, { "frame_number": 26449, "timestamp_epoch": "1732599292.717415000", "display_filter": "frame.number == 26449", "tcp_stream": 77 }, { "frame_number": 26508, "timestamp_epoch": "1732599352.967228000", "display_filter": "frame.number == 26508", "tcp_stream": 77 }, { "frame_number": 26533, "timestamp_epoch": "1732599413.228563000", "display_filter": "frame.number == 26533", "tcp_stream": 77 }, { "frame_number": 26554, "timestamp_epoch": "1732599473.382552000", "display_filter": "frame.number == 26554", "tcp_stream": 77 }, { "frame_number": 26570, "timestamp_epoch": "1732599533.536694000", "display_filter": "frame.number == 26570", "tcp_stream": 77 }, { "frame_number": 26809, "timestamp_epoch": "1732599628.801338000", "display_filter": "frame.number == 26809", "tcp_stream": 140 }, { "frame_number": 26811, "timestamp_epoch": "1732599629.009850000", "display_filter": "frame.number == 26811", "tcp_stream": 140 }, { "frame_number": 26814, "timestamp_epoch": "1732599629.317405000", "display_filter": "frame.number == 26814", "tcp_stream": 140 }, { "frame_number": 26842, "timestamp_epoch": "1732599689.372894000", "display_filter": "frame.number == 26842", "tcp_stream": 140 }, { "frame_number": 26901, "timestamp_epoch": "1732599749.528770000", "display_filter": "frame.number == 26901", "tcp_stream": 140 }, { "frame_number": 26913, "timestamp_epoch": "1732599809.682016000", "display_filter": "frame.number == 26913", "tcp_stream": 140 } ], "metrics": { "request_count": 58, "source": "10.11.26.183", "destination": "194.180.191.64", "host": "194.180.191.64", "uri": "http://194.180.191.64/fakeurl.htm" } }, { "finding_id": "finding-89d44c49a788d0f0f0614088", "rule_id": "periodic-http-callbacks", "rule_version": "pcap-rules-v3", "severity": "high", "title": "Periodic HTTP callback pattern", "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.", "confidence": 0.88, "status": "candidate", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 }, { "frame_number": 25937, "timestamp_epoch": "1732597669.001919000", "display_filter": "frame.number == 25937", "tcp_stream": 77 }, { "frame_number": 25968, "timestamp_epoch": "1732597729.062950000", "display_filter": "frame.number == 25968", "tcp_stream": 77 }, { "frame_number": 25985, "timestamp_epoch": "1732597789.216290000", "display_filter": "frame.number == 25985", "tcp_stream": 77 }, { "frame_number": 26022, "timestamp_epoch": "1732597849.369834000", "display_filter": "frame.number == 26022", "tcp_stream": 77 }, { "frame_number": 26051, "timestamp_epoch": "1732597909.523158000", "display_filter": "frame.number == 26051", "tcp_stream": 77 }, { "frame_number": 26055, "timestamp_epoch": "1732597969.680246000", "display_filter": "frame.number == 26055", "tcp_stream": 77 }, { "frame_number": 26066, "timestamp_epoch": "1732598029.737747000", "display_filter": "frame.number == 26066", "tcp_stream": 77 }, { "frame_number": 26074, "timestamp_epoch": "1732598089.880222000", "display_filter": "frame.number == 26074", "tcp_stream": 77 }, { "frame_number": 26087, "timestamp_epoch": "1732598149.936096000", "display_filter": "frame.number == 26087", "tcp_stream": 77 }, { "frame_number": 26097, "timestamp_epoch": "1732598210.090084000", "display_filter": "frame.number == 26097", "tcp_stream": 77 }, { "frame_number": 26107, "timestamp_epoch": "1732598270.148715000", "display_filter": "frame.number == 26107", "tcp_stream": 77 }, { "frame_number": 26119, "timestamp_epoch": "1732598330.207754000", "display_filter": "frame.number == 26119", "tcp_stream": 77 }, { "frame_number": 26133, "timestamp_epoch": "1732598390.367131000", "display_filter": "frame.number == 26133", "tcp_stream": 77 }, { "frame_number": 26215, "timestamp_epoch": "1732598450.424378000", "display_filter": "frame.number == 26215", "tcp_stream": 77 }, { "frame_number": 26297, "timestamp_epoch": "1732598510.485705000", "display_filter": "frame.number == 26297", "tcp_stream": 77 }, { "frame_number": 26301, "timestamp_epoch": "1732598570.640951000", "display_filter": "frame.number == 26301", "tcp_stream": 77 }, { "frame_number": 26317, "timestamp_epoch": "1732598630.794559000", "display_filter": "frame.number == 26317", "tcp_stream": 77 }, { "frame_number": 26325, "timestamp_epoch": "1732598691.056411000", "display_filter": "frame.number == 26325", "tcp_stream": 77 }, { "frame_number": 26339, "timestamp_epoch": "1732598751.112829000", "display_filter": "frame.number == 26339", "tcp_stream": 77 }, { "frame_number": 26357, "timestamp_epoch": "1732598811.175685000", "display_filter": "frame.number == 26357", "tcp_stream": 77 }, { "frame_number": 26371, "timestamp_epoch": "1732598871.330432000", "display_filter": "frame.number == 26371", "tcp_stream": 77 }, { "frame_number": 26381, "timestamp_epoch": "1732598931.593448000", "display_filter": "frame.number == 26381", "tcp_stream": 77 }, { "frame_number": 26395, "timestamp_epoch": "1732598991.748754000", "display_filter": "frame.number == 26395", "tcp_stream": 77 }, { "frame_number": 26407, "timestamp_epoch": "1732599052.010090000", "display_filter": "frame.number == 26407", "tcp_stream": 77 }, { "frame_number": 26425, "timestamp_epoch": "1732599112.161738000", "display_filter": "frame.number == 26425", "tcp_stream": 77 }, { "frame_number": 26431, "timestamp_epoch": "1732599172.411164000", "display_filter": "frame.number == 26431", "tcp_stream": 77 }, { "frame_number": 26441, "timestamp_epoch": "1732599232.561197000", "display_filter": "frame.number == 26441", "tcp_stream": 77 }, { "frame_number": 26449, "timestamp_epoch": "1732599292.717415000", "display_filter": "frame.number == 26449", "tcp_stream": 77 }, { "frame_number": 26508, "timestamp_epoch": "1732599352.967228000", "display_filter": "frame.number == 26508", "tcp_stream": 77 }, { "frame_number": 26533, "timestamp_epoch": "1732599413.228563000", "display_filter": "frame.number == 26533", "tcp_stream": 77 }, { "frame_number": 26554, "timestamp_epoch": "1732599473.382552000", "display_filter": "frame.number == 26554", "tcp_stream": 77 }, { "frame_number": 26570, "timestamp_epoch": "1732599533.536694000", "display_filter": "frame.number == 26570", "tcp_stream": 77 }, { "frame_number": 26809, "timestamp_epoch": "1732599628.801338000", "display_filter": "frame.number == 26809", "tcp_stream": 140 }, { "frame_number": 26811, "timestamp_epoch": "1732599629.009850000", "display_filter": "frame.number == 26811", "tcp_stream": 140 }, { "frame_number": 26814, "timestamp_epoch": "1732599629.317405000", "display_filter": "frame.number == 26814", "tcp_stream": 140 }, { "frame_number": 26842, "timestamp_epoch": "1732599689.372894000", "display_filter": "frame.number == 26842", "tcp_stream": 140 }, { "frame_number": 26901, "timestamp_epoch": "1732599749.528770000", "display_filter": "frame.number == 26901", "tcp_stream": 140 }, { "frame_number": 26913, "timestamp_epoch": "1732599809.682016000", "display_filter": "frame.number == 26913", "tcp_stream": 140 } ], "metrics": { "request_count": 58, "median_interval_seconds": 60.154, "median_absolute_deviation": 0.091, "source": "10.11.26.183", "destination": "194.180.191.64", "port": 443, "host": "194.180.191.64", "uri": "http://194.180.191.64/fakeurl.htm", "method": "POST" } }, { "finding_id": "finding-f2eac4fa26ed6ea5ec889582", "rule_id": "remote-access-user-agent", "rule_version": "pcap-rules-v3", "severity": "high", "title": "Remote-access software network signature", "explanation": "An HTTP User-Agent explicitly identifies remote-access software. Validate authorization and endpoint ownership.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 }, { "frame_number": 25937, "timestamp_epoch": "1732597669.001919000", "display_filter": "frame.number == 25937", "tcp_stream": 77 }, { "frame_number": 25968, "timestamp_epoch": "1732597729.062950000", "display_filter": "frame.number == 25968", "tcp_stream": 77 }, { "frame_number": 25985, "timestamp_epoch": "1732597789.216290000", "display_filter": "frame.number == 25985", "tcp_stream": 77 }, { "frame_number": 26022, "timestamp_epoch": "1732597849.369834000", "display_filter": "frame.number == 26022", "tcp_stream": 77 }, { "frame_number": 26051, "timestamp_epoch": "1732597909.523158000", "display_filter": "frame.number == 26051", "tcp_stream": 77 }, { "frame_number": 26055, "timestamp_epoch": "1732597969.680246000", "display_filter": "frame.number == 26055", "tcp_stream": 77 }, { "frame_number": 26066, "timestamp_epoch": "1732598029.737747000", "display_filter": "frame.number == 26066", "tcp_stream": 77 }, { "frame_number": 26074, "timestamp_epoch": "1732598089.880222000", "display_filter": "frame.number == 26074", "tcp_stream": 77 }, { "frame_number": 26087, "timestamp_epoch": "1732598149.936096000", "display_filter": "frame.number == 26087", "tcp_stream": 77 }, { "frame_number": 26097, "timestamp_epoch": "1732598210.090084000", "display_filter": "frame.number == 26097", "tcp_stream": 77 }, { "frame_number": 26107, "timestamp_epoch": "1732598270.148715000", "display_filter": "frame.number == 26107", "tcp_stream": 77 }, { "frame_number": 26119, "timestamp_epoch": "1732598330.207754000", "display_filter": "frame.number == 26119", "tcp_stream": 77 }, { "frame_number": 26133, "timestamp_epoch": "1732598390.367131000", "display_filter": "frame.number == 26133", "tcp_stream": 77 }, { "frame_number": 26215, "timestamp_epoch": "1732598450.424378000", "display_filter": "frame.number == 26215", "tcp_stream": 77 }, { "frame_number": 26297, "timestamp_epoch": "1732598510.485705000", "display_filter": "frame.number == 26297", "tcp_stream": 77 }, { "frame_number": 26301, "timestamp_epoch": "1732598570.640951000", "display_filter": "frame.number == 26301", "tcp_stream": 77 }, { "frame_number": 26317, "timestamp_epoch": "1732598630.794559000", "display_filter": "frame.number == 26317", "tcp_stream": 77 }, { "frame_number": 26325, "timestamp_epoch": "1732598691.056411000", "display_filter": "frame.number == 26325", "tcp_stream": 77 }, { "frame_number": 26339, "timestamp_epoch": "1732598751.112829000", "display_filter": "frame.number == 26339", "tcp_stream": 77 }, { "frame_number": 26357, "timestamp_epoch": "1732598811.175685000", "display_filter": "frame.number == 26357", "tcp_stream": 77 }, { "frame_number": 26371, "timestamp_epoch": "1732598871.330432000", "display_filter": "frame.number == 26371", "tcp_stream": 77 }, { "frame_number": 26381, "timestamp_epoch": "1732598931.593448000", "display_filter": "frame.number == 26381", "tcp_stream": 77 }, { "frame_number": 26395, "timestamp_epoch": "1732598991.748754000", "display_filter": "frame.number == 26395", "tcp_stream": 77 }, { "frame_number": 26407, "timestamp_epoch": "1732599052.010090000", "display_filter": "frame.number == 26407", "tcp_stream": 77 }, { "frame_number": 26425, "timestamp_epoch": "1732599112.161738000", "display_filter": "frame.number == 26425", "tcp_stream": 77 }, { "frame_number": 26431, "timestamp_epoch": "1732599172.411164000", "display_filter": "frame.number == 26431", "tcp_stream": 77 }, { "frame_number": 26441, "timestamp_epoch": "1732599232.561197000", "display_filter": "frame.number == 26441", "tcp_stream": 77 }, { "frame_number": 26449, "timestamp_epoch": "1732599292.717415000", "display_filter": "frame.number == 26449", "tcp_stream": 77 }, { "frame_number": 26508, "timestamp_epoch": "1732599352.967228000", "display_filter": "frame.number == 26508", "tcp_stream": 77 }, { "frame_number": 26533, "timestamp_epoch": "1732599413.228563000", "display_filter": "frame.number == 26533", "tcp_stream": 77 }, { "frame_number": 26554, "timestamp_epoch": "1732599473.382552000", "display_filter": "frame.number == 26554", "tcp_stream": 77 }, { "frame_number": 26570, "timestamp_epoch": "1732599533.536694000", "display_filter": "frame.number == 26570", "tcp_stream": 77 }, { "frame_number": 26809, "timestamp_epoch": "1732599628.801338000", "display_filter": "frame.number == 26809", "tcp_stream": 140 }, { "frame_number": 26811, "timestamp_epoch": "1732599629.009850000", "display_filter": "frame.number == 26811", "tcp_stream": 140 }, { "frame_number": 26814, "timestamp_epoch": "1732599629.317405000", "display_filter": "frame.number == 26814", "tcp_stream": 140 }, { "frame_number": 26842, "timestamp_epoch": "1732599689.372894000", "display_filter": "frame.number == 26842", "tcp_stream": 140 }, { "frame_number": 26901, "timestamp_epoch": "1732599749.528770000", "display_filter": "frame.number == 26901", "tcp_stream": 140 }, { "frame_number": 26913, "timestamp_epoch": "1732599809.682016000", "display_filter": "frame.number == 26913", "tcp_stream": 140 } ], "metrics": { "request_count": 58, "user_agent": "NetSupport Manager/1.3", "source": "10.11.26.183", "destination": "194.180.191.64" } }, { "finding_id": "finding-a133356b6375dd54a56b447f", "rule_id": "repeated-http-posts", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Repeated outbound HTTP POST activity", "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.", "confidence": 0.72, "status": "candidate", "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 }, { "frame_number": 21145, "timestamp_epoch": "1732596767.103354000", "display_filter": "frame.number == 21145", "tcp_stream": 77 }, { "frame_number": 21153, "timestamp_epoch": "1732596827.260093000", "display_filter": "frame.number == 21153", "tcp_stream": 77 }, { "frame_number": 21246, "timestamp_epoch": "1732596887.427092000", "display_filter": "frame.number == 21246", "tcp_stream": 77 }, { "frame_number": 21295, "timestamp_epoch": "1732596947.485672000", "display_filter": "frame.number == 21295", "tcp_stream": 77 }, { "frame_number": 21337, "timestamp_epoch": "1732597007.546358000", "display_filter": "frame.number == 21337", "tcp_stream": 77 }, { "frame_number": 21352, "timestamp_epoch": "1732597067.608604000", "display_filter": "frame.number == 21352", "tcp_stream": 77 }, { "frame_number": 21364, "timestamp_epoch": "1732597127.763032000", "display_filter": "frame.number == 21364", "tcp_stream": 77 }, { "frame_number": 21415, "timestamp_epoch": "1732597187.818149000", "display_filter": "frame.number == 21415", "tcp_stream": 77 }, { "frame_number": 21608, "timestamp_epoch": "1732597248.022865000", "display_filter": "frame.number == 21608", "tcp_stream": 77 }, { "frame_number": 21708, "timestamp_epoch": "1732597308.318189000", "display_filter": "frame.number == 21708", "tcp_stream": 77 }, { "frame_number": 21782, "timestamp_epoch": "1732597368.487475000", "display_filter": "frame.number == 21782", "tcp_stream": 77 }, { "frame_number": 21792, "timestamp_epoch": "1732597428.558212000", "display_filter": "frame.number == 21792", "tcp_stream": 77 }, { "frame_number": 21823, "timestamp_epoch": "1732597488.715402000", "display_filter": "frame.number == 21823", "tcp_stream": 77 }, { "frame_number": 25880, "timestamp_epoch": "1732597548.896946000", "display_filter": "frame.number == 25880", "tcp_stream": 77 }, { "frame_number": 25891, "timestamp_epoch": "1732597608.946138000", "display_filter": "frame.number == 25891", "tcp_stream": 77 }, { "frame_number": 25937, "timestamp_epoch": "1732597669.001919000", "display_filter": "frame.number == 25937", "tcp_stream": 77 }, { "frame_number": 25968, "timestamp_epoch": "1732597729.062950000", "display_filter": "frame.number == 25968", "tcp_stream": 77 }, { "frame_number": 25985, "timestamp_epoch": "1732597789.216290000", "display_filter": "frame.number == 25985", "tcp_stream": 77 }, { "frame_number": 26022, "timestamp_epoch": "1732597849.369834000", "display_filter": "frame.number == 26022", "tcp_stream": 77 }, { "frame_number": 26051, "timestamp_epoch": "1732597909.523158000", "display_filter": "frame.number == 26051", "tcp_stream": 77 }, { "frame_number": 26055, "timestamp_epoch": "1732597969.680246000", "display_filter": "frame.number == 26055", "tcp_stream": 77 }, { "frame_number": 26066, "timestamp_epoch": "1732598029.737747000", "display_filter": "frame.number == 26066", "tcp_stream": 77 }, { "frame_number": 26074, "timestamp_epoch": "1732598089.880222000", "display_filter": "frame.number == 26074", "tcp_stream": 77 }, { "frame_number": 26087, "timestamp_epoch": "1732598149.936096000", "display_filter": "frame.number == 26087", "tcp_stream": 77 }, { "frame_number": 26097, "timestamp_epoch": "1732598210.090084000", "display_filter": "frame.number == 26097", "tcp_stream": 77 }, { "frame_number": 26107, "timestamp_epoch": "1732598270.148715000", "display_filter": "frame.number == 26107", "tcp_stream": 77 }, { "frame_number": 26119, "timestamp_epoch": "1732598330.207754000", "display_filter": "frame.number == 26119", "tcp_stream": 77 }, { "frame_number": 26133, "timestamp_epoch": "1732598390.367131000", "display_filter": "frame.number == 26133", "tcp_stream": 77 }, { "frame_number": 26215, "timestamp_epoch": "1732598450.424378000", "display_filter": "frame.number == 26215", "tcp_stream": 77 }, { "frame_number": 26297, "timestamp_epoch": "1732598510.485705000", "display_filter": "frame.number == 26297", "tcp_stream": 77 }, { "frame_number": 26301, "timestamp_epoch": "1732598570.640951000", "display_filter": "frame.number == 26301", "tcp_stream": 77 }, { "frame_number": 26317, "timestamp_epoch": "1732598630.794559000", "display_filter": "frame.number == 26317", "tcp_stream": 77 }, { "frame_number": 26325, "timestamp_epoch": "1732598691.056411000", "display_filter": "frame.number == 26325", "tcp_stream": 77 }, { "frame_number": 26339, "timestamp_epoch": "1732598751.112829000", "display_filter": "frame.number == 26339", "tcp_stream": 77 }, { "frame_number": 26357, "timestamp_epoch": "1732598811.175685000", "display_filter": "frame.number == 26357", "tcp_stream": 77 }, { "frame_number": 26371, "timestamp_epoch": "1732598871.330432000", "display_filter": "frame.number == 26371", "tcp_stream": 77 }, { "frame_number": 26381, "timestamp_epoch": "1732598931.593448000", "display_filter": "frame.number == 26381", "tcp_stream": 77 }, { "frame_number": 26395, "timestamp_epoch": "1732598991.748754000", "display_filter": "frame.number == 26395", "tcp_stream": 77 }, { "frame_number": 26407, "timestamp_epoch": "1732599052.010090000", "display_filter": "frame.number == 26407", "tcp_stream": 77 }, { "frame_number": 26425, "timestamp_epoch": "1732599112.161738000", "display_filter": "frame.number == 26425", "tcp_stream": 77 }, { "frame_number": 26431, "timestamp_epoch": "1732599172.411164000", "display_filter": "frame.number == 26431", "tcp_stream": 77 }, { "frame_number": 26441, "timestamp_epoch": "1732599232.561197000", "display_filter": "frame.number == 26441", "tcp_stream": 77 }, { "frame_number": 26449, "timestamp_epoch": "1732599292.717415000", "display_filter": "frame.number == 26449", "tcp_stream": 77 }, { "frame_number": 26508, "timestamp_epoch": "1732599352.967228000", "display_filter": "frame.number == 26508", "tcp_stream": 77 }, { "frame_number": 26533, "timestamp_epoch": "1732599413.228563000", "display_filter": "frame.number == 26533", "tcp_stream": 77 }, { "frame_number": 26554, "timestamp_epoch": "1732599473.382552000", "display_filter": "frame.number == 26554", "tcp_stream": 77 }, { "frame_number": 26570, "timestamp_epoch": "1732599533.536694000", "display_filter": "frame.number == 26570", "tcp_stream": 77 }, { "frame_number": 26809, "timestamp_epoch": "1732599628.801338000", "display_filter": "frame.number == 26809", "tcp_stream": 140 }, { "frame_number": 26811, "timestamp_epoch": "1732599629.009850000", "display_filter": "frame.number == 26811", "tcp_stream": 140 }, { "frame_number": 26814, "timestamp_epoch": "1732599629.317405000", "display_filter": "frame.number == 26814", "tcp_stream": 140 }, { "frame_number": 26842, "timestamp_epoch": "1732599689.372894000", "display_filter": "frame.number == 26842", "tcp_stream": 140 }, { "frame_number": 26901, "timestamp_epoch": "1732599749.528770000", "display_filter": "frame.number == 26901", "tcp_stream": 140 }, { "frame_number": 26913, "timestamp_epoch": "1732599809.682016000", "display_filter": "frame.number == 26913", "tcp_stream": 140 } ], "metrics": { "request_count": 58, "declared_body_bytes": 2624, "source": "10.11.26.183", "destination": "194.180.191.64", "port": 443, "host": "194.180.191.64", "uri": "http://194.180.191.64/fakeurl.htm" } }, { "finding_id": "finding-977311ea28e6696a0adf6d4c", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 23, "timestamp_epoch": "1732596578.919448000", "display_filter": "frame.number == 23", "udp_stream": 4 }, { "frame_number": 25, "timestamp_epoch": "1732596578.919535000", "display_filter": "frame.number == 25", "udp_stream": 3 }, { "frame_number": 189, "timestamp_epoch": "1732596584.253026000", "display_filter": "frame.number == 189", "udp_stream": 17 }, { "frame_number": 190, "timestamp_epoch": "1732596584.253067000", "display_filter": "frame.number == 190", "udp_stream": 16 }, { "frame_number": 902, "timestamp_epoch": "1732596599.779310000", "display_filter": "frame.number == 902", "udp_stream": 26 }, { "frame_number": 903, "timestamp_epoch": "1732596599.779345000", "display_filter": "frame.number == 903", "udp_stream": 17 }, { "frame_number": 1117, "timestamp_epoch": "1732596610.942457000", "display_filter": "frame.number == 1117", "udp_stream": 32 }, { "frame_number": 8691, "timestamp_epoch": "1732596618.945400000", "display_filter": "frame.number == 8691", "udp_stream": 32 }, { "frame_number": 20494, "timestamp_epoch": "1732596659.836575000", "display_filter": "frame.number == 20494", "udp_stream": 17 }, { "frame_number": 20495, "timestamp_epoch": "1732596659.836636000", "display_filter": "frame.number == 20495", "udp_stream": 81 }, { "frame_number": 20614, "timestamp_epoch": "1732596717.645876000", "display_filter": "frame.number == 20614", "udp_stream": 83 }, { "frame_number": 21092, "timestamp_epoch": "1732596725.657338000", "display_filter": "frame.number == 21092", "udp_stream": 83 }, { "frame_number": 21668, "timestamp_epoch": "1732597259.884101000", "display_filter": "frame.number == 21668", "udp_stream": 109 }, { "frame_number": 21669, "timestamp_epoch": "1732597259.884131000", "display_filter": "frame.number == 21669", "udp_stream": 110 }, { "frame_number": 21748, "timestamp_epoch": "1732597317.772416000", "display_filter": "frame.number == 21748", "udp_stream": 112 }, { "frame_number": 21756, "timestamp_epoch": "1732597325.779840000", "display_filter": "frame.number == 21756", "udp_stream": 112 }, { "frame_number": 26036, "timestamp_epoch": "1732597859.914522000", "display_filter": "frame.number == 26036", "udp_stream": 123 }, { "frame_number": 26037, "timestamp_epoch": "1732597859.914603000", "display_filter": "frame.number == 26037", "udp_stream": 124 }, { "frame_number": 26225, "timestamp_epoch": "1732598459.951992000", "display_filter": "frame.number == 26225", "udp_stream": 125 }, { "frame_number": 26226, "timestamp_epoch": "1732598459.952027000", "display_filter": "frame.number == 26226", "udp_stream": 126 }, { "frame_number": 26417, "timestamp_epoch": "1732599059.998703000", "display_filter": "frame.number == 26417", "udp_stream": 127 }, { "frame_number": 26418, "timestamp_epoch": "1732599059.998779000", "display_filter": "frame.number == 26418", "udp_stream": 128 }, { "frame_number": 26832, "timestamp_epoch": "1732599660.031331000", "display_filter": "frame.number == 26832", "udp_stream": 133 }, { "frame_number": 26833, "timestamp_epoch": "1732599660.031369000", "display_filter": "frame.number == 26833", "udp_stream": 131 } ], "metrics": { "source": "10.11.26.183", "domain": "wpad.mshome.net", "response_count": 24 } }, { "finding_id": "finding-3526e260798a47582bdaad59", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 19, "timestamp_epoch": "1732596578.919159000", "display_filter": "frame.number == 19", "udp_stream": 4 }, { "frame_number": 20, "timestamp_epoch": "1732596578.919159000", "display_filter": "frame.number == 20", "udp_stream": 3 }, { "frame_number": 185, "timestamp_epoch": "1732596584.252589000", "display_filter": "frame.number == 185", "udp_stream": 17 }, { "frame_number": 186, "timestamp_epoch": "1732596584.252645000", "display_filter": "frame.number == 186", "udp_stream": 16 }, { "frame_number": 898, "timestamp_epoch": "1732596599.778838000", "display_filter": "frame.number == 898", "udp_stream": 26 }, { "frame_number": 899, "timestamp_epoch": "1732596599.778882000", "display_filter": "frame.number == 899", "udp_stream": 17 }, { "frame_number": 1115, "timestamp_epoch": "1732596610.942148000", "display_filter": "frame.number == 1115", "udp_stream": 32 }, { "frame_number": 8688, "timestamp_epoch": "1732596618.944965000", "display_filter": "frame.number == 8688", "udp_stream": 32 }, { "frame_number": 20490, "timestamp_epoch": "1732596659.782088000", "display_filter": "frame.number == 20490", "udp_stream": 81 }, { "frame_number": 20491, "timestamp_epoch": "1732596659.782134000", "display_filter": "frame.number == 20491", "udp_stream": 17 }, { "frame_number": 20612, "timestamp_epoch": "1732596717.645557000", "display_filter": "frame.number == 20612", "udp_stream": 83 }, { "frame_number": 21090, "timestamp_epoch": "1732596725.656822000", "display_filter": "frame.number == 21090", "udp_stream": 83 }, { "frame_number": 21664, "timestamp_epoch": "1732597259.823544000", "display_filter": "frame.number == 21664", "udp_stream": 110 }, { "frame_number": 21665, "timestamp_epoch": "1732597259.823606000", "display_filter": "frame.number == 21665", "udp_stream": 109 }, { "frame_number": 21746, "timestamp_epoch": "1732597317.772120000", "display_filter": "frame.number == 21746", "udp_stream": 112 }, { "frame_number": 21754, "timestamp_epoch": "1732597325.778936000", "display_filter": "frame.number == 21754", "udp_stream": 112 }, { "frame_number": 26032, "timestamp_epoch": "1732597859.867198000", "display_filter": "frame.number == 26032", "udp_stream": 123 }, { "frame_number": 26033, "timestamp_epoch": "1732597859.867272000", "display_filter": "frame.number == 26033", "udp_stream": 124 }, { "frame_number": 26221, "timestamp_epoch": "1732598459.902062000", "display_filter": "frame.number == 26221", "udp_stream": 126 }, { "frame_number": 26222, "timestamp_epoch": "1732598459.902091000", "display_filter": "frame.number == 26222", "udp_stream": 125 }, { "frame_number": 26413, "timestamp_epoch": "1732599059.936808000", "display_filter": "frame.number == 26413", "udp_stream": 128 }, { "frame_number": 26414, "timestamp_epoch": "1732599059.936885000", "display_filter": "frame.number == 26414", "udp_stream": 127 }, { "frame_number": 26828, "timestamp_epoch": "1732599659.986175000", "display_filter": "frame.number == 26828", "udp_stream": 131 }, { "frame_number": 26829, "timestamp_epoch": "1732599659.986270000", "display_filter": "frame.number == 26829", "udp_stream": 133 } ], "metrics": { "source": "10.11.26.183", "domain": "wpad.nemotoads.health", "response_count": 24 } }, { "finding_id": "finding-6ccecc4b31af99f2715e3a0a", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 304, "timestamp_epoch": "1732596595.586808000", "display_filter": "frame.number == 304", "tcp_stream": 11 }, { "frame_number": 309, "timestamp_epoch": "1732596595.587339000", "display_filter": "frame.number == 309", "tcp_stream": 11 }, { "frame_number": 312, "timestamp_epoch": "1732596595.587890000", "display_filter": "frame.number == 312", "tcp_stream": 11 }, { "frame_number": 315, "timestamp_epoch": "1732596595.588486000", "display_filter": "frame.number == 315", "tcp_stream": 11 }, { "frame_number": 486, "timestamp_epoch": "1732596597.430818000", "display_filter": "frame.number == 486", "tcp_stream": 24 }, { "frame_number": 488, "timestamp_epoch": "1732596597.431540000", "display_filter": "frame.number == 488", "tcp_stream": 24 }, { "frame_number": 490, "timestamp_epoch": "1732596597.432409000", "display_filter": "frame.number == 490", "tcp_stream": 24 }, { "frame_number": 500, "timestamp_epoch": "1732596597.434219000", "display_filter": "frame.number == 500", "tcp_stream": 24 }, { "frame_number": 502, "timestamp_epoch": "1732596597.434750000", "display_filter": "frame.number == 502", "tcp_stream": 24 }, { "frame_number": 504, "timestamp_epoch": "1732596597.435524000", "display_filter": "frame.number == 504", "tcp_stream": 24 }, { "frame_number": 1120, "timestamp_epoch": "1732596611.004869000", "display_filter": "frame.number == 1120", "tcp_stream": 24 }, { "frame_number": 1122, "timestamp_epoch": "1732596611.005414000", "display_filter": "frame.number == 1122", "tcp_stream": 24 }, { "frame_number": 1124, "timestamp_epoch": "1732596611.006319000", "display_filter": "frame.number == 1124", "tcp_stream": 24 }, { "frame_number": 1128, "timestamp_epoch": "1732596611.008033000", "display_filter": "frame.number == 1128", "tcp_stream": 24 }, { "frame_number": 1130, "timestamp_epoch": "1732596611.008586000", "display_filter": "frame.number == 1130", "tcp_stream": 24 }, { "frame_number": 1132, "timestamp_epoch": "1732596611.009379000", "display_filter": "frame.number == 1132", "tcp_stream": 24 }, { "frame_number": 20433, "timestamp_epoch": "1732596656.533998000", "display_filter": "frame.number == 20433", "tcp_stream": 81 }, { "frame_number": 20435, "timestamp_epoch": "1732596656.534849000", "display_filter": "frame.number == 20435", "tcp_stream": 81 }, { "frame_number": 20437, "timestamp_epoch": "1732596656.535867000", "display_filter": "frame.number == 20437", "tcp_stream": 81 }, { "frame_number": 20441, "timestamp_epoch": "1732596656.537556000", "display_filter": "frame.number == 20441", "tcp_stream": 81 }, { "frame_number": 20443, "timestamp_epoch": "1732596656.538202000", "display_filter": "frame.number == 20443", "tcp_stream": 81 }, { "frame_number": 20445, "timestamp_epoch": "1732596656.539148000", "display_filter": "frame.number == 20445", "tcp_stream": 81 }, { "frame_number": 26626, "timestamp_epoch": "1732599597.841790000", "display_filter": "frame.number == 26626", "tcp_stream": 137 }, { "frame_number": 26628, "timestamp_epoch": "1732599597.842980000", "display_filter": "frame.number == 26628", "tcp_stream": 137 }, { "frame_number": 26630, "timestamp_epoch": "1732599597.844431000", "display_filter": "frame.number == 26630", "tcp_stream": 137 } ], "metrics": { "source": "10.11.26.183", "destination": "10.11.26.3", "protocol": "drsuapi", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-37ae52acec082e76514687be", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 36, "timestamp_epoch": "1732596579.029388000", "display_filter": "frame.number == 36", "tcp_stream": 1 }, { "frame_number": 43, "timestamp_epoch": "1732596579.031921000", "display_filter": "frame.number == 43", "tcp_stream": 1 }, { "frame_number": 46, "timestamp_epoch": "1732596579.034568000", "display_filter": "frame.number == 46", "tcp_stream": 1 }, { "frame_number": 359, "timestamp_epoch": "1732596595.594374000", "display_filter": "frame.number == 359", "tcp_stream": 16 }, { "frame_number": 371, "timestamp_epoch": "1732596595.596273000", "display_filter": "frame.number == 371", "tcp_stream": 16 }, { "frame_number": 382, "timestamp_epoch": "1732596595.600858000", "display_filter": "frame.number == 382", "tcp_stream": 16 }, { "frame_number": 388, "timestamp_epoch": "1732596595.603729000", "display_filter": "frame.number == 388", "tcp_stream": 17 }, { "frame_number": 391, "timestamp_epoch": "1732596595.605015000", "display_filter": "frame.number == 391", "tcp_stream": 17 }, { "frame_number": 393, "timestamp_epoch": "1732596595.605405000", "display_filter": "frame.number == 393", "tcp_stream": 17 }, { "frame_number": 395, "timestamp_epoch": "1732596595.605921000", "display_filter": "frame.number == 395", "tcp_stream": 16 }, { "frame_number": 397, "timestamp_epoch": "1732596595.612414000", "display_filter": "frame.number == 397", "tcp_stream": 17 }, { "frame_number": 401, "timestamp_epoch": "1732596595.614914000", "display_filter": "frame.number == 401", "tcp_stream": 16 }, { "frame_number": 510, "timestamp_epoch": "1732596597.438168000", "display_filter": "frame.number == 510", "tcp_stream": 25 }, { "frame_number": 515, "timestamp_epoch": "1732596597.440552000", "display_filter": "frame.number == 515", "tcp_stream": 25 }, { "frame_number": 518, "timestamp_epoch": "1732596597.443147000", "display_filter": "frame.number == 518", "tcp_stream": 25 }, { "frame_number": 522, "timestamp_epoch": "1732596597.446466000", "display_filter": "frame.number == 522", "tcp_stream": 25 }, { "frame_number": 524, "timestamp_epoch": "1732596597.447634000", "display_filter": "frame.number == 524", "tcp_stream": 25 }, { "frame_number": 535, "timestamp_epoch": "1732596597.465797000", "display_filter": "frame.number == 535", "tcp_stream": 26 }, { "frame_number": 538, "timestamp_epoch": "1732596597.467107000", "display_filter": "frame.number == 538", "tcp_stream": 26 }, { "frame_number": 543, "timestamp_epoch": "1732596597.468024000", "display_filter": "frame.number == 543", "tcp_stream": 26 }, { "frame_number": 545, "timestamp_epoch": "1732596597.468754000", "display_filter": "frame.number == 545", "tcp_stream": 26 }, { "frame_number": 548, "timestamp_epoch": "1732596597.468892000", "display_filter": "frame.number == 548", "tcp_stream": 25 }, { "frame_number": 1138, "timestamp_epoch": "1732596611.011629000", "display_filter": "frame.number == 1138", "tcp_stream": 38 }, { "frame_number": 1141, "timestamp_epoch": "1732596611.014485000", "display_filter": "frame.number == 1141", "tcp_stream": 38 }, { "frame_number": 1143, "timestamp_epoch": "1732596611.015315000", "display_filter": "frame.number == 1143", "tcp_stream": 38 }, { "frame_number": 1145, "timestamp_epoch": "1732596611.016071000", "display_filter": "frame.number == 1145", "tcp_stream": 38 }, { "frame_number": 1151, "timestamp_epoch": "1732596611.018656000", "display_filter": "frame.number == 1151", "tcp_stream": 39 }, { "frame_number": 1154, "timestamp_epoch": "1732596611.021073000", "display_filter": "frame.number == 1154", "tcp_stream": 39 }, { "frame_number": 1159, "timestamp_epoch": "1732596611.022315000", "display_filter": "frame.number == 1159", "tcp_stream": 39 }, { "frame_number": 1161, "timestamp_epoch": "1732596611.023177000", "display_filter": "frame.number == 1161", "tcp_stream": 39 }, { "frame_number": 1163, "timestamp_epoch": "1732596611.023322000", "display_filter": "frame.number == 1163", "tcp_stream": 38 }, { "frame_number": 20450, "timestamp_epoch": "1732596656.541082000", "display_filter": "frame.number == 20450", "tcp_stream": 82 }, { "frame_number": 20455, "timestamp_epoch": "1732596656.543311000", "display_filter": "frame.number == 20455", "tcp_stream": 82 }, { "frame_number": 20458, "timestamp_epoch": "1732596656.545813000", "display_filter": "frame.number == 20458", "tcp_stream": 82 }, { "frame_number": 20460, "timestamp_epoch": "1732596656.546756000", "display_filter": "frame.number == 20460", "tcp_stream": 82 }, { "frame_number": 20462, "timestamp_epoch": "1732596656.547675000", "display_filter": "frame.number == 20462", "tcp_stream": 82 }, { "frame_number": 20468, "timestamp_epoch": "1732596656.550432000", "display_filter": "frame.number == 20468", "tcp_stream": 83 }, { "frame_number": 20471, "timestamp_epoch": "1732596656.552990000", "display_filter": "frame.number == 20471", "tcp_stream": 83 }, { "frame_number": 20476, "timestamp_epoch": "1732596656.554350000", "display_filter": "frame.number == 20476", "tcp_stream": 83 }, { "frame_number": 20478, "timestamp_epoch": "1732596656.555397000", "display_filter": "frame.number == 20478", "tcp_stream": 83 }, { "frame_number": 20480, "timestamp_epoch": "1732596656.555572000", "display_filter": "frame.number == 20480", "tcp_stream": 82 }, { "frame_number": 21162, "timestamp_epoch": "1732596827.738941000", "display_filter": "frame.number == 21162", "tcp_stream": 93 }, { "frame_number": 21179, "timestamp_epoch": "1732596827.745508000", "display_filter": "frame.number == 21179", "tcp_stream": 93 }, { "frame_number": 21182, "timestamp_epoch": "1732596827.749181000", "display_filter": "frame.number == 21182", "tcp_stream": 93 }, { "frame_number": 21184, "timestamp_epoch": "1732596827.750218000", "display_filter": "frame.number == 21184", "tcp_stream": 93 }, { "frame_number": 21192, "timestamp_epoch": "1732596827.760127000", "display_filter": "frame.number == 21192", "tcp_stream": 95 }, { "frame_number": 21195, "timestamp_epoch": "1732596827.761428000", "display_filter": "frame.number == 21195", "tcp_stream": 95 }, { "frame_number": 21197, "timestamp_epoch": "1732596827.761912000", "display_filter": "frame.number == 21197", "tcp_stream": 95 }, { "frame_number": 21257, "timestamp_epoch": "1732596897.033500000", "display_filter": "frame.number == 21257", "tcp_stream": 97 }, { "frame_number": 21262, "timestamp_epoch": "1732596897.036140000", "display_filter": "frame.number == 21262", "tcp_stream": 97 }, { "frame_number": 21265, "timestamp_epoch": "1732596897.039773000", "display_filter": "frame.number == 21265", "tcp_stream": 97 }, { "frame_number": 21267, "timestamp_epoch": "1732596897.040938000", "display_filter": "frame.number == 21267", "tcp_stream": 97 }, { "frame_number": 21275, "timestamp_epoch": "1732596897.048150000", "display_filter": "frame.number == 21275", "tcp_stream": 98 }, { "frame_number": 21278, "timestamp_epoch": "1732596897.050523000", "display_filter": "frame.number == 21278", "tcp_stream": 98 }, { "frame_number": 21280, "timestamp_epoch": "1732596897.051336000", "display_filter": "frame.number == 21280", "tcp_stream": 98 }, { "frame_number": 26599, "timestamp_epoch": "1732599597.741334000", "display_filter": "frame.number == 26599", "tcp_stream": 135 }, { "frame_number": 26604, "timestamp_epoch": "1732599597.744037000", "display_filter": "frame.number == 26604", "tcp_stream": 135 }, { "frame_number": 26632, "timestamp_epoch": "1732599597.868867000", "display_filter": "frame.number == 26632", "tcp_stream": 135 }, { "frame_number": 26643, "timestamp_epoch": "1732599597.983021000", "display_filter": "frame.number == 26643", "tcp_stream": 138 }, { "frame_number": 26646, "timestamp_epoch": "1732599597.985102000", "display_filter": "frame.number == 26646", "tcp_stream": 138 }, { "frame_number": 26648, "timestamp_epoch": "1732599597.986188000", "display_filter": "frame.number == 26648", "tcp_stream": 138 }, { "frame_number": 26650, "timestamp_epoch": "1732599597.988239000", "display_filter": "frame.number == 26650", "tcp_stream": 135 }, { "frame_number": 26787, "timestamp_epoch": "1732599598.044618000", "display_filter": "frame.number == 26787", "tcp_stream": 138 }, { "frame_number": 26791, "timestamp_epoch": "1732599598.049093000", "display_filter": "frame.number == 26791", "tcp_stream": 135 } ], "metrics": { "source": "10.11.26.183", "destination": "10.11.26.3", "protocol": "ldap", "event_count": 64, "operation_numbers": [ "", "0", "2", "3" ] } }, { "finding_id": "finding-fe6b4fe22ff26b68a72f2ad0", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 330, "timestamp_epoch": "1732596595.590229000", "display_filter": "frame.number == 330", "tcp_stream": 10 }, { "frame_number": 334, "timestamp_epoch": "1732596595.590763000", "display_filter": "frame.number == 334", "tcp_stream": 10 }, { "frame_number": 340, "timestamp_epoch": "1732596595.591192000", "display_filter": "frame.number == 340", "tcp_stream": 10 }, { "frame_number": 344, "timestamp_epoch": "1732596595.591682000", "display_filter": "frame.number == 344", "tcp_stream": 10 }, { "frame_number": 346, "timestamp_epoch": "1732596595.592111000", "display_filter": "frame.number == 346", "tcp_stream": 10 }, { "frame_number": 349, "timestamp_epoch": "1732596595.592658000", "display_filter": "frame.number == 349", "tcp_stream": 10 }, { "frame_number": 351, "timestamp_epoch": "1732596595.593077000", "display_filter": "frame.number == 351", "tcp_stream": 10 }, { "frame_number": 353, "timestamp_epoch": "1732596595.593657000", "display_filter": "frame.number == 353", "tcp_stream": 10 }, { "frame_number": 358, "timestamp_epoch": "1732596595.594248000", "display_filter": "frame.number == 358", "tcp_stream": 10 }, { "frame_number": 361, "timestamp_epoch": "1732596595.594830000", "display_filter": "frame.number == 361", "tcp_stream": 10 }, { "frame_number": 366, "timestamp_epoch": "1732596595.595354000", "display_filter": "frame.number == 366", "tcp_stream": 10 }, { "frame_number": 368, "timestamp_epoch": "1732596595.595836000", "display_filter": "frame.number == 368", "tcp_stream": 10 }, { "frame_number": 372, "timestamp_epoch": "1732596595.596294000", "display_filter": "frame.number == 372", "tcp_stream": 10 }, { "frame_number": 375, "timestamp_epoch": "1732596595.596654000", "display_filter": "frame.number == 375", "tcp_stream": 10 }, { "frame_number": 377, "timestamp_epoch": "1732596595.597066000", "display_filter": "frame.number == 377", "tcp_stream": 10 } ], "metrics": { "source": "10.11.26.183", "destination": "10.11.26.3", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-f201a1cea0a8f116e3aa9f3e", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 305, "timestamp_epoch": "1732596595.587007000", "display_filter": "frame.number == 305", "tcp_stream": 11 }, { "frame_number": 311, "timestamp_epoch": "1732596595.587700000", "display_filter": "frame.number == 311", "tcp_stream": 11 }, { "frame_number": 313, "timestamp_epoch": "1732596595.588294000", "display_filter": "frame.number == 313", "tcp_stream": 11 }, { "frame_number": 316, "timestamp_epoch": "1732596595.588613000", "display_filter": "frame.number == 316", "tcp_stream": 11 }, { "frame_number": 487, "timestamp_epoch": "1732596597.431332000", "display_filter": "frame.number == 487", "tcp_stream": 24 }, { "frame_number": 489, "timestamp_epoch": "1732596597.432272000", "display_filter": "frame.number == 489", "tcp_stream": 24 }, { "frame_number": 491, "timestamp_epoch": "1732596597.432620000", "display_filter": "frame.number == 491", "tcp_stream": 24 }, { "frame_number": 501, "timestamp_epoch": "1732596597.434596000", "display_filter": "frame.number == 501", "tcp_stream": 24 }, { "frame_number": 503, "timestamp_epoch": "1732596597.435395000", "display_filter": "frame.number == 503", "tcp_stream": 24 }, { "frame_number": 505, "timestamp_epoch": "1732596597.435730000", "display_filter": "frame.number == 505", "tcp_stream": 24 }, { "frame_number": 1121, "timestamp_epoch": "1732596611.005236000", "display_filter": "frame.number == 1121", "tcp_stream": 24 }, { "frame_number": 1123, "timestamp_epoch": "1732596611.006177000", "display_filter": "frame.number == 1123", "tcp_stream": 24 }, { "frame_number": 1125, "timestamp_epoch": "1732596611.006536000", "display_filter": "frame.number == 1125", "tcp_stream": 24 }, { "frame_number": 1129, "timestamp_epoch": "1732596611.008413000", "display_filter": "frame.number == 1129", "tcp_stream": 24 }, { "frame_number": 1131, "timestamp_epoch": "1732596611.009217000", "display_filter": "frame.number == 1131", "tcp_stream": 24 }, { "frame_number": 1133, "timestamp_epoch": "1732596611.009581000", "display_filter": "frame.number == 1133", "tcp_stream": 24 }, { "frame_number": 20434, "timestamp_epoch": "1732596656.534486000", "display_filter": "frame.number == 20434", "tcp_stream": 81 }, { "frame_number": 20436, "timestamp_epoch": "1732596656.535544000", "display_filter": "frame.number == 20436", "tcp_stream": 81 }, { "frame_number": 20438, "timestamp_epoch": "1732596656.536083000", "display_filter": "frame.number == 20438", "tcp_stream": 81 }, { "frame_number": 20442, "timestamp_epoch": "1732596656.537881000", "display_filter": "frame.number == 20442", "tcp_stream": 81 }, { "frame_number": 20444, "timestamp_epoch": "1732596656.538841000", "display_filter": "frame.number == 20444", "tcp_stream": 81 }, { "frame_number": 20446, "timestamp_epoch": "1732596656.539357000", "display_filter": "frame.number == 20446", "tcp_stream": 81 }, { "frame_number": 26627, "timestamp_epoch": "1732599597.842269000", "display_filter": "frame.number == 26627", "tcp_stream": 137 }, { "frame_number": 26629, "timestamp_epoch": "1732599597.843863000", "display_filter": "frame.number == 26629", "tcp_stream": 137 }, { "frame_number": 26631, "timestamp_epoch": "1732599597.844792000", "display_filter": "frame.number == 26631", "tcp_stream": 137 } ], "metrics": { "source": "10.11.26.3", "destination": "10.11.26.183", "protocol": "drsuapi", "event_count": 25, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-273a41d00ef67b8cf7e27d53", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 40, "timestamp_epoch": "1732596579.030853000", "display_filter": "frame.number == 40", "tcp_stream": 1 }, { "frame_number": 45, "timestamp_epoch": "1732596579.034205000", "display_filter": "frame.number == 45", "tcp_stream": 1 }, { "frame_number": 363, "timestamp_epoch": "1732596595.595173000", "display_filter": "frame.number == 363", "tcp_stream": 16 }, { "frame_number": 379, "timestamp_epoch": "1732596595.597345000", "display_filter": "frame.number == 379", "tcp_stream": 16 }, { "frame_number": 383, "timestamp_epoch": "1732596595.601465000", "display_filter": "frame.number == 383", "tcp_stream": 16 }, { "frame_number": 390, "timestamp_epoch": "1732596595.604722000", "display_filter": "frame.number == 390", "tcp_stream": 17 }, { "frame_number": 392, "timestamp_epoch": "1732596595.605218000", "display_filter": "frame.number == 392", "tcp_stream": 17 }, { "frame_number": 394, "timestamp_epoch": "1732596595.605655000", "display_filter": "frame.number == 394", "tcp_stream": 17 }, { "frame_number": 396, "timestamp_epoch": "1732596595.606287000", "display_filter": "frame.number == 396", "tcp_stream": 16 }, { "frame_number": 512, "timestamp_epoch": "1732596597.439561000", "display_filter": "frame.number == 512", "tcp_stream": 25 }, { "frame_number": 517, "timestamp_epoch": "1732596597.442740000", "display_filter": "frame.number == 517", "tcp_stream": 25 }, { "frame_number": 520, "timestamp_epoch": "1732596597.443804000", "display_filter": "frame.number == 520", "tcp_stream": 25 }, { "frame_number": 523, "timestamp_epoch": "1732596597.447405000", "display_filter": "frame.number == 523", "tcp_stream": 25 }, { "frame_number": 525, "timestamp_epoch": "1732596597.448211000", "display_filter": "frame.number == 525", "tcp_stream": 25 }, { "frame_number": 537, "timestamp_epoch": "1732596597.466785000", "display_filter": "frame.number == 537", "tcp_stream": 26 }, { "frame_number": 541, "timestamp_epoch": "1732596597.467868000", "display_filter": "frame.number == 541", "tcp_stream": 26 }, { "frame_number": 544, "timestamp_epoch": "1732596597.468577000", "display_filter": "frame.number == 544", "tcp_stream": 26 }, { "frame_number": 1140, "timestamp_epoch": "1732596611.014080000", "display_filter": "frame.number == 1140", "tcp_stream": 38 }, { "frame_number": 1142, "timestamp_epoch": "1732596611.015142000", "display_filter": "frame.number == 1142", "tcp_stream": 38 }, { "frame_number": 1144, "timestamp_epoch": "1732596611.015919000", "display_filter": "frame.number == 1144", "tcp_stream": 38 }, { "frame_number": 1146, "timestamp_epoch": "1732596611.016629000", "display_filter": "frame.number == 1146", "tcp_stream": 38 }, { "frame_number": 1153, "timestamp_epoch": "1732596611.020767000", "display_filter": "frame.number == 1153", "tcp_stream": 39 }, { "frame_number": 1157, "timestamp_epoch": "1732596611.022156000", "display_filter": "frame.number == 1157", "tcp_stream": 39 }, { "frame_number": 1160, "timestamp_epoch": "1732596611.023059000", "display_filter": "frame.number == 1160", "tcp_stream": 39 }, { "frame_number": 20452, "timestamp_epoch": "1732596656.542432000", "display_filter": "frame.number == 20452", "tcp_stream": 82 }, { "frame_number": 20457, "timestamp_epoch": "1732596656.545412000", "display_filter": "frame.number == 20457", "tcp_stream": 82 }, { "frame_number": 20459, "timestamp_epoch": "1732596656.546433000", "display_filter": "frame.number == 20459", "tcp_stream": 82 }, { "frame_number": 20461, "timestamp_epoch": "1732596656.547363000", "display_filter": "frame.number == 20461", "tcp_stream": 82 }, { "frame_number": 20463, "timestamp_epoch": "1732596656.548244000", "display_filter": "frame.number == 20463", "tcp_stream": 82 }, { "frame_number": 20470, "timestamp_epoch": "1732596656.552608000", "display_filter": "frame.number == 20470", "tcp_stream": 83 }, { "frame_number": 20474, "timestamp_epoch": "1732596656.554080000", "display_filter": "frame.number == 20474", "tcp_stream": 83 }, { "frame_number": 20477, "timestamp_epoch": "1732596656.555100000", "display_filter": "frame.number == 20477", "tcp_stream": 83 }, { "frame_number": 21164, "timestamp_epoch": "1732596827.740374000", "display_filter": "frame.number == 21164", "tcp_stream": 93 }, { "frame_number": 21181, "timestamp_epoch": "1732596827.747859000", "display_filter": "frame.number == 21181", "tcp_stream": 93 }, { "frame_number": 21183, "timestamp_epoch": "1732596827.750040000", "display_filter": "frame.number == 21183", "tcp_stream": 93 }, { "frame_number": 21194, "timestamp_epoch": "1732596827.761122000", "display_filter": "frame.number == 21194", "tcp_stream": 95 }, { "frame_number": 21196, "timestamp_epoch": "1732596827.761727000", "display_filter": "frame.number == 21196", "tcp_stream": 95 }, { "frame_number": 21259, "timestamp_epoch": "1732596897.034953000", "display_filter": "frame.number == 21259", "tcp_stream": 97 }, { "frame_number": 21264, "timestamp_epoch": "1732596897.038424000", "display_filter": "frame.number == 21264", "tcp_stream": 97 }, { "frame_number": 21266, "timestamp_epoch": "1732596897.040650000", "display_filter": "frame.number == 21266", "tcp_stream": 97 }, { "frame_number": 21277, "timestamp_epoch": "1732596897.050275000", "display_filter": "frame.number == 21277", "tcp_stream": 98 }, { "frame_number": 21279, "timestamp_epoch": "1732596897.051221000", "display_filter": "frame.number == 21279", "tcp_stream": 98 }, { "frame_number": 26601, "timestamp_epoch": "1732599597.742724000", "display_filter": "frame.number == 26601", "tcp_stream": 135 }, { "frame_number": 26606, "timestamp_epoch": "1732599597.746289000", "display_filter": "frame.number == 26606", "tcp_stream": 135 }, { "frame_number": 26633, "timestamp_epoch": "1732599597.869495000", "display_filter": "frame.number == 26633", "tcp_stream": 135 }, { "frame_number": 26645, "timestamp_epoch": "1732599597.984023000", "display_filter": "frame.number == 26645", "tcp_stream": 138 }, { "frame_number": 26647, "timestamp_epoch": "1732599597.985532000", "display_filter": "frame.number == 26647", "tcp_stream": 138 }, { "frame_number": 26649, "timestamp_epoch": "1732599597.986650000", "display_filter": "frame.number == 26649", "tcp_stream": 138 }, { "frame_number": 26651, "timestamp_epoch": "1732599597.989094000", "display_filter": "frame.number == 26651", "tcp_stream": 135 } ], "metrics": { "source": "10.11.26.3", "destination": "10.11.26.183", "protocol": "ldap", "event_count": 49, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-d322b50ffa8c20a5d431f3cf", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 333, "timestamp_epoch": "1732596595.590598000", "display_filter": "frame.number == 333", "tcp_stream": 10 }, { "frame_number": 337, "timestamp_epoch": "1732596595.591034000", "display_filter": "frame.number == 337", "tcp_stream": 10 }, { "frame_number": 342, "timestamp_epoch": "1732596595.591453000", "display_filter": "frame.number == 342", "tcp_stream": 10 }, { "frame_number": 345, "timestamp_epoch": "1732596595.591967000", "display_filter": "frame.number == 345", "tcp_stream": 10 }, { "frame_number": 348, "timestamp_epoch": "1732596595.592505000", "display_filter": "frame.number == 348", "tcp_stream": 10 }, { "frame_number": 350, "timestamp_epoch": "1732596595.592934000", "display_filter": "frame.number == 350", "tcp_stream": 10 }, { "frame_number": 352, "timestamp_epoch": "1732596595.593509000", "display_filter": "frame.number == 352", "tcp_stream": 10 }, { "frame_number": 355, "timestamp_epoch": "1732596595.594089000", "display_filter": "frame.number == 355", "tcp_stream": 10 }, { "frame_number": 360, "timestamp_epoch": "1732596595.594659000", "display_filter": "frame.number == 360", "tcp_stream": 10 }, { "frame_number": 364, "timestamp_epoch": "1732596595.595194000", "display_filter": "frame.number == 364", "tcp_stream": 10 }, { "frame_number": 367, "timestamp_epoch": "1732596595.595679000", "display_filter": "frame.number == 367", "tcp_stream": 10 }, { "frame_number": 369, "timestamp_epoch": "1732596595.596027000", "display_filter": "frame.number == 369", "tcp_stream": 10 }, { "frame_number": 374, "timestamp_epoch": "1732596595.596520000", "display_filter": "frame.number == 374", "tcp_stream": 10 }, { "frame_number": 376, "timestamp_epoch": "1732596595.596929000", "display_filter": "frame.number == 376", "tcp_stream": 10 }, { "frame_number": 378, "timestamp_epoch": "1732596595.597278000", "display_filter": "frame.number == 378", "tcp_stream": 10 } ], "metrics": { "source": "10.11.26.3", "destination": "10.11.26.183", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [ { "attack_id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "command-and-control", "confidence": 0.85, "status": "suggested", "mapping_basis": "versioned-deterministic-rule", "finding_ids": [ "finding-826deb5286207c26818905b0", "finding-89d44c49a788d0f0f0614088" ], "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 } ] }, { "attack_id": "T1219", "name": "Remote Access Software", "tactic": "command-and-control", "confidence": 0.9, "status": "suggested", "mapping_basis": "versioned-deterministic-rule", "finding_ids": [ "finding-f2eac4fa26ed6ea5ec889582" ], "evidence": [ { "frame_number": 20340, "timestamp_epoch": "1732596645.849438000", "display_filter": "frame.number == 20340", "tcp_stream": 77 }, { "frame_number": 20342, "timestamp_epoch": "1732596646.046139000", "display_filter": "frame.number == 20342", "tcp_stream": 77 }, { "frame_number": 20348, "timestamp_epoch": "1732596646.348055000", "display_filter": "frame.number == 20348", "tcp_stream": 77 }, { "frame_number": 20350, "timestamp_epoch": "1732596646.749227000", "display_filter": "frame.number == 20350", "tcp_stream": 77 }, { "frame_number": 20572, "timestamp_epoch": "1732596706.921682000", "display_filter": "frame.number == 20572", "tcp_stream": 77 } ] } ], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 343, "truncated": false }, "http_request": { "returned": 74, "truncated": false }, "http_response": { "returned": 10, "truncated": false }, "tls_client_hello": { "returned": 109, "truncated": false }, "dhcp": { "returned": 0, "truncated": false }, "identity": { "returned": 411, "truncated": false }, "directory_service": { "returned": 193, "truncated": false }, "unclassified_tcp": { "returned": 100, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 66, "hashed_objects": 66, "unique_hashes": 11, "returned_unique_hashes": 11, "detailed_objects": 11, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 3596, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 26922 packets across 61 IP endpoints and 276 transport flows. Observed 343 DNS events, 74 HTTP requests, 109 TLS ClientHello events, and 11 exported HTTP object(s). Deterministic rules produced 12 finding(s): 2 high, 2 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:08:41.573203+00:00", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_semantic_sha256": "4fa4f2aabaa7bcc51a396dcd62fc65dbd2ee862d01d0ba16095da5915212d518", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 243, "observables_checked": 243, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 243, "prior_cases_checked": 6, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [ { "attack_id": "T1071.001", "name": "Web Protocols", "catalog_version_id": 851, "url": "https://attack.mitre.org/techniques/T1071/001", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "NSM:Flow", "WinEventLog:Sysmon", "auditd:SYSCALL", "macos:osquery", "macos:unifiedlog", "esxi:shell" ], "detection": "", "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc", "attack_id": "DET0027", "name": "Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets" } ], "detection_links_truncated": false, "status": "catalog-context-not-validation-of-behavior" }, { "attack_id": "T1219", "name": "Remote Access Tools", "catalog_version_id": 851, "url": "https://attack.mitre.org/techniques/T1219", "platforms": [ "Linux", "macOS", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "WinEventLog:System", "auditd:SYSCALL", "auditd:PATH", "macos:unifiedlog", "macos:osquery" ], "detection": "", "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--ec412019-109f-4f84-aa2f-d623f40254e0", "attack_id": "DET0496", "name": "Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)" } ], "detection_links_truncated": false, "status": "catalog-context-not-validation-of-behavior" } ], "cross_case_correlations": [ { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "code.jquery.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "52.168.112.67" } ], "shared_count": 10, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.190.135.3" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "52.168.112.67" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 30, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "armmf.adobe.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "wpad.mshome.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "142.250.138.94" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.190.135.3" }, { "type": "ipv4", "value": "20.190.135.6" }, { "type": "ipv4", "value": "20.190.135.7" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.14" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "40.126.7.32" }, { "type": "ipv4", "value": "52.168.112.67" }, { "type": "sha256", "value": "2b69346572041eefe558a82b58d654237e087ce9ab4e0876254a40a8954279a9" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" }, { "type": "sha256", "value": "975b5678560775735da4a9e8b805dce370329179b8e17ebc1c289aaeb293f7ff" }, { "type": "sha256", "value": "f0e200cacd273e3dd257057f27aeda839a1f2f31482e0bb01ea8b1363a7af245" } ], "shared_count": 46, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wpad.mshome.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.google.com" }, { "type": "domain", "value": "www.gstatic.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "142.250.113.95" }, { "type": "ipv4", "value": "142.250.114.95" }, { "type": "ipv4", "value": "142.250.115.95" }, { "type": "ipv4", "value": "142.251.116.95" }, { "type": "ipv4", "value": "142.251.186.95" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 37, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "fonts.googleapis.com" }, { "type": "domain", "value": "fonts.gstatic.com" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.google.com" }, { "type": "domain", "value": "www.gstatic.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "142.250.113.95" }, { "type": "ipv4", "value": "142.250.115.95" }, { "type": "ipv4", "value": "20.189.173.6" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.190.135.6" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.28.14" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 37, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "checkappexec.microsoft.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.live.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.google.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.21.239" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "142.251.186.103" }, { "type": "ipv4", "value": "142.251.186.104" }, { "type": "ipv4", "value": "142.251.186.105" }, { "type": "ipv4", "value": "142.251.186.106" }, { "type": "ipv4", "value": "142.251.186.147" }, { "type": "ipv4", "value": "142.251.186.99" }, { "type": "ipv4", "value": "20.189.173.16" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.190.135.3" }, { "type": "ipv4", "value": "20.190.135.6" }, { "type": "ipv4", "value": "20.190.135.7" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.239" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "4.150.155.223" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "40.126.7.32" }, { "type": "ipv4", "value": "52.109.20.47" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 54, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "82f0a542eadbd91c1d0554cf45b8bd4f69607e372cf96649bcd6ec9cab5fafb8" }, "techniques": [ { "attack_id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "command-and-control", "confidence": 0.85, "evidence": "T1071.001 Application Layer Protocol: Web Protocols", "review_status": "suggested", "evidence_start": 7423, "evidence_end": 7474, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null }, { "attack_id": "T1219", "name": "Remote Access Software", "tactic": "command-and-control", "confidence": 0.9, "evidence": "T1219 Remote Access Software", "review_status": "suggested", "evidence_start": 7571, "evidence_end": 7599, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0071", "group_name": "Orangeworm", "similarity": 0.3333, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0083", "group_name": "SilverTerrier", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1042", "group_name": "RedEcho", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0008", "group_name": "Carbanak", "similarity": 0.1, "shared_count": 1, "shared_techniques": [ "T1219" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0115", "group_name": "GOLD SOUTHFIELD", "similarity": 0.1, "shared_count": 1, "shared_techniques": [ "T1219" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0105", "group_name": "DarkVishnya", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1219" ] }, { "group_attack_id": "G0026", "group_name": "APT18", "similarity": 0.0769, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0085", "group_name": "FIN4", "similarity": 0.0769, "shared_count": 1, "shared_techniques": [ "T1071.001" ] } ] }