{
  "case": "2019-06-22",
  "captured_at": "2026-09-22T19:40:53.557Z",
  "url": "[local-instance]",
  "analysis_id": "8879e360-655c-4073-beb9-68018699a4d4",
  "summary_id": "investigation-summary:7ae590f3-65a9-43e6-a5a2-2f39852714f3",
  "model": "gpt-4.1-2025-04-14",
  "capture_sha256": "6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63",
  "native_summary_saved": true,
  "source_sha256": "b9f1a88f1eb5dc39a70c7866539846763b38f3831e54ee0cdd99ef746bfcbc52",
  "screenshot_sha256": "4f23dc6582a93d75b63d6f39ca8de25197c9d06a36a9e3cb5771e425a05fe099",
  "all_claim_texts_present": true,
  "live_summary_matches_saved": true,
  "stale": false,
  "width": 1100,
  "height": 777,
  "overflow": [],
  "narrativeFont": "17px",
  "text": "ADVERSARYGRAPH · PCAP INVESTIGATION\nANALYST REVIEW REQUIRED\nWhat happened in this capture?\n\n2019-06-22-traffic-analysis-exercise.pcap\n\nDuring the observed period, host 10.0.76.109 requested and received a large executable-formatted transfer (declared content type application/x-msdownload, size 584192 bytes) from 37.46.135.170; no explicit evidence establishes the intent or execution of this payload.\n\n10.0.76.109 was identified as associated with the workstation Bangkok-8ac2-PC and account bangkok-8ac2-pc$ during the capture.\n\nWho was involved\n10.0.76.109 is identified as Bangkok-8ac2-PC (host) and bangkok-8ac2-pc$ (account).\nBangkok-8ac2-PC hostname seen for 10.0.76.109.\nWhat remains uncertain\nNo evidence confirms whether the transferred file on 10.0.76.109 was executed or if it was malicious.\nNext check\nVerify the presence and execution status of the transferred executable on 10.0.76.109 (Bangkok-8ac2-PC), and inspect for follow-on behavior or compromise indications.\n\nModel: gpt-4.1-2025-04-14 · 99 claim-text words · 2026-09-22 · pcap-investigation-summary-v5\n\nCapture SHA-256: 6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63\n\nExact citations and reputation coverage are available separately. A downloaded file is not proof of execution.\n\n1 optional entry was omitted after validation; see the evidence details.",
  "browser_errors": [],
  "overlapping_fixed_elements": [],
  "visual_review": {
    "status": "passed",
    "reviewer": "assistant visual image inspection",
    "reviewed_at": "2026-09-22T19:50:28.472698+00:00",
    "image_sha256": "4f23dc6582a93d75b63d6f39ca8de25197c9d06a36a9e3cb5771e425a05fe099",
    "notes": "Viewed final screenshot at native width: text readable, no overlap or cropping, filename and SHA visible. StingrayAhoy correctly shows no saved summary. Presentation pass is not semantic approval.",
    "scope": "Image presentation only: readable text, complete frame, consistent case identity, no overlap/clipping. Investigation correctness is evaluated separately against evidence and answers."
  }
}