{
  "case": "2019-01-28",
  "captured_at": "2026-09-22T19:41:03.633Z",
  "url": "[local-instance]",
  "analysis_id": "f4c6d05d-a600-4616-9c66-c96965645a65",
  "summary_id": "investigation-summary:6e58f2e4-e195-4862-b38f-78dd19f603f4",
  "model": "gpt-4.1-2025-04-14",
  "capture_sha256": "2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db",
  "native_summary_saved": true,
  "source_sha256": "232959ecfde73702ceb94ffbaac8de4b5b9d939715bbd2b3f3caca597c9bbf58",
  "screenshot_sha256": "7f3023ff828d9767cd6cdf6a29cd0f78b67c7367da37bec4b4c6cfe05cdd0f12",
  "all_claim_texts_present": true,
  "live_summary_matches_saved": true,
  "stale": false,
  "width": 1100,
  "height": 694,
  "overflow": [],
  "narrativeFont": "17px",
  "text": "ADVERSARYGRAPH · PCAP INVESTIGATION\nANALYST REVIEW REQUIRED\nWhat happened in this capture?\n\n2019-01-28-traffic-analysis-exercise.pcap\n\nHost 172.17.8.109 (Dunn-Windows-PC) downloaded an executable file identified as Portable Executable (PE) format from http://91.121.30.169:8000/91msE95B/actiV.bin during the capture period.\n\nWho was involved\n172.17.8.109 is the primary internal IP performing network and file download activity in the capture.\nThe host name Dunn-Windows-PC is associated with IP 172.17.8.109.\nAccount margaret.dunn initiated Kerberos authentication using 172.17.8.109.\nWhat remains uncertain\nIt is not established by packet data whether the downloaded file 9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08 executed or resulted in compromise on 172.17.8.109.\nNext check\nReview endpoint telemetry or host process logs from 172.17.8.109 to determine if the downloaded PE file was launched.\n\nModel: gpt-4.1-2025-04-14 · 87 claim-text words · 2026-09-22 · pcap-investigation-summary-v5\n\nCapture SHA-256: 2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db\n\nExact citations and reputation coverage are available separately. A downloaded file is not proof of execution.",
  "browser_errors": [],
  "overlapping_fixed_elements": [],
  "visual_review": {
    "status": "passed",
    "reviewer": "assistant visual image inspection",
    "reviewed_at": "2026-09-22T19:50:38.416005+00:00",
    "image_sha256": "7f3023ff828d9767cd6cdf6a29cd0f78b67c7367da37bec4b4c6cfe05cdd0f12",
    "notes": "Inspected complete final image: narrative, evidence limits and provenance are legible, case matches, no clipping or overlay. Story omissions and redundancy are recorded in answer comparison.",
    "scope": "Image presentation only: readable text, complete frame, consistent case identity, no overlap/clipping. Investigation correctness is evaluated separately against evidence and answers."
  }
}