sysmon-10.2-dns.evtx.golden.json

[
  {
    "@timestamp": "2019-07-18T03:34:01.239Z",
    "dns": {
      "answers": [
        {
          "data": "go.microsoft.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e11290.dspg.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.223.14.67",
          "type": "A"
        }
      ],
      "question": {
        "name": "go.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "23.223.14.67"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a8-5d2f-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 66,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.261Z",
    "dns": {
      "answers": [
        {
          "data": "www-msn-com.a-0003.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "a-0003.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "204.79.197.203",
          "type": "A"
        }
      ],
      "question": {
        "name": "www.msn.com",
        "registered_domain": "msn.com"
      },
      "resolved_ip": [
        "204.79.197.203"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 67,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.449Z",
    "dns": {
      "answers": [
        {
          "data": "a1999.dscg2.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.192",
          "type": "A"
        },
        {
          "data": "23.50.53.195",
          "type": "A"
        }
      ],
      "question": {
        "name": "static-global-s-msn-com.akamaized.net",
        "registered_domain": "akamaized.net"
      },
      "resolved_ip": [
        "23.50.53.192",
        "23.50.53.195"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 68,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.457Z",
    "dns": {
      "answers": [
        {
          "data": "a-0001.a-afdentry.net.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "dual-a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "204.79.197.200",
          "type": "A"
        },
        {
          "data": "13.107.21.200",
          "type": "A"
        }
      ],
      "question": {
        "name": "www.bing.com",
        "registered_domain": "bing.com"
      },
      "resolved_ip": [
        "204.79.197.200",
        "13.107.21.200"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a8-5d2f-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 69,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.494Z",
    "dns": {
      "answers": [
        {
          "data": "linkmaker.itunes.apple.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e4541.dsce9.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.64.104.249",
          "type": "A"
        }
      ],
      "question": {
        "name": "linkmaker.itunes.apple.com",
        "registered_domain": "apple.com"
      },
      "resolved_ip": [
        "23.64.104.249"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 70,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.81Z",
    "dns": {
      "answers": [
        {
          "data": "151.101.1.194",
          "type": "A"
        },
        {
          "data": "151.101.65.194",
          "type": "A"
        },
        {
          "data": "151.101.129.194",
          "type": "A"
        },
        {
          "data": "151.101.193.194",
          "type": "A"
        }
      ],
      "question": {
        "name": "confiant-integrations.global.ssl.fastly.net",
        "registered_domain": "confiant-integrations.global.ssl.fastly.net"
      },
      "resolved_ip": [
        "151.101.1.194",
        "151.101.65.194",
        "151.101.129.194",
        "151.101.193.194"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 71,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.894Z",
    "dns": {
      "answers": [
        {
          "data": "c.msn.com.nsatc.net",
          "type": "CNAME"
        },
        {
          "data": "20.36.253.92",
          "type": "A"
        }
      ],
      "question": {
        "name": "c.msn.com",
        "registered_domain": "msn.com"
      },
      "resolved_ip": [
        "20.36.253.92"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 72,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:01.948Z",
    "dns": {
      "answers": [
        {
          "data": "c-bing-com.a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "dual-a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "13.107.21.200",
          "type": "A"
        },
        {
          "data": "204.79.197.200",
          "type": "A"
        }
      ],
      "question": {
        "name": "c.bing.com",
        "registered_domain": "bing.com"
      },
      "resolved_ip": [
        "13.107.21.200",
        "204.79.197.200"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 73,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.085Z",
    "dns": {
      "answers": [
        {
          "data": "23.52.167.93",
          "type": "A"
        }
      ],
      "question": {
        "name": "contextual.media.net",
        "registered_domain": "media.net"
      },
      "resolved_ip": [
        "23.52.167.93"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 74,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.174Z",
    "dns": {
      "answers": [
        {
          "data": "glb-ads.atwola.adtechus.com",
          "type": "CNAME"
        },
        {
          "data": "cs670.wac.thetacdn.net",
          "type": "CNAME"
        },
        {
          "data": "cs670.lb.wac.apr-1b09e.edgecastdns.net",
          "type": "CNAME"
        },
        {
          "data": "cs935.wac.thetacdn.net",
          "type": "CNAME"
        },
        {
          "data": "152.195.32.120",
          "type": "A"
        }
      ],
      "question": {
        "name": "at.atwola.com",
        "registered_domain": "atwola.com"
      },
      "resolved_ip": [
        "152.195.32.120"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 75,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.274Z",
    "dns": {
      "answers": [
        {
          "data": "microsoft.geo.appnexusgslb.net",
          "type": "CNAME"
        },
        {
          "data": "m.anycast.adnxs.com",
          "type": "CNAME"
        },
        {
          "data": "204.13.192.56",
          "type": "A"
        },
        {
          "data": "204.13.192.120",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "m.adnxs.com",
        "registered_domain": "adnxs.com"
      },
      "resolved_ip": [
        "204.13.192.56",
        "204.13.192.120",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 76,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.291Z",
    "dns": {
      "answers": [
        {
          "data": "spcms-global.pbp.gysm.yahoodns.net",
          "type": "CNAME"
        },
        {
          "data": "74.6.137.78",
          "type": "A"
        }
      ],
      "question": {
        "name": "cms.analytics.yahoo.com",
        "registered_domain": "yahoo.com"
      },
      "resolved_ip": [
        "74.6.137.78"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 77,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.413Z",
    "dns": {
      "answers": [
        {
          "data": "cvision.media.net.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e607.d.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.167.93",
          "type": "A"
        }
      ],
      "question": {
        "name": "cvision.media.net",
        "registered_domain": "media.net"
      },
      "resolved_ip": [
        "23.52.167.93"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 78,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.424Z",
    "dns": {
      "answers": [
        {
          "data": "g-bing-com.a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "dual-a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "204.79.197.200",
          "type": "A"
        },
        {
          "data": "13.107.21.200",
          "type": "A"
        }
      ],
      "question": {
        "name": "g.bing.com",
        "registered_domain": "bing.com"
      },
      "resolved_ip": [
        "204.79.197.200",
        "13.107.21.200"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 79,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.427Z",
    "dns": {
      "answers": [
        {
          "data": "23.52.167.93",
          "type": "A"
        }
      ],
      "question": {
        "name": "lg3.media.net",
        "registered_domain": "media.net"
      },
      "resolved_ip": [
        "23.52.167.93"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 80,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.469Z",
    "dns": {
      "answers": [
        {
          "data": "service.sp.aolp-ds-prd.aws.oath.cloud",
          "type": "CNAME"
        },
        {
          "data": "54.88.96.255",
          "type": "A"
        },
        {
          "data": "34.233.100.168",
          "type": "A"
        },
        {
          "data": "54.209.58.223",
          "type": "A"
        }
      ],
      "question": {
        "name": "service.sp.advertising.com",
        "registered_domain": "advertising.com"
      },
      "resolved_ip": [
        "54.88.96.255",
        "34.233.100.168",
        "54.209.58.223"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 81,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.485Z",
    "dns": {
      "answers": [
        {
          "data": "sb.scorecardresearch.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e1879.e7.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "184.25.176.117",
          "type": "A"
        }
      ],
      "question": {
        "name": "sb.scorecardresearch.com",
        "registered_domain": "scorecardresearch.com"
      },
      "resolved_ip": [
        "184.25.176.117"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 82,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.5Z",
    "dns": {
      "answers": [
        {
          "data": "iceotf-prod-fe-tm.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "iceotf-prod-fe-eastus.cloudapp.net",
          "type": "CNAME"
        },
        {
          "data": "40.114.54.223",
          "type": "A"
        }
      ],
      "question": {
        "name": "otf.msn.com",
        "registered_domain": "msn.com"
      },
      "resolved_ip": [
        "40.114.54.223"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 83,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.58Z",
    "dns": {
      "answers": [
        {
          "data": "35.171.101.225",
          "type": "A"
        },
        {
          "data": "34.196.57.87",
          "type": "A"
        },
        {
          "data": "34.194.164.46",
          "type": "A"
        },
        {
          "data": "34.233.181.142",
          "type": "A"
        },
        {
          "data": "34.194.167.169",
          "type": "A"
        },
        {
          "data": "34.193.242.172",
          "type": "A"
        },
        {
          "data": "34.234.152.11",
          "type": "A"
        },
        {
          "data": "34.206.12.124",
          "type": "A"
        }
      ],
      "question": {
        "name": "ping.chartbeat.net",
        "registered_domain": "chartbeat.net"
      },
      "resolved_ip": [
        "35.171.101.225",
        "34.196.57.87",
        "34.194.164.46",
        "34.233.181.142",
        "34.194.167.169",
        "34.193.242.172",
        "34.234.152.11",
        "34.206.12.124"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 84,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.628Z",
    "dns": {
      "answers": [
        {
          "data": "151.101.194.79",
          "type": "A"
        },
        {
          "data": "151.101.2.79",
          "type": "A"
        },
        {
          "data": "151.101.66.79",
          "type": "A"
        },
        {
          "data": "151.101.130.79",
          "type": "A"
        }
      ],
      "question": {
        "name": "clarium.freetls.fastly.net",
        "registered_domain": "clarium.freetls.fastly.net"
      },
      "resolved_ip": [
        "151.101.194.79",
        "151.101.2.79",
        "151.101.66.79",
        "151.101.130.79"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 85,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.633Z",
    "dns": {
      "answers": [
        {
          "data": "68.67.178.252",
          "type": "A"
        },
        {
          "data": "68.67.179.11",
          "type": "A"
        },
        {
          "data": "68.67.179.228",
          "type": "A"
        },
        {
          "data": "68.67.178.184",
          "type": "A"
        },
        {
          "data": "204.13.192.141",
          "type": "A"
        },
        {
          "data": "68.67.180.43",
          "type": "A"
        },
        {
          "data": "68.67.179.23",
          "type": "A"
        },
        {
          "data": "68.67.179.197",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "nym1-ib.adnxs.com",
        "registered_domain": "adnxs.com"
      },
      "resolved_ip": [
        "68.67.178.252",
        "68.67.179.11",
        "68.67.179.228",
        "68.67.178.184",
        "204.13.192.141",
        "68.67.180.43",
        "68.67.179.23",
        "68.67.179.197",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 86,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.716Z",
    "dns": {
      "answers": [
        {
          "data": "us-east-eb2.3lift.com",
          "type": "CNAME"
        },
        {
          "data": "dualstack.engagement-bus-prod-713264365.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "34.196.86.129",
          "type": "A"
        },
        {
          "data": "34.233.250.110",
          "type": "A"
        },
        {
          "data": "18.209.244.108",
          "type": "A"
        },
        {
          "data": "34.224.204.11",
          "type": "A"
        },
        {
          "data": "34.237.44.255",
          "type": "A"
        },
        {
          "data": "3.210.231.21",
          "type": "A"
        },
        {
          "data": "54.172.198.255",
          "type": "A"
        },
        {
          "data": "34.199.186.227",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "eb2.3lift.com",
        "registered_domain": "3lift.com"
      },
      "resolved_ip": [
        "34.196.86.129",
        "34.233.250.110",
        "18.209.244.108",
        "34.224.204.11",
        "34.237.44.255",
        "3.210.231.21",
        "54.172.198.255",
        "34.199.186.227",
        "192.5.6.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 87,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.727Z",
    "dns": {
      "answers": [
        {
          "data": "mix.linkedin.com",
          "type": "CNAME"
        },
        {
          "data": "any-na.mix.linkedin.com",
          "type": "CNAME"
        },
        {
          "data": "108.174.10.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "px.ads.linkedin.com",
        "registered_domain": "linkedin.com"
      },
      "resolved_ip": [
        "108.174.10.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 88,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.733Z",
    "dns": {
      "answers": [
        {
          "data": "login.msa.msidentity.com",
          "type": "CNAME"
        },
        {
          "data": "lgin.msa.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "40.90.23.239",
          "type": "A"
        },
        {
          "data": "40.90.23.213",
          "type": "A"
        },
        {
          "data": "40.90.23.154",
          "type": "A"
        }
      ],
      "question": {
        "name": "login.live.com",
        "registered_domain": "live.com"
      },
      "resolved_ip": [
        "40.90.23.239",
        "40.90.23.213",
        "40.90.23.154"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 89,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.792Z",
    "dns": {
      "answers": [
        {
          "data": "74.119.119.150",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "dis.criteo.com",
        "registered_domain": "criteo.com"
      },
      "resolved_ip": [
        "74.119.119.150",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 90,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.792Z",
    "dns": {
      "answers": [
        {
          "data": "g.geogslb.com",
          "type": "CNAME"
        },
        {
          "data": "ib.anycast.adnxs.com",
          "type": "CNAME"
        },
        {
          "data": "68.67.180.12",
          "type": "A"
        },
        {
          "data": "68.67.179.228",
          "type": "A"
        },
        {
          "data": "68.67.180.44",
          "type": "A"
        },
        {
          "data": "204.13.192.141",
          "type": "A"
        },
        {
          "data": "68.67.178.230",
          "type": "A"
        },
        {
          "data": "68.67.178.252",
          "type": "A"
        },
        {
          "data": "68.67.179.23",
          "type": "A"
        },
        {
          "data": "68.67.179.232",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ib.adnxs.com",
        "registered_domain": "adnxs.com"
      },
      "resolved_ip": [
        "68.67.180.12",
        "68.67.179.228",
        "68.67.180.44",
        "204.13.192.141",
        "68.67.178.230",
        "68.67.178.252",
        "68.67.179.23",
        "68.67.179.232",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 91,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.809Z",
    "dns": {
      "answers": [
        {
          "data": "pagead.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.34",
          "type": "A"
        }
      ],
      "question": {
        "name": "cm.g.doubleclick.net",
        "registered_domain": "doubleclick.net"
      },
      "resolved_ip": [
        "172.217.10.34"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 92,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.821Z",
    "dns": {
      "answers": [
        {
          "data": "match-975362022.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "54.208.129.24",
          "type": "A"
        },
        {
          "data": "54.175.5.93",
          "type": "A"
        },
        {
          "data": "52.86.210.96",
          "type": "A"
        },
        {
          "data": "3.93.252.59",
          "type": "A"
        },
        {
          "data": "54.86.97.130",
          "type": "A"
        },
        {
          "data": "34.194.239.194",
          "type": "A"
        },
        {
          "data": "3.94.67.102",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "match.adsrvr.org",
        "registered_domain": "adsrvr.org"
      },
      "resolved_ip": [
        "54.208.129.24",
        "54.175.5.93",
        "52.86.210.96",
        "3.93.252.59",
        "54.86.97.130",
        "34.194.239.194",
        "3.94.67.102",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 93,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.821Z",
    "dns": {
      "answers": [
        {
          "data": "ssum-sec.casalemedia.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e8037.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.162.21",
          "type": "A"
        }
      ],
      "question": {
        "name": "ssum-sec.casalemedia.com",
        "registered_domain": "casalemedia.com"
      },
      "resolved_ip": [
        "23.52.162.21"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 94,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.828Z",
    "dns": {
      "answers": [
        {
          "data": "adserver-clarium-446793891.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "18.204.130.216",
          "type": "A"
        },
        {
          "data": "18.209.246.43",
          "type": "A"
        },
        {
          "data": "107.23.153.61",
          "type": "A"
        },
        {
          "data": "18.235.141.27",
          "type": "A"
        },
        {
          "data": "3.210.79.248",
          "type": "A"
        },
        {
          "data": "18.209.146.43",
          "type": "A"
        },
        {
          "data": "18.210.64.206",
          "type": "A"
        },
        {
          "data": "18.214.161.226",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "protected-by.clarium.io",
        "registered_domain": "clarium.io"
      },
      "resolved_ip": [
        "18.204.130.216",
        "18.209.246.43",
        "107.23.153.61",
        "18.235.141.27",
        "3.210.79.248",
        "18.209.146.43",
        "18.210.64.206",
        "18.214.161.226",
        "192.5.6.30",
        "2001:503:a83e::2:30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 95,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.838Z",
    "dns": {
      "answers": [
        {
          "data": "pagead46.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.66",
          "type": "A"
        }
      ],
      "question": {
        "name": "pagead2.googlesyndication.com",
        "registered_domain": "googlesyndication.com"
      },
      "resolved_ip": [
        "172.217.10.66"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 96,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.839Z",
    "dns": {
      "answers": [
        {
          "data": "pagead46.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.66",
          "type": "A"
        }
      ],
      "question": {
        "name": "googleads.g.doubleclick.net",
        "registered_domain": "doubleclick.net"
      },
      "resolved_ip": [
        "172.217.10.66"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 97,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.841Z",
    "dns": {
      "answers": [
        {
          "data": "prod.ups-adcom.aolp-ds-prd.aws.oath.cloud",
          "type": "CNAME"
        },
        {
          "data": "prod.ups-us-east-1.aolp-ds-prd.aws.oath.cloud",
          "type": "CNAME"
        },
        {
          "data": "52.22.184.73",
          "type": "A"
        },
        {
          "data": "54.152.30.174",
          "type": "A"
        },
        {
          "data": "3.213.70.197",
          "type": "A"
        },
        {
          "data": "54.158.57.141",
          "type": "A"
        },
        {
          "data": "52.6.39.34",
          "type": "A"
        },
        {
          "data": "52.0.113.251",
          "type": "A"
        },
        {
          "data": "3.213.8.28",
          "type": "A"
        },
        {
          "data": "3.215.246.105",
          "type": "A"
        }
      ],
      "question": {
        "name": "pixel.advertising.com",
        "registered_domain": "advertising.com"
      },
      "resolved_ip": [
        "52.22.184.73",
        "54.152.30.174",
        "3.213.70.197",
        "54.158.57.141",
        "52.6.39.34",
        "52.0.113.251",
        "3.213.8.28",
        "3.215.246.105"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 98,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.844Z",
    "dns": {
      "answers": [
        {
          "data": "uplynk.adaptv.advertising.com",
          "type": "CNAME"
        },
        {
          "data": "uplynk-geo.adap.tv",
          "type": "CNAME"
        },
        {
          "data": "uplynk-beacon-newvpc-1603485991.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "54.210.214.197",
          "type": "A"
        },
        {
          "data": "52.202.202.147",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "onevideosync.uplynk.com",
        "registered_domain": "uplynk.com"
      },
      "resolved_ip": [
        "54.210.214.197",
        "52.202.202.147",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 99,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:02.956Z",
    "dns": {
      "answers": [
        {
          "data": "ad.turn.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "50.116.194.21",
          "type": "A"
        }
      ],
      "question": {
        "name": "ad.turn.com",
        "registered_domain": "turn.com"
      },
      "resolved_ip": [
        "50.116.194.21"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 100,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.005Z",
    "dns": {
      "answers": [
        {
          "data": "prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud",
          "type": "CNAME"
        },
        {
          "data": "34.225.20.218",
          "type": "A"
        },
        {
          "data": "3.216.14.125",
          "type": "A"
        },
        {
          "data": "52.200.28.150",
          "type": "A"
        },
        {
          "data": "3.216.103.132",
          "type": "A"
        },
        {
          "data": "52.4.86.222",
          "type": "A"
        },
        {
          "data": "52.21.200.160",
          "type": "A"
        },
        {
          "data": "3.216.249.238",
          "type": "A"
        },
        {
          "data": "3.94.175.146",
          "type": "A"
        }
      ],
      "question": {
        "name": "ups.analytics.yahoo.com",
        "registered_domain": "yahoo.com"
      },
      "resolved_ip": [
        "34.225.20.218",
        "3.216.14.125",
        "52.200.28.150",
        "3.216.103.132",
        "52.4.86.222",
        "52.21.200.160",
        "3.216.249.238",
        "3.94.175.146"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 101,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.07Z",
    "dns": {
      "answers": [
        {
          "data": "dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "34.237.248.89",
          "type": "A"
        },
        {
          "data": "35.153.21.25",
          "type": "A"
        },
        {
          "data": "52.200.238.112",
          "type": "A"
        },
        {
          "data": "52.206.93.38",
          "type": "A"
        },
        {
          "data": "34.227.35.137",
          "type": "A"
        },
        {
          "data": "35.169.96.208",
          "type": "A"
        },
        {
          "data": "52.22.206.42",
          "type": "A"
        },
        {
          "data": "52.201.81.61",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "pm.w55c.net",
        "registered_domain": "w55c.net"
      },
      "resolved_ip": [
        "34.237.248.89",
        "35.153.21.25",
        "52.200.238.112",
        "52.206.93.38",
        "34.227.35.137",
        "35.169.96.208",
        "52.22.206.42",
        "52.201.81.61",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 102,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.093Z",
    "dns": {
      "answers": [
        {
          "data": "35.186.239.238",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "cm.eyereturn.com",
        "registered_domain": "eyereturn.com"
      },
      "resolved_ip": [
        "35.186.239.238",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 103,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.099Z",
    "dns": {
      "answers": [
        {
          "data": "pagead46.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.66",
          "type": "A"
        }
      ],
      "question": {
        "name": "www.googletagservices.com",
        "registered_domain": "googletagservices.com"
      },
      "resolved_ip": [
        "172.217.10.66"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 104,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.107Z",
    "dns": {
      "answers": [
        {
          "data": "rtb.adgrx.com",
          "type": "CNAME"
        },
        {
          "data": "173.231.178.117",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "cm.adgrx.com",
        "registered_domain": "adgrx.com"
      },
      "resolved_ip": [
        "173.231.178.117",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 105,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.107Z",
    "dns": {
      "answers": [
        {
          "data": "j2waycm.netmng.com",
          "type": "CNAME"
        },
        {
          "data": "j2waycm-us-wdc.netmng.com",
          "type": "CNAME"
        },
        {
          "data": "104.193.83.156",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "csm2waycm-atl.netmng.com",
        "registered_domain": "netmng.com"
      },
      "resolved_ip": [
        "104.193.83.156",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 106,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.112Z",
    "dns": {
      "answers": [
        {
          "data": "ds-pr-bh.ybp.gysm.yahoodns.net",
          "type": "CNAME"
        },
        {
          "data": "72.30.2.182",
          "type": "A"
        }
      ],
      "question": {
        "name": "pr-bh.ybp.yahoo.com",
        "registered_domain": "yahoo.com"
      },
      "resolved_ip": [
        "72.30.2.182"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 107,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.113Z",
    "dns": {
      "answers": [
        {
          "data": "3.83.220.223",
          "type": "A"
        }
      ],
      "question": {
        "name": "ps.eyeota.net",
        "registered_domain": "eyeota.net"
      },
      "resolved_ip": [
        "3.83.220.223"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 108,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.146Z",
    "dns": {
      "answers": [
        {
          "data": "idpix.media6degrees.com.cdn.cloudflare.net",
          "type": "CNAME"
        },
        {
          "data": "map.media6degrees.com",
          "type": "CNAME"
        },
        {
          "data": "map.media6degrees.com.cdn.cloudflare.net",
          "type": "CNAME"
        },
        {
          "data": "204.2.197.201",
          "type": "A"
        },
        {
          "data": "204.2.197.211",
          "type": "A"
        }
      ],
      "question": {
        "name": "idpix.media6degrees.com",
        "registered_domain": "media6degrees.com"
      },
      "resolved_ip": [
        "204.2.197.201",
        "204.2.197.211"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 109,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.146Z",
    "dns": {
      "answers": [
        {
          "data": "pagead-googlehosted.l.google.com",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.1",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "tpc.googlesyndication.com",
        "registered_domain": "googlesyndication.com"
      },
      "resolved_ip": [
        "172.217.10.1",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 110,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.182Z",
    "dns": {
      "answers": [
        {
          "data": "pug44000nfc.pubmatic.com",
          "type": "CNAME"
        },
        {
          "data": "pug44000nf.pubmatic.com",
          "type": "CNAME"
        },
        {
          "data": "162.248.19.147",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "image2.pubmatic.com",
        "registered_domain": "pubmatic.com"
      },
      "resolved_ip": [
        "162.248.19.147",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 111,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.183Z",
    "dns": {
      "answers": [
        {
          "data": "www.msn.com",
          "type": "CNAME"
        },
        {
          "data": "www-msn-com.a-0003.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "a-0003.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "204.79.197.203",
          "type": "A"
        }
      ],
      "question": {
        "name": "sam.msn.com",
        "registered_domain": "msn.com"
      },
      "resolved_ip": [
        "204.79.197.203"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 112,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.222Z",
    "dns": {
      "answers": [
        {
          "data": "52.85.89.250",
          "type": "A"
        },
        {
          "data": "52.85.89.94",
          "type": "A"
        },
        {
          "data": "52.85.89.22",
          "type": "A"
        },
        {
          "data": "52.85.89.139",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "ocsp.sca1b.amazontrust.com",
        "registered_domain": "amazontrust.com"
      },
      "resolved_ip": [
        "52.85.89.250",
        "52.85.89.94",
        "52.85.89.22",
        "52.85.89.139",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 113,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.271Z",
    "dns": {
      "answers": [
        {
          "data": "track.adformnet.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "track-us.adformnet.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "185.167.164.43",
          "type": "A"
        },
        {
          "data": "185.167.164.42",
          "type": "A"
        }
      ],
      "question": {
        "name": "c1.adform.net",
        "registered_domain": "adform.net"
      },
      "resolved_ip": [
        "185.167.164.43",
        "185.167.164.42"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 114,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.271Z",
    "dns": {
      "answers": [
        {
          "data": "wd-prod-ss.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "wd-prod-ss-us-southcentral-2-fe.southcentralus.cloudapp.azure.com",
          "type": "CNAME"
        },
        {
          "data": "40.84.140.84",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "urs.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "40.84.140.84",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 115,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.29Z",
    "dns": {
      "answers": [
        {
          "data": "dsum-sec.casalemedia.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e8037.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.162.21",
          "type": "A"
        }
      ],
      "question": {
        "name": "dsum-sec.casalemedia.com",
        "registered_domain": "casalemedia.com"
      },
      "resolved_ip": [
        "23.52.162.21"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 116,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.292Z",
    "dns": {
      "answers": [
        {
          "data": "ocsp.godaddy.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "72.167.239.239",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.godaddy.com",
        "registered_domain": "godaddy.com"
      },
      "resolved_ip": [
        "72.167.239.239"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 117,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.315Z",
    "dns": {
      "question": {
        "name": "googleads.g.doubleclick.net",
        "registered_domain": "doubleclick.net"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RECORD_DOES_NOT_EXIST"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 118,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.315Z",
    "dns": {
      "question": {
        "name": "tpc.googlesyndication.com",
        "registered_domain": "googlesyndication.com"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RECORD_DOES_NOT_EXIST"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 119,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.333Z",
    "dns": {
      "answers": [
        {
          "data": "t3j2g9x7.stackpathcdn.com",
          "type": "CNAME"
        },
        {
          "data": "151.139.128.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.usertrust.com",
        "registered_domain": "usertrust.com"
      },
      "resolved_ip": [
        "151.139.128.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 120,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.343Z",
    "dns": {
      "answers": [
        {
          "data": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
          "type": "CNAME"
        },
        {
          "data": "a279.dscq.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.179",
          "type": "A"
        },
        {
          "data": "23.50.53.176",
          "type": "A"
        }
      ],
      "question": {
        "name": "isrg.trustid.ocsp.identrust.com",
        "registered_domain": "identrust.com"
      },
      "resolved_ip": [
        "23.50.53.179",
        "23.50.53.176"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 121,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.391Z",
    "dns": {
      "answers": [
        {
          "data": "dart.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.6.198",
          "type": "A"
        }
      ],
      "question": {
        "name": "ad.doubleclick.net",
        "registered_domain": "doubleclick.net"
      },
      "resolved_ip": [
        "172.217.6.198"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 122,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.393Z",
    "dns": {
      "answers": [
        {
          "data": "t3j2g9x7.stackpathcdn.com",
          "type": "CNAME"
        },
        {
          "data": "151.139.128.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.sectigo.com",
        "registered_domain": "sectigo.com"
      },
      "resolved_ip": [
        "151.139.128.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 123,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.468Z",
    "dns": {
      "answers": [
        {
          "data": "ocsp.int-x3.letsencrypt.org.edgesuite.net",
          "type": "CNAME"
        },
        {
          "data": "a771.dscq.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.179",
          "type": "A"
        },
        {
          "data": "23.50.53.177",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.int-x3.letsencrypt.org",
        "registered_domain": "letsencrypt.org"
      },
      "resolved_ip": [
        "23.50.53.179",
        "23.50.53.177"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 124,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.581Z",
    "dns": {
      "answers": [
        {
          "data": "pki-goog.l.google.com",
          "type": "CNAME"
        },
        {
          "data": "172.217.12.195",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.pki.goog",
        "registered_domain": "pki.goog"
      },
      "resolved_ip": [
        "172.217.12.195",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 125,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.872Z",
    "dns": {
      "answers": [
        {
          "data": "pagead.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.34",
          "type": "A"
        }
      ],
      "question": {
        "name": "googleads4.g.doubleclick.net",
        "registered_domain": "doubleclick.net"
      },
      "resolved_ip": [
        "172.217.10.34"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 126,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.889Z",
    "dns": {
      "answers": [
        {
          "data": "f2.taboola.map.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.2.2",
          "type": "A"
        },
        {
          "data": "151.101.66.2",
          "type": "A"
        },
        {
          "data": "151.101.130.2",
          "type": "A"
        },
        {
          "data": "151.101.194.2",
          "type": "A"
        }
      ],
      "question": {
        "name": "images.taboola.com",
        "registered_domain": "taboola.com"
      },
      "resolved_ip": [
        "151.101.2.2",
        "151.101.66.2",
        "151.101.130.2",
        "151.101.194.2"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 127,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.89Z",
    "dns": {
      "answers": [
        {
          "data": "f2.taboola.map.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.66.2",
          "type": "A"
        },
        {
          "data": "151.101.130.2",
          "type": "A"
        },
        {
          "data": "151.101.194.2",
          "type": "A"
        },
        {
          "data": "151.101.2.2",
          "type": "A"
        }
      ],
      "question": {
        "name": "api-s2s.taboola.com",
        "registered_domain": "taboola.com"
      },
      "resolved_ip": [
        "151.101.66.2",
        "151.101.130.2",
        "151.101.194.2",
        "151.101.2.2"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 128,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.892Z",
    "dns": {
      "answers": [
        {
          "data": "35.231.30.22",
          "type": "A"
        },
        {
          "data": "35.196.212.198",
          "type": "A"
        }
      ],
      "question": {
        "name": "x.bidswitch.net",
        "registered_domain": "bidswitch.net"
      },
      "resolved_ip": [
        "35.231.30.22",
        "35.196.212.198"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 129,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.894Z",
    "dns": {
      "answers": [
        {
          "data": "anycast.pixel.adsafeprotected.com",
          "type": "CNAME"
        },
        {
          "data": "199.166.0.26",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "pixel.adsafeprotected.com",
        "registered_domain": "adsafeprotected.com"
      },
      "resolved_ip": [
        "199.166.0.26",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 130,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.894Z",
    "dns": {
      "answers": [
        {
          "data": "35.171.48.231",
          "type": "A"
        },
        {
          "data": "52.206.107.32",
          "type": "A"
        },
        {
          "data": "35.175.80.59",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ml314.com",
        "registered_domain": "ml314.com"
      },
      "resolved_ip": [
        "35.171.48.231",
        "52.206.107.32",
        "35.175.80.59",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 131,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.902Z",
    "dns": {
      "answers": [
        {
          "data": "156.154.200.36",
          "type": "A"
        },
        {
          "data": "63.251.88.56",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "aa.agkn.com",
        "registered_domain": "agkn.com"
      },
      "resolved_ip": [
        "156.154.200.36",
        "63.251.88.56",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 132,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.911Z",
    "dns": {
      "answers": [
        {
          "data": "s0-2mdn-net.l.google.com",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.134",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "s0.2mdn.net",
        "registered_domain": "2mdn.net"
      },
      "resolved_ip": [
        "172.217.10.134",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 133,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.911Z",
    "dns": {
      "answers": [
        {
          "data": "b.scorecardresearch.com.edgesuite.net",
          "type": "CNAME"
        },
        {
          "data": "a1294.w20.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.195",
          "type": "A"
        },
        {
          "data": "23.50.53.185",
          "type": "A"
        }
      ],
      "question": {
        "name": "b.scorecardresearch.com",
        "registered_domain": "scorecardresearch.com"
      },
      "resolved_ip": [
        "23.50.53.195",
        "23.50.53.185"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 134,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:03.921Z",
    "dns": {
      "answers": [
        {
          "data": "f2.shared.global.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.130.2",
          "type": "A"
        },
        {
          "data": "151.101.194.2",
          "type": "A"
        },
        {
          "data": "151.101.2.2",
          "type": "A"
        },
        {
          "data": "151.101.66.2",
          "type": "A"
        }
      ],
      "question": {
        "name": "edw.edmunds.com",
        "registered_domain": "edmunds.com"
      },
      "resolved_ip": [
        "151.101.130.2",
        "151.101.194.2",
        "151.101.2.2",
        "151.101.66.2"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 135,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.101Z",
    "dns": {
      "answers": [
        {
          "data": "cs9.wac.phicdn.net",
          "type": "CNAME"
        },
        {
          "data": "72.21.91.29",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.digicert.com",
        "registered_domain": "digicert.com"
      },
      "resolved_ip": [
        "72.21.91.29"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 136,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.137Z",
    "dns": {
      "answers": [
        {
          "data": "usermatch.targeting.unrulymedia.com",
          "type": "CNAME"
        },
        {
          "data": "35.167.55.0",
          "type": "A"
        },
        {
          "data": "52.24.219.168",
          "type": "A"
        },
        {
          "data": "52.43.21.209",
          "type": "A"
        },
        {
          "data": "54.200.225.167",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "pre-usermatch.targeting.unrulymedia.com",
        "registered_domain": "unrulymedia.com"
      },
      "resolved_ip": [
        "35.167.55.0",
        "52.24.219.168",
        "52.43.21.209",
        "54.200.225.167",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 137,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.141Z",
    "dns": {
      "answers": [
        {
          "data": "farm-hetzner.plista.com",
          "type": "CNAME"
        },
        {
          "data": "144.76.67.119",
          "type": "A"
        },
        {
          "data": "148.251.77.207",
          "type": "A"
        },
        {
          "data": "148.251.15.115",
          "type": "A"
        },
        {
          "data": "176.9.103.51",
          "type": "A"
        },
        {
          "data": "88.198.208.110",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "farm.plista.com",
        "registered_domain": "plista.com"
      },
      "resolved_ip": [
        "144.76.67.119",
        "148.251.77.207",
        "148.251.15.115",
        "176.9.103.51",
        "88.198.208.110",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 138,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.168Z",
    "dns": {
      "answers": [
        {
          "data": "beacon-n-ash.lb.krxd.net",
          "type": "CNAME"
        },
        {
          "data": "beacon-17-537698933.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "50.17.180.35",
          "type": "A"
        },
        {
          "data": "50.19.103.40",
          "type": "A"
        },
        {
          "data": "50.19.210.19",
          "type": "A"
        },
        {
          "data": "50.19.117.149",
          "type": "A"
        },
        {
          "data": "50.19.222.244",
          "type": "A"
        },
        {
          "data": "50.19.222.88",
          "type": "A"
        },
        {
          "data": "50.19.81.100",
          "type": "A"
        },
        {
          "data": "54.204.10.30",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "beacon.krxd.net",
        "registered_domain": "krxd.net"
      },
      "resolved_ip": [
        "50.17.180.35",
        "50.19.103.40",
        "50.19.210.19",
        "50.19.117.149",
        "50.19.222.244",
        "50.19.222.88",
        "50.19.81.100",
        "54.204.10.30",
        "192.5.6.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 139,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.169Z",
    "dns": {
      "answers": [
        {
          "data": "dsum.casalemedia.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e8037.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.162.21",
          "type": "A"
        }
      ],
      "question": {
        "name": "dsum.casalemedia.com",
        "registered_domain": "casalemedia.com"
      },
      "resolved_ip": [
        "23.52.162.21"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 140,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.169Z",
    "dns": {
      "answers": [
        {
          "data": "pixel-origin.mathtag.com",
          "type": "CNAME"
        },
        {
          "data": "216.200.232.235",
          "type": "A"
        },
        {
          "data": "216.200.232.201",
          "type": "A"
        },
        {
          "data": "74.121.138.26",
          "type": "A"
        },
        {
          "data": "216.200.232.185",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync.mathtag.com",
        "registered_domain": "mathtag.com"
      },
      "resolved_ip": [
        "216.200.232.235",
        "216.200.232.201",
        "74.121.138.26",
        "216.200.232.185",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 141,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.184Z",
    "dns": {
      "answers": [
        {
          "data": "ocsp.digicert.com",
          "type": "CNAME"
        },
        {
          "data": "cs9.wac.phicdn.net",
          "type": "CNAME"
        },
        {
          "data": "72.21.91.29",
          "type": "A"
        }
      ],
      "question": {
        "name": "status.rapidssl.com",
        "registered_domain": "rapidssl.com"
      },
      "resolved_ip": [
        "72.21.91.29"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 142,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.184Z",
    "dns": {
      "answers": [
        {
          "data": "cookiesyncing-1395500543.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "34.197.195.131",
          "type": "A"
        },
        {
          "data": "34.192.39.82",
          "type": "A"
        },
        {
          "data": "34.199.231.204",
          "type": "A"
        },
        {
          "data": "34.199.113.81",
          "type": "A"
        },
        {
          "data": "34.197.3.157",
          "type": "A"
        },
        {
          "data": "34.205.112.156",
          "type": "A"
        },
        {
          "data": "34.195.29.8",
          "type": "A"
        },
        {
          "data": "34.201.247.123",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync.extend.tv",
        "registered_domain": "extend.tv"
      },
      "resolved_ip": [
        "34.197.195.131",
        "34.192.39.82",
        "34.199.231.204",
        "34.199.113.81",
        "34.197.3.157",
        "34.205.112.156",
        "34.195.29.8",
        "34.201.247.123",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 143,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.185Z",
    "dns": {
      "answers": [
        {
          "data": "t3j2g9x7.stackpathcdn.com",
          "type": "CNAME"
        },
        {
          "data": "151.139.128.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.comodoca.com",
        "registered_domain": "comodoca.com"
      },
      "resolved_ip": [
        "151.139.128.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 144,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.189Z",
    "dns": {
      "answers": [
        {
          "data": "sync.tubemogul.com",
          "type": "CNAME"
        },
        {
          "data": "syncf.tubemogul.com",
          "type": "CNAME"
        },
        {
          "data": "h2.shared.global.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.2.49",
          "type": "A"
        },
        {
          "data": "151.101.66.49",
          "type": "A"
        },
        {
          "data": "151.101.130.49",
          "type": "A"
        },
        {
          "data": "151.101.194.49",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync-tm.everesttech.net",
        "registered_domain": "everesttech.net"
      },
      "resolved_ip": [
        "151.101.2.49",
        "151.101.66.49",
        "151.101.130.49",
        "151.101.194.49"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 145,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.237Z",
    "dns": {
      "answers": [
        {
          "data": "34.95.92.78",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "idsync.rlcdn.com",
        "registered_domain": "rlcdn.com"
      },
      "resolved_ip": [
        "34.95.92.78",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 146,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.274Z",
    "dns": {
      "answers": [
        {
          "data": "track-eu.adformnet.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "37.157.2.239",
          "type": "A"
        },
        {
          "data": "37.157.6.253",
          "type": "A"
        },
        {
          "data": "37.157.2.238",
          "type": "A"
        },
        {
          "data": "37.157.4.25",
          "type": "A"
        },
        {
          "data": "37.157.4.24",
          "type": "A"
        },
        {
          "data": "37.157.6.247",
          "type": "A"
        }
      ],
      "question": {
        "name": "cm.adform.net",
        "registered_domain": "adform.net"
      },
      "resolved_ip": [
        "37.157.2.239",
        "37.157.6.253",
        "37.157.2.238",
        "37.157.4.25",
        "37.157.4.24",
        "37.157.6.247"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 147,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.302Z",
    "dns": {
      "answers": [
        {
          "data": "37.18.16.16",
          "type": "A"
        }
      ],
      "question": {
        "name": "dm.hybrid.ai",
        "registered_domain": "hybrid.ai"
      },
      "resolved_ip": [
        "37.18.16.16"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 148,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.304Z",
    "dns": {
      "answers": [
        {
          "data": "anycast.static.adsafeprotected.com",
          "type": "CNAME"
        },
        {
          "data": "199.166.0.32",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "static.adsafeprotected.com",
        "registered_domain": "adsafeprotected.com"
      },
      "resolved_ip": [
        "199.166.0.32",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 149,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.322Z",
    "dns": {
      "answers": [
        {
          "data": "f2.taboola.map.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.130.2",
          "type": "A"
        },
        {
          "data": "151.101.194.2",
          "type": "A"
        },
        {
          "data": "151.101.2.2",
          "type": "A"
        },
        {
          "data": "151.101.66.2",
          "type": "A"
        }
      ],
      "question": {
        "name": "trc.taboola.com",
        "registered_domain": "taboola.com"
      },
      "resolved_ip": [
        "151.101.130.2",
        "151.101.194.2",
        "151.101.2.2",
        "151.101.66.2"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 150,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.379Z",
    "dns": {
      "answers": [
        {
          "data": "107.178.254.65",
          "type": "A"
        }
      ],
      "question": {
        "name": "pippio.com",
        "registered_domain": "pippio.com"
      },
      "resolved_ip": [
        "107.178.254.65"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 151,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.482Z",
    "dns": {
      "answers": [
        {
          "data": "pixel-a.sitescout.com",
          "type": "CNAME"
        },
        {
          "data": "209.15.36.34",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "pixel-sync.sitescout.com",
        "registered_domain": "sitescout.com"
      },
      "resolved_ip": [
        "209.15.36.34",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 152,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.502Z",
    "dns": {
      "answers": [
        {
          "data": "35.186.202.217",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "prod.y-medialink.com",
        "registered_domain": "y-medialink.com"
      },
      "resolved_ip": [
        "35.186.202.217",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 153,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.507Z",
    "dns": {
      "answers": [
        {
          "data": "jadserve.postrelease.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "54.80.117.178",
          "type": "A"
        },
        {
          "data": "3.217.22.176",
          "type": "A"
        },
        {
          "data": "35.153.215.15",
          "type": "A"
        },
        {
          "data": "52.207.54.164",
          "type": "A"
        },
        {
          "data": "52.204.186.237",
          "type": "A"
        },
        {
          "data": "52.86.46.105",
          "type": "A"
        }
      ],
      "question": {
        "name": "jadserve.postrelease.com",
        "registered_domain": "postrelease.com"
      },
      "resolved_ip": [
        "54.80.117.178",
        "3.217.22.176",
        "35.153.215.15",
        "52.207.54.164",
        "52.204.186.237",
        "52.86.46.105"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 154,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.508Z",
    "dns": {
      "answers": [
        {
          "data": "partners-1732315393.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "107.21.43.184",
          "type": "A"
        },
        {
          "data": "54.164.220.86",
          "type": "A"
        },
        {
          "data": "52.72.172.174",
          "type": "A"
        },
        {
          "data": "3.209.65.250",
          "type": "A"
        },
        {
          "data": "3.94.51.187",
          "type": "A"
        },
        {
          "data": "34.193.211.130",
          "type": "A"
        },
        {
          "data": "18.214.47.10",
          "type": "A"
        },
        {
          "data": "18.214.151.246",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "appnexus-partners.tremorhub.com",
        "registered_domain": "tremorhub.com"
      },
      "resolved_ip": [
        "107.21.43.184",
        "54.164.220.86",
        "52.72.172.174",
        "3.209.65.250",
        "3.94.51.187",
        "34.193.211.130",
        "18.214.47.10",
        "18.214.151.246",
        "192.5.6.30",
        "2001:503:a83e::2:30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 155,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.531Z",
    "dns": {
      "answers": [
        {
          "data": "gtm13.nexac.com",
          "type": "CNAME"
        },
        {
          "data": "ad2deadfb5fbf11e9872302ad9419486-194325762.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "107.21.14.70",
          "type": "A"
        },
        {
          "data": "107.23.33.163",
          "type": "A"
        },
        {
          "data": "23.22.192.59",
          "type": "A"
        },
        {
          "data": "100.24.96.238",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "x.dlx.addthis.com",
        "registered_domain": "addthis.com"
      },
      "resolved_ip": [
        "107.21.14.70",
        "107.23.33.163",
        "23.22.192.59",
        "100.24.96.238",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 156,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.532Z",
    "dns": {
      "answers": [
        {
          "data": "haproxy-dmp.sizmdx.com",
          "type": "CNAME"
        },
        {
          "data": "dmp-prod-haproxyd-14y2amas34vrd-330219680.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "18.205.112.71",
          "type": "A"
        },
        {
          "data": "50.19.40.146",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "dh.serving-sys.com",
        "registered_domain": "serving-sys.com"
      },
      "resolved_ip": [
        "18.205.112.71",
        "50.19.40.146",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 157,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.534Z",
    "dns": {
      "answers": [
        {
          "data": "match-us-east-1.sharethrough.com",
          "type": "CNAME"
        },
        {
          "data": "52.55.160.246",
          "type": "A"
        },
        {
          "data": "3.211.67.240",
          "type": "A"
        },
        {
          "data": "35.173.61.59",
          "type": "A"
        },
        {
          "data": "34.233.179.235",
          "type": "A"
        },
        {
          "data": "34.228.105.237",
          "type": "A"
        },
        {
          "data": "52.7.23.213",
          "type": "A"
        },
        {
          "data": "52.201.177.113",
          "type": "A"
        },
        {
          "data": "34.235.70.251",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "match.sharethrough.com",
        "registered_domain": "sharethrough.com"
      },
      "resolved_ip": [
        "52.55.160.246",
        "3.211.67.240",
        "35.173.61.59",
        "34.233.179.235",
        "34.228.105.237",
        "52.7.23.213",
        "52.201.177.113",
        "34.235.70.251",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 158,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.601Z",
    "dns": {
      "answers": [
        {
          "data": "35.241.16.233",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "tags.rd.linksynergy.com",
        "registered_domain": "linksynergy.com"
      },
      "resolved_ip": [
        "35.241.16.233",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 159,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.604Z",
    "dns": {
      "answers": [
        {
          "data": "2-01-275d-002d.cdx.cedexis.net",
          "type": "CNAME"
        },
        {
          "data": "rtb-csync-tmk.smartadserver.com",
          "type": "CNAME"
        },
        {
          "data": "199.187.193.166",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "rtb-csync.smartadserver.com",
        "registered_domain": "smartadserver.com"
      },
      "resolved_ip": [
        "199.187.193.166",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 160,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.621Z",
    "dns": {
      "answers": [
        {
          "data": "anycast.sc.iasds01.com",
          "type": "CNAME"
        },
        {
          "data": "199.166.0.200",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "sc.iasds01.com",
        "registered_domain": "iasds01.com"
      },
      "resolved_ip": [
        "199.166.0.200",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 161,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.822Z",
    "dns": {
      "answers": [
        {
          "data": "sjedt.adsafeprotected.com",
          "type": "CNAME"
        },
        {
          "data": "104.244.38.20",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "dt.adsafeprotected.com",
        "registered_domain": "adsafeprotected.com"
      },
      "resolved_ip": [
        "104.244.38.20",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 162,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.822Z",
    "dns": {
      "answers": [
        {
          "data": "ocsp.digicert.com",
          "type": "CNAME"
        },
        {
          "data": "cs9.wac.phicdn.net",
          "type": "CNAME"
        },
        {
          "data": "72.21.91.29",
          "type": "A"
        }
      ],
      "question": {
        "name": "status.thawte.com",
        "registered_domain": "thawte.com"
      },
      "resolved_ip": [
        "72.21.91.29"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 163,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.86Z",
    "dns": {
      "answers": [
        {
          "data": "ip1.ads.stickyadstv.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "wlb1.ads.stickyadstv.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "fp4.ads.stickyadstv.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "38.134.110.101",
          "type": "A"
        },
        {
          "data": "38.134.110.143",
          "type": "A"
        },
        {
          "data": "38.134.110.141",
          "type": "A"
        },
        {
          "data": "38.134.110.171",
          "type": "A"
        },
        {
          "data": "38.134.110.177",
          "type": "A"
        },
        {
          "data": "38.134.110.115",
          "type": "A"
        },
        {
          "data": "38.134.110.104",
          "type": "A"
        },
        {
          "data": "38.134.110.114",
          "type": "A"
        }
      ],
      "question": {
        "name": "ads.stickyadstv.com",
        "registered_domain": "stickyadstv.com"
      },
      "resolved_ip": [
        "38.134.110.101",
        "38.134.110.143",
        "38.134.110.141",
        "38.134.110.171",
        "38.134.110.177",
        "38.134.110.115",
        "38.134.110.104",
        "38.134.110.114"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 164,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.904Z",
    "dns": {
      "answers": [
        {
          "data": "hbx.media.net.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e607.d.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.167.93",
          "type": "A"
        }
      ],
      "question": {
        "name": "hbx.media.net",
        "registered_domain": "media.net"
      },
      "resolved_ip": [
        "23.52.167.93"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 165,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:04.911Z",
    "dns": {
      "answers": [
        {
          "data": "trc.taboola.map.fastly.net",
          "type": "CNAME"
        },
        {
          "data": "151.101.194.49",
          "type": "A"
        },
        {
          "data": "151.101.2.49",
          "type": "A"
        },
        {
          "data": "151.101.66.49",
          "type": "A"
        },
        {
          "data": "151.101.130.49",
          "type": "A"
        }
      ],
      "question": {
        "name": "match.taboola.com",
        "registered_domain": "taboola.com"
      },
      "resolved_ip": [
        "151.101.194.49",
        "151.101.2.49",
        "151.101.66.49",
        "151.101.130.49"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 166,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.056Z",
    "dns": {
      "answers": [
        {
          "data": "a1834.dspg2.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.185",
          "type": "A"
        },
        {
          "data": "23.50.53.194",
          "type": "A"
        }
      ],
      "question": {
        "name": "img-s-msn-com.akamaized.net",
        "registered_domain": "akamaized.net"
      },
      "resolved_ip": [
        "23.50.53.185",
        "23.50.53.194"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 167,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.064Z",
    "dns": {
      "answers": [
        {
          "data": "a1505.g2.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.194",
          "type": "A"
        },
        {
          "data": "23.50.53.186",
          "type": "A"
        }
      ],
      "question": {
        "name": "static-entertainment-eus-s-msn-com.akamaized.net",
        "registered_domain": "akamaized.net"
      },
      "resolved_ip": [
        "23.50.53.194",
        "23.50.53.186"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 168,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.178Z",
    "dns": {
      "answers": [
        {
          "data": "radarmaps.weather.microsoft.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e15275.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.217.149.91",
          "type": "A"
        }
      ],
      "question": {
        "name": "radarmaps.weather.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "23.217.149.91"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 169,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.455Z",
    "dns": {
      "answers": [
        {
          "data": "a1505.g2.akamai.net",
          "type": "CNAME"
        },
        {
          "data": "23.50.53.194",
          "type": "A"
        },
        {
          "data": "23.50.53.186",
          "type": "A"
        }
      ],
      "question": {
        "name": "static-entertainment-eus-s-msn-com.akamaized.net",
        "registered_domain": "akamaized.net"
      },
      "resolved_ip": [
        "23.50.53.194",
        "23.50.53.186"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a8-5d2f-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 170,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.494Z",
    "dns": {
      "answers": [
        {
          "data": "cs747173190.wac.omegacdn.net",
          "type": "CNAME"
        },
        {
          "data": "152.195.32.163",
          "type": "A"
        }
      ],
      "question": {
        "name": "tag.sp.advertising.com",
        "registered_domain": "advertising.com"
      },
      "resolved_ip": [
        "152.195.32.163"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 171,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:06.567Z",
    "dns": {
      "answers": [
        {
          "data": "a-0001.a-afdentry.net.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "dual-a-0001.a-msedge.net",
          "type": "CNAME"
        },
        {
          "data": "204.79.197.200",
          "type": "A"
        },
        {
          "data": "13.107.21.200",
          "type": "A"
        }
      ],
      "question": {
        "name": "www.bing.com",
        "registered_domain": "bing.com"
      },
      "resolved_ip": [
        "204.79.197.200",
        "13.107.21.200"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 172,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.228Z",
    "dns": {
      "answers": [
        {
          "data": "akacdn.doubleverify.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e17513.d.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.164.109",
          "type": "A"
        }
      ],
      "question": {
        "name": "cdn.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "23.52.164.109"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 173,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.357Z",
    "dns": {
      "answers": [
        {
          "data": "cdn.doubleverify.com",
          "type": "CNAME"
        },
        {
          "data": "akacdn.doubleverify.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e17513.d.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.164.109",
          "type": "A"
        }
      ],
      "question": {
        "name": "cdn3.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "23.52.164.109"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 174,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.721Z",
    "dns": {
      "answers": [
        {
          "data": "bs-geo.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "rtb0.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 175,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.774Z",
    "dns": {
      "answers": [
        {
          "data": "platform.maps.glbdns2.microsoft.com",
          "type": "CNAME"
        },
        {
          "data": "fe-bmplatform-prod-atm.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "20.36.236.157",
          "type": "A"
        }
      ],
      "question": {
        "name": "dev.virtualearth.net",
        "registered_domain": "virtualearth.net"
      },
      "resolved_ip": [
        "20.36.236.157"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 176,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.847Z",
    "dns": {
      "answers": [
        {
          "data": "t.ssl.ak.dynamic.tiles.virtualearth.net.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e7622.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.161.238",
          "type": "A"
        }
      ],
      "question": {
        "name": "t.ssl.ak.dynamic.tiles.virtualearth.net",
        "registered_domain": "virtualearth.net"
      },
      "resolved_ip": [
        "23.52.161.238"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 177,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.943Z",
    "dns": {
      "answers": [
        {
          "data": "74.217.253.61",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "rp.gwallet.com",
        "registered_domain": "gwallet.com"
      },
      "resolved_ip": [
        "74.217.253.61",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 178,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.945Z",
    "dns": {
      "answers": [
        {
          "data": "fo-fd-world-new.yax.gysm.yahoodns.net",
          "type": "CNAME"
        },
        {
          "data": "98.139.225.43",
          "type": "A"
        },
        {
          "data": "98.138.49.44",
          "type": "A"
        },
        {
          "data": "72.30.3.43",
          "type": "A"
        },
        {
          "data": "216.155.194.56",
          "type": "A"
        }
      ],
      "question": {
        "name": "ads.yahoo.com",
        "registered_domain": "yahoo.com"
      },
      "resolved_ip": [
        "98.139.225.43",
        "98.138.49.44",
        "72.30.3.43",
        "216.155.194.56"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 179,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.954Z",
    "dns": {
      "answers": [
        {
          "data": "169.55.104.49",
          "type": "A"
        },
        {
          "data": "169.60.66.35",
          "type": "A"
        },
        {
          "data": "169.61.103.241",
          "type": "A"
        }
      ],
      "question": {
        "name": "um.simpli.fi",
        "registered_domain": "simpli.fi"
      },
      "resolved_ip": [
        "169.55.104.49",
        "169.60.66.35",
        "169.61.103.241"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 180,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.955Z",
    "dns": {
      "answers": [
        {
          "data": "35.186.236.204",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "mpp.vindicosuite.com",
        "registered_domain": "vindicosuite.com"
      },
      "resolved_ip": [
        "35.186.236.204",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 181,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.955Z",
    "dns": {
      "answers": [
        {
          "data": "8.41.222.152",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync.1rx.io",
        "registered_domain": "1rx.io"
      },
      "resolved_ip": [
        "8.41.222.152"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 182,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:07.956Z",
    "dns": {
      "answers": [
        {
          "data": "sync.teads.tv.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e9957.g.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.52.160.7",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync.teads.tv",
        "registered_domain": "teads.tv"
      },
      "resolved_ip": [
        "23.52.160.7"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 183,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.019Z",
    "dns": {
      "answers": [
        {
          "data": "td.thebrighttag.com",
          "type": "CNAME"
        },
        {
          "data": "3.15.109.176",
          "type": "A"
        },
        {
          "data": "52.15.225.252",
          "type": "A"
        },
        {
          "data": "3.18.121.79",
          "type": "A"
        },
        {
          "data": "3.15.101.187",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "s.thebrighttag.com",
        "registered_domain": "thebrighttag.com"
      },
      "resolved_ip": [
        "3.15.109.176",
        "52.15.225.252",
        "3.18.121.79",
        "3.15.101.187",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 184,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.05Z",
    "dns": {
      "answers": [
        {
          "data": "d386jaag4hn9zl.cloudfront.net",
          "type": "CNAME"
        },
        {
          "data": "54.192.55.189",
          "type": "A"
        }
      ],
      "question": {
        "name": "t.a3cloud.net",
        "registered_domain": "a3cloud.net"
      },
      "resolved_ip": [
        "54.192.55.189"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 186,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.07Z",
    "dns": {
      "answers": [
        {
          "data": "nycp-hlb.doubleverify.com",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "tps618.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 187,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.09Z",
    "dns": {
      "answers": [
        {
          "data": "gslb-2.demdex.net",
          "type": "CNAME"
        },
        {
          "data": "edge-va6.demdex.net",
          "type": "CNAME"
        },
        {
          "data": "dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "54.157.69.185",
          "type": "A"
        },
        {
          "data": "18.209.139.81",
          "type": "A"
        },
        {
          "data": "18.233.36.36",
          "type": "A"
        },
        {
          "data": "52.54.198.81",
          "type": "A"
        },
        {
          "data": "52.55.201.28",
          "type": "A"
        },
        {
          "data": "18.210.34.44",
          "type": "A"
        },
        {
          "data": "52.72.163.149",
          "type": "A"
        },
        {
          "data": "18.232.198.130",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "dpm.demdex.net",
        "registered_domain": "demdex.net"
      },
      "resolved_ip": [
        "54.157.69.185",
        "18.209.139.81",
        "18.233.36.36",
        "52.54.198.81",
        "52.55.201.28",
        "18.210.34.44",
        "52.72.163.149",
        "18.232.198.130",
        "192.5.6.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 188,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.308Z",
    "dns": {
      "answers": [
        {
          "data": "g.geogslb.com",
          "type": "CNAME"
        },
        {
          "data": "ib.anycast.adnxs.com",
          "type": "CNAME"
        },
        {
          "data": "68.67.179.228",
          "type": "A"
        },
        {
          "data": "68.67.180.44",
          "type": "A"
        },
        {
          "data": "204.13.192.141",
          "type": "A"
        },
        {
          "data": "68.67.178.230",
          "type": "A"
        },
        {
          "data": "68.67.178.252",
          "type": "A"
        },
        {
          "data": "68.67.179.23",
          "type": "A"
        },
        {
          "data": "68.67.179.232",
          "type": "A"
        },
        {
          "data": "68.67.180.12",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "secure.adnxs.com",
        "registered_domain": "adnxs.com"
      },
      "resolved_ip": [
        "68.67.179.228",
        "68.67.180.44",
        "204.13.192.141",
        "68.67.178.230",
        "68.67.178.252",
        "68.67.179.23",
        "68.67.179.232",
        "68.67.180.12",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 189,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.478Z",
    "dns": {
      "answers": [
        {
          "data": "tps-geo.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "tps.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 190,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.536Z",
    "dns": {
      "answers": [
        {
          "data": "idaas-production.us-east-1.elasticbeanstalk.com",
          "type": "CNAME"
        },
        {
          "data": "52.71.175.22",
          "type": "A"
        },
        {
          "data": "52.71.208.229",
          "type": "A"
        },
        {
          "data": "52.86.201.172",
          "type": "A"
        },
        {
          "data": "52.7.6.198",
          "type": "A"
        },
        {
          "data": "54.152.156.164",
          "type": "A"
        },
        {
          "data": "54.152.56.202",
          "type": "A"
        },
        {
          "data": "54.164.15.83",
          "type": "A"
        },
        {
          "data": "52.86.191.75",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "i.liadm.com",
        "registered_domain": "liadm.com"
      },
      "resolved_ip": [
        "52.71.175.22",
        "52.71.208.229",
        "52.86.201.172",
        "52.7.6.198",
        "54.152.156.164",
        "54.152.56.202",
        "54.164.15.83",
        "52.86.191.75",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 191,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.544Z",
    "dns": {
      "answers": [
        {
          "data": "67.231.251.189",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "pixel.s3xified.com",
        "registered_domain": "s3xified.com"
      },
      "resolved_ip": [
        "67.231.251.189",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 192,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.55Z",
    "dns": {
      "answers": [
        {
          "data": "104.20.252.85",
          "type": "A"
        },
        {
          "data": "104.20.253.85",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "router.infolinks.com",
        "registered_domain": "infolinks.com"
      },
      "resolved_ip": [
        "104.20.252.85",
        "104.20.253.85",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 193,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.552Z",
    "dns": {
      "answers": [
        {
          "data": "94.23.171.206",
          "type": "A"
        },
        {
          "data": "188.165.137.78",
          "type": "A"
        },
        {
          "data": "87.98.128.108",
          "type": "A"
        },
        {
          "data": "94.23.73.243",
          "type": "A"
        },
        {
          "data": "94.23.144.220",
          "type": "A"
        },
        {
          "data": "87.98.228.78",
          "type": "A"
        },
        {
          "data": "188.165.27.173",
          "type": "A"
        },
        {
          "data": "87.98.252.5",
          "type": "A"
        },
        {
          "data": "188.165.4.142",
          "type": "A"
        },
        {
          "data": "87.98.242.60",
          "type": "A"
        }
      ],
      "question": {
        "name": "grey.erne.co",
        "registered_domain": "erne.co"
      },
      "resolved_ip": [
        "94.23.171.206",
        "188.165.137.78",
        "87.98.128.108",
        "94.23.73.243",
        "94.23.144.220",
        "87.98.228.78",
        "188.165.27.173",
        "87.98.252.5",
        "188.165.4.142",
        "87.98.242.60"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 194,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.552Z",
    "dns": {
      "answers": [
        {
          "data": "54.243.145.203",
          "type": "A"
        },
        {
          "data": "54.221.211.153",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "sync.jivox.com",
        "registered_domain": "jivox.com"
      },
      "resolved_ip": [
        "54.243.145.203",
        "54.221.211.153",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 195,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.594Z",
    "dns": {
      "answers": [
        {
          "data": "b1-lsw-use1.zemanta.com",
          "type": "CNAME"
        },
        {
          "data": "207.244.121.25",
          "type": "A"
        },
        {
          "data": "108.59.0.1",
          "type": "A"
        },
        {
          "data": "162.210.196.115",
          "type": "A"
        },
        {
          "data": "207.244.94.20",
          "type": "A"
        },
        {
          "data": "108.59.0.12",
          "type": "A"
        },
        {
          "data": "207.244.121.65",
          "type": "A"
        },
        {
          "data": "162.210.199.69",
          "type": "A"
        },
        {
          "data": "207.244.76.83",
          "type": "A"
        },
        {
          "data": "162.210.197.137",
          "type": "A"
        },
        {
          "data": "207.244.108.217",
          "type": "A"
        },
        {
          "data": "207.244.121.137",
          "type": "A"
        },
        {
          "data": "207.244.67.99",
          "type": "A"
        },
        {
          "data": "198.7.56.229",
          "type": "A"
        },
        {
          "data": "198.7.56.231",
          "type": "A"
        },
        {
          "data": "108.59.4.172",
          "type": "A"
        },
        {
          "data": "108.62.117.43",
          "type": "A"
        },
        {
          "data": "108.59.4.171",
          "type": "A"
        },
        {
          "data": "207.244.121.27",
          "type": "A"
        },
        {
          "data": "207.244.71.67",
          "type": "A"
        },
        {
          "data": "207.244.121.70",
          "type": "A"
        },
        {
          "data": "199.58.84.25",
          "type": "A"
        },
        {
          "data": "207.244.67.98",
          "type": "A"
        },
        {
          "data": "162.210.196.116",
          "type": "A"
        },
        {
          "data": "207.244.73.10",
          "type": "A"
        },
        {
          "data": "207.244.110.3",
          "type": "A"
        },
        {
          "data": "108.59.4.173",
          "type": "A"
        },
        {
          "data": "108.59.0.8",
          "type": "A"
        },
        {
          "data": "207.244.71.88",
          "type": "A"
        },
        {
          "data": "207.244.121.73",
          "type": "A"
        },
        {
          "data": "207.244.69.231",
          "type": "A"
        },
        {
          "data": "108.59.0.2",
          "type": "A"
        },
        {
          "data": "207.244.121.74",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        },
        {
          "data": "2001:502:1ca1::30",
          "type": "AAAA"
        },
        {
          "data": "192.35.51.30",
          "type": "A"
        },
        {
          "data": "2001:503:d414::30",
          "type": "AAAA"
        },
        {
          "data": "192.42.93.30",
          "type": "A"
        },
        {
          "data": "2001:503:eea3::30",
          "type": "AAAA"
        },
        {
          "data": "192.54.112.30",
          "type": "A"
        },
        {
          "data": "2001:502:8cc::30",
          "type": "AAAA"
        },
        {
          "data": "192.43.172.30",
          "type": "A"
        },
        {
          "data": "2001:503:39c1::30",
          "type": "AAAA"
        },
        {
          "data": "192.48.79.30",
          "type": "A"
        },
        {
          "data": "2001:502:7094::30",
          "type": "AAAA"
        },
        {
          "data": "192.5",
          "type": "A"
        }
      ],
      "question": {
        "name": "b1sync.zemanta.com",
        "registered_domain": "zemanta.com"
      },
      "resolved_ip": [
        "207.244.121.25",
        "108.59.0.1",
        "162.210.196.115",
        "207.244.94.20",
        "108.59.0.12",
        "207.244.121.65",
        "162.210.199.69",
        "207.244.76.83",
        "162.210.197.137",
        "207.244.108.217",
        "207.244.121.137",
        "207.244.67.99",
        "198.7.56.229",
        "198.7.56.231",
        "108.59.4.172",
        "108.62.117.43",
        "108.59.4.171",
        "207.244.121.27",
        "207.244.71.67",
        "207.244.121.70",
        "199.58.84.25",
        "207.244.67.98",
        "162.210.196.116",
        "207.244.73.10",
        "207.244.110.3",
        "108.59.4.173",
        "108.59.0.8",
        "207.244.71.88",
        "207.244.121.73",
        "207.244.69.231",
        "108.59.0.2",
        "207.244.121.74",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30",
        "2001:502:1ca1::30",
        "192.35.51.30",
        "2001:503:d414::30",
        "192.42.93.30",
        "2001:503:eea3::30",
        "192.54.112.30",
        "2001:502:8cc::30",
        "192.43.172.30",
        "2001:503:39c1::30",
        "192.48.79.30",
        "2001:502:7094::30",
        "192.5"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 196,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.619Z",
    "dns": {
      "answers": [
        {
          "data": "tg3.dr.socdm.com",
          "type": "CNAME"
        },
        {
          "data": "124.146.215.43",
          "type": "A"
        },
        {
          "data": "202.241.208.53",
          "type": "A"
        },
        {
          "data": "124.146.215.46",
          "type": "A"
        },
        {
          "data": "202.241.208.52",
          "type": "A"
        },
        {
          "data": "124.146.215.48",
          "type": "A"
        },
        {
          "data": "124.146.215.45",
          "type": "A"
        },
        {
          "data": "202.241.208.54",
          "type": "A"
        },
        {
          "data": "124.146.215.47",
          "type": "A"
        },
        {
          "data": "124.146.215.42",
          "type": "A"
        },
        {
          "data": "124.146.215.44",
          "type": "A"
        },
        {
          "data": "202.241.208.55",
          "type": "A"
        },
        {
          "data": "202.241.208.56",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "tg.socdm.com",
        "registered_domain": "socdm.com"
      },
      "resolved_ip": [
        "124.146.215.43",
        "202.241.208.53",
        "124.146.215.46",
        "202.241.208.52",
        "124.146.215.48",
        "124.146.215.45",
        "202.241.208.54",
        "124.146.215.47",
        "124.146.215.42",
        "124.146.215.44",
        "202.241.208.55",
        "202.241.208.56",
        "192.5.6.30",
        "2001:503:a83e::2:30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 197,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.62Z",
    "dns": {
      "answers": [
        {
          "data": "prebid.appnexusgslb.net",
          "type": "CNAME"
        },
        {
          "data": "68.67.153.75",
          "type": "A"
        }
      ],
      "question": {
        "name": "prebid.adnxs.com",
        "registered_domain": "adnxs.com"
      },
      "resolved_ip": [
        "68.67.153.75"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 198,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.811Z",
    "dns": {
      "answers": [
        {
          "data": "tps.doubleverify.com",
          "type": "CNAME"
        },
        {
          "data": "tps-geo.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "ul1.dvtps.com",
        "registered_domain": "dvtps.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 199,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:08.912Z",
    "dns": {
      "question": {
        "name": "ul1.dvtps.com",
        "registered_domain": "dvtps.com"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RECORD_DOES_NOT_EXIST"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 200,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.016Z",
    "dns": {
      "answers": [
        {
          "data": "tags.bluekai.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e13541.x.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.3.125.199",
          "type": "A"
        }
      ],
      "question": {
        "name": "tags.bluekai.com",
        "registered_domain": "bluekai.com"
      },
      "resolved_ip": [
        "23.3.125.199"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 201,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.048Z",
    "dns": {
      "answers": [
        {
          "data": "104.19.195.151",
          "type": "A"
        },
        {
          "data": "104.19.199.151",
          "type": "A"
        },
        {
          "data": "104.19.198.151",
          "type": "A"
        },
        {
          "data": "104.19.197.151",
          "type": "A"
        },
        {
          "data": "104.19.196.151",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "cdnjs.cloudflare.com",
        "registered_domain": "cloudflare.com"
      },
      "resolved_ip": [
        "104.19.195.151",
        "104.19.199.151",
        "104.19.198.151",
        "104.19.197.151",
        "104.19.196.151",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 202,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.051Z",
    "dns": {
      "answers": [
        {
          "data": "85.194.243.23",
          "type": "A"
        },
        {
          "data": "85.194.243.239",
          "type": "A"
        },
        {
          "data": "85.194.240.137",
          "type": "A"
        },
        {
          "data": "85.194.242.103",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "pixel.onaudience.com",
        "registered_domain": "onaudience.com"
      },
      "resolved_ip": [
        "85.194.243.23",
        "85.194.243.239",
        "85.194.240.137",
        "85.194.242.103",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 203,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.054Z",
    "dns": {
      "answers": [
        {
          "data": "ocsp.digicert.com",
          "type": "CNAME"
        },
        {
          "data": "cs9.wac.phicdn.net",
          "type": "CNAME"
        },
        {
          "data": "72.21.91.29",
          "type": "A"
        }
      ],
      "question": {
        "name": "status.geotrust.com",
        "registered_domain": "geotrust.com"
      },
      "resolved_ip": [
        "72.21.91.29"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 204,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.126Z",
    "dns": {
      "answers": [
        {
          "data": "t3j2g9x7.stackpathcdn.com",
          "type": "CNAME"
        },
        {
          "data": "151.139.128.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.trust-provider.com",
        "registered_domain": "trust-provider.com"
      },
      "resolved_ip": [
        "151.139.128.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 205,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.184Z",
    "dns": {
      "answers": [
        {
          "data": "t3j2g9x7.stackpathcdn.com",
          "type": "CNAME"
        },
        {
          "data": "151.139.128.14",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "ocsp.comodoca4.com",
        "registered_domain": "comodoca4.com"
      },
      "resolved_ip": [
        "151.139.128.14",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 206,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.322Z",
    "dns": {
      "answers": [
        {
          "data": "td.crwdcntrl.net",
          "type": "CNAME"
        },
        {
          "data": "nginx-bcp-stackB-428666447.us-east-1.elb.amazonaws.com",
          "type": "CNAME"
        },
        {
          "data": "52.4.111.14",
          "type": "A"
        },
        {
          "data": "52.205.68.184",
          "type": "A"
        },
        {
          "data": "52.0.28.154",
          "type": "A"
        },
        {
          "data": "34.225.82.232",
          "type": "A"
        },
        {
          "data": "18.213.13.245",
          "type": "A"
        },
        {
          "data": "52.22.171.66",
          "type": "A"
        },
        {
          "data": "52.207.199.229",
          "type": "A"
        },
        {
          "data": "52.72.57.144",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "sync.crwdcntrl.net",
        "registered_domain": "crwdcntrl.net"
      },
      "resolved_ip": [
        "52.4.111.14",
        "52.205.68.184",
        "52.0.28.154",
        "34.225.82.232",
        "18.213.13.245",
        "52.22.171.66",
        "52.207.199.229",
        "52.72.57.144",
        "192.5.6.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 207,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:09.73Z",
    "dns": {
      "answers": [
        {
          "data": "cpe.us.dotomi.weighted.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "cpe.us.iad.dotomi.weighted.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "iad04-convex.dotomi.com",
          "type": "CNAME"
        },
        {
          "data": "159.127.42.114",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "match.sync.ad.cpe.dotomi.com",
        "registered_domain": "dotomi.com"
      },
      "resolved_ip": [
        "159.127.42.114",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 208,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:10.627Z",
    "dns": {
      "answers": [
        {
          "data": "nycp-hlb.doubleverify.com",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "tps10230.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 209,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:10.65Z",
    "dns": {
      "answers": [
        {
          "data": "nycp-hlb.doubleverify.com",
          "type": "CNAME"
        },
        {
          "data": "nycp-hlb.dvgtm.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "204.154.111.122",
          "type": "A"
        }
      ],
      "question": {
        "name": "tps10221.doubleverify.com",
        "registered_domain": "doubleverify.com"
      },
      "resolved_ip": [
        "204.154.111.122"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 210,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:16.329Z",
    "dns": {
      "answers": [
        {
          "data": "star-mini.c10r.facebook.com",
          "type": "CNAME"
        },
        {
          "data": "31.13.71.36",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        },
        {
          "data": "192.12.94.30",
          "type": "A"
        }
      ],
      "question": {
        "name": "www.facebook.com",
        "registered_domain": "facebook.com"
      },
      "resolved_ip": [
        "31.13.71.36",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30",
        "192.12.94.30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 212,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:16.386Z",
    "dns": {
      "answers": [
        {
          "data": "cs472.wac.edgecastcdn.net",
          "type": "CNAME"
        },
        {
          "data": "cs1-apr-8315.wac.edgecastcdn.net",
          "type": "CNAME"
        },
        {
          "data": "wac.apr-8315.edgecastdns.net",
          "type": "CNAME"
        },
        {
          "data": "cs1-lb-us.8315.ecdns.net",
          "type": "CNAME"
        },
        {
          "data": "cs491.wac.edgecastcdn.net",
          "type": "CNAME"
        },
        {
          "data": "192.229.163.25",
          "type": "A"
        }
      ],
      "question": {
        "name": "platform.twitter.com",
        "registered_domain": "twitter.com"
      },
      "resolved_ip": [
        "192.229.163.25"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 213,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:16.482Z",
    "dns": {
      "answers": [
        {
          "data": "104.244.42.8",
          "type": "A"
        },
        {
          "data": "104.244.42.200",
          "type": "A"
        },
        {
          "data": "104.244.42.136",
          "type": "A"
        },
        {
          "data": "104.244.42.72",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        },
        {
          "data": "192.31.80.30",
          "type": "A"
        },
        {
          "data": "2001:500:856e::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "syndication.twitter.com",
        "registered_domain": "twitter.com"
      },
      "resolved_ip": [
        "104.244.42.8",
        "104.244.42.200",
        "104.244.42.136",
        "104.244.42.72",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30",
        "192.31.80.30",
        "2001:500:856e::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 214,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:19.578Z",
    "dns": {
      "answers": [
        {
          "data": "pagead.l.doubleclick.net",
          "type": "CNAME"
        },
        {
          "data": "172.217.10.34",
          "type": "A"
        }
      ],
      "question": {
        "name": "ade.googlesyndication.com",
        "registered_domain": "googlesyndication.com"
      },
      "resolved_ip": [
        "172.217.10.34"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a9-5d2f-0000-001053699900}",
      "executable": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 2736
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 215,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:34:31.219Z",
    "dns": {
      "answers": [
        {
          "data": "ie9comview.vo.msecnd.net",
          "type": "CNAME"
        },
        {
          "data": "cs9.wpc.v0cdn.net",
          "type": "CNAME"
        },
        {
          "data": "72.21.81.200",
          "type": "A"
        }
      ],
      "question": {
        "name": "iecvlist.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "72.21.81.200"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a8-5d2f-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 216,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:39:02.752Z",
    "dns": {
      "answers": [
        {
          "data": "tsfe.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "40.77.232.95",
          "type": "A"
        }
      ],
      "question": {
        "name": "tsfe.trafficshaping.dsp.mp.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "40.77.232.95"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-b1a2-5d2f-0000-00106aca0000}",
      "executable": "C:\\Windows\\System32\\svchost.exe",
      "name": "svchost.exe",
      "pid": 844
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 220,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:39:20.413Z",
    "dns": {
      "question": {
        "name": "isatap.local.crowbird.com",
        "registered_domain": "crowbird.com"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-b1a2-5d2f-0000-00106aca0000}",
      "executable": "C:\\Windows\\System32\\svchost.exe",
      "name": "svchost.exe",
      "pid": 844
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RCODE_NAME_ERROR"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 221,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:39:40.504Z",
    "dns": {
      "question": {
        "name": "puppet"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e9f7-5d2f-0000-001031039c00}",
      "executable": "C:\\Program Files\\Puppet Labs\\Puppet\\sys\\ruby\\bin\\ruby.exe",
      "name": "ruby.exe",
      "pid": 676
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RCODE_NAME_ERROR"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 230,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:40:40.433Z",
    "dns": {
      "question": {
        "name": "wpad"
      }
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-b1a2-5d2f-0000-001016f70000}",
      "executable": "C:\\Windows\\System32\\svchost.exe",
      "name": "svchost.exe",
      "pid": 636
    },
    "sysmon": {
      "dns": {
        "status": "DNS_ERROR_RCODE_NAME_ERROR"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 231,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:42:54.033Z",
    "dns": {
      "answers": [
        {
          "data": "v10-win.vortex.data.microsoft.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "geo.vortex.data.microsoft.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "bn2.vortex.data.microsoft.com.akadns.net",
          "type": "CNAME"
        },
        {
          "data": "65.55.44.109",
          "type": "A"
        }
      ],
      "question": {
        "name": "v10.vortex-win.data.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "65.55.44.109"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-b1a3-5d2f-0000-00102f440100}",
      "executable": "C:\\Windows\\System32\\svchost.exe",
      "name": "svchost.exe",
      "pid": 1788
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 232,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:43:04.4Z",
    "dns": {
      "answers": [
        {
          "data": "settingsfd-geo.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "20.36.218.63",
          "type": "A"
        }
      ],
      "question": {
        "name": "settings-win.data.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "20.36.218.63"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-b1a3-5d2f-0000-00102f440100}",
      "executable": "C:\\Windows\\System32\\svchost.exe",
      "name": "svchost.exe",
      "pid": 1788
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 233,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  },
  {
    "@timestamp": "2019-07-18T03:49:51.154Z",
    "dns": {
      "answers": [
        {
          "data": "wd-prod-ss.trafficmanager.net",
          "type": "CNAME"
        },
        {
          "data": "wd-prod-ss-us-east-1-fe.eastus.cloudapp.azure.com",
          "type": "CNAME"
        },
        {
          "data": "40.121.17.79",
          "type": "A"
        },
        {
          "data": "192.5.6.30",
          "type": "A"
        },
        {
          "data": "2001:503:a83e::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.33.14.30",
          "type": "A"
        },
        {
          "data": "2001:503:231d::2:30",
          "type": "AAAA"
        },
        {
          "data": "192.26.92.30",
          "type": "A"
        },
        {
          "data": "2001:503:83eb::30",
          "type": "AAAA"
        }
      ],
      "question": {
        "name": "c.urs.microsoft.com",
        "registered_domain": "microsoft.com"
      },
      "resolved_ip": [
        "40.121.17.79",
        "192.5.6.30",
        "2001:503:a83e::2:30",
        "192.33.14.30",
        "2001:503:231d::2:30",
        "192.26.92.30",
        "2001:503:83eb::30"
      ]
    },
    "event": {
      "code": 22,
      "kind": "event",
      "module": "sysmon",
      "provider": "Microsoft-Windows-Sysmon"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{fa4a0de6-e8a8-5d2f-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    },
    "winlog": {
      "api": "wineventlog",
      "channel": "Microsoft-Windows-Sysmon/Operational",
      "computer_name": "vagrant-2016",
      "event_id": 22,
      "process": {
        "pid": 2828,
        "thread": {
          "id": 1684
        }
      },
      "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
      "provider_name": "Microsoft-Windows-Sysmon",
      "record_id": 234,
      "user": {
        "domain": "NT AUTHORITY",
        "identifier": "S-1-5-18",
        "name": "SYSTEM",
        "type": "Well Known Group"
      },
      "version": 5
    }
  }
]