['flow', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo']
src_ip: 192.168.10.8, src_port: 8418, dest_ip: 104.28.16.90, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 248, flow_pkts_toclient: 420, flow_bytes_toserver: 32822, flow_bytes_toclient: 672779, flow_age: 47, flow_state: closed, flow_reason: timeout, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 7410820, event_type: http, proto: TCP, tx_id: 0, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720177124043299.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14812 ; pcap_cnt: 7410997, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720177124043299.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14812, app_proto: http, fileinfo_filename: /Content/Upload/med/720177124043299.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 14812, fileinfo_tx_id: 0 ; pcap_cnt: 7411116, event_type: http, proto: TCP, tx_id: 1, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/11201622205814377.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 33651 ; pcap_cnt: 7411123, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/11201622205814377.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 33651, app_proto: http, fileinfo_filename: /Content/Upload/med/11201622205814377.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 33651, fileinfo_tx_id: 1 ; pcap_cnt: 7411242, event_type: http, proto: TCP, tx_id: 2, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017620532842.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10101 ; pcap_cnt: 7411245, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017620532842.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10101, app_proto: http, fileinfo_filename: /Content/Upload/small/72017620532842.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 10101, fileinfo_tx_id: 2 ; pcap_cnt: 7411264, event_type: http, proto: TCP, tx_id: 3, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017617463953.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12498 ; pcap_cnt: 7411297, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017617463953.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12498, app_proto: http, fileinfo_filename: /Content/Upload/small/72017617463953.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 12498, fileinfo_tx_id: 3 ; pcap_cnt: 7411313, event_type: http, proto: TCP, tx_id: 4, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720175171631735.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12477 ; pcap_cnt: 7411347, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720175171631735.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12477, app_proto: http, fileinfo_filename: /Content/Upload/small/720175171631735.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 12477, fileinfo_tx_id: 4 ; pcap_cnt: 7411448, event_type: http, proto: TCP, tx_id: 5, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720175153622665.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 9643 ; pcap_cnt: 7411474, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720175153622665.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 9643, app_proto: http, fileinfo_filename: /Content/Upload/small/720175153622665.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 9643, fileinfo_tx_id: 5 ; pcap_cnt: 7411627, event_type: http, proto: TCP, tx_id: 6, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/620176163838224.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 64568 ; pcap_cnt: 7411738, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/620176163838224.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 64568, app_proto: http, fileinfo_filename: /Content/Upload/med/620176163838224.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 64568, fileinfo_tx_id: 6 ; pcap_cnt: 7411821, event_type: http, proto: TCP, tx_id: 7, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720174214234858.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11708 ; pcap_cnt: 7411880, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720174214234858.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11708, app_proto: http, fileinfo_filename: /Content/Upload/small/720174214234858.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11708, fileinfo_tx_id: 7 ; pcap_cnt: 7412029, event_type: http, proto: TCP, tx_id: 8, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720177203651514.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15671 ; pcap_cnt: 7412030, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720177203651514.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15671, app_proto: http, fileinfo_filename: /Content/Upload/small/720177203651514.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 15671, fileinfo_tx_id: 8 ; pcap_cnt: 7412058, event_type: http, proto: TCP, tx_id: 9, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/220141320028.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15620 ; pcap_cnt: 7412156, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/220141320028.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15620, app_proto: http, fileinfo_filename: /Content/Upload/small/220141320028.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 15620, fileinfo_tx_id: 9 ; pcap_cnt: 7412356, event_type: http, proto: TCP, tx_id: 10, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/7201771950165.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10509 ; pcap_cnt: 7412357, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/7201771950165.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10509, app_proto: http, fileinfo_filename: /Content/Upload/small/7201771950165.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 10509, fileinfo_tx_id: 10 ; pcap_cnt: 7412453, event_type: http, proto: TCP, tx_id: 11, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201724165913775.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14457 ; pcap_cnt: 7412506, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201724165913775.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14457, app_proto: http, fileinfo_filename: /Content/Upload/small/6201724165913775.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 14457, fileinfo_tx_id: 11 ; pcap_cnt: 7412572, event_type: http, proto: TCP, tx_id: 12, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017718206857.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8622 ; pcap_cnt: 7412573, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017718206857.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8622, app_proto: http, fileinfo_filename: /Content/Upload/small/72017718206857.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 8622, fileinfo_tx_id: 12 ; pcap_cnt: 7412583, event_type: http, proto: TCP, tx_id: 13, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720177173049277.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12509 ; pcap_cnt: 7412632, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/720177173049277.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 12509, app_proto: http, fileinfo_filename: /Content/Upload/small/720177173049277.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 12509, fileinfo_tx_id: 13 ; pcap_cnt: 7412677, event_type: http, proto: TCP, tx_id: 14, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017120349791.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14780 ; pcap_cnt: 7412678, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017120349791.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14780, app_proto: http, fileinfo_filename: /Content/Upload/small/72017120349791.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 14780, fileinfo_tx_id: 14 ; pcap_cnt: 7412685, event_type: http, proto: TCP, tx_id: 15, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201515122529.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11004 ; pcap_cnt: 7412706, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201515122529.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11004, app_proto: http, fileinfo_filename: /Content/Upload/small/6201515122529.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 11004, fileinfo_tx_id: 15 ; pcap_cnt: 7412719, event_type: http, proto: TCP, tx_id: 16, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201713131541289.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11194 ; pcap_cnt: 7412737, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/6201713131541289.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11194, app_proto: http, fileinfo_filename: /Content/Upload/small/6201713131541289.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11194, fileinfo_tx_id: 16 ; pcap_cnt: 7412752, event_type: http, proto: TCP, tx_id: 17, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017715154798.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15500 ; pcap_cnt: 7412758, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017715154798.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 15500, app_proto: http, fileinfo_filename: /Content/Upload/small/72017715154798.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 15500, fileinfo_tx_id: 17 ; pcap_cnt: 7412772, event_type: http, proto: TCP, tx_id: 18, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017715154629.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14973 ; pcap_cnt: 7412786, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017715154629.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14973, app_proto: http, fileinfo_filename: /Content/Upload/small/72017715154629.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 14973, fileinfo_tx_id: 18 ; pcap_cnt: 7412794, event_type: http, proto: TCP, tx_id: 19, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/620152913203564.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 7157 ; pcap_cnt: 7412810, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/620152913203564.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 7157, app_proto: http, fileinfo_filename: /Content/Upload/small/620152913203564.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 7157, fileinfo_tx_id: 19 ; pcap_cnt: 7412828, event_type: http, proto: TCP, tx_id: 20, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017713145237.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14696 ; pcap_cnt: 7412855, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017713145237.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14696, app_proto: http, fileinfo_filename: /Content/Upload/small/72017713145237.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 14696, fileinfo_tx_id: 20 ; pcap_cnt: 7412866, event_type: http, proto: TCP, tx_id: 21, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017621457400.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10291 ; pcap_cnt: 7412884, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/72017621457400.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 10291, app_proto: http, fileinfo_filename: /Content/Upload/small/72017621457400.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 10291, fileinfo_tx_id: 21 ; pcap_cnt: 7412888, event_type: http, proto: TCP, tx_id: 22, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/7201711027350.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3281 ; pcap_cnt: 7412909, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/7201711027350.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3281, app_proto: http, fileinfo_filename: /Content/Upload/tiny/7201711027350.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 3281, fileinfo_tx_id: 22 ; pcap_cnt: 7412912, event_type: http, proto: TCP, tx_id: 23, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/62017261640210.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3676 ; pcap_cnt: 7412929, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/62017261640210.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3676, app_proto: http, fileinfo_filename: /Content/Upload/tiny/62017261640210.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 3676, fileinfo_tx_id: 23 ; pcap_cnt: 7412962, event_type: http, proto: TCP, tx_id: 24, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/62017865370.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 4141 ; pcap_cnt: 7412963, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/62017865370.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 4141, app_proto: http, fileinfo_filename: /Content/Upload/tiny/62017865370.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 4141, fileinfo_tx_id: 24 ; pcap_cnt: 7413055, event_type: http, proto: TCP, tx_id: 25, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720173828470.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 44050 ; pcap_cnt: 7413099, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720173828470.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 44050, app_proto: http, fileinfo_filename: /Content/Upload/med/720173828470.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 44050, fileinfo_tx_id: 25 ; pcap_cnt: 7413184, event_type: http, proto: TCP, tx_id: 26, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720173828483.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 39220 ; pcap_cnt: 7413385, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/720173828483.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 39220, app_proto: http, fileinfo_filename: /Content/Upload/med/720173828483.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 39220, fileinfo_tx_id: 26 ; pcap_cnt: 7413522, event_type: http, proto: TCP, tx_id: 27, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/72017716645391.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 32836 ; pcap_cnt: 7413523, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/72017716645391.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 32836, app_proto: http, fileinfo_filename: /Content/Upload/med/72017716645391.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 32836, fileinfo_tx_id: 27 ; pcap_cnt: 7413754, event_type: http, proto: TCP, tx_id: 28, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/72017322241136.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 62834 ; pcap_cnt: 7413775, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/med/72017322241136.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 62834, app_proto: http, fileinfo_filename: /Content/Upload/med/72017322241136.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 62834, fileinfo_tx_id: 28 ; pcap_cnt: 7413778, event_type: http, proto: TCP, tx_id: 29, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/editor348.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2776 ; pcap_cnt: 7413846, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/editor348.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2776, app_proto: http, fileinfo_filename: /Content/Upload/small/editor348.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 2776, fileinfo_tx_id: 29 ; pcap_cnt: 7413849, event_type: http, proto: TCP, tx_id: 30, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/editor403.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2681 ; pcap_cnt: 7413920, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/editor403.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2681, app_proto: http, fileinfo_filename: /Content/Upload/small/editor403.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 2681, fileinfo_tx_id: 30 ; pcap_cnt: 7413923, event_type: http, proto: TCP, tx_id: 31, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/Editor1841.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2577 ; pcap_cnt: 7413923, event_type: http, proto: TCP, tx_id: 32, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/Editor1707.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2337 ; pcap_cnt: 7413969, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/Editor1841.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2577, app_proto: http, fileinfo_filename: /Content/Upload/small/Editor1841.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 2577, fileinfo_tx_id: 31 ; pcap_cnt: 7413969, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/Editor1707.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 2337, app_proto: http, fileinfo_filename: /Content/Upload/small/Editor1707.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 2337, fileinfo_tx_id: 32 ; pcap_cnt: 7413972, event_type: http, proto: TCP, tx_id: 33, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/420165443725.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3589 ; pcap_cnt: 7413993, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/420165443725.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3589, app_proto: http, fileinfo_filename: /Content/Upload/tiny/420165443725.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 3589, fileinfo_tx_id: 33 ; pcap_cnt: 7413996, event_type: http, proto: TCP, tx_id: 34, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/420172410215457.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3377 ; pcap_cnt: 7414067, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/tiny/420172410215457.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 3377, app_proto: http, fileinfo_filename: /Content/Upload/tiny/420172410215457.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 3377, fileinfo_tx_id: 34 ; pcap_cnt: 7414085, event_type: http, proto: TCP, tx_id: 35, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120173022558.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 16562 ; pcap_cnt: 7414169, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120173022558.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 16562, app_proto: http, fileinfo_filename: /Content/Upload/small/120173022558.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 16562, fileinfo_tx_id: 35 ; pcap_cnt: 7414234, event_type: http, proto: TCP, tx_id: 36, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172874752.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 19648 ; pcap_cnt: 7414237, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172874752.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 19648, app_proto: http, fileinfo_filename: /Content/Upload/small/120172874752.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 19648, fileinfo_tx_id: 36 ; pcap_cnt: 7414351, event_type: http, proto: TCP, tx_id: 37, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172642929.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 28643 ; pcap_cnt: 7414352, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172642929.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 28643, app_proto: http, fileinfo_filename: /Content/Upload/small/120172642929.jpg, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 28643, fileinfo_tx_id: 37 ; pcap_cnt: 7435178, event_type: http, proto: TCP, tx_id: 38, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172485537.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14163 ; pcap_cnt: 7435179, event_type: fileinfo, proto: TCP, metadata_flowbits_0: ET.Zberp, metadata_flowbits_1: ETPRO.maldoc.jpg, http_hostname: www.arabi21.com, http_url: /Content/Upload/small/120172485537.jpg, http_http_user_agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0, http_http_content_type: image/jpeg, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 14163, app_proto: http, fileinfo_filename: /Content/Upload/small/120172485537.jpg, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 14163, fileinfo_tx_id: 38
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.