{
  "case": "2019-11-12",
  "status": 200,
  "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
  "investigation_id": "ba6adbd3-a55e-4659-a930-526752920a68",
  "packet_report_original_chars": 297320,
  "handoff_report_chars": 537,
  "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
  "retained_packet_report_sha256": "77408943904e86f99cc74b1bc76f421d751b6e5a3c28f6ffc0f8e821c0a0665d",
  "response": {
    "id": "ba6adbd3-a55e-4659-a930-526752920a68",
    "name": "Readable report handoff retest — Okay-Boomer 2019-11-12",
    "description": "Previously oversized public PCAP handoff regression; no publisher answers.",
    "status": "active",
    "domain": "enterprise-attack",
    "tlp": "TLP:AMBER+STRICT",
    "actor_ids": [],
    "technique_ids": [
      "T1105"
    ],
    "report_ids": [],
    "evidence_nodes": [
      {
        "id": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "type": "log-pcap-analysis",
        "label": "2019-11-12-traffic-analysis-exercise.pcap",
        "report": "# PCAP evidence summary\n\nDecoded 22828 packets across 364 IP endpoints and 1475 transport flows. Observed 2822 DNS events, 234 HTTP requests, 182 TLS ClientHello events, and 191 recovered file/message object(s). Deterministic rules produced 68 finding(s): 0 high, 60 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\nFull packet evidence: /api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8\n\nWrite the concise investigation summary after enrichment.",
        "summary": "Decoded 22828 packets across 364 IP endpoints and 1475 transport flows. Observed 2822 DNS events, 234 HTTP requests, 182 TLS ClientHello events, and 191 recovered file/message object(s). Deterministic rules produced 68 finding(s): 0 high, 60 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "observables": [
          {
            "type": "domain",
            "value": "1-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 10 / UDP stream 7, frame 21 / UDP stream 7, frame 31 / UDP stream 7, frame 56 / UDP stream 7, frame 65 / UDP stream 7"
          },
          {
            "type": "domain",
            "value": "1-courier.sandbox.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 9 / UDP stream 6, frame 20 / UDP stream 6, frame 30 / UDP stream 6, frame 55 / UDP stream 6, frame 63 / UDP stream 6"
          },
          {
            "type": "domain",
            "value": "1-you.njalla.no",
            "confidence": 1,
            "description": "dns-query; frame 11381 / UDP stream 596, frame 11382 / UDP stream 596, frame 11383 / UDP stream 597, frame 11385 / UDP stream 597, frame 13400 / UDP stream 673 +8 more"
          },
          {
            "type": "domain",
            "value": "1.courier-push-apple.com.akadns.net",
            "confidence": 1,
            "description": "dns-query; frame 35 / UDP stream 15, frame 40 / UDP stream 15"
          },
          {
            "type": "domain",
            "value": "1.courier-sandbox-push-apple.com.akadns.net",
            "confidence": 1,
            "description": "dns-query; frame 34 / UDP stream 14, frame 41 / UDP stream 14"
          },
          {
            "type": "domain",
            "value": "2-01-2c3e-0055.cdx.cedexis.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 3689 / UDP stream 296, frame 3898 / UDP stream 316, frame 3916 / UDP stream 316"
          },
          {
            "type": "domain",
            "value": "2-01-37d2-0018.cdx.cedexis.net",
            "confidence": 1,
            "description": "dns-cname; frame 4901 / UDP stream 360"
          },
          {
            "type": "domain",
            "value": "22-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 746 / UDP stream 81, frame 776 / UDP stream 81, frame 796 / UDP stream 100, frame 801 / UDP stream 100, frame 806 / UDP stream 81 +2 more"
          },
          {
            "type": "domain",
            "value": "22.courier-push-apple.com.akadns.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 801 / UDP stream 100, frame 864 / UDP stream 111, frame 871 / UDP stream 111"
          },
          {
            "type": "domain",
            "value": "24-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 11 / UDP stream 8, frame 22 / UDP stream 8, frame 32 / UDP stream 8, frame 36 / UDP stream 16, frame 38 / UDP stream 16 +2 more"
          },
          {
            "type": "domain",
            "value": "24.courier-push-apple.com.akadns.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 38 / UDP stream 16, frame 58 / UDP stream 20, frame 61 / UDP stream 20"
          },
          {
            "type": "domain",
            "value": "3-get.njalla.fo",
            "confidence": 1,
            "description": "dns-query; frame 22122 / UDP stream 923, frame 22124 / UDP stream 923, frame 22144 / UDP stream 929, frame 22152 / UDP stream 931, frame 22153 / UDP stream 931"
          },
          {
            "type": "domain",
            "value": "8704410.fls.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 17421 / UDP stream 736, frame 17422 / UDP stream 736, frame 18511 / TCP stream 324, frame 18828 / TCP stream 332"
          },
          {
            "type": "domain",
            "value": "a-0001.a-afdentry.net.trafficmanager.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 683 / UDP stream 69, frame 754 / UDP stream 86, frame 761 / UDP stream 93, frame 828 / UDP stream 58, frame 829 / UDP stream 58 +15 more"
          },
          {
            "type": "domain",
            "value": "a-9999.dc-msedge.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 691 / UDP stream 74, frame 757 / UDP stream 89, frame 769 / UDP stream 89, frame 770 / UDP stream 63"
          },
          {
            "type": "domain",
            "value": "a-lb.tribalfusion.com.akadns.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 13386 / UDP stream 670, frame 13448 / UDP stream 679, frame 13453 / UDP stream 679"
          },
          {
            "type": "domain",
            "value": "a-ring-fallback.msedge.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 653 / UDP stream 63, frame 664 / UDP stream 63, frame 676 / UDP stream 63, frame 688 / UDP stream 74, frame 691 / UDP stream 74 +3 more"
          },
          {
            "type": "domain",
            "value": "a.ns.c10r.facebook.com",
            "confidence": 1,
            "description": "dns-query; frame 3897 / UDP stream 315, frame 3917 / UDP stream 315, frame 4718 / UDP stream 347, frame 4719 / UDP stream 347, frame 4738 / UDP stream 351 +15 more"
          },
          {
            "type": "domain",
            "value": "a.ns.xx.fbcdn.net",
            "confidence": 1,
            "description": "dns-query; frame 17626 / UDP stream 785, frame 17648 / UDP stream 785, frame 18264 / UDP stream 804, frame 18274 / UDP stream 804, frame 18923 / UDP stream 827 +7 more"
          },
          {
            "type": "domain",
            "value": "a.tribalfusion.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 13286 / UDP stream 661, frame 13312 / UDP stream 661, frame 13369 / UDP stream 661, frame 13381 / UDP stream 669, frame 13384 / UDP stream 669 +15 more"
          },
          {
            "type": "domain",
            "value": "a.tribalfusion.com-v1.edgekey.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 13453 / UDP stream 679, frame 13845 / UDP stream 661, frame 14306 / UDP stream 661, frame 15355 / UDP stream 661, frame 15363 / UDP stream 703 +3 more"
          },
          {
            "type": "domain",
            "value": "a1294.w20.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 3679 / UDP stream 295, frame 3705 / UDP stream 295"
          },
          {
            "type": "domain",
            "value": "a1834.dspg2.akamai.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 7481 / UDP stream 463, frame 7490 / UDP stream 463, frame 7491 / UDP stream 442"
          },
          {
            "type": "domain",
            "value": "a279.dscq.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 5529 / UDP stream 378, frame 5530 / UDP stream 379, frame 5531 / UDP stream 379, frame 5541 / UDP stream 378"
          },
          {
            "type": "domain",
            "value": "a771.dscq.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 4742 / UDP stream 355, frame 4744 / UDP stream 355"
          },
          {
            "type": "domain",
            "value": "accounts.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 3593 / UDP stream 278, frame 3617 / UDP stream 278, frame 3668 / UDP stream 278, frame 3684 / UDP stream 300, frame 3699 / UDP stream 300 +2 more"
          },
          {
            "type": "domain",
            "value": "acjabogados.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 10081 / UDP stream 522, frame 10184 / UDP stream 522, frame 10193 / UDP stream 522, frame 10456 / UDP stream 530, frame 10522 / UDP stream 530 +4 more"
          },
          {
            "type": "domain",
            "value": "ad.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, http-host; frame 3590 / UDP stream 275, frame 3614 / UDP stream 275, frame 3665 / UDP stream 275, frame 3681 / UDP stream 297, frame 3697 / UDP stream 297 +2 more"
          },
          {
            "type": "domain",
            "value": "ad2.netshelter.net",
            "confidence": 1,
            "description": "dns-query; frame 10913 / UDP stream 535, frame 10957 / UDP stream 535, frame 11015 / UDP stream 535, frame 11023 / UDP stream 556, frame 11031 / UDP stream 556 +3 more"
          },
          {
            "type": "domain",
            "value": "ade.googlesyndication.com",
            "confidence": 1,
            "description": "dns-query; frame 13045 / UDP stream 647, frame 13061 / UDP stream 647, frame 13244 / UDP stream 647, frame 13275 / UDP stream 659, frame 13279 / UDP stream 659 +1 more"
          },
          {
            "type": "domain",
            "value": "ads-bid.l.doubleclick.net",
            "confidence": 1,
            "description": "dns-cname; frame 17650 / UDP stream 793, frame 17651 / UDP stream 776"
          },
          {
            "type": "domain",
            "value": "ads.yahoo.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 17549 / UDP stream 774, frame 17602 / UDP stream 774, frame 17616 / UDP stream 774, frame 17634 / UDP stream 792, frame 17640 / UDP stream 792 +4 more"
          },
          {
            "type": "domain",
            "value": "adservice.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 5806 / UDP stream 402, frame 5856 / UDP stream 402, frame 6064 / UDP stream 402, frame 6078 / UDP stream 420, frame 6090 / UDP stream 420 +11 more"
          },
          {
            "type": "domain",
            "value": "aep.mxptint.net",
            "confidence": 1,
            "description": "dns-query; frame 10950 / UDP stream 542, frame 11000 / UDP stream 542, frame 11035 / UDP stream 542, frame 11056 / UDP stream 563, frame 11185 / UDP stream 563 +4 more"
          },
          {
            "type": "domain",
            "value": "ajax.googleapis.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 5353 / UDP stream 365, frame 5512 / UDP stream 365, frame 5551 / UDP stream 365, frame 5758 / UDP stream 388, frame 5784 / UDP stream 388 +5 more"
          },
          {
            "type": "domain",
            "value": "amongolia.com",
            "confidence": 1,
            "description": "dns-query; frame 21593 / UDP stream 903, frame 21594 / UDP stream 903, frame 21597 / UDP stream 903, frame 21598 / UDP stream 904, frame 21599 / UDP stream 904 +15 more"
          },
          {
            "type": "domain",
            "value": "ampcid.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 3601 / UDP stream 284, frame 3621 / UDP stream 284, frame 3672 / UDP stream 284, frame 3688 / UDP stream 304, frame 3702 / UDP stream 304 +2 more"
          },
          {
            "type": "domain",
            "value": "api-glb-dal.smoot.apple.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 1217 / UDP stream 158, frame 1232 / UDP stream 158, frame 1269 / UDP stream 158, frame 1272 / UDP stream 164, frame 1276 / UDP stream 164 +2 more"
          },
          {
            "type": "domain",
            "value": "api.bing.com",
            "confidence": 1,
            "description": "dns-query; frame 13029 / UDP stream 640, frame 13050 / UDP stream 640, frame 13083 / UDP stream 640, frame 13243 / UDP stream 640"
          },
          {
            "type": "domain",
            "value": "api.bit.ly",
            "confidence": 1,
            "description": "dns-query, http-host; frame 1611 / UDP stream 190, frame 1624 / UDP stream 190, frame 1640 / UDP stream 190, frame 1821 / UDP stream 190, frame 1902 / UDP stream 235 +3 more"
          },
          {
            "type": "domain",
            "value": "api.bounceexchange.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 6945 / UDP stream 450, frame 7402 / UDP stream 450, frame 7575 / UDP stream 450, frame 7589 / UDP stream 475, frame 7594 / UDP stream 475 +3 more"
          },
          {
            "type": "domain",
            "value": "api.locuslabs.com",
            "confidence": 1,
            "description": "dns-query; frame 21482 / UDP stream 897, frame 21483 / UDP stream 897"
          },
          {
            "type": "domain",
            "value": "api.samsungcloud.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 21886 / UDP stream 915, frame 21887 / UDP stream 915, frame 21891 / TCP stream 400, frame 21915 / TCP stream 401, frame 21932 / TCP stream 402 +6 more"
          },
          {
            "type": "domain",
            "value": "api.segment.io",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 7608 / UDP stream 479, frame 8037 / UDP stream 479, frame 8326 / UDP stream 479, frame 8681 / UDP stream 479, frame 10178 / UDP stream 524 +4 more"
          },
          {
            "type": "domain",
            "value": "api.weather.com",
            "confidence": 1,
            "description": "dns-query; frame 750 / UDP stream 83, frame 752 / UDP stream 85, frame 779 / UDP stream 85"
          },
          {
            "type": "domain",
            "value": "apis.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 1612 / UDP stream 191, frame 1625 / UDP stream 191, frame 1641 / UDP stream 191, frame 1658 / UDP stream 191, frame 2130 / TCP stream 80"
          },
          {
            "type": "domain",
            "value": "assets.bounceexchange.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 3938 / UDP stream 326, frame 3957 / UDP stream 326, frame 3973 / UDP stream 326, frame 5899 / TCP stream 160, frame 9733 / TCP stream 160 +3 more"
          },
          {
            "type": "domain",
            "value": "assets.locuslabs.com",
            "confidence": 1,
            "description": "dns-query; frame 21195 / UDP stream 873, frame 21197 / UDP stream 873"
          },
          {
            "type": "domain",
            "value": "auth.time.com",
            "confidence": 1,
            "description": "dns-query; frame 3584 / UDP stream 270, frame 3607 / UDP stream 270, frame 3661 / UDP stream 270, frame 3815 / UDP stream 270, frame 3965 / UDP stream 270"
          },
          {
            "type": "domain",
            "value": "awseb-e-i-awsebloa-5f3ihwsl49wt-1616338667.us-east-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 17639 / UDP stream 789, frame 18928 / UDP stream 830, frame 18934 / UDP stream 830"
          },
          {
            "type": "domain",
            "value": "b-9999.b-msedge.net",
            "confidence": 1,
            "description": "dns-cname; frame 767 / UDP stream 88"
          },
          {
            "type": "domain",
            "value": "b-ring.b-9999.b-msedge.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 690 / UDP stream 70, frame 756 / UDP stream 88, frame 767 / UDP stream 88"
          },
          {
            "type": "domain",
            "value": "b-ring.msedge.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 649 / UDP stream 59, frame 662 / UDP stream 59, frame 673 / UDP stream 59, frame 684 / UDP stream 70, frame 690 / UDP stream 70 +3 more"
          },
          {
            "type": "domain",
            "value": "b.scorecardresearch.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 3586 / UDP stream 272, frame 3612 / UDP stream 272, frame 3663 / UDP stream 272, frame 3707 / UDP stream 272, frame 4789 / TCP stream 142 +2 more"
          },
          {
            "type": "domain",
            "value": "beacons-handoff.gcp.gvt2.com",
            "confidence": 1,
            "description": "dns-cname; frame 1672 / UDP stream 207"
          },
          {
            "type": "domain",
            "value": "beacons.gcp.gvt2.com",
            "confidence": 1,
            "description": "dns-query; frame 1671 / UDP stream 207, frame 1672 / UDP stream 207"
          },
          {
            "type": "domain",
            "value": "bid.g.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 17552 / UDP stream 776, frame 17603 / UDP stream 776, frame 17617 / UDP stream 776, frame 17635 / UDP stream 793, frame 17650 / UDP stream 793 +3 more"
          },
          {
            "type": "domain",
            "value": "bsw.digitru.st",
            "confidence": 1,
            "description": "dns-query; frame 11353 / UDP stream 585, frame 11377 / UDP stream 585, frame 11416 / UDP stream 585, frame 11481 / UDP stream 602, frame 11542 / UDP stream 602 +5 more"
          },
          {
            "type": "domain",
            "value": "c.amazon-adsystem.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 7471 / UDP stream 458, frame 7568 / UDP stream 458, frame 7612 / UDP stream 458, frame 7632 / UDP stream 483, frame 7656 / UDP stream 483 +7 more"
          },
          {
            "type": "domain",
            "value": "c.apple.news",
            "confidence": 1,
            "description": "dns-query; frame 749 / UDP stream 82, frame 751 / UDP stream 84, frame 778 / UDP stream 84, frame 924 / UDP stream 84, frame 925 / UDP stream 84 +1 more"
          },
          {
            "type": "domain",
            "value": "cdn-content.ampproject.org",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 8721 / UDP stream 511, frame 8727 / UDP stream 511, frame 8728 / UDP stream 502"
          },
          {
            "type": "domain",
            "value": "cdn.ampproject.org",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 8542 / UDP stream 502, frame 8675 / UDP stream 502, frame 8687 / UDP stream 502, frame 8728 / UDP stream 502, frame 10966 / TCP stream 262"
          },
          {
            "type": "domain",
            "value": "cdn.iphonehacks.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 7440 / UDP stream 455, frame 7563 / UDP stream 455, frame 7610 / UDP stream 455, frame 7630 / UDP stream 481, frame 7643 / UDP stream 481 +15 more"
          },
          {
            "type": "domain",
            "value": "cdn.krxd.net",
            "confidence": 1,
            "description": "dns-query; frame 17429 / UDP stream 743, frame 17467 / UDP stream 743, frame 17487 / UDP stream 743, frame 17511 / UDP stream 768, frame 17565 / UDP stream 743 +11 more"
          },
          {
            "type": "domain",
            "value": "cdn.mxpnl.com",
            "confidence": 1,
            "description": "dns-query; frame 17431 / UDP stream 745, frame 17466 / UDP stream 745, frame 17485 / UDP stream 745, frame 17567 / UDP stream 745, frame 17665 / UDP stream 745 +12 more"
          },
          {
            "type": "domain",
            "value": "cdn.onenote.net",
            "confidence": 1,
            "description": "dns-query; frame 624 / UDP stream 55, frame 640 / UDP stream 55, frame 656 / UDP stream 55, frame 678 / UDP stream 67, frame 681 / UDP stream 55 +2 more"
          },
          {
            "type": "domain",
            "value": "cdn.optimizely.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 1610 / UDP stream 189, frame 1623 / UDP stream 189, frame 1639 / UDP stream 189, frame 1648 / UDP stream 199, frame 1661 / UDP stream 199 +3 more"
          },
          {
            "type": "domain",
            "value": "cdn.taboola.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 3585 / UDP stream 271, frame 3611 / UDP stream 271, frame 3662 / UDP stream 271, frame 3695 / UDP stream 271, frame 4785 / TCP stream 141"
          },
          {
            "type": "domain",
            "value": "cdn.taboola.map.fastly.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 3907 / UDP stream 324, frame 3923 / UDP stream 324, frame 3925 / UDP stream 308"
          },
          {
            "type": "domain",
            "value": "cdn.taboolasyndication.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 1614 / UDP stream 193, frame 1627 / UDP stream 193, frame 1643 / UDP stream 193, frame 1655 / UDP stream 193, frame 2132 / TCP stream 82"
          },
          {
            "type": "domain",
            "value": "cdn1.friendbuy.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 13457 / UDP stream 682, frame 13557 / UDP stream 682, frame 13629 / UDP stream 682, frame 13841 / UDP stream 693, frame 13842 / UDP stream 693 +5 more"
          },
          {
            "type": "domain",
            "value": "cdnjs.cloudflare.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 13041 / UDP stream 644, frame 13057 / UDP stream 644, frame 13124 / UDP stream 644, frame 13270 / UDP stream 644, frame 13376 / UDP stream 644 +5 more"
          },
          {
            "type": "domain",
            "value": "cf.zdassets.com",
            "confidence": 1,
            "description": "dns-cname; frame 17433 / UDP stream 746, frame 17561 / UDP stream 779"
          },
          {
            "type": "domain",
            "value": "cgi.timeinc.net",
            "confidence": 1,
            "description": "dns-query; frame 3716 / UDP stream 191, frame 3732 / UDP stream 191, frame 3810 / UDP stream 191, frame 3904 / UDP stream 322, frame 3934 / UDP stream 322 +1 more"
          },
          {
            "type": "domain",
            "value": "checkappexec.microsoft.com",
            "confidence": 1,
            "description": "dns-query; frame 840 / UDP stream 105, frame 843 / UDP stream 105, frame 861 / UDP stream 105, frame 882 / UDP stream 105, frame 940 / UDP stream 105 +1 more"
          },
          {
            "type": "domain",
            "value": "chimpstatic.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 17408 / UDP stream 730, frame 17458 / UDP stream 730, frame 17476 / UDP stream 730, frame 17504 / UDP stream 761, frame 17516 / UDP stream 761 +3 more"
          },
          {
            "type": "domain",
            "value": "chromebooktrivia.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 1668 / UDP stream 205, frame 1669 / UDP stream 205, frame 2362 / TCP stream 86"
          },
          {
            "type": "domain",
            "value": "clients.l.google.com",
            "confidence": 1,
            "description": "dns-cname; frame 8452 / UDP stream 500, frame 8453 / UDP stream 489"
          },
          {
            "type": "domain",
            "value": "clients1.google.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 8111 / UDP stream 489, frame 8309 / UDP stream 489, frame 8378 / UDP stream 489, frame 8446 / UDP stream 500, frame 8452 / UDP stream 500 +2 more"
          },
          {
            "type": "domain",
            "value": "clientservices.googleapis.com",
            "confidence": 1,
            "description": "dns-query; frame 886 / UDP stream 118, frame 887 / UDP stream 118, frame 897 / UDP stream 122, frame 898 / UDP stream 122"
          },
          {
            "type": "domain",
            "value": "cloud.newsletters.time.com",
            "confidence": 1,
            "description": "dns-query; frame 5552 / UDP stream 382, frame 5553 / UDP stream 382"
          },
          {
            "type": "domain",
            "value": "cm.g.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 10956 / UDP stream 548, frame 11006 / UDP stream 548, frame 11041 / UDP stream 548, frame 11062 / UDP stream 569, frame 11103 / UDP stream 569 +2 more"
          },
          {
            "type": "domain",
            "value": "cms.quantserve.com",
            "confidence": 1,
            "description": "dns-query; frame 17362 / UDP stream 717, frame 17378 / UDP stream 717, frame 17438 / UDP stream 717, frame 17445 / UDP stream 754, frame 17446 / UDP stream 754 +4 more"
          },
          {
            "type": "domain",
            "value": "connect.facebook.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 3591 / UDP stream 276, frame 3615 / UDP stream 276, frame 3666 / UDP stream 276, frame 3713 / UDP stream 276, frame 5808 / UDP stream 404 +15 more"
          },
          {
            "type": "domain",
            "value": "connectivitycheck.gstatic.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 20939 / UDP stream 861, frame 20981 / UDP stream 861, frame 21008 / TCP stream 376"
          },
          {
            "type": "domain",
            "value": "content.time.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 1220 / UDP stream 160, frame 1239 / UDP stream 160, frame 1271 / UDP stream 160, frame 1347 / UDP stream 172, frame 1349 / UDP stream 172 +4 more"
          },
          {
            "type": "domain",
            "value": "corposted.com",
            "confidence": 1,
            "description": "dns-query; frame 12983 / UDP stream 637, frame 13036 / UDP stream 637, frame 13053 / UDP stream 637, frame 13122 / UDP stream 651, frame 13133 / UDP stream 651 +15 more"
          },
          {
            "type": "domain",
            "value": "coujtried.com",
            "confidence": 1,
            "description": "dns-query; frame 20524 / UDP stream 836, frame 20529 / UDP stream 836, frame 20617 / UDP stream 836, frame 20761 / UDP stream 849, frame 20773 / UDP stream 849 +15 more"
          },
          {
            "type": "domain",
            "value": "courier.push.apple.com",
            "confidence": 1,
            "description": "tls-sni; frame 560 / TCP stream 28, frame 1137 / TCP stream 38"
          },
          {
            "type": "domain",
            "value": "crl3.digicert.com",
            "confidence": 1,
            "description": "dns-query; frame 6707 / UDP stream 448, frame 7187 / UDP stream 448, frame 7484 / UDP stream 448, frame 7583 / UDP stream 448, frame 8330 / UDP stream 448 +7 more"
          },
          {
            "type": "domain",
            "value": "crl4.digicert.com",
            "confidence": 1,
            "description": "dns-query; frame 6706 / UDP stream 447, frame 7186 / UDP stream 447, frame 7483 / UDP stream 447, frame 7582 / UDP stream 447, frame 8329 / UDP stream 447 +7 more"
          },
          {
            "type": "domain",
            "value": "cs766.wpc.epsiloncdn.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 3916 / UDP stream 316, frame 3978 / UDP stream 274, frame 3993 / UDP stream 274, frame 4722 / UDP stream 274, frame 4740 / UDP stream 353 +3 more"
          },
          {
            "type": "domain",
            "value": "cs9.wac.phicdn.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 1916 / UDP stream 238, frame 2104 / UDP stream 203, frame 6188 / UDP stream 432, frame 6681 / UDP stream 401, frame 7587 / UDP stream 473 +12 more"
          },
          {
            "type": "domain",
            "value": "cse.google.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 7474 / UDP stream 460, frame 7569 / UDP stream 460, frame 7613 / UDP stream 460, frame 7633 / UDP stream 484, frame 7647 / UDP stream 484 +3 more"
          },
          {
            "type": "domain",
            "value": "cta-service-cms2.hubspot.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 5893 / UDP stream 412, frame 6068 / UDP stream 412, frame 6098 / UDP stream 412, frame 6120 / UDP stream 430, frame 6121 / UDP stream 430 +3 more"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com",
            "confidence": 1,
            "description": "dns-query; frame 3348 / UDP stream 263, frame 3357 / UDP stream 263, frame 3389 / UDP stream 263, frame 3576 / UDP stream 263, frame 3673 / UDP stream 289 +15 more"
          },
          {
            "type": "domain",
            "value": "d10f0ruikmplv3.cloudfront.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 3714 / UDP stream 305, frame 3903 / UDP stream 321, frame 3935 / UDP stream 321, frame 3975 / UDP stream 266, frame 3976 / UDP stream 266 +5 more"
          },
          {
            "type": "domain",
            "value": "d1xe77h82zlvyn.cloudfront.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 17507 / UDP stream 764, frame 17523 / UDP stream 764, frame 17525 / UDP stream 739"
          },
          {
            "type": "domain",
            "value": "d1ykf07e75w7ss.cloudfront.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 7669 / UDP stream 485, frame 8443 / UDP stream 497, frame 8449 / UDP stream 497, frame 8726 / UDP stream 458, frame 8751 / UDP stream 458 +6 more"
          },
          {
            "type": "domain",
            "value": "d2ceh8694r4o9j.cloudfront.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 2399 / UDP stream 259, frame 3223 / UDP stream 261, frame 3229 / UDP stream 261, frame 3346 / UDP stream 251, frame 3347 / UDP stream 251 +5 more"
          }
        ],
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap"
        ],
        "source_sha256": "1c607e6b1245a2ee781551fb8a9c629763f848410c3756f28d80615c55fc22d1",
        "semantic_sha256": "77408943904e86f99cc74b1bc76f421d751b6e5a3c28f6ffc0f8e821c0a0665d",
        "observable_count": 1697,
        "assessment_sha256": "0de12687cbf0516347a9797fd6e4d938dfc52011c9270baf201e6462fdfd3f1b",
        "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
        "ioc_candidate_count": 0,
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "suspicious_findings": [
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2004 / TCP stream 78, frame 2065 / TCP stream 78",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2131 / TCP stream 83, frame 2154 / TCP stream 83",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2132 / TCP stream 82, frame 2193 / TCP stream 82",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2539 / TCP stream 91, frame 2586 / TCP stream 91",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2543 / TCP stream 92, frame 2668 / TCP stream 92",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2544 / TCP stream 93, frame 2645 / TCP stream 93",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2573 / TCP stream 87, frame 2678 / TCP stream 87",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2598 / TCP stream 88, frame 2677 / TCP stream 88",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2602 / TCP stream 94, frame 3065 / TCP stream 94",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2647 / TCP stream 90, frame 2688 / TCP stream 90",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2650 / TCP stream 89, frame 2692 / TCP stream 89",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2665 / TCP stream 93, frame 2696 / TCP stream 93",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2670 / TCP stream 92, frame 2707 / TCP stream 92",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 2684 / TCP stream 87, frame 2753 / TCP stream 87",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3078 / TCP stream 94, frame 3093 / TCP stream 94",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3096 / TCP stream 94, frame 3114 / TCP stream 94",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3221 / TCP stream 99, frame 3226 / TCP stream 99",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3352 / TCP stream 104, frame 3354 / TCP stream 104",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4785 / TCP stream 141, frame 5073 / TCP stream 141",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4789 / TCP stream 142, frame 4844 / TCP stream 142",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 5585 / TCP stream 149, frame 5640 / TCP stream 149",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 5899 / TCP stream 160, frame 6045 / TCP stream 160",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 6247 / TCP stream 167, frame 6271 / TCP stream 167",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 6248 / TCP stream 166, frame 6358 / TCP stream 166",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 6488 / TCP stream 179, frame 6503 / TCP stream 179",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 6999 / TCP stream 196, frame 7127 / TCP stream 196",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 7021 / TCP stream 197, frame 7091 / TCP stream 197",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 7211 / TCP stream 206, frame 7464 / TCP stream 206",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 7212 / TCP stream 207, frame 7441 / TCP stream 207",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 7213 / TCP stream 208, frame 7362 / TCP stream 208",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8476 / TCP stream 229, frame 8536 / TCP stream 229",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8827 / TCP stream 235, frame 8911 / TCP stream 235",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8938 / TCP stream 234, frame 8949 / TCP stream 234",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8942 / TCP stream 232, frame 8964 / TCP stream 232",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8968 / TCP stream 234, frame 8993 / TCP stream 234",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8976 / TCP stream 233, frame 8994 / TCP stream 233",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8977 / TCP stream 232, frame 8995 / TCP stream 232",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 8989 / TCP stream 231, frame 9004 / TCP stream 231",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9001 / TCP stream 234, frame 9010 / TCP stream 234",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9002 / TCP stream 233, frame 9008 / TCP stream 233",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9003 / TCP stream 232, frame 9044 / TCP stream 232",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9006 / TCP stream 231, frame 9047 / TCP stream 231",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9029 / TCP stream 233, frame 9051 / TCP stream 233",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9076 / TCP stream 237, frame 9129 / TCP stream 237",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9624 / TCP stream 246, frame 9707 / TCP stream 246",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9627 / TCP stream 245, frame 9744 / TCP stream 245",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 9815 / TCP stream 246, frame 9840 / TCP stream 246",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 10077 / TCP stream 251, frame 10170 / TCP stream 251",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 11469 / TCP stream 265, frame 11537 / TCP stream 265",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 11563 / TCP stream 267, frame 11592 / TCP stream 267",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 13545 / TCP stream 286, frame 13550 / TCP stream 286",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14053 / TCP stream 301, frame 14459 / TCP stream 301",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17289 / TCP stream 304, frame 17355 / TCP stream 304",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17669 / TCP stream 310, frame 17690 / TCP stream 310",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17701 / TCP stream 310, frame 17705 / TCP stream 310",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17717 / TCP stream 311, frame 17786 / TCP stream 311",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18497 / TCP stream 304, frame 18612 / TCP stream 304",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 21023 / TCP stream 377, frame 21038 / TCP stream 377",
            "severity": "medium"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 224 / TCP stream 6, frame 226 / TCP stream 6, frame 228 / TCP stream 6, frame 230 / TCP stream 6, frame 3803 / TCP stream 123 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 122 / TCP stream 2, frame 171 / TCP stream 2, frame 247 / TCP stream 10, frame 252 / TCP stream 10, frame 266 / TCP stream 10 +28 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 1399 / TCP stream 50, frame 1401 / TCP stream 50, frame 1403 / TCP stream 50, frame 1405 / TCP stream 50, frame 3415 / TCP stream 50 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 1303 / TCP stream 45, frame 1337 / TCP stream 45, frame 1424 / TCP stream 55, frame 1429 / TCP stream 55, frame 1443 / TCP stream 55 +28 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 223 / TCP stream 6, frame 225 / TCP stream 6, frame 227 / TCP stream 6, frame 229 / TCP stream 6, frame 3802 / TCP stream 123 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 120 / TCP stream 2, frame 169 / TCP stream 2, frame 172 / TCP stream 2, frame 245 / TCP stream 10, frame 250 / TCP stream 10 +36 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 1398 / TCP stream 50, frame 1400 / TCP stream 50, frame 1402 / TCP stream 50, frame 1404 / TCP stream 50, frame 3414 / TCP stream 50 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 1301 / TCP stream 45, frame 1335 / TCP stream 45, frame 1338 / TCP stream 45, frame 1422 / TCP stream 55, frame 1427 / TCP stream 55 +36 more",
            "severity": "low"
          },
          {
            "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v5; confidence 70%.",
            "category": "Sustained external TCP conversation outside decoded application coverage",
            "evidence": "frame 6642 / TCP stream 181",
            "severity": "medium"
          },
          {
            "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v5; confidence 70%.",
            "category": "Sustained external TCP conversation outside decoded application coverage",
            "evidence": "frame 21118 / TCP stream 382",
            "severity": "medium"
          }
        ],
        "observables_truncated": true,
        "actor_similarity_leads": [
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Volatile Cedar",
            "similarity": 0.2,
            "shared_count": 1,
            "group_attack_id": "G0123",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Winnti Group",
            "similarity": 0.1667,
            "shared_count": 1,
            "group_attack_id": "G0044",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Ajax Security Team",
            "similarity": 0.1667,
            "shared_count": 1,
            "group_attack_id": "G0130",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "IndigoZebra",
            "similarity": 0.1429,
            "shared_count": 1,
            "group_attack_id": "G0136",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Nomadic Octopus",
            "similarity": 0.1429,
            "shared_count": 1,
            "group_attack_id": "G0133",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Metador",
            "similarity": 0.1111,
            "shared_count": 1,
            "group_attack_id": "G1013",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Whitefly",
            "similarity": 0.1111,
            "shared_count": 1,
            "group_attack_id": "G0107",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Elderwood",
            "similarity": 0.1111,
            "shared_count": 1,
            "group_attack_id": "G0066",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Rancor",
            "similarity": 0.1111,
            "shared_count": 1,
            "group_attack_id": "G0075",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Evilnum",
            "similarity": 0.0909,
            "shared_count": 1,
            "group_attack_id": "G0120",
            "shared_techniques": [
              "T1105"
            ]
          }
        ],
        "reputation_snapshot_sha256": "929b0c28a4f0e3b8ebf28d972f6ef92bb22ccfdb54d82d783958a017d24044ff",
        "expected_suspicious_behaviors": []
      },
      {
        "id": "ttp-evidence:76f521c2-4e4a-41d5-95ad-a44fd9887dd8:T1105",
        "type": "ttp-evidence",
        "label": "T1105 Ingress Tool Transfer",
        "source": "log-pcap-analysis",
        "status": "suggested",
        "tactic": "command-and-control",
        "evidence": "T1105 Ingress Tool Transfer",
        "attack_id": "T1105",
        "confidence": 0.8,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ]
      },
      {
        "id": "finding-e09dcd9d5999adfb4b96a792",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/js/utils/0,30172,,00.js",
          "source": "143.204.29.34",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 78,
            "frame_number": 2004,
            "display_filter": "frame.number == 2004",
            "timestamp_epoch": "1573510890.503812000"
          },
          {
            "tcp_stream": 78,
            "frame_number": 2065,
            "display_filter": "frame.number == 2065",
            "timestamp_epoch": "1573510890.561924000"
          }
        ]
      },
      {
        "id": "finding-b1db1e019517fd380fd50502",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/vip/time2014/js/dist/header-footer.js",
          "source": "13.249.79.119",
          "destination": "10.11.11.179",
          "content_type": "text/html",
          "response_count": 1,
          "declared_body_bytes": 183
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 83,
            "frame_number": 2131,
            "display_filter": "frame.number == 2131",
            "timestamp_epoch": "1573510894.274824000"
          },
          {
            "tcp_stream": 83,
            "frame_number": 2154,
            "display_filter": "frame.number == 2154",
            "timestamp_epoch": "1573510894.298519000"
          }
        ]
      },
      {
        "id": "finding-9ed3252e2708dc1e517c661b",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/libtrc/timeinc-time/loader.js",
          "source": "151.101.50.2",
          "destination": "10.11.11.179",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 32126
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 82,
            "frame_number": 2132,
            "display_filter": "frame.number == 2132",
            "timestamp_epoch": "1573510894.275034000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 2193,
            "display_filter": "frame.number == 2193",
            "timestamp_epoch": "1573510894.323978000"
          }
        ]
      },
      {
        "id": "finding-1e15bbf8465244261632ee5e",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/epq2dmc.js",
          "source": "13.33.255.25",
          "destination": "10.11.11.179",
          "content_type": "application/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 7651
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 2539,
            "display_filter": "frame.number == 2539",
            "timestamp_epoch": "1573510898.297486000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 2586,
            "display_filter": "frame.number == 2586",
            "timestamp_epoch": "1573510898.340728000"
          }
        ]
      },
      {
        "id": "finding-9fcbb5d01fa384ab1385a32e",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/jquery.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 92,
            "frame_number": 2543,
            "display_filter": "frame.number == 2543",
            "timestamp_epoch": "1573510898.299343000"
          },
          {
            "tcp_stream": 92,
            "frame_number": 2668,
            "display_filter": "frame.number == 2668",
            "timestamp_epoch": "1573510898.359390000"
          }
        ]
      },
      {
        "id": "finding-889f290b8f53a9868abb30de",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/main.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 93,
            "frame_number": 2544,
            "display_filter": "frame.number == 2544",
            "timestamp_epoch": "1573510898.299798000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 2645,
            "display_filter": "frame.number == 2645",
            "timestamp_epoch": "1573510898.351816000"
          }
        ]
      },
      {
        "id": "finding-c92d427366d0451d5686f9ae",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/articles.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 87,
            "frame_number": 2573,
            "display_filter": "frame.number == 2573",
            "timestamp_epoch": "1573510898.338392000"
          },
          {
            "tcp_stream": 87,
            "frame_number": 2678,
            "display_filter": "frame.number == 2678",
            "timestamp_epoch": "1573510898.386847000"
          }
        ]
      },
      {
        "id": "finding-c1f2ee743395e3cad97763fb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/showLinks.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 751
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 88,
            "frame_number": 2598,
            "display_filter": "frame.number == 2598",
            "timestamp_epoch": "1573510898.343617000"
          },
          {
            "tcp_stream": 88,
            "frame_number": 2677,
            "display_filter": "frame.number == 2677",
            "timestamp_epoch": "1573510898.386664000"
          }
        ]
      },
      {
        "id": "finding-2d07ca5aebed2a30d8113b0f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/core/scripts/lrs/tin-can.min.js?_=1573510907652",
          "source": "52.218.228.130",
          "destination": "10.11.11.94",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 121587
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 2602,
            "display_filter": "frame.number == 2602",
            "timestamp_epoch": "1573510898.344305000"
          },
          {
            "tcp_stream": 94,
            "frame_number": 3065,
            "display_filter": "frame.number == 3065",
            "timestamp_epoch": "1573510898.799019000"
          }
        ]
      },
      {
        "id": "finding-109f67eef9a633811c65c6ef",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/js/photoessay.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 90,
            "frame_number": 2647,
            "display_filter": "frame.number == 2647",
            "timestamp_epoch": "1573510898.352138000"
          },
          {
            "tcp_stream": 90,
            "frame_number": 2688,
            "display_filter": "frame.number == 2688",
            "timestamp_epoch": "1573510898.396627000"
          }
        ]
      },
      {
        "id": "finding-13e470071a3e7e7e6ff09fa4",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/assets/js/frequency_capping.min.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 319
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 89,
            "frame_number": 2650,
            "display_filter": "frame.number == 2650",
            "timestamp_epoch": "1573510898.352906000"
          },
          {
            "tcp_stream": 89,
            "frame_number": 2692,
            "display_filter": "frame.number == 2692",
            "timestamp_epoch": "1573510898.404287000"
          }
        ]
      },
      {
        "id": "finding-b4fd7f76a0a16972f06b11fd",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/mobileExperience.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 93,
            "frame_number": 2665,
            "display_filter": "frame.number == 2665",
            "timestamp_epoch": "1573510898.357204000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 2696,
            "display_filter": "frame.number == 2696",
            "timestamp_epoch": "1573510898.406195000"
          }
        ]
      },
      {
        "id": "finding-07ec4387ee5d14368a6181b6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/time/rd/trunk/www/web/feds/j/MobileCompatibility.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 92,
            "frame_number": 2670,
            "display_filter": "frame.number == 2670",
            "timestamp_epoch": "1573510898.362102000"
          },
          {
            "tcp_stream": 92,
            "frame_number": 2707,
            "display_filter": "frame.number == 2707",
            "timestamp_epoch": "1573510898.414769000"
          }
        ]
      },
      {
        "id": "finding-3f64c7458ee1944f8674ee17",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/tii/omniture/h/config/time_s_code.js",
          "source": "143.204.29.89",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 87,
            "frame_number": 2684,
            "display_filter": "frame.number == 2684",
            "timestamp_epoch": "1573510898.390152000"
          },
          {
            "tcp_stream": 87,
            "frame_number": 2753,
            "display_filter": "frame.number == 2753",
            "timestamp_epoch": "1573510898.465197000"
          }
        ]
      },
      {
        "id": "finding-862d9fa4fc8ef720e6565ae1",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/templates/black-friday/black-friday.js?_=1573510907653",
          "source": "52.218.228.130",
          "destination": "10.11.11.94",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 14127
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 3078,
            "display_filter": "frame.number == 3078",
            "timestamp_epoch": "1573510898.825231000"
          },
          {
            "tcp_stream": 94,
            "frame_number": 3093,
            "display_filter": "frame.number == 3093",
            "timestamp_epoch": "1573510898.925949000"
          }
        ]
      },
      {
        "id": "finding-99b47b9c79c9079e3c57be6c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/templates/black-friday/snowstorm.js?_=1573510907654",
          "source": "52.218.228.130",
          "destination": "10.11.11.94",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 21206
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 3096,
            "display_filter": "frame.number == 3096",
            "timestamp_epoch": "1573510898.935361000"
          },
          {
            "tcp_stream": 94,
            "frame_number": 3114,
            "display_filter": "frame.number == 3114",
            "timestamp_epoch": "1573510899.057785000"
          }
        ]
      },
      {
        "id": "finding-80dbd5fdd6d563d140210be9",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/v3/twitter_tweet_button.js?login=timeinc&apiKey=[redacted]&",
          "source": "67.199.248.26",
          "destination": "10.11.11.179",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 2869
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 99,
            "frame_number": 3221,
            "display_filter": "frame.number == 3221",
            "timestamp_epoch": "1573510901.336688000"
          },
          {
            "tcp_stream": 99,
            "frame_number": 3226,
            "display_filter": "frame.number == 3226",
            "timestamp_epoch": "1573510901.397578000"
          }
        ]
      },
      {
        "id": "finding-fab757687f59c26a07919583",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ads/tgx.js",
          "source": "13.33.255.51",
          "destination": "10.11.11.179",
          "content_type": "text/html; charset=iso-8859-1",
          "response_count": 1,
          "declared_body_bytes": 251
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 104,
            "frame_number": 3352,
            "display_filter": "frame.number == 3352",
            "timestamp_epoch": "1573510906.374767000"
          },
          {
            "tcp_stream": 104,
            "frame_number": 3354,
            "display_filter": "frame.number == 3354",
            "timestamp_epoch": "1573510906.429069000"
          }
        ]
      },
      {
        "id": "finding-f88653de25bb1b333b1f186b",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/libtrc/impl.349-18-RELEASE.js",
          "source": "151.101.50.2",
          "destination": "10.11.11.179",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 105099
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 141,
            "frame_number": 4785,
            "display_filter": "frame.number == 4785",
            "timestamp_epoch": "1573510926.737347000"
          },
          {
            "tcp_stream": 141,
            "frame_number": 5073,
            "display_filter": "frame.number == 5073",
            "timestamp_epoch": "1573510926.839686000"
          }
        ]
      },
      {
        "id": "finding-15b886f995abce5913038bf9",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/beacon.js",
          "source": "23.203.62.64",
          "destination": "10.11.11.179",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 901
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 142,
            "frame_number": 4789,
            "display_filter": "frame.number == 4789",
            "timestamp_epoch": "1573510926.746585000"
          },
          {
            "tcp_stream": 142,
            "frame_number": 4844,
            "display_filter": "frame.number == 4844",
            "timestamp_epoch": "1573510926.780050000"
          }
        ]
      },
      {
        "id": "finding-8c1c673d0e9fac826a1b652e",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/1709/i.js",
          "source": "35.190.92.63",
          "destination": "10.11.11.179",
          "content_type": "text/plain; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 6677
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 149,
            "frame_number": 5585,
            "display_filter": "frame.number == 5585",
            "timestamp_epoch": "1573510930.707995000"
          },
          {
            "tcp_stream": 149,
            "frame_number": 5640,
            "display_filter": "frame.number == 5640",
            "timestamp_epoch": "1573510930.767177000"
          }
        ]
      },
      {
        "id": "finding-88ff783e54a30dfd866a85e3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/assets/smart-tag/versioned/ijs_all_modules_cjs_min_69f909e1f154dad67bb582362cdca3b2.js",
          "source": "34.98.72.95",
          "destination": "10.11.11.179",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 112507
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 160,
            "frame_number": 5899,
            "display_filter": "frame.number == 5899",
            "timestamp_epoch": "1573510933.804339000"
          },
          {
            "tcp_stream": 160,
            "frame_number": 6045,
            "display_filter": "frame.number == 6045",
            "timestamp_epoch": "1573510933.908371000"
          }
        ]
      },
      {
        "id": "finding-4f791610c9e593fd1c347223",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/common_js/start_facebook.js",
          "source": "12.133.50.21",
          "destination": "10.11.11.195",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 411
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 167,
            "frame_number": 6247,
            "display_filter": "frame.number == 6247",
            "timestamp_epoch": "1573510939.796385000"
          },
          {
            "tcp_stream": 167,
            "frame_number": 6271,
            "display_filter": "frame.number == 6271",
            "timestamp_epoch": "1573510939.851824000"
          }
        ]
      },
      {
        "id": "finding-80570e7cac23d827d3bd2254",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/common_js/polyfills.js",
          "source": "12.133.50.21",
          "destination": "10.11.11.195",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 32943
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 166,
            "frame_number": 6248,
            "display_filter": "frame.number == 6248",
            "timestamp_epoch": "1573510939.796386000"
          },
          {
            "tcp_stream": 166,
            "frame_number": 6358,
            "display_filter": "frame.number == 6358",
            "timestamp_epoch": "1573510939.956983000"
          }
        ]
      },
      {
        "id": "finding-5118020d75cbb7a7b6033973",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/startup.js?script_version=1567795643",
          "source": "12.133.50.21",
          "destination": "10.11.11.195",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 3511
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 179,
            "frame_number": 6488,
            "display_filter": "frame.number == 6488",
            "timestamp_epoch": "1573510940.135501000"
          },
          {
            "tcp_stream": 179,
            "frame_number": 6503,
            "display_filter": "frame.number == 6503",
            "timestamp_epoch": "1573510940.202037000"
          }
        ]
      },
      {
        "id": "finding-69f6050c83e7c2315cb9d251",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ajax/libs/jquery/1.9.1/jquery.min.js",
          "source": "172.217.12.42",
          "destination": "10.11.11.195",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 33018
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 196,
            "frame_number": 6999,
            "display_filter": "frame.number == 6999",
            "timestamp_epoch": "1573510943.924921000"
          },
          {
            "tcp_stream": 196,
            "frame_number": 7127,
            "display_filter": "frame.number == 7127",
            "timestamp_epoch": "1573510943.991651000"
          }
        ]
      },
      {
        "id": "finding-14938d416d5ae1c43118ccd5",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/3778170.js",
          "source": "104.17.213.204",
          "destination": "10.11.11.195",
          "content_type": "application/json;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 197,
            "frame_number": 7021,
            "display_filter": "frame.number == 7021",
            "timestamp_epoch": "1573510943.945668000"
          },
          {
            "tcp_stream": 197,
            "frame_number": 7091,
            "display_filter": "frame.number == 7091",
            "timestamp_epoch": "1573510943.977789000"
          }
        ]
      },
      {
        "id": "finding-005d05b8f254e72eab9d87b8",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/prod/assets/themes/magazines/default/template-resources/js/shared/jsUtilityLibrary1.js",
          "source": "13.33.255.72",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 17246
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 206,
            "frame_number": 7211,
            "display_filter": "frame.number == 7211",
            "timestamp_epoch": "1573510944.061392000"
          },
          {
            "tcp_stream": 206,
            "frame_number": 7464,
            "display_filter": "frame.number == 7464",
            "timestamp_epoch": "1573510944.540158000"
          }
        ]
      },
      {
        "id": "finding-f721a3717e95fed869f9aefd",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/prod/assets/themes/magazines/default/template-resources/js/shared/ofie_regex.js",
          "source": "13.33.255.72",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 409
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 7212,
            "display_filter": "frame.number == 7212",
            "timestamp_epoch": "1573510944.061785000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 7441,
            "display_filter": "frame.number == 7441",
            "timestamp_epoch": "1573510944.500250000"
          }
        ]
      },
      {
        "id": "finding-4ee4919d9d7374919cac7fe6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/prod/assets/themes/magazines/default/template-resources/js/omniture/config/timecom.js",
          "source": "13.33.255.72",
          "destination": "10.11.11.179",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 18127
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 208,
            "frame_number": 7213,
            "display_filter": "frame.number == 7213",
            "timestamp_epoch": "1573510944.062232000"
          },
          {
            "tcp_stream": 208,
            "frame_number": 7362,
            "display_filter": "frame.number == 7362",
            "timestamp_epoch": "1573510944.112243000"
          }
        ]
      },
      {
        "id": "finding-ebb2b08079fab6587639ef20",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/pagead/js/adsbygoogle.js",
          "source": "172.217.6.162",
          "destination": "10.11.11.179",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 37729
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 229,
            "frame_number": 8476,
            "display_filter": "frame.number == 8476",
            "timestamp_epoch": "1573510952.331669000"
          },
          {
            "tcp_stream": 229,
            "frame_number": 8536,
            "display_filter": "frame.number == 8536",
            "timestamp_epoch": "1573510952.408272000"
          }
        ]
      },
      {
        "id": "finding-6e2dde6b888d3bf34771669d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ajax/libs/jquery/1.12.4/jquery.min.js",
          "source": "172.217.12.42",
          "destination": "10.11.11.217",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 33951
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 235,
            "frame_number": 8827,
            "display_filter": "frame.number == 8827",
            "timestamp_epoch": "1573510957.544024000"
          },
          {
            "tcp_stream": 235,
            "frame_number": 8911,
            "display_filter": "frame.number == 8911",
            "timestamp_epoch": "1573510957.593346000"
          }
        ]
      },
      {
        "id": "finding-1782958f58f8e457bf60ca27",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/super-rss-reader/public/srr-js.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 8938,
            "display_filter": "frame.number == 8938",
            "timestamp_epoch": "1573510957.618536000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 8949,
            "display_filter": "frame.number == 8949",
            "timestamp_epoch": "1573510957.675777000"
          }
        ]
      },
      {
        "id": "finding-555d6b58934875d3d475e781",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/iphonehacks/js/modernizr.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 8942,
            "display_filter": "frame.number == 8942",
            "timestamp_epoch": "1573510957.620030000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 8964,
            "display_filter": "frame.number == 8964",
            "timestamp_epoch": "1573510957.679573000"
          }
        ]
      },
      {
        "id": "finding-6c74ec0fdc2b11fd98cefbe3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/jquery-migrate.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 8968,
            "display_filter": "frame.number == 8968",
            "timestamp_epoch": "1573510957.681311000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 8993,
            "display_filter": "frame.number == 8993",
            "timestamp_epoch": "1573510957.737887000"
          }
        ]
      },
      {
        "id": "finding-576dee4ce3e7a4176e72f823",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/iphonehacks/js/app.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 233,
            "frame_number": 8976,
            "display_filter": "frame.number == 8976",
            "timestamp_epoch": "1573510957.686331000"
          },
          {
            "tcp_stream": 233,
            "frame_number": 8994,
            "display_filter": "frame.number == 8994",
            "timestamp_epoch": "1573510957.738054000"
          }
        ]
      },
      {
        "id": "finding-ce15f8bfe8a97eadf4ad73bc",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/lazy-load/js/jquery.sonar.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 8977,
            "display_filter": "frame.number == 8977",
            "timestamp_epoch": "1573510957.687343000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 8995,
            "display_filter": "frame.number == 8995",
            "timestamp_epoch": "1573510957.738242000"
          }
        ]
      },
      {
        "id": "finding-42719d747a18267a9db33f72",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/lazy-load/js/lazy-load.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8989,
            "display_filter": "frame.number == 8989",
            "timestamp_epoch": "1573510957.729932000"
          },
          {
            "tcp_stream": 231,
            "frame_number": 9004,
            "display_filter": "frame.number == 9004",
            "timestamp_epoch": "1573510957.781888000"
          }
        ]
      },
      {
        "id": "finding-4d58cb2dcf80da97c75ca32d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/q2w3-fixed-widget/js/q2w3-fixed-widget.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 9001,
            "display_filter": "frame.number == 9001",
            "timestamp_epoch": "1573510957.745607000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 9010,
            "display_filter": "frame.number == 9010",
            "timestamp_epoch": "1573510957.797413000"
          }
        ]
      },
      {
        "id": "finding-18f391f57758e43242e5ef76",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/comment-reply.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 233,
            "frame_number": 9002,
            "display_filter": "frame.number == 9002",
            "timestamp_epoch": "1573510957.746162000"
          },
          {
            "tcp_stream": 233,
            "frame_number": 9008,
            "display_filter": "frame.number == 9008",
            "timestamp_epoch": "1573510957.796883000"
          }
        ]
      },
      {
        "id": "finding-7ae704bd8a5f6955c53c00bc",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/iphonehacks/js/foundation.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 9003,
            "display_filter": "frame.number == 9003",
            "timestamp_epoch": "1573510957.746739000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 9044,
            "display_filter": "frame.number == 9044",
            "timestamp_epoch": "1573510957.813919000"
          }
        ]
      },
      {
        "id": "finding-b9d3c7f741c2440f58820e20",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/wp-embed.min.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 9006,
            "display_filter": "frame.number == 9006",
            "timestamp_epoch": "1573510957.786375000"
          },
          {
            "tcp_stream": 231,
            "frame_number": 9047,
            "display_filter": "frame.number == 9047",
            "timestamp_epoch": "1573510957.846581000"
          }
        ]
      },
      {
        "id": "finding-8eee3e84d71af9e6b26c005a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/iphonehacks/js/jquery.fitvids.js",
          "source": "35.185.55.255",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 233,
            "frame_number": 9029,
            "display_filter": "frame.number == 9029",
            "timestamp_epoch": "1573510957.805026000"
          },
          {
            "tcp_stream": 233,
            "frame_number": 9051,
            "display_filter": "frame.number == 9051",
            "timestamp_epoch": "1573510957.860478000"
          }
        ]
      },
      {
        "id": "finding-4d6e2490a3027fb815f25bce",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/tag/js/gpt.js",
          "source": "172.217.6.162",
          "destination": "10.11.11.217",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 15651
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 237,
            "frame_number": 9076,
            "display_filter": "frame.number == 9076",
            "timestamp_epoch": "1573510957.951796000"
          },
          {
            "tcp_stream": 237,
            "frame_number": 9129,
            "display_filter": "frame.number == 9129",
            "timestamp_epoch": "1573510958.006386000"
          }
        ]
      },
      {
        "id": "finding-45c32d99e77eec72658b89e0",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/bounce/init1.js?tojQ=function&cts=1573510956419&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22r%22%3A%22%22%7D&cookie=%7B%22v%22%3A%7B%22value_in_cart%22%3A0%2C%22ref_persist%22%3A%22%22%7D%2C%22fvt%22%3A1573510543%2C%22vid%22%3A1573510543567356%2C%22ao%22%3A0%2C%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22as%22%3A0%2C%22vpv%22%3A1%2C%22d%22%3A%22d%22%2C%22r%22%3A%22%22%2C%22cvt%22%3A1573510543%2C%22sid%22%3A6%2C%22gcr%22%3A18%2C%22m%22%3A0%2C%22did%22%3A%227348910884260421544%22%2C%22lvt%22%3A1573510575%2C%22campaigns%22%3A%7B%221004275%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510575%7D%2C%221015182%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510575%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510543%2C%22av%22%3A1%2C%22fsa%22%3A1573510543%2C%22as%22%3A1%2C%22ao%22%3A1%7D%2C%221025199%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510575%7D%7D%7D&vars[items_in_cart]=0&vars[value_in_cart]=0&vars[video_playing]=false&vars[ref_persist]=&vars[sponsorship_present]=not_ready&vars[subscribed_today]=195&vars[subscribed_this_week]=1%2C129&vars[page_tag]=&vars[page_type]=article&vars[breadcrumb]=false&vars[article_class]=false&vars[dfp_rblock]=allow&vars[backfill_deployment]=&vars[time_on_site]=false&vdef[value_in_cart]=0&cookie_too_large=false&bp=0&etp=[]&pts=&compliance_flag=",
          "source": "35.186.255.8",
          "destination": "10.11.11.179",
          "content_type": "text/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 246,
            "frame_number": 9624,
            "display_filter": "frame.number == 9624",
            "timestamp_epoch": "1573510960.220052000"
          },
          {
            "tcp_stream": 246,
            "frame_number": 9707,
            "display_filter": "frame.number == 9707",
            "timestamp_epoch": "1573510960.327793000"
          }
        ]
      },
      {
        "id": "finding-1a4f9b687476ec68199d7f2d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/analytics.js/v1/Tjrt25JUOrbvQQX1cGykGGzC3GncV6F9/analytics.min.js",
          "source": "143.204.31.50",
          "destination": "10.11.11.179",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 57182
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 245,
            "frame_number": 9627,
            "display_filter": "frame.number == 9627",
            "timestamp_epoch": "1573510960.241067000"
          },
          {
            "tcp_stream": 245,
            "frame_number": 9744,
            "display_filter": "frame.number == 9744",
            "timestamp_epoch": "1573510960.353742000"
          }
        ]
      },
      {
        "id": "finding-c9ce41bbc7f9a4e002705d3f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/bounce/reloadCampaigns.js?tojQ=function&cts=1573510961475&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22r%22%3A%22%22%7D&cookie=%7B%22v%22%3A%7B%22value_in_cart%22%3A0%2C%22ref_persist%22%3A%22%22%7D%2C%22fvt%22%3A1573510960%2C%22vid%22%3A1573510543567356%2C%22ao%22%3A0%2C%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22as%22%3A0%2C%22vpv%22%3A2%2C%22d%22%3A%22d%22%2C%22r%22%3A%22%22%2C%22cvt%22%3A1573510543%2C%22sid%22%3A13%2C%22gcr%22%3A18%2C%22m%22%3A0%2C%22did%22%3A%227348910884260421544%22%2C%22lvt%22%3A1573510960%2C%22campaigns%22%3A%7B%22873465%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510960%2C%22av%22%3A1%2C%22fsa%22%3A1573510960%2C%22as%22%3A1%2C%22ao%22%3A1%7D%2C%221004275%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510960%7D%2C%221015182%22%3A%7B%22vv%22%3A2%2C%22lvt%22%3A1573510960%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510960%2C%22av%22%3A2%2C%22fsa%22%3A1573510543%2C%22as%22%3A2%2C%22ao%22%3A2%7D%2C%221025199%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510960%7D%2C%221025997%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%7D%2C%221026031%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%7D%7D%7D&vars[items_in_cart]=0&vars[value_in_cart]=0&vars[video_playing]=false&vars[ref_persist]=&vars[sponsorship_present]=not_ready&vars[subscribed_today]=195&vars[subscribed_this_week]=1%2C129&vars[page_tag]=&vars[page_type]=article&vars[breadcrumb]=false&vars[article_class]=false&vars[dfp_rblock]=allow&vars[backfill_deployment]=&vars[time_on_site]=false&cookie_too_large=false&bp=0&etp=[]&pts=&compliance_flag=&pvid=2&vc[]=873465&vc[]=1015182&rltype=dfp_rblock&rlname=variable",
          "source": "35.186.255.8",
          "destination": "10.11.11.179",
          "content_type": "text/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 246,
            "frame_number": 9815,
            "display_filter": "frame.number == 9815",
            "timestamp_epoch": "1573510961.293828000"
          },
          {
            "tcp_stream": 246,
            "frame_number": 9840,
            "display_filter": "frame.number == 9840",
            "timestamp_epoch": "1573510961.396883000"
          }
        ]
      },
      {
        "id": "finding-c32e8af9e7c13d89bd24ecd3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/adsense/search/async-ads.js",
          "source": "172.217.2.238",
          "destination": "10.11.11.217",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 251,
            "frame_number": 10077,
            "display_filter": "frame.number == 10077",
            "timestamp_epoch": "1573510961.960358000"
          },
          {
            "tcp_stream": 251,
            "frame_number": 10170,
            "display_filter": "frame.number == 10170",
            "timestamp_epoch": "1573510962.065853000"
          }
        ]
      },
      {
        "id": "finding-76add41a51f9a0d78cc5c0e1",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/aax2/apstag.js",
          "source": "143.204.26.216",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 265,
            "frame_number": 11469,
            "display_filter": "frame.number == 11469",
            "timestamp_epoch": "1573510979.499493000"
          },
          {
            "tcp_stream": 265,
            "frame_number": 11537,
            "display_filter": "frame.number == 11537",
            "timestamp_epoch": "1573510979.557009000"
          }
        ]
      },
      {
        "id": "finding-c621c3dc9f63451f9770bafb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/bao-csm/aps-comm/aps_csm.js",
          "source": "143.204.26.216",
          "destination": "10.11.11.217",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 267,
            "frame_number": 11563,
            "display_filter": "frame.number == 11563",
            "timestamp_epoch": "1573510979.700502000"
          },
          {
            "tcp_stream": 267,
            "frame_number": 11592,
            "display_filter": "frame.number == 11592",
            "timestamp_epoch": "1573510979.747829000"
          }
        ]
      },
      {
        "id": "finding-c6545d58bc164226c2a508d7",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/static/ofi.browser.293d64b6588f.js",
          "source": "13.33.255.37",
          "destination": "10.11.11.200",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 286,
            "frame_number": 13545,
            "display_filter": "frame.number == 13545",
            "timestamp_epoch": "1573511003.749282000"
          },
          {
            "tcp_stream": 286,
            "frame_number": 13550,
            "display_filter": "frame.number == 13550",
            "timestamp_epoch": "1573511003.796770000"
          }
        ]
      },
      {
        "id": "finding-3af5f3e570250f52bc922f4d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/tags/iPhoneHackscom/ROS/tags.js",
          "source": "104.100.226.86",
          "destination": "10.11.11.217",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 2305
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 301,
            "frame_number": 14053,
            "display_filter": "frame.number == 14053",
            "timestamp_epoch": "1573511007.936224000"
          },
          {
            "tcp_stream": 301,
            "frame_number": 14459,
            "display_filter": "frame.number == 14459",
            "timestamp_epoch": "1573511008.014475000"
          }
        ]
      },
      {
        "id": "finding-002e225be391f268ae0235f6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/friendbuy.min.js",
          "source": "13.33.252.19",
          "destination": "10.11.11.200",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 304,
            "frame_number": 17289,
            "display_filter": "frame.number == 17289",
            "timestamp_epoch": "1573511015.954433000"
          },
          {
            "tcp_stream": 304,
            "frame_number": 17355,
            "display_filter": "frame.number == 17355",
            "timestamp_epoch": "1573511016.060303000"
          }
        ]
      },
      {
        "id": "finding-0eb12d02fc912d1a7b6527cb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/real/tags/iPhoneHackscom/ROS/tags.js",
          "source": "23.204.246.46",
          "destination": "10.11.11.217",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 13993
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 310,
            "frame_number": 17669,
            "display_filter": "frame.number == 17669",
            "timestamp_epoch": "1573511028.113020000"
          },
          {
            "tcp_stream": 310,
            "frame_number": 17690,
            "display_filter": "frame.number == 17690",
            "timestamp_epoch": "1573511028.215351000"
          }
        ]
      },
      {
        "id": "finding-ea33bddc54f82fe3782eebe6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/displayAd.js?dver=0.8&th=7460035367",
          "source": "23.204.246.46",
          "destination": "10.11.11.217",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 329
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 310,
            "frame_number": 17701,
            "display_filter": "frame.number == 17701",
            "timestamp_epoch": "1573511028.252987000"
          },
          {
            "tcp_stream": 310,
            "frame_number": 17705,
            "display_filter": "frame.number == 17705",
            "timestamp_epoch": "1573511028.405049000"
          }
        ]
      },
      {
        "id": "finding-18b56c7bf1e5dc9c69c76750",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/pagead/js/adsbygoogle.js",
          "source": "172.217.6.162",
          "destination": "10.11.11.217",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 37729
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 311,
            "frame_number": 17717,
            "display_filter": "frame.number == 17717",
            "timestamp_epoch": "1573511028.625724000"
          },
          {
            "tcp_stream": 311,
            "frame_number": 17786,
            "display_filter": "frame.number == 17786",
            "timestamp_epoch": "1573511028.714916000"
          }
        ]
      },
      {
        "id": "finding-2645f34515569b143cb49a19",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/friendbuy.min.js",
          "source": "13.33.252.19",
          "destination": "10.11.11.200",
          "content_type": "",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 304,
            "frame_number": 18497,
            "display_filter": "frame.number == 18497",
            "timestamp_epoch": "1573511032.636214000"
          },
          {
            "tcp_stream": 304,
            "frame_number": 18612,
            "display_filter": "frame.number == 18612",
            "timestamp_epoch": "1573511032.684875000"
          }
        ]
      },
      {
        "id": "finding-9cab16d5972c4151b40608b3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/v2/ktag.js?tid=KT-N2BAB-3ED",
          "source": "34.194.61.181",
          "destination": "10.11.11.200",
          "content_type": "text/plain",
          "response_count": 1,
          "declared_body_bytes": 4229
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 377,
            "frame_number": 21023,
            "display_filter": "frame.number == 21023",
            "timestamp_epoch": "1573511048.396501000"
          },
          {
            "tcp_stream": 377,
            "frame_number": 21038,
            "display_filter": "frame.number == 21038",
            "timestamp_epoch": "1573511048.453246000"
          }
        ]
      },
      {
        "id": "finding-f95dce1faf44bb87f3de7058",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.11",
          "protocol": "drsuapi",
          "destination": "10.11.11.200",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 224,
            "display_filter": "frame.number == 224",
            "timestamp_epoch": "1573510823.608927000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 226,
            "display_filter": "frame.number == 226",
            "timestamp_epoch": "1573510823.611247000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 228,
            "display_filter": "frame.number == 228",
            "timestamp_epoch": "1573510823.613287000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 230,
            "display_filter": "frame.number == 230",
            "timestamp_epoch": "1573510823.614922000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3803,
            "display_filter": "frame.number == 3803",
            "timestamp_epoch": "1573510916.798473000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3805,
            "display_filter": "frame.number == 3805",
            "timestamp_epoch": "1573510916.800503000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3807,
            "display_filter": "frame.number == 3807",
            "timestamp_epoch": "1573510916.806054000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3809,
            "display_filter": "frame.number == 3809",
            "timestamp_epoch": "1573510916.809276000"
          }
        ]
      },
      {
        "id": "finding-932232688a89d49e3720be17",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.11",
          "protocol": "ldap",
          "destination": "10.11.11.200",
          "event_count": 33,
          "operation_numbers": [
            "",
            "1",
            "4,19,19,19,5",
            "4,5",
            "5"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 122,
            "display_filter": "frame.number == 122",
            "timestamp_epoch": "1573510822.788430000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 171,
            "display_filter": "frame.number == 171",
            "timestamp_epoch": "1573510822.931519000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 247,
            "display_filter": "frame.number == 247",
            "timestamp_epoch": "1573510824.444777000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 252,
            "display_filter": "frame.number == 252",
            "timestamp_epoch": "1573510824.450826000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 266,
            "display_filter": "frame.number == 266",
            "timestamp_epoch": "1573510824.496875000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 281,
            "display_filter": "frame.number == 281",
            "timestamp_epoch": "1573510824.529345000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 287,
            "display_filter": "frame.number == 287",
            "timestamp_epoch": "1573510824.532437000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 291,
            "display_filter": "frame.number == 291",
            "timestamp_epoch": "1573510824.535673000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 298,
            "display_filter": "frame.number == 298",
            "timestamp_epoch": "1573510824.540255000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 490,
            "display_filter": "frame.number == 490",
            "timestamp_epoch": "1573510831.714713000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 495,
            "display_filter": "frame.number == 495",
            "timestamp_epoch": "1573510831.725047000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 497,
            "display_filter": "frame.number == 497",
            "timestamp_epoch": "1573510831.730110000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 499,
            "display_filter": "frame.number == 499",
            "timestamp_epoch": "1573510831.731812000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 501,
            "display_filter": "frame.number == 501",
            "timestamp_epoch": "1573510831.733976000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 503,
            "display_filter": "frame.number == 503",
            "timestamp_epoch": "1573510831.736119000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 512,
            "display_filter": "frame.number == 512",
            "timestamp_epoch": "1573510831.815906000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 514,
            "display_filter": "frame.number == 514",
            "timestamp_epoch": "1573510831.817865000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 547,
            "display_filter": "frame.number == 547",
            "timestamp_epoch": "1573510831.970464000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3845,
            "display_filter": "frame.number == 3845",
            "timestamp_epoch": "1573510917.415659000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3848,
            "display_filter": "frame.number == 3848",
            "timestamp_epoch": "1573510917.426545000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3855,
            "display_filter": "frame.number == 3855",
            "timestamp_epoch": "1573510917.467319000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3857,
            "display_filter": "frame.number == 3857",
            "timestamp_epoch": "1573510917.469660000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3859,
            "display_filter": "frame.number == 3859",
            "timestamp_epoch": "1573510917.471613000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3861,
            "display_filter": "frame.number == 3861",
            "timestamp_epoch": "1573510917.474157000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22621,
            "display_filter": "frame.number == 22621",
            "timestamp_epoch": "1573511740.288153000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22638,
            "display_filter": "frame.number == 22638",
            "timestamp_epoch": "1573511740.327629000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22640,
            "display_filter": "frame.number == 22640",
            "timestamp_epoch": "1573511740.330913000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22642,
            "display_filter": "frame.number == 22642",
            "timestamp_epoch": "1573511740.346532000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22654,
            "display_filter": "frame.number == 22654",
            "timestamp_epoch": "1573511740.541831000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22666,
            "display_filter": "frame.number == 22666",
            "timestamp_epoch": "1573511740.744979000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22674,
            "display_filter": "frame.number == 22674",
            "timestamp_epoch": "1573511740.781127000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22682,
            "display_filter": "frame.number == 22682",
            "timestamp_epoch": "1573511740.823016000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22684,
            "display_filter": "frame.number == 22684",
            "timestamp_epoch": "1573511740.832378000"
          }
        ]
      },
      {
        "id": "finding-4a521052654cf6590cb0be74",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.11",
          "protocol": "drsuapi",
          "destination": "10.11.11.203",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1399,
            "display_filter": "frame.number == 1399",
            "timestamp_epoch": "1573510873.323496000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1401,
            "display_filter": "frame.number == 1401",
            "timestamp_epoch": "1573510873.331361000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1573510873.334618000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1405,
            "display_filter": "frame.number == 1405",
            "timestamp_epoch": "1573510873.338157000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3415,
            "display_filter": "frame.number == 3415",
            "timestamp_epoch": "1573510908.234967000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3417,
            "display_filter": "frame.number == 3417",
            "timestamp_epoch": "1573510908.237706000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3419,
            "display_filter": "frame.number == 3419",
            "timestamp_epoch": "1573510908.240241000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3421,
            "display_filter": "frame.number == 3421",
            "timestamp_epoch": "1573510908.245372000"
          }
        ]
      },
      {
        "id": "finding-121cf8282cdc958878f82b04",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.11",
          "protocol": "ldap",
          "destination": "10.11.11.203",
          "event_count": 33,
          "operation_numbers": [
            "",
            "1",
            "4,19,19,19,5",
            "4,5",
            "5"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1303,
            "display_filter": "frame.number == 1303",
            "timestamp_epoch": "1573510872.446083000"
          },
          {
            "tcp_stream": 45,
            "frame_number": 1337,
            "display_filter": "frame.number == 1337",
            "timestamp_epoch": "1573510872.599640000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1424,
            "display_filter": "frame.number == 1424",
            "timestamp_epoch": "1573510874.105446000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1429,
            "display_filter": "frame.number == 1429",
            "timestamp_epoch": "1573510874.110730000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1443,
            "display_filter": "frame.number == 1443",
            "timestamp_epoch": "1573510874.153097000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1459,
            "display_filter": "frame.number == 1459",
            "timestamp_epoch": "1573510874.187192000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1465,
            "display_filter": "frame.number == 1465",
            "timestamp_epoch": "1573510874.190036000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1469,
            "display_filter": "frame.number == 1469",
            "timestamp_epoch": "1573510874.193321000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1476,
            "display_filter": "frame.number == 1476",
            "timestamp_epoch": "1573510874.197496000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1736,
            "display_filter": "frame.number == 1736",
            "timestamp_epoch": "1573510882.354582000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1742,
            "display_filter": "frame.number == 1742",
            "timestamp_epoch": "1573510882.363871000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1746,
            "display_filter": "frame.number == 1746",
            "timestamp_epoch": "1573510882.371225000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1749,
            "display_filter": "frame.number == 1749",
            "timestamp_epoch": "1573510882.373734000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1751,
            "display_filter": "frame.number == 1751",
            "timestamp_epoch": "1573510882.379008000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1753,
            "display_filter": "frame.number == 1753",
            "timestamp_epoch": "1573510882.381701000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1764,
            "display_filter": "frame.number == 1764",
            "timestamp_epoch": "1573510882.429982000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1766,
            "display_filter": "frame.number == 1766",
            "timestamp_epoch": "1573510882.437616000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1798,
            "display_filter": "frame.number == 1798",
            "timestamp_epoch": "1573510882.594064000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3443,
            "display_filter": "frame.number == 3443",
            "timestamp_epoch": "1573510908.829913000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3445,
            "display_filter": "frame.number == 3445",
            "timestamp_epoch": "1573510908.837973000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3452,
            "display_filter": "frame.number == 3452",
            "timestamp_epoch": "1573510908.894226000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3454,
            "display_filter": "frame.number == 3454",
            "timestamp_epoch": "1573510908.898369000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3456,
            "display_filter": "frame.number == 3456",
            "timestamp_epoch": "1573510908.900766000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3458,
            "display_filter": "frame.number == 3458",
            "timestamp_epoch": "1573510908.903712000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22734,
            "display_filter": "frame.number == 22734",
            "timestamp_epoch": "1573511791.989608000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22751,
            "display_filter": "frame.number == 22751",
            "timestamp_epoch": "1573511792.039150000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22753,
            "display_filter": "frame.number == 22753",
            "timestamp_epoch": "1573511792.042024000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22755,
            "display_filter": "frame.number == 22755",
            "timestamp_epoch": "1573511792.045149000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22767,
            "display_filter": "frame.number == 22767",
            "timestamp_epoch": "1573511792.180482000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22779,
            "display_filter": "frame.number == 22779",
            "timestamp_epoch": "1573511792.330719000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22786,
            "display_filter": "frame.number == 22786",
            "timestamp_epoch": "1573511792.370954000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22795,
            "display_filter": "frame.number == 22795",
            "timestamp_epoch": "1573511792.410188000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22797,
            "display_filter": "frame.number == 22797",
            "timestamp_epoch": "1573511792.413040000"
          }
        ]
      },
      {
        "id": "finding-d8c964d840ad179845de017d",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.200",
          "protocol": "drsuapi",
          "destination": "10.11.11.11",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 223,
            "display_filter": "frame.number == 223",
            "timestamp_epoch": "1573510823.608599000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 225,
            "display_filter": "frame.number == 225",
            "timestamp_epoch": "1573510823.610809000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 227,
            "display_filter": "frame.number == 227",
            "timestamp_epoch": "1573510823.612821000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 229,
            "display_filter": "frame.number == 229",
            "timestamp_epoch": "1573510823.614781000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3802,
            "display_filter": "frame.number == 3802",
            "timestamp_epoch": "1573510916.798137000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3804,
            "display_filter": "frame.number == 3804",
            "timestamp_epoch": "1573510916.800073000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3806,
            "display_filter": "frame.number == 3806",
            "timestamp_epoch": "1573510916.805606000"
          },
          {
            "tcp_stream": 123,
            "frame_number": 3808,
            "display_filter": "frame.number == 3808",
            "timestamp_epoch": "1573510916.807602000"
          }
        ]
      },
      {
        "id": "finding-cbe344269579cefde5fc84df",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.200",
          "protocol": "ldap",
          "destination": "10.11.11.11",
          "event_count": 41,
          "operation_numbers": [
            "",
            "0",
            "2",
            "3"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 120,
            "display_filter": "frame.number == 120",
            "timestamp_epoch": "1573510822.788114000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 169,
            "display_filter": "frame.number == 169",
            "timestamp_epoch": "1573510822.930227000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 172,
            "display_filter": "frame.number == 172",
            "timestamp_epoch": "1573510822.943007000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 245,
            "display_filter": "frame.number == 245",
            "timestamp_epoch": "1573510824.444494000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 250,
            "display_filter": "frame.number == 250",
            "timestamp_epoch": "1573510824.449841000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 265,
            "display_filter": "frame.number == 265",
            "timestamp_epoch": "1573510824.496555000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 277,
            "display_filter": "frame.number == 277",
            "timestamp_epoch": "1573510824.526806000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 286,
            "display_filter": "frame.number == 286",
            "timestamp_epoch": "1573510824.532252000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 290,
            "display_filter": "frame.number == 290",
            "timestamp_epoch": "1573510824.535423000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 296,
            "display_filter": "frame.number == 296",
            "timestamp_epoch": "1573510824.539010000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 373,
            "display_filter": "frame.number == 373",
            "timestamp_epoch": "1573510824.873008000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 388,
            "display_filter": "frame.number == 388",
            "timestamp_epoch": "1573510825.317313000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 488,
            "display_filter": "frame.number == 488",
            "timestamp_epoch": "1573510831.714444000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 493,
            "display_filter": "frame.number == 493",
            "timestamp_epoch": "1573510831.723771000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 496,
            "display_filter": "frame.number == 496",
            "timestamp_epoch": "1573510831.729917000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 498,
            "display_filter": "frame.number == 498",
            "timestamp_epoch": "1573510831.731611000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 500,
            "display_filter": "frame.number == 500",
            "timestamp_epoch": "1573510831.733646000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 502,
            "display_filter": "frame.number == 502",
            "timestamp_epoch": "1573510831.735770000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 510,
            "display_filter": "frame.number == 510",
            "timestamp_epoch": "1573510831.814937000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 513,
            "display_filter": "frame.number == 513",
            "timestamp_epoch": "1573510831.817712000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 546,
            "display_filter": "frame.number == 546",
            "timestamp_epoch": "1573510831.970026000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 548,
            "display_filter": "frame.number == 548",
            "timestamp_epoch": "1573510831.994566000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 550,
            "display_filter": "frame.number == 550",
            "timestamp_epoch": "1573510831.994569000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3843,
            "display_filter": "frame.number == 3843",
            "timestamp_epoch": "1573510917.414704000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3847,
            "display_filter": "frame.number == 3847",
            "timestamp_epoch": "1573510917.426196000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3853,
            "display_filter": "frame.number == 3853",
            "timestamp_epoch": "1573510917.466351000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3856,
            "display_filter": "frame.number == 3856",
            "timestamp_epoch": "1573510917.469464000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3858,
            "display_filter": "frame.number == 3858",
            "timestamp_epoch": "1573510917.471371000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3860,
            "display_filter": "frame.number == 3860",
            "timestamp_epoch": "1573510917.473710000"
          },
          {
            "tcp_stream": 127,
            "frame_number": 3919,
            "display_filter": "frame.number == 3919",
            "timestamp_epoch": "1573510917.631483000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 3942,
            "display_filter": "frame.number == 3942",
            "timestamp_epoch": "1573510918.128832000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22619,
            "display_filter": "frame.number == 22619",
            "timestamp_epoch": "1573511740.287774000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22636,
            "display_filter": "frame.number == 22636",
            "timestamp_epoch": "1573511740.326576000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22639,
            "display_filter": "frame.number == 22639",
            "timestamp_epoch": "1573511740.330690000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22641,
            "display_filter": "frame.number == 22641",
            "timestamp_epoch": "1573511740.346142000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22653,
            "display_filter": "frame.number == 22653",
            "timestamp_epoch": "1573511740.541505000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22664,
            "display_filter": "frame.number == 22664",
            "timestamp_epoch": "1573511740.744529000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22673,
            "display_filter": "frame.number == 22673",
            "timestamp_epoch": "1573511740.780772000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22681,
            "display_filter": "frame.number == 22681",
            "timestamp_epoch": "1573511740.822691000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22683,
            "display_filter": "frame.number == 22683",
            "timestamp_epoch": "1573511740.832103000"
          },
          {
            "tcp_stream": 433,
            "frame_number": 22685,
            "display_filter": "frame.number == 22685",
            "timestamp_epoch": "1573511740.840703000"
          }
        ]
      },
      {
        "id": "finding-ccc9d4dff22262d92ee891a8",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.203",
          "protocol": "drsuapi",
          "destination": "10.11.11.11",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1398,
            "display_filter": "frame.number == 1398",
            "timestamp_epoch": "1573510873.323163000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1400,
            "display_filter": "frame.number == 1400",
            "timestamp_epoch": "1573510873.330903000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1402,
            "display_filter": "frame.number == 1402",
            "timestamp_epoch": "1573510873.334173000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1404,
            "display_filter": "frame.number == 1404",
            "timestamp_epoch": "1573510873.337938000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3414,
            "display_filter": "frame.number == 3414",
            "timestamp_epoch": "1573510908.234638000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3416,
            "display_filter": "frame.number == 3416",
            "timestamp_epoch": "1573510908.237250000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3418,
            "display_filter": "frame.number == 3418",
            "timestamp_epoch": "1573510908.239791000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 3420,
            "display_filter": "frame.number == 3420",
            "timestamp_epoch": "1573510908.245152000"
          }
        ]
      },
      {
        "id": "finding-9222a36bd2b6a4a5dd25a869",
        "type": "pcap-finding",
        "label": "Directory-service protocol activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.203",
          "protocol": "ldap",
          "destination": "10.11.11.11",
          "event_count": 41,
          "operation_numbers": [
            "",
            "0",
            "2",
            "3"
          ]
        },
        "rule_id": "directory-service-activity",
        "severity": "low",
        "confidence": 0.95,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1301,
            "display_filter": "frame.number == 1301",
            "timestamp_epoch": "1573510872.445764000"
          },
          {
            "tcp_stream": 45,
            "frame_number": 1335,
            "display_filter": "frame.number == 1335",
            "timestamp_epoch": "1573510872.598699000"
          },
          {
            "tcp_stream": 45,
            "frame_number": 1338,
            "display_filter": "frame.number == 1338",
            "timestamp_epoch": "1573510872.622400000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1422,
            "display_filter": "frame.number == 1422",
            "timestamp_epoch": "1573510874.105179000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1427,
            "display_filter": "frame.number == 1427",
            "timestamp_epoch": "1573510874.109613000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1442,
            "display_filter": "frame.number == 1442",
            "timestamp_epoch": "1573510874.152717000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1455,
            "display_filter": "frame.number == 1455",
            "timestamp_epoch": "1573510874.185476000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1464,
            "display_filter": "frame.number == 1464",
            "timestamp_epoch": "1573510874.189903000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1468,
            "display_filter": "frame.number == 1468",
            "timestamp_epoch": "1573510874.193051000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1474,
            "display_filter": "frame.number == 1474",
            "timestamp_epoch": "1573510874.196288000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1552,
            "display_filter": "frame.number == 1552",
            "timestamp_epoch": "1573510874.522764000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1562,
            "display_filter": "frame.number == 1562",
            "timestamp_epoch": "1573510875.022146000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1573510882.354287000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1740,
            "display_filter": "frame.number == 1740",
            "timestamp_epoch": "1573510882.362920000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1745,
            "display_filter": "frame.number == 1745",
            "timestamp_epoch": "1573510882.371068000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1748,
            "display_filter": "frame.number == 1748",
            "timestamp_epoch": "1573510882.373498000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1750,
            "display_filter": "frame.number == 1750",
            "timestamp_epoch": "1573510882.378678000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1752,
            "display_filter": "frame.number == 1752",
            "timestamp_epoch": "1573510882.381366000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1762,
            "display_filter": "frame.number == 1762",
            "timestamp_epoch": "1573510882.429039000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1765,
            "display_filter": "frame.number == 1765",
            "timestamp_epoch": "1573510882.437450000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1797,
            "display_filter": "frame.number == 1797",
            "timestamp_epoch": "1573510882.593706000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 1799,
            "display_filter": "frame.number == 1799",
            "timestamp_epoch": "1573510882.602247000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1801,
            "display_filter": "frame.number == 1801",
            "timestamp_epoch": "1573510882.602250000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3441,
            "display_filter": "frame.number == 3441",
            "timestamp_epoch": "1573510908.828983000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3444,
            "display_filter": "frame.number == 3444",
            "timestamp_epoch": "1573510908.837626000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3450,
            "display_filter": "frame.number == 3450",
            "timestamp_epoch": "1573510908.893227000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3453,
            "display_filter": "frame.number == 3453",
            "timestamp_epoch": "1573510908.898174000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3455,
            "display_filter": "frame.number == 3455",
            "timestamp_epoch": "1573510908.900487000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3457,
            "display_filter": "frame.number == 3457",
            "timestamp_epoch": "1573510908.903300000"
          },
          {
            "tcp_stream": 112,
            "frame_number": 3499,
            "display_filter": "frame.number == 3499",
            "timestamp_epoch": "1573510909.101596000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3507,
            "display_filter": "frame.number == 3507",
            "timestamp_epoch": "1573510909.281776000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22732,
            "display_filter": "frame.number == 22732",
            "timestamp_epoch": "1573511791.989330000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22749,
            "display_filter": "frame.number == 22749",
            "timestamp_epoch": "1573511792.038209000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22752,
            "display_filter": "frame.number == 22752",
            "timestamp_epoch": "1573511792.041800000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22754,
            "display_filter": "frame.number == 22754",
            "timestamp_epoch": "1573511792.044711000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22766,
            "display_filter": "frame.number == 22766",
            "timestamp_epoch": "1573511792.180215000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22778,
            "display_filter": "frame.number == 22778",
            "timestamp_epoch": "1573511792.330440000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22785,
            "display_filter": "frame.number == 22785",
            "timestamp_epoch": "1573511792.370553000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22794,
            "display_filter": "frame.number == 22794",
            "timestamp_epoch": "1573511792.409846000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22796,
            "display_filter": "frame.number == 22796",
            "timestamp_epoch": "1573511792.412726000"
          },
          {
            "tcp_stream": 442,
            "frame_number": 22798,
            "display_filter": "frame.number == 22798",
            "timestamp_epoch": "1573511792.415436000"
          }
        ]
      },
      {
        "id": "finding-9e3ce7614406ea2f9860106b",
        "type": "pcap-finding",
        "label": "Sustained external TCP conversation outside decoded application coverage",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.145",
          "packets": 12,
          "wire_bytes": 1008,
          "destination": "173.194.67.188",
          "destination_port": 5228,
          "duration_seconds": 692.338
        },
        "rule_id": "unclassified-external-tcp",
        "severity": "medium",
        "confidence": 0.7,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 181,
            "frame_number": 6642,
            "display_filter": "tcp.stream == 181",
            "timestamp_epoch": "1573510940.792022"
          }
        ]
      },
      {
        "id": "finding-ebab3524b6002d526f7e0e9f",
        "type": "pcap-finding",
        "label": "Sustained external TCP conversation outside decoded application coverage",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "source": "10.11.11.121",
          "packets": 13,
          "wire_bytes": 2125,
          "destination": "113.29.141.91",
          "destination_port": 5242,
          "duration_seconds": 89.983
        },
        "rule_id": "unclassified-external-tcp",
        "severity": "medium",
        "confidence": 0.7,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 382,
            "frame_number": 21118,
            "display_filter": "tcp.stream == 382",
            "timestamp_epoch": "1573511049.082233"
          }
        ]
      },
      {
        "id": "identity-6cfb7b383dce6ea9e971054d",
        "type": "identity",
        "label": "account: 279",
        "value": "279",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 160,
            "frame_number": 6045,
            "display_filter": "frame.number == 6045",
            "timestamp_epoch": "1573510933.908371000"
          },
          {
            "tcp_stream": 160,
            "frame_number": 6045,
            "display_filter": "frame.number == 6045",
            "timestamp_epoch": "1573510933.908371000"
          }
        ]
      },
      {
        "id": "identity-5e30db390fb7f7764b27a059",
        "type": "identity",
        "label": "account: bd67b7d8021484837291d4db4",
        "value": "bd67b7d8021484837291d4db4",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 286,
            "frame_number": 13516,
            "display_filter": "frame.number == 13516",
            "timestamp_epoch": "1573511003.643047000"
          }
        ]
      },
      {
        "id": "identity-1557e040b9d72aa2fe50e605",
        "type": "identity",
        "label": "account: brandon.gilbert",
        "value": "brandon.gilbert",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.200"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 119,
            "frame_number": 3749,
            "display_filter": "frame.number == 3749",
            "timestamp_epoch": "1573510916.243691000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 3756,
            "display_filter": "frame.number == 3756",
            "timestamp_epoch": "1573510916.288802000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 3758,
            "display_filter": "frame.number == 3758",
            "timestamp_epoch": "1573510916.289862000"
          },
          {
            "tcp_stream": 121,
            "frame_number": 3769,
            "display_filter": "frame.number == 3769",
            "timestamp_epoch": "1573510916.325785000"
          },
          {
            "tcp_stream": 124,
            "frame_number": 3791,
            "display_filter": "frame.number == 3791",
            "timestamp_epoch": "1573510916.784179000"
          },
          {
            "tcp_stream": 126,
            "frame_number": 3837,
            "display_filter": "frame.number == 3837",
            "timestamp_epoch": "1573510917.406404000"
          },
          {
            "tcp_stream": 129,
            "frame_number": 3876,
            "display_filter": "frame.number == 3876",
            "timestamp_epoch": "1573510917.545185000"
          },
          {
            "tcp_stream": 130,
            "frame_number": 3887,
            "display_filter": "frame.number == 3887",
            "timestamp_epoch": "1573510917.584125000"
          }
        ]
      },
      {
        "id": "identity-9da27d34e33fd292dddb7e99",
        "type": "identity",
        "label": "account: candice.tucker",
        "value": "candice.tucker",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.203"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 105,
            "frame_number": 3361,
            "display_filter": "frame.number == 3361",
            "timestamp_epoch": "1573510907.223779000"
          },
          {
            "tcp_stream": 106,
            "frame_number": 3369,
            "display_filter": "frame.number == 3369",
            "timestamp_epoch": "1573510907.314316000"
          },
          {
            "tcp_stream": 106,
            "frame_number": 3371,
            "display_filter": "frame.number == 3371",
            "timestamp_epoch": "1573510907.315451000"
          },
          {
            "tcp_stream": 107,
            "frame_number": 3382,
            "display_filter": "frame.number == 3382",
            "timestamp_epoch": "1573510907.357273000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 3403,
            "display_filter": "frame.number == 3403",
            "timestamp_epoch": "1573510908.226122000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 3435,
            "display_filter": "frame.number == 3435",
            "timestamp_epoch": "1573510908.825629000"
          },
          {
            "tcp_stream": 114,
            "frame_number": 3471,
            "display_filter": "frame.number == 3471",
            "timestamp_epoch": "1573510908.996025000"
          },
          {
            "tcp_stream": 115,
            "frame_number": 3483,
            "display_filter": "frame.number == 3483",
            "timestamp_epoch": "1573510909.052169000"
          }
        ]
      },
      {
        "id": "identity-cad02fad0f9cd802bac2a05e",
        "type": "identity",
        "label": "account: gilbert-win7-pc$",
        "value": "gilbert-win7-pc$",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.200"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 3,
            "frame_number": 131,
            "display_filter": "frame.number == 131",
            "timestamp_epoch": "1573510822.824985000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 147,
            "display_filter": "frame.number == 147",
            "timestamp_epoch": "1573510822.849033000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 152,
            "display_filter": "frame.number == 152",
            "timestamp_epoch": "1573510822.886154000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 163,
            "display_filter": "frame.number == 163",
            "timestamp_epoch": "1573510822.926497000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 187,
            "display_filter": "frame.number == 187",
            "timestamp_epoch": "1573510823.485051000"
          },
          {
            "tcp_stream": 8,
            "frame_number": 195,
            "display_filter": "frame.number == 195",
            "timestamp_epoch": "1573510823.547870000"
          },
          {
            "tcp_stream": 8,
            "frame_number": 197,
            "display_filter": "frame.number == 197",
            "timestamp_epoch": "1573510823.548921000"
          },
          {
            "tcp_stream": 9,
            "frame_number": 211,
            "display_filter": "frame.number == 211",
            "timestamp_epoch": "1573510823.599281000"
          },
          {
            "tcp_stream": 11,
            "frame_number": 260,
            "display_filter": "frame.number == 260",
            "timestamp_epoch": "1573510824.488014000"
          },
          {
            "tcp_stream": 12,
            "frame_number": 280,
            "display_filter": "frame.number == 280",
            "timestamp_epoch": "1573510824.527911000"
          },
          {
            "tcp_stream": 15,
            "frame_number": 323,
            "display_filter": "frame.number == 323",
            "timestamp_epoch": "1573510824.651445000"
          },
          {
            "tcp_stream": 18,
            "frame_number": 344,
            "display_filter": "frame.number == 344",
            "timestamp_epoch": "1573510824.747564000"
          },
          {
            "tcp_stream": 19,
            "frame_number": 356,
            "display_filter": "frame.number == 356",
            "timestamp_epoch": "1573510824.803881000"
          },
          {
            "tcp_stream": 25,
            "frame_number": 518,
            "display_filter": "frame.number == 518",
            "timestamp_epoch": "1573510831.857107000"
          },
          {
            "tcp_stream": 26,
            "frame_number": 526,
            "display_filter": "frame.number == 526",
            "timestamp_epoch": "1573510831.916013000"
          },
          {
            "tcp_stream": 26,
            "frame_number": 528,
            "display_filter": "frame.number == 528",
            "timestamp_epoch": "1573510831.917080000"
          },
          {
            "tcp_stream": 27,
            "frame_number": 540,
            "display_filter": "frame.number == 540",
            "timestamp_epoch": "1573510831.959858000"
          },
          {
            "tcp_stream": 67,
            "frame_number": 1687,
            "display_filter": "frame.number == 1687",
            "timestamp_epoch": "1573510882.006986000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 1699,
            "display_filter": "frame.number == 1699",
            "timestamp_epoch": "1573510882.048482000"
          },
          {
            "tcp_stream": 434,
            "frame_number": 22630,
            "display_filter": "frame.number == 22630",
            "timestamp_epoch": "1573511740.322254000"
          }
        ]
      },
      {
        "id": "identity-b261ab0e719fd2014972fec4",
        "type": "identity",
        "label": "account: tucker-win7-pc$",
        "value": "tucker-win7-pc$",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.203"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1308,
            "display_filter": "frame.number == 1308",
            "timestamp_epoch": "1573510872.489360000"
          },
          {
            "tcp_stream": 47,
            "frame_number": 1316,
            "display_filter": "frame.number == 1316",
            "timestamp_epoch": "1573510872.544228000"
          },
          {
            "tcp_stream": 47,
            "frame_number": 1318,
            "display_filter": "frame.number == 1318",
            "timestamp_epoch": "1573510872.545259000"
          },
          {
            "tcp_stream": 48,
            "frame_number": 1329,
            "display_filter": "frame.number == 1329",
            "timestamp_epoch": "1573510872.587261000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1364,
            "display_filter": "frame.number == 1364",
            "timestamp_epoch": "1573510873.183737000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1372,
            "display_filter": "frame.number == 1372",
            "timestamp_epoch": "1573510873.264258000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1374,
            "display_filter": "frame.number == 1374",
            "timestamp_epoch": "1573510873.265383000"
          },
          {
            "tcp_stream": 53,
            "frame_number": 1386,
            "display_filter": "frame.number == 1386",
            "timestamp_epoch": "1573510873.309427000"
          },
          {
            "tcp_stream": 56,
            "frame_number": 1437,
            "display_filter": "frame.number == 1437",
            "timestamp_epoch": "1573510874.148071000"
          },
          {
            "tcp_stream": 58,
            "frame_number": 1458,
            "display_filter": "frame.number == 1458",
            "timestamp_epoch": "1573510874.186298000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 1503,
            "display_filter": "frame.number == 1503",
            "timestamp_epoch": "1573510874.304950000"
          },
          {
            "tcp_stream": 63,
            "frame_number": 1523,
            "display_filter": "frame.number == 1523",
            "timestamp_epoch": "1573510874.398683000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1536,
            "display_filter": "frame.number == 1536",
            "timestamp_epoch": "1573510874.453904000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 1770,
            "display_filter": "frame.number == 1770",
            "timestamp_epoch": "1573510882.484060000"
          },
          {
            "tcp_stream": 73,
            "frame_number": 1778,
            "display_filter": "frame.number == 1778",
            "timestamp_epoch": "1573510882.545835000"
          },
          {
            "tcp_stream": 73,
            "frame_number": 1780,
            "display_filter": "frame.number == 1780",
            "timestamp_epoch": "1573510882.546864000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 1791,
            "display_filter": "frame.number == 1791",
            "timestamp_epoch": "1573510882.588063000"
          },
          {
            "tcp_stream": 158,
            "frame_number": 5849,
            "display_filter": "frame.number == 5849",
            "timestamp_epoch": "1573510932.006817000"
          },
          {
            "tcp_stream": 159,
            "frame_number": 5864,
            "display_filter": "frame.number == 5864",
            "timestamp_epoch": "1573510932.056991000"
          },
          {
            "tcp_stream": 443,
            "frame_number": 22743,
            "display_filter": "frame.number == 22743",
            "timestamp_epoch": "1573511792.031094000"
          }
        ]
      },
      {
        "id": "identity-9b61a66ab809319f81148d9c",
        "type": "identity",
        "label": "domain: OKAY-BOOMER",
        "value": "OKAY-BOOMER",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.200",
          "10.11.11.203"
        ],
        "identity_type": "domain",
        "frame_evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 323,
            "display_filter": "frame.number == 323",
            "timestamp_epoch": "1573510824.651445000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 1503,
            "display_filter": "frame.number == 1503",
            "timestamp_epoch": "1573510874.304950000"
          }
        ]
      },
      {
        "id": "identity-529e078d621d93023b35afe6",
        "type": "identity",
        "label": "hostname: GILBERT-WIN7-PC",
        "value": "GILBERT-WIN7-PC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.200"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 27,
            "frame_number": 87,
            "display_filter": "frame.number == 87",
            "timestamp_epoch": "1573510822.038135000"
          },
          {
            "udp_stream": 27,
            "frame_number": 88,
            "display_filter": "frame.number == 88",
            "timestamp_epoch": "1573510822.038844000"
          },
          {
            "udp_stream": 27,
            "frame_number": 148,
            "display_filter": "frame.number == 148",
            "timestamp_epoch": "1573510822.855507000"
          },
          {
            "udp_stream": 27,
            "frame_number": 150,
            "display_filter": "frame.number == 150",
            "timestamp_epoch": "1573510822.856208000"
          },
          {
            "udp_stream": 27,
            "frame_number": 198,
            "display_filter": "frame.number == 198",
            "timestamp_epoch": "1573510823.573527000"
          },
          {
            "udp_stream": 27,
            "frame_number": 200,
            "display_filter": "frame.number == 200",
            "timestamp_epoch": "1573510823.574433000"
          },
          {
            "udp_stream": 27,
            "frame_number": 234,
            "display_filter": "frame.number == 234",
            "timestamp_epoch": "1573510824.288346000"
          },
          {
            "udp_stream": 27,
            "frame_number": 236,
            "display_filter": "frame.number == 236",
            "timestamp_epoch": "1573510824.289023000"
          },
          {
            "tcp_stream": 15,
            "frame_number": 323,
            "display_filter": "frame.number == 323",
            "timestamp_epoch": "1573510824.651445000"
          },
          {
            "udp_stream": 27,
            "frame_number": 604,
            "display_filter": "frame.number == 604",
            "timestamp_epoch": "1573510835.017155000"
          },
          {
            "udp_stream": 27,
            "frame_number": 606,
            "display_filter": "frame.number == 606",
            "timestamp_epoch": "1573510835.017437000"
          },
          {
            "udp_stream": 27,
            "frame_number": 616,
            "display_filter": "frame.number == 616",
            "timestamp_epoch": "1573510835.767275000"
          },
          {
            "udp_stream": 27,
            "frame_number": 618,
            "display_filter": "frame.number == 618",
            "timestamp_epoch": "1573510835.767276000"
          },
          {
            "udp_stream": 27,
            "frame_number": 621,
            "display_filter": "frame.number == 621",
            "timestamp_epoch": "1573510836.517010000"
          },
          {
            "udp_stream": 27,
            "frame_number": 623,
            "display_filter": "frame.number == 623",
            "timestamp_epoch": "1573510836.517012000"
          },
          {
            "udp_stream": 27,
            "frame_number": 626,
            "display_filter": "frame.number == 626",
            "timestamp_epoch": "1573510837.266594000"
          },
          {
            "udp_stream": 27,
            "frame_number": 628,
            "display_filter": "frame.number == 628",
            "timestamp_epoch": "1573510837.266868000"
          }
        ]
      },
      {
        "id": "identity-90d805dca2df0d3700e31940",
        "type": "identity",
        "label": "hostname: MACBOOKPRO-8843",
        "value": "MACBOOKPRO-8843",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.179"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 12,
            "frame_number": 27,
            "display_filter": "frame.number == 27",
            "timestamp_epoch": "1573510810.882766000"
          },
          {
            "udp_stream": 12,
            "frame_number": 46,
            "display_filter": "frame.number == 46",
            "timestamp_epoch": "1573510812.213499000"
          },
          {
            "udp_stream": 12,
            "frame_number": 53,
            "display_filter": "frame.number == 53",
            "timestamp_epoch": "1573510813.748086000"
          },
          {
            "udp_stream": 12,
            "frame_number": 231,
            "display_filter": "frame.number == 231",
            "timestamp_epoch": "1573510823.811445000"
          },
          {
            "udp_stream": 12,
            "frame_number": 384,
            "display_filter": "frame.number == 384",
            "timestamp_epoch": "1573510825.181588000"
          },
          {
            "udp_stream": 12,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1573510826.671659000"
          }
        ]
      },
      {
        "id": "identity-b0177ba21caafd8c9b5de271",
        "type": "identity",
        "label": "hostname: OKAY-BOOMER-DC",
        "value": "OKAY-BOOMER-DC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.11"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 906,
            "frame_number": 21606,
            "display_filter": "frame.number == 21606",
            "timestamp_epoch": "1573511088.070781000"
          },
          {
            "udp_stream": 906,
            "frame_number": 22815,
            "display_filter": "frame.number == 22815",
            "timestamp_epoch": "1573511805.661559000"
          }
        ]
      },
      {
        "id": "identity-e7a05d96e7ed7e5f4a557fe9",
        "type": "identity",
        "label": "hostname: TUCKER-WIN7-PC",
        "value": "TUCKER-WIN7-PC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "10.11.11.203"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 165,
            "frame_number": 1273,
            "display_filter": "frame.number == 1273",
            "timestamp_epoch": "1573510872.000158000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1278,
            "display_filter": "frame.number == 1278",
            "timestamp_epoch": "1573510872.042519000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1343,
            "display_filter": "frame.number == 1343",
            "timestamp_epoch": "1573510872.749784000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1345,
            "display_filter": "frame.number == 1345",
            "timestamp_epoch": "1573510872.789384000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1406,
            "display_filter": "frame.number == 1406",
            "timestamp_epoch": "1573510873.499407000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1408,
            "display_filter": "frame.number == 1408",
            "timestamp_epoch": "1573510873.539228000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1496,
            "display_filter": "frame.number == 1496",
            "timestamp_epoch": "1573510874.290154000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 1503,
            "display_filter": "frame.number == 1503",
            "timestamp_epoch": "1573510874.304950000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1832,
            "display_filter": "frame.number == 1832",
            "timestamp_epoch": "1573510885.010658000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1573510885.053123000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1882,
            "display_filter": "frame.number == 1882",
            "timestamp_epoch": "1573510885.760324000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1885,
            "display_filter": "frame.number == 1885",
            "timestamp_epoch": "1573510885.800092000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1889,
            "display_filter": "frame.number == 1889",
            "timestamp_epoch": "1573510886.510343000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1891,
            "display_filter": "frame.number == 1891",
            "timestamp_epoch": "1573510886.550058000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1896,
            "display_filter": "frame.number == 1896",
            "timestamp_epoch": "1573510887.262221000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1897,
            "display_filter": "frame.number == 1897",
            "timestamp_epoch": "1573510887.300559000"
          }
        ]
      },
      {
        "id": "identity-b4e29f93e57235fb501932e5",
        "type": "identity",
        "label": "netbios-group: OKAY-BOOMER",
        "value": "OKAY-BOOMER",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "netbios-group",
        "frame_evidence": [
          {
            "udp_stream": 27,
            "frame_number": 149,
            "display_filter": "frame.number == 149",
            "timestamp_epoch": "1573510822.855826000"
          },
          {
            "udp_stream": 27,
            "frame_number": 199,
            "display_filter": "frame.number == 199",
            "timestamp_epoch": "1573510823.573774000"
          },
          {
            "udp_stream": 27,
            "frame_number": 235,
            "display_filter": "frame.number == 235",
            "timestamp_epoch": "1573510824.288781000"
          },
          {
            "udp_stream": 27,
            "frame_number": 605,
            "display_filter": "frame.number == 605",
            "timestamp_epoch": "1573510835.017437000"
          },
          {
            "udp_stream": 27,
            "frame_number": 617,
            "display_filter": "frame.number == 617",
            "timestamp_epoch": "1573510835.767276000"
          },
          {
            "udp_stream": 27,
            "frame_number": 622,
            "display_filter": "frame.number == 622",
            "timestamp_epoch": "1573510836.517011000"
          },
          {
            "udp_stream": 27,
            "frame_number": 627,
            "display_filter": "frame.number == 627",
            "timestamp_epoch": "1573510837.266867000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1274,
            "display_filter": "frame.number == 1274",
            "timestamp_epoch": "1573510872.000538000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1342,
            "display_filter": "frame.number == 1342",
            "timestamp_epoch": "1573510872.749390000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1407,
            "display_filter": "frame.number == 1407",
            "timestamp_epoch": "1573510873.499783000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1487,
            "display_filter": "frame.number == 1487",
            "timestamp_epoch": "1573510874.251937000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1833,
            "display_filter": "frame.number == 1833",
            "timestamp_epoch": "1573510885.010937000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1881,
            "display_filter": "frame.number == 1881",
            "timestamp_epoch": "1573510885.760323000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1890,
            "display_filter": "frame.number == 1890",
            "timestamp_epoch": "1573510886.510344000"
          },
          {
            "udp_stream": 165,
            "frame_number": 1895,
            "display_filter": "frame.number == 1895",
            "timestamp_epoch": "1573510887.261950000"
          }
        ]
      },
      {
        "id": "artifact-78c10a5ae582533f5faf0807",
        "md5": "69f909e1f154dad67bb582362cdca3b2",
        "sha1": "b2df0351e0246a95484891c04b5931a3034d1dbd",
        "type": "file-artifact",
        "label": "ijs_all_modules_cjs_min_69f909e1f154dad67bb582362cdca3b2.js",
        "value": "7fdb67c0a4d9da83b868e919901fcc496082cf802e99902fa0c4bf903bc69864",
        "sha256": "7fdb67c0a4d9da83b868e919901fcc496082cf802e99902fa0c4bf903bc69864",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://assets.bounceexchange.com/assets/smart-tag/versioned/ijs_all_modules_cjs_min_69f909e1f154dad67bb582362cdca3b2.js",
            "client_ip": "10.11.11.179",
            "server_ip": "34.98.72.95",
            "tcp_stream": 160,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 5899,
            "response_frame": 6045
          }
        ],
        "size_bytes": 423065,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 160,
            "frame_number": 6045,
            "display_filter": "frame.number == 6045",
            "timestamp_epoch": "1573510933.908371000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-86b99b01439d20dbcedf6528",
        "md5": "f59b3c50d97fe7fa58001c345cbea37e",
        "sha1": "0e4c394560faf7853bcd9d51b7c959f0a093eb74",
        "type": "file-artifact",
        "label": "40group.tiff",
        "value": "8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635",
        "sha256": "8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://acjabogados.com/40group.tiff",
            "client_ip": "10.11.11.203",
            "server_ip": "188.95.248.71",
            "tcp_stream": 264,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 11415,
            "response_frame": 11979
          }
        ],
        "size_bytes": 389120,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/tiff",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 264,
            "frame_number": 11979,
            "display_filter": "frame.number == 11979",
            "timestamp_epoch": "1573510980.570539000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-3693529b3e790b61972b5b54",
        "md5": "7874260ab3a0bd324496e0e5d08d532f",
        "sha1": "7fa9629996cec83aaf49df07ebab0256f8308706",
        "type": "file-artifact",
        "label": "impl.349-18-RELEASE.js",
        "value": "6c5ff7ea83e52bc381c96600e619db8f8661d88a11deeb63f9433f74c39c4531",
        "sha256": "6c5ff7ea83e52bc381c96600e619db8f8661d88a11deeb63f9433f74c39c4531",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.taboola.com/libtrc/impl.349-18-RELEASE.js",
            "client_ip": "10.11.11.179",
            "server_ip": "151.101.50.2",
            "tcp_stream": 141,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 4785,
            "response_frame": 5073
          }
        ],
        "size_bytes": 370925,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 141,
            "frame_number": 5073,
            "display_filter": "frame.number == 5073",
            "timestamp_epoch": "1573510926.839686000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fdde86f7adb2fba5d136456f",
        "md5": "562e20f49f8ed87396a7a23c49189b74",
        "sha1": "2eb818d09be566cd6143a6ec9167b62ebb5c9171",
        "type": "file-artifact",
        "label": "tin-can.min.js%3f_=1573510907652",
        "value": "e4980b12540ba3a4f5d64a559ddffd9afd16702d50e2ccbb25cdf8fa2f91a357",
        "sha256": "e4980b12540ba3a4f5d64a559ddffd9afd16702d50e2ccbb25cdf8fa2f91a357",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.chromebooktrivia.com/core/scripts/lrs/tin-can.min.js?_=1573510907652",
            "client_ip": "10.11.11.94",
            "server_ip": "52.218.228.130",
            "tcp_stream": 94,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 2602,
            "response_frame": 3065
          }
        ],
        "size_bytes": 121587,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 3065,
            "display_filter": "frame.number == 3065",
            "timestamp_epoch": "1573510898.799019000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-6f71bc83b24223752c2585cc",
        "md5": "183e04cde08f40d768be67590e69190d",
        "sha1": "92ed17bdd0cafea9fd24d11510a1c67b3d7d1488",
        "type": "file-artifact",
        "label": "apstag.js",
        "value": "29d14c1ad2f8f1be84efd4d678ff3de9d6c3f94eb3b77894504c4824ff1a8ad4",
        "sha256": "29d14c1ad2f8f1be84efd4d678ff3de9d6c3f94eb3b77894504c4824ff1a8ad4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://c.amazon-adsystem.com/aax2/apstag.js",
            "client_ip": "10.11.11.217",
            "server_ip": "143.204.26.216",
            "tcp_stream": 265,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 11469,
            "response_frame": 11537
          }
        ],
        "size_bytes": 88238,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 265,
            "frame_number": 11537,
            "display_filter": "frame.number == 11537",
            "timestamp_epoch": "1573510979.557009000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1cb0558497210d8850a72912",
        "md5": "7778455d1a488c54c3704b0ec7fa5734",
        "sha1": "b12d198a6ed9d7e60311ac150971c64c6a28996d",
        "type": "file-artifact",
        "label": "time_s_code.js",
        "value": "a874f98ca9fc78c29ab6e41b58da4f4f4cb788b8ca8c535abc2ffaee241c35fc",
        "sha256": "a874f98ca9fc78c29ab6e41b58da4f4f4cb788b8ca8c535abc2ffaee241c35fc",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/tii/omniture/h/config/time_s_code.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 87,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2684,
            "response_frame": 2753
          }
        ],
        "size_bytes": 71414,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 87,
            "frame_number": 2753,
            "display_filter": "frame.number == 2753",
            "timestamp_epoch": "1573510898.465197000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-aada23129476ece95a7a9bcd",
        "md5": "15909604a62d594b49750e7124f1b611",
        "sha1": "94004ad67bfa8638ec4971be4f10927012fcde7a",
        "type": "file-artifact",
        "label": "tags(1).js",
        "value": "02421b3b99f39a2e6c412a2a709b1e2685b8801e652ac5d01d7ab24a610375ef",
        "sha256": "02421b3b99f39a2e6c412a2a709b1e2685b8801e652ac5d01d7ab24a610375ef",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://a.tribalfusion.com/real/tags/iPhoneHackscom/ROS/tags.js",
            "client_ip": "10.11.11.217",
            "server_ip": "23.204.246.46",
            "tcp_stream": 310,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17669,
            "response_frame": 17690
          }
        ],
        "size_bytes": 60113,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 310,
            "frame_number": 17690,
            "display_filter": "frame.number == 17690",
            "timestamp_epoch": "1573511028.215351000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e3d17eb3b3f32cfc1d6f3aa8",
        "md5": "b6f8963cdf7efa007209ff8494958197",
        "sha1": "dc16aa9e8c2330658e9a5e9cb23d90135acc569c",
        "type": "file-artifact",
        "label": "timecom.js",
        "value": "726ba9071d0576e8b6da71500a5deffe7c6707b46855b42958f0e88d22ec5a6e",
        "sha256": "726ba9071d0576e8b6da71500a5deffe7c6707b46855b42958f0e88d22ec5a6e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://subscription-assets.timeinc.com/prod/assets/themes/magazines/default/template-resources/js/omniture/config/timecom.js",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.72",
            "tcp_stream": 208,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 7213,
            "response_frame": 7362
          }
        ],
        "size_bytes": 50016,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 208,
            "frame_number": 7362,
            "display_filter": "frame.number == 7362",
            "timestamp_epoch": "1573510944.112243000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4e42e1cc78f734f93e20859f",
        "md5": "c9470b0f600752e30fb48bdff31a39b9",
        "sha1": "273852b658e314c2d897cfdbb957bb0b14f75def",
        "type": "file-artifact",
        "label": "main.js",
        "value": "9995757952af47309f1651f3eab89cc440f4483a8f4cae42d1235276dc87b0de",
        "sha256": "9995757952af47309f1651f3eab89cc440f4483a8f4cae42d1235276dc87b0de",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/j/main.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 93,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2544,
            "response_frame": 2645
          }
        ],
        "size_bytes": 33869,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 93,
            "frame_number": 2645,
            "display_filter": "frame.number == 2645",
            "timestamp_epoch": "1573510898.351816000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b1a85c7e7f76c13fb5b5b26d",
        "md5": "9482924348b0c3d618da80a1244a30f5",
        "sha1": "7a745f37b33bc2b6d51e3606f8631a16ef25c5d1",
        "type": "file-artifact",
        "label": "0,29307,2077702,00.html",
        "value": "7eaa8936ff23275cd41b71dd4a53b7568e42c3124f0f88b2b46624f92158b539",
        "sha256": "7eaa8936ff23275cd41b71dd4a53b7568e42c3124f0f88b2b46624f92158b539",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://content.time.com/time/photogallery/0,29307,2077702,00.html",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.34",
            "tcp_stream": 76,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1935,
            "response_frame": 2046
          }
        ],
        "size_bytes": 32630,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/html",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2046,
            "display_filter": "frame.number == 2046",
            "timestamp_epoch": "1573510890.531084000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1230ac6447460ddc27de8850",
        "md5": "a4d296427fc806b21335359e398c025c",
        "sha1": "46928ccd1407b4e55192bb9d0a07dcfebd9687b7",
        "type": "file-artifact",
        "label": "aps_csm.js",
        "value": "06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844",
        "sha256": "06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js",
            "client_ip": "10.11.11.217",
            "server_ip": "143.204.26.216",
            "tcp_stream": 267,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 11563,
            "response_frame": 11592
          }
        ],
        "size_bytes": 6482,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 267,
            "frame_number": 11592,
            "display_filter": "frame.number == 11592",
            "timestamp_epoch": "1573510979.747829000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-43cb59aef163ac1767094f1f",
        "md5": "5891a9ecc128bca4e6360f4667f04297",
        "sha1": "9f70c567a921b1efe96932b3af17adcbded2e811",
        "type": "file-artifact",
        "label": "loader.js",
        "value": "d815b63e6c3c0ee03db4360d364767b22958f01ab7902e828834eb46b8edf4ac",
        "sha256": "d815b63e6c3c0ee03db4360d364767b22958f01ab7902e828834eb46b8edf4ac",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.taboolasyndication.com/libtrc/timeinc-time/loader.js",
            "client_ip": "10.11.11.179",
            "server_ip": "151.101.50.2",
            "tcp_stream": 82,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2132,
            "response_frame": 2193
          }
        ],
        "size_bytes": 336910,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 82,
            "frame_number": 2193,
            "display_filter": "frame.number == 2193",
            "timestamp_epoch": "1573510894.323978000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-df02e8c668e44ea738aed094",
        "md5": "95448480eab0f42244fadad616d8f68f",
        "sha1": "f023d898bd1b6902055fc8177dcf54649b6fa688",
        "type": "file-artifact",
        "label": "analytics.min.js",
        "value": "2741f3d57085857684637bd2f1f7cdc9f43398d604fd894ab7c4514a7647967e",
        "sha256": "2741f3d57085857684637bd2f1f7cdc9f43398d604fd894ab7c4514a7647967e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://d2dq2ahtl5zl1z.cloudfront.net/analytics.js/v1/Tjrt25JUOrbvQQX1cGykGGzC3GncV6F9/analytics.min.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.31.50",
            "tcp_stream": 245,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9627,
            "response_frame": 9744
          }
        ],
        "size_bytes": 296710,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 245,
            "frame_number": 9744,
            "display_filter": "frame.number == 9744",
            "timestamp_epoch": "1573510960.353742000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fc7bc9161ac5ff692b52439a",
        "md5": "5c02f67c115e0188eb29f566e8298435",
        "sha1": "af0e62ba3c9e3e7bdd9c1df2279e605c42836b04",
        "type": "file-artifact",
        "label": "async-ads.js",
        "value": "98bc475d844bdf3883722cecfeabc646fdef167cea0644c05ac8038e10b6b4cf",
        "sha256": "98bc475d844bdf3883722cecfeabc646fdef167cea0644c05ac8038e10b6b4cf",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cse.google.com/adsense/search/async-ads.js",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.2.238",
            "tcp_stream": 251,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 10077,
            "response_frame": 10170
          }
        ],
        "size_bytes": 166757,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 251,
            "frame_number": 10170,
            "display_filter": "frame.number == 10170",
            "timestamp_epoch": "1573510962.065853000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0639e279f4b88cccaeec678e",
        "md5": "a3758833b93191f3f6af8121e185a4c7",
        "sha1": "4ae7dd1370b0af1a722f8fd1e46e06383c2ebcae",
        "type": "file-artifact",
        "label": "app.css",
        "value": "a57d87401fa0f698c27986deb5f1feceaaedc19928fa2e63a417a374f43518f2",
        "sha256": "a57d87401fa0f698c27986deb5f1feceaaedc19928fa2e63a417a374f43518f2",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/css/app.css",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8815,
            "response_frame": 8909
          }
        ],
        "size_bytes": 150953,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8909,
            "display_filter": "frame.number == 8909",
            "timestamp_epoch": "1573510957.592781000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-16d89bab5a43fd2f826ce6c8",
        "md5": "b378f616b6edc5663c5ad29d209d8323",
        "sha1": "03cfc3561d3ae3ebd8f79def56a8b10ee23e118a",
        "type": "file-artifact",
        "label": "common_css.php%3fc=3281&mt=1573231401",
        "value": "a1bf598f55e97c5fbb655bb7e989904b7242687431c4a77fb28d5831b155635b",
        "sha256": "a1bf598f55e97c5fbb655bb7e989904b7242687431c4a77fb28d5831b155635b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/common_js/common_css.php?c=3281&mt=1573231401",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 168,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6246,
            "response_frame": 6376
          }
        ],
        "size_bytes": 143498,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 168,
            "frame_number": 6376,
            "display_filter": "frame.number == 6376",
            "timestamp_epoch": "1573510939.960075000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b9bdba528cfb844a88082283",
        "md5": "e78230e0fb3562faefd2f449bbea0a94",
        "sha1": "d0fe0976cb5116b4bc90cd1c9bad47fd8ebb7df6",
        "type": "file-artifact",
        "label": "libya_ruins_01.jpg",
        "value": "6a4907421b7075663cca082e973fcd4fa8ddaa393a1031718f327f5db4395dd5",
        "sha256": "6a4907421b7075663cca082e973fcd4fa8ddaa393a1031718f327f5db4395dd5",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/photoessays/2011/libya_ruins/libya_ruins_01.jpg",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 88,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 2685,
            "response_frame": 2947
          }
        ],
        "size_bytes": 124562,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 88,
            "frame_number": 2947,
            "display_filter": "frame.number == 2947",
            "timestamp_epoch": "1573510898.591418000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1d603e73a85168a923c3fba2",
        "md5": "98e5159367a00dd3a6772c76e6ff44b2",
        "sha1": "428b6300b6af0687e9ec951e5a18144d3f831b23",
        "type": "file-artifact",
        "label": "friendbuy.min.js",
        "value": "4582858c4190dded337320ee561c74c4ff264e35eb1de0dd62dc9ff882e2a0c0",
        "sha256": "4582858c4190dded337320ee561c74c4ff264e35eb1de0dd62dc9ff882e2a0c0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://djnf6e5yyirys.cloudfront.net/js/friendbuy.min.js",
            "client_ip": "10.11.11.200",
            "server_ip": "13.33.252.19",
            "tcp_stream": 304,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17289,
            "response_frame": 17355
          }
        ],
        "size_bytes": 122429,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 304,
            "frame_number": 17355,
            "display_filter": "frame.number == 17355",
            "timestamp_epoch": "1573511016.060303000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ce2a6ae03c9bf20ea2aa3ee3",
        "md5": "b68605db9470362087fef839793d4917",
        "sha1": "ccbf9efe16df5e88329c32ec0659e03d22907c5a",
        "type": "file-artifact",
        "label": "guide-to-flattening-warped-vinyl-records",
        "value": "8e37440d4a467d0e23fb778cb18dadb860516f19aad531bfe5c0b07c2c60dd47",
        "sha256": "8e37440d4a467d0e23fb778cb18dadb860516f19aad531bfe5c0b07c2c60dd47",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.vinylmeplease.com/magazine/guide-to-flattening-warped-vinyl-records/",
            "client_ip": "10.11.11.200",
            "server_ip": "13.33.255.37",
            "tcp_stream": 286,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13445,
            "response_frame": 13516
          }
        ],
        "size_bytes": 116383,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 286,
            "frame_number": 13516,
            "display_filter": "frame.number == 13516",
            "timestamp_epoch": "1573511003.643047000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fd4225b5b2971417479d4a52",
        "md5": "7a2ab3192de74afe36986b626efe6c28",
        "sha1": "1e689daaba85aae3a94b174b09d2c553e5b50d7b",
        "type": "file-artifact",
        "label": "polyfills.js",
        "value": "7dc6cd90d71e4f9210182fe795201941777a368761309cfd97bd95141c6fe027",
        "sha256": "7dc6cd90d71e4f9210182fe795201941777a368761309cfd97bd95141c6fe027",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/common_js/polyfills.js",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 166,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6248,
            "response_frame": 6358
          }
        ],
        "size_bytes": 108139,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 166,
            "frame_number": 6358,
            "display_filter": "frame.number == 6358",
            "timestamp_epoch": "1573510939.956983000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-02b6d6a657ed5455428aa1bc",
        "md5": "6fc4cd1079e0df0950051108562bd84b",
        "sha1": "ce4a195dc7d70559ea155d04d08039e45805fc25",
        "type": "file-artifact",
        "label": "adsbygoogle(1).js",
        "value": "7a2cdbdee49d6f5ac7158962d48a61f758b17baac728fc73e2b3be7f0f736117",
        "sha256": "7a2cdbdee49d6f5ac7158962d48a61f758b17baac728fc73e2b3be7f0f736117",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",
            "client_ip": "10.11.11.179",
            "server_ip": "172.217.6.162",
            "tcp_stream": 229,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8476,
            "response_frame": 8536
          },
          {
            "url": "http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.6.162",
            "tcp_stream": 311,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17717,
            "response_frame": 17786
          }
        ],
        "size_bytes": 106101,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 229,
            "frame_number": 8536,
            "display_filter": "frame.number == 8536",
            "timestamp_epoch": "1573510952.408272000"
          },
          {
            "tcp_stream": 311,
            "frame_number": 17786,
            "display_filter": "frame.number == 17786",
            "timestamp_epoch": "1573511028.714916000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7dc3a731850430780c651245",
        "md5": "4f252523d4af0b478c810c2547a63e19",
        "sha1": "5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb",
        "type": "file-artifact",
        "label": "jquery.min(1).js",
        "value": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "sha256": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.12.42",
            "tcp_stream": 235,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8827,
            "response_frame": 8911
          }
        ],
        "size_bytes": 97163,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 235,
            "frame_number": 8911,
            "display_filter": "frame.number == 8911",
            "timestamp_epoch": "1573510957.593346000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f7d7d963fdeede1a9aab1418",
        "md5": "397754ba49e9e0cf4e7c190da78dda05",
        "sha1": "ae49e56999d82802727455f0ba83b63acd90a22b",
        "type": "file-artifact",
        "label": "jquery.min.js",
        "value": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "sha256": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js",
            "client_ip": "10.11.11.195",
            "server_ip": "172.217.12.42",
            "tcp_stream": 196,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6999,
            "response_frame": 7127
          }
        ],
        "size_bytes": 92629,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 196,
            "frame_number": 7127,
            "display_filter": "frame.number == 7127",
            "timestamp_epoch": "1573510943.991651000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7bea50abfa51742925f5ab13",
        "md5": "5d46b502610af07434698a6eef9b0eed",
        "sha1": "ff28c499bc4cda9573e6e1414a00c6a3d7f88d79",
        "type": "file-artifact",
        "label": "foundation.min.js",
        "value": "31dacbcecc9839d6f68e83876207a19d2f28d22c56921d43c12c30ba7510b739",
        "sha256": "31dacbcecc9839d6f68e83876207a19d2f28d22c56921d43c12c30ba7510b739",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/js/foundation.min.js",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 232,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9003,
            "response_frame": 9044
          }
        ],
        "size_bytes": 91943,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 9044,
            "display_filter": "frame.number == 9044",
            "timestamp_epoch": "1573510957.813919000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5254002dbc6c374e23a27f5d",
        "md5": "46bfbed290dde15c06ca6201d087484c",
        "sha1": "a603d2d960a11b807e30556e6870fa267ed0c1bb",
        "type": "file-artifact",
        "label": "main.css",
        "value": "d97b87d9e5dde03b3fd701e5dfb5b55c8d1f606581a86f21b79ce627db7efaf5",
        "sha256": "d97b87d9e5dde03b3fd701e5dfb5b55c8d1f606581a86f21b79ce627db7efaf5",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/c/v4/main.css",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 87,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2526,
            "response_frame": 2560
          }
        ],
        "size_bytes": 90277,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 87,
            "frame_number": 2560,
            "display_filter": "frame.number == 2560",
            "timestamp_epoch": "1573510898.335972000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e26932ebb690cbdfce69de96",
        "md5": "3200734550530fb19470493d376084ac",
        "sha1": "2f80c90bd2d1f6501b2444f5174b60251ed006b7",
        "type": "file-artifact",
        "label": "style.f795fa8febec.css",
        "value": "98899dcb5dcd03f379d15ee123311e2d8f61e81060e8a4c7bc3d01864a528fd0",
        "sha256": "98899dcb5dcd03f379d15ee123311e2d8f61e81060e8a4c7bc3d01864a528fd0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.vinylmeplease.com/static/style.f795fa8febec.css",
            "client_ip": "10.11.11.200",
            "server_ip": "13.33.255.37",
            "tcp_stream": 286,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13519,
            "response_frame": 13534
          }
        ],
        "size_bytes": 85680,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 286,
            "frame_number": 13534,
            "display_filter": "frame.number == 13534",
            "timestamp_epoch": "1573511003.744831000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2a9b3033149f4ca0fdc8ef9c",
        "md5": "d98572ec10d80981b406a94ccc03d6ce",
        "sha1": "ccb822336096bcf35db6a46cf2d67f7931a36551",
        "type": "file-artifact",
        "label": "reloadCampaigns.js%3ftojQ=function&cts=1573510961475&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcon",
        "value": "4ddf3cc87fdaa2a88ebadd0d9fa28a8850bb94aada3772ce152d9def51c3402e",
        "sha256": "4ddf3cc87fdaa2a88ebadd0d9fa28a8850bb94aada3772ce152d9def51c3402e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://api.bounceexchange.com/bounce/reloadCampaigns.js?tojQ=function&cts=1573510961475&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22r%22%3A%22%22%7D&cookie=%7B%22v%22%3A%7B%22value_in_cart%22%3A0%2C%22ref_persist%22%3A%22%22%7D%2C%22fvt%22%3A1573510960%2C%22vid%22%3A1573510543567356%2C%22ao%22%3A0%2C%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22as%22%3A0%2C%22vpv%22%3A2%2C%22d%22%3A%22d%22%2C%22r%22%3A%22%22%2C%22cvt%22%3A1573510543%2C%22sid%22%3A13%2C%22gcr%22%3A18%2C%22m%22%3A0%2C%22did%22%3A%227348910884260421544%22%2C%22lvt%22%3A1573510960%2C%22campaigns%22%3A%7B%22873465%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510960%2C%22av%22%3A1%2C%22fsa%22%3A1573510960%2C%22as%22%3A1%2C%22ao%22%3A1%7D%2C%221004275%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510960%7D%2C%221015182%22%3A%7B%22vv%22%3A2%2C%22lvt%22%3A1573510960%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510960%2C%22av%22%3A2%2C%22fsa%22%3A1573510543%2C%22as%22%3A2%2C%22ao%22%3A2%7D%2C%221025199%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510960%7D%2C%221025997%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%7D%2C%221026031%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510960%7D%7D%7D&vars[items_in_cart]=0&vars[value_in_cart]=0&vars[video_playing]=false&vars[ref_persist]=&vars[sponsorship_present]=not_ready&vars[subscribed_today]=195&vars[subscribed_this_week]=1%2C129&vars[page_tag]=&vars[page_type]=article&vars[breadcrumb]=false&vars[article_class]=false&vars[dfp_rblock]=allow&vars[backfill_deployment]=&vars[time_on_site]=false&cookie_too_large=false&bp=0&etp=[]&pts=&compliance_flag=&pvid=2&vc[]=873465&vc[]=1015182&rltype=dfp_rblock&rlname=variable",
            "client_ip": "10.11.11.179",
            "server_ip": "35.186.255.8",
            "tcp_stream": 246,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9815,
            "response_frame": 9840
          }
        ],
        "size_bytes": 79721,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 246,
            "frame_number": 9840,
            "display_filter": "frame.number == 9840",
            "timestamp_epoch": "1573510961.396883000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-709b452b8e622e55f9294bb3",
        "md5": "3b49e1ff03af44d44eb0c545a833ca4a",
        "sha1": "9ff335c081ec15a75c26814089ee396caad346df",
        "type": "file-artifact",
        "label": "init1.js%3ftojQ=function&cts=1573510956419&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcontent.time.",
        "value": "6c5e15629a0ff3c7ffbee8b660426bc165edf160b92f3a79030230f2ef70b263",
        "sha256": "6c5e15629a0ff3c7ffbee8b660426bc165edf160b92f3a79030230f2ef70b263",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://api.bounceexchange.com/bounce/init1.js?tojQ=function&cts=1573510956419&tzo=480&website_id=1709&resolution=1280x694&referrer=&calling_url=http%3A%2F%2Fcontent.time.com%2Ftime%2Fphotogallery%2F0%2C29307%2C2077702%2C00.html&visit_cookie=%7B%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22r%22%3A%22%22%7D&cookie=%7B%22v%22%3A%7B%22value_in_cart%22%3A0%2C%22ref_persist%22%3A%22%22%7D%2C%22fvt%22%3A1573510543%2C%22vid%22%3A1573510543567356%2C%22ao%22%3A0%2C%22lp%22%3A%22http%253A%252F%252Fcontent.time.com%252Ftime%252Fphotogallery%252F0%252C29307%252C2077702%252C00.html%22%2C%22as%22%3A0%2C%22vpv%22%3A1%2C%22d%22%3A%22d%22%2C%22r%22%3A%22%22%2C%22cvt%22%3A1573510543%2C%22sid%22%3A6%2C%22gcr%22%3A18%2C%22m%22%3A0%2C%22did%22%3A%227348910884260421544%22%2C%22lvt%22%3A1573510575%2C%22campaigns%22%3A%7B%221004275%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510575%7D%2C%221015182%22%3A%7B%22vv%22%3A1%2C%22lvt%22%3A1573510575%2C%22lavid%22%3A1573510543567356%2C%22la%22%3A1573510543%2C%22av%22%3A1%2C%22fsa%22%3A1573510543%2C%22as%22%3A1%2C%22ao%22%3A1%7D%2C%221025199%22%3A%7B%22vv%22%3A0%2C%22lvt%22%3A1573510575%7D%7D%7D&vars[items_in_cart]=0&vars[value_in_cart]=0&vars[video_playing]=false&vars[ref_persist]=&vars[sponsorship_present]=not_ready&vars[subscribed_today]=195&vars[subscribed_this_week]=1%2C129&vars[page_tag]=&vars[page_type]=article&vars[breadcrumb]=false&vars[article_class]=false&vars[dfp_rblock]=allow&vars[backfill_deployment]=&vars[time_on_site]=false&vdef[value_in_cart]=0&cookie_too_large=false&bp=0&etp=[]&pts=&compliance_flag=",
            "client_ip": "10.11.11.179",
            "server_ip": "35.186.255.8",
            "tcp_stream": 246,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9624,
            "response_frame": 9707
          }
        ],
        "size_bytes": 78581,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 246,
            "frame_number": 9707,
            "display_filter": "frame.number == 9707",
            "timestamp_epoch": "1573510960.327793000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e74cd0b3b62a8ab659cd0ca1",
        "md5": "a8a2a48ddaa95527c6d3db763e2b7809",
        "sha1": "d5168c9a86579d1fc2c5c3f0706ebe3ac14dfe46",
        "type": "file-artifact",
        "label": "jquery.js",
        "value": "1adeb9b7455c164e01a88173d356742be2a4b5dc4977f0f64fee5b5d4b38e0b3",
        "sha256": "1adeb9b7455c164e01a88173d356742be2a4b5dc4977f0f64fee5b5d4b38e0b3",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/j/jquery.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 92,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2543,
            "response_frame": 2668
          }
        ],
        "size_bytes": 72326,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 92,
            "frame_number": 2668,
            "display_filter": "frame.number == 2668",
            "timestamp_epoch": "1573510898.359390000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7594b96fd3ccb54319eb32a4",
        "md5": "e6cf7c6ec7c2d6f670ae9d762604cb0b",
        "sha1": "97e438cc545714309882fbceadbf344fcaddcec5",
        "type": "file-artifact",
        "label": "fontawesome-webfont.woff2%3fv=4.6.3",
        "value": "7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73",
        "sha256": "7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/fonts/fontawesome-webfont.woff2?v=4.6.3",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 9193,
            "response_frame": 9473
          }
        ],
        "size_bytes": 71896,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 9473,
            "display_filter": "frame.number == 9473",
            "timestamp_epoch": "1573510958.267914000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e79f3c6e232c70183f655f80",
        "md5": "27e1420b757f01f17a6e1bb95de56456",
        "sha1": "b127faba2ba55507b14e043776bf7f1fc7f2f55d",
        "type": "file-artifact",
        "label": "jetpack.css",
        "value": "b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb",
        "sha256": "b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/plugins/jetpack/css/jetpack.css",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 233,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8937,
            "response_frame": 8960
          }
        ],
        "size_bytes": 71643,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 233,
            "frame_number": 8960,
            "display_filter": "frame.number == 8960",
            "timestamp_epoch": "1573510957.678832000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-cc826620ce118cbfa0b108e4",
        "md5": "6e2587891b12c3f66367c2d8f6e5b06a",
        "sha1": "8eb962892a8a1537c11885706125cc745e1b5ae6",
        "type": "file-artifact",
        "label": "jailbreak-ios-13",
        "value": "729ccb444da66d98803b01cecb8ffc4d6c046e09f5642f733daec6a1c53a9c3a",
        "sha256": "729ccb444da66d98803b01cecb8ffc4d6c046e09f5642f733daec6a1c53a9c3a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/jailbreak-ios-13",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8772,
            "response_frame": 8793
          }
        ],
        "size_bytes": 61591,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8793,
            "display_filter": "frame.number == 8793",
            "timestamp_epoch": "1573510957.397125000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-3d79c57ff75149cab27693cc",
        "md5": "4526f72e446aa3267e0c527f183dec42",
        "sha1": "ef142bb17c4d8d322707ecf3da9112e5d08d5ed5",
        "type": "file-artifact",
        "label": "jsUtilityLibrary1.js",
        "value": "ab8b92e2b5d66dcddb532092bfa5185ed6536feeaa0845bb3770da45e812fdae",
        "sha256": "ab8b92e2b5d66dcddb532092bfa5185ed6536feeaa0845bb3770da45e812fdae",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://subscription-assets.timeinc.com/prod/assets/themes/magazines/default/template-resources/js/shared/jsUtilityLibrary1.js",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.72",
            "tcp_stream": 206,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 7211,
            "response_frame": 7464
          }
        ],
        "size_bytes": 59471,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 206,
            "frame_number": 7464,
            "display_filter": "frame.number == 7464",
            "timestamp_epoch": "1573510944.540158000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7d1f59bfd8bc58bbe10b8557",
        "md5": "701e3bc7bfda4ac5b7c58fb04dfdf8ec",
        "sha1": "dbf571feb45328fc4d68f549566b35461fdd07d7",
        "type": "file-artifact",
        "label": "style.php",
        "value": "f714ad11f67806cf22b6b019762efef7bea88162422616a9262056b12888a0b6",
        "sha256": "f714ad11f67806cf22b6b019762efef7bea88162422616a9262056b12888a0b6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/style.php",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 164,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6226,
            "response_frame": 6308
          }
        ],
        "size_bytes": 55939,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 164,
            "frame_number": 6308,
            "display_filter": "frame.number == 6308",
            "timestamp_epoch": "1573510939.906020000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a9facfda06f8be80d6e5cc91",
        "md5": "6f3e0601a3b30021613c11ee1717831d",
        "sha1": "4d53577964378394030c2c9d47a109cc413a18aa",
        "type": "file-artifact",
        "label": "gpt.js",
        "value": "c3825ca33d7f23fa275f8c6287073ae8b36631f0a2dbd592071c812f37c2b938",
        "sha256": "c3825ca33d7f23fa275f8c6287073ae8b36631f0a2dbd592071c812f37c2b938",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.googletagservices.com/tag/js/gpt.js",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.6.162",
            "tcp_stream": 237,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9076,
            "response_frame": 9129
          }
        ],
        "size_bytes": 52326,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 237,
            "frame_number": 9129,
            "display_filter": "frame.number == 9129",
            "timestamp_epoch": "1573510958.006386000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-99075fd77e44b3f3acb3b8b2",
        "md5": "b1a38d29d7ef495a97c3fb40ded52b9a",
        "sha1": "a74f98254440a34f1e47334e53dde8b7796d0309",
        "type": "file-artifact",
        "label": "%2f(2)",
        "value": "7a10b359e1a05ad63a7d3b4dbf2a78681b1c39fa6e40bff19d43cca8a93028ea",
        "sha256": "7a10b359e1a05ad63a7d3b4dbf2a78681b1c39fa6e40bff19d43cca8a93028ea",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://orbike.com/",
            "client_ip": "10.11.11.121",
            "server_ip": "173.236.251.15",
            "tcp_stream": 391,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21397,
            "response_frame": 21406
          },
          {
            "url": "http://orbike.com/",
            "client_ip": "10.11.11.121",
            "server_ip": "173.236.251.15",
            "tcp_stream": 391,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21419,
            "response_frame": 21429
          }
        ],
        "size_bytes": 41029,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 391,
            "frame_number": 21406,
            "display_filter": "frame.number == 21406",
            "timestamp_epoch": "1573511063.556974000"
          },
          {
            "tcp_stream": 391,
            "frame_number": 21429,
            "display_filter": "frame.number == 21429",
            "timestamp_epoch": "1573511063.996754000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5e5a5febefd25b4b3dc77e1a",
        "md5": "fc3bcfe61add9048a2729d72be0cce0f",
        "sha1": "e5564a135dd1b45825dbd453c66ded206b559a25",
        "type": "file-artifact",
        "label": "283173.png%3flast_modified=1566573494",
        "value": "b45f1276da2af6391e64970f41c169b3bcea4d6e8bc2fdb491d0f47444482b04",
        "sha256": "b45f1276da2af6391e64970f41c169b3bcea4d6e8bc2fdb491d0f47444482b04",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pictures.fasthealth.com/pictures/283173.png?last_modified=1566573494",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.22",
            "tcp_stream": 189,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6699,
            "response_frame": 6930
          }
        ],
        "size_bytes": 39331,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 189,
            "frame_number": 6930,
            "display_filter": "frame.number == 6930",
            "timestamp_epoch": "1573510943.188818000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f07cc7c65848233b465eef50",
        "md5": "c5aba50ff433c155add7c45226c4595b",
        "sha1": "2d31ea89644e03e8691f82d94b09a283b78d0525",
        "type": "file-artifact",
        "label": "getpage.php%3fname=whatappendixdo",
        "value": "8dd9d7f81d78e4f07d4fd8a822f903222b9aadd2f81a83743bc04dadd0cd38ef",
        "sha256": "8dd9d7f81d78e4f07d4fd8a822f903222b9aadd2f81a83743bc04dadd0cd38ef",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/getpage.php?name=whatappendixdo",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 165,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6207,
            "response_frame": 6221
          }
        ],
        "size_bytes": 37981,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 165,
            "frame_number": 6221,
            "display_filter": "frame.number == 6221",
            "timestamp_epoch": "1573510939.585333000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-070cb86df2d46752fbda2680",
        "md5": "8072c97867a7e6a23678e3099be80262",
        "sha1": "3f2615893d1b1e229b98671b4d2049ad25239c4f",
        "type": "file-artifact",
        "label": "283175.png%3flast_modified=1566573563",
        "value": "502f0b5cfc3859d89aed3b5e79fd7cb45d76201862c9d28fcd32dbf939254ff1",
        "sha256": "502f0b5cfc3859d89aed3b5e79fd7cb45d76201862c9d28fcd32dbf939254ff1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pictures.fasthealth.com/pictures/283175.png?last_modified=1566573563",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.22",
            "tcp_stream": 188,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6697,
            "response_frame": 6938
          }
        ],
        "size_bytes": 36528,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 188,
            "frame_number": 6938,
            "display_filter": "frame.number == 6938",
            "timestamp_epoch": "1573510943.197695000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-3065be636980645c615011d8",
        "md5": "213e8040c318f2aaa8a68b8fb549ff99",
        "sha1": "9c59f3b6ea69090055b0bc8efdee739a3516d0e4",
        "type": "file-artifact",
        "label": "jailbreak-ios-13-13-1-ipadOS.png",
        "value": "5e49bf693ec382ee689b0a8d062ebed44f3e5aacb9b70402423cb99901a2acc1",
        "sha256": "5e49bf693ec382ee689b0a8d062ebed44f3e5aacb9b70402423cb99901a2acc1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.iphonehacks.com/wp-content/uploads/2019/09/jailbreak-ios-13-13-1-ipadOS.png",
            "client_ip": "10.11.11.217",
            "server_ip": "94.31.29.96",
            "tcp_stream": 259,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 10552,
            "response_frame": 10664
          }
        ],
        "size_bytes": 35865,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 259,
            "frame_number": 10664,
            "display_filter": "frame.number == 10664",
            "timestamp_epoch": "1573510965.460271000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7f32f09260603fbd0cc96cc7",
        "md5": "fced18c7873396742fa20a4686c5b9e7",
        "sha1": "7965ba7fde40fe3cfce891bc6aa7eaaea7b13c99",
        "type": "file-artifact",
        "label": "appleglassdisplay.jpg",
        "value": "acad7e7a54a533041f08a9179fb37b73826b1e5c937e4014a7b879b23256a321",
        "sha256": "acad7e7a54a533041f08a9179fb37b73826b1e5c937e4014a7b879b23256a321",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.iphonehacks.com/wp-content/uploads/2018/02/appleglassdisplay.jpg",
            "client_ip": "10.11.11.217",
            "server_ip": "94.31.29.96",
            "tcp_stream": 257,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 10537,
            "response_frame": 10617
          }
        ],
        "size_bytes": 34807,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 257,
            "frame_number": 10617,
            "display_filter": "frame.number == 10617",
            "timestamp_epoch": "1573510965.444241000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d625cd1dacc1757ed73b9597",
        "md5": "6b83f5e9f815a34124b317a8f357a8b4",
        "sha1": "cef9405aaf122c8fb429cbb8c4251f831a2bd00a",
        "type": "file-artifact",
        "label": "style.css%3fver=1.130",
        "value": "467adfd1e3a82ceb3820acd2a991360a8806c4efae6643b4be62e9994db03733",
        "sha256": "467adfd1e3a82ceb3820acd2a991360a8806c4efae6643b4be62e9994db03733",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/style.css?ver=1.130",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8947,
            "response_frame": 8985
          }
        ],
        "size_bytes": 31498,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8985,
            "display_filter": "frame.number == 8985",
            "timestamp_epoch": "1573510957.726416000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4ba08d6429e9309e30c2e398",
        "md5": "ab660ee943a5638ff0311a2fc9bf4344",
        "sha1": "25b311cd617d99734466e089d4edc428e980b273",
        "type": "file-artifact",
        "label": "font-awesome.min.css",
        "value": "69c0162d9102848858454ae467402cd402138ac95789c79947745cde0cf7b937",
        "sha256": "69c0162d9102848858454ae467402cd402138ac95789c79947745cde0cf7b937",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/common_js/font-awesome-4.7.0/css/font-awesome.min.css",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 171,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6401,
            "response_frame": 6464
          }
        ],
        "size_bytes": 30934,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 171,
            "frame_number": 6464,
            "display_filter": "frame.number == 6464",
            "timestamp_epoch": "1573510940.083993000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fa295f77ea235fc035b9c8ac",
        "md5": "375bd65d60ff3c8723fccc343afb1b9b",
        "sha1": "b06ba18a307bdf4821dded9ebffd2489f7b01d6a",
        "type": "file-artifact",
        "label": "style.min.css",
        "value": "4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d",
        "sha256": "4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-includes/css/dist/block-library/style.min.css",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 232,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8837,
            "response_frame": 8934
          }
        ],
        "size_bytes": 29295,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 8934,
            "display_filter": "frame.number == 8934",
            "timestamp_epoch": "1573510957.612945000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e3daf198c9cc1f251c3338f5",
        "md5": "9126debd96b491df1a0c4792f510330b",
        "sha1": "14ad6900c6586d739baaee9d17f0c3ca4b578124",
        "type": "file-artifact",
        "label": "59e13b45ca55004b15253acf0d1583734f977224-l.woff2",
        "value": "4dcc7f2174e5ff8c47c42436a4c603856fd7e752339cdc7d5161d9195d7e123e",
        "sha256": "4dcc7f2174e5ff8c47c42436a4c603856fd7e752339cdc7d5161d9195d7e123e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/59e13b45ca55004b15253acf0d1583734f977224-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 135,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4349,
            "response_frame": 4519
          }
        ],
        "size_bytes": 29092,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 135,
            "frame_number": 4519,
            "display_filter": "frame.number == 4519",
            "timestamp_epoch": "1573510923.218893000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-db58d766b35cae1df9bc13c9",
        "md5": "bb53ad7bffecc0014d64553e96501dce",
        "sha1": "7cd5a3384333f95c3d37d9488ad82cd6c4b03761",
        "type": "file-artifact",
        "label": "font-awesome.min(1).css",
        "value": "7bc15c522a05ce0e56b8cb3fff83bc6e770130afdd840d469869db69663d78fe",
        "sha256": "7bc15c522a05ce0e56b8cb3fff83bc6e770130afdd840d469869db69663d78fe",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/css/font-awesome.min.css",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8795,
            "response_frame": 8805
          }
        ],
        "size_bytes": 29062,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8805,
            "display_filter": "frame.number == 8805",
            "timestamp_epoch": "1573510957.500466000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5b222c8f1a65394111172b73",
        "md5": "ecc915b2cbd5da8dd23229694c2894f2",
        "sha1": "3034e84bef1aef33018f3fc4f9bc90b37823962a",
        "type": "file-artifact",
        "label": "health-bk.jpg",
        "value": "e38186eec3c4b4c967737af9191995d9e09972fe19b863d37ea83c064b149225",
        "sha256": "e38186eec3c4b4c967737af9191995d9e09972fe19b863d37ea83c064b149225",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/docs/health-bk.jpg",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 212,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7376,
            "response_frame": 7425
          }
        ],
        "size_bytes": 26924,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 212,
            "frame_number": 7425,
            "display_filter": "frame.number == 7425",
            "timestamp_epoch": "1573510944.276867000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8dc53614b8cdc419baa5ab40",
        "md5": "88d8f57b69317ce1e5d6155945326a93",
        "sha1": "6359d527fb3dbf8651139d3555199215ca240a9f",
        "type": "file-artifact",
        "label": "i.js",
        "value": "0598bd5943d77dc98747798eb12ee9dd92dce1a85d9ac98c18b8e2de21857628",
        "sha256": "0598bd5943d77dc98747798eb12ee9dd92dce1a85d9ac98c18b8e2de21857628",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://tag.bounceexchange.com/1709/i.js",
            "client_ip": "10.11.11.179",
            "server_ip": "35.190.92.63",
            "tcp_stream": 149,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 5585,
            "response_frame": 5640
          }
        ],
        "size_bytes": 24365,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 149,
            "frame_number": 5640,
            "display_filter": "frame.number == 5640",
            "timestamp_epoch": "1573510930.767177000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-bdb027c8b30662430c1807db",
        "md5": "df78c06907776b96fc9bab301a9f0ce6",
        "sha1": "a4665ed5dd3d31d36f5a8a023900c88a27b9657c",
        "type": "file-artifact",
        "label": "180215.jpg",
        "value": "7f709773527990d3cadd71e01685f54b8592f290716e3ca9b25a9e2b1daaf2a2",
        "sha256": "7f709773527990d3cadd71e01685f54b8592f290716e3ca9b25a9e2b1daaf2a2",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/pictures/content/180215.jpg",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 178,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6487,
            "response_frame": 6547
          }
        ],
        "size_bytes": 22916,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 178,
            "frame_number": 6547,
            "display_filter": "frame.number == 6547",
            "timestamp_epoch": "1573510940.256716000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b8a285a821a832489fb2189e",
        "md5": "ac02d3e8a155957345d67fc2a02437e5",
        "sha1": "a30d4d1372062633d095c3f0be2ae45f08168368",
        "type": "file-artifact",
        "label": "284675.png",
        "value": "7e935ae772d2d67ed17e7e5ccacf7759d4876d275f534ded2950bad16fdfc95f",
        "sha256": "7e935ae772d2d67ed17e7e5ccacf7759d4876d275f534ded2950bad16fdfc95f",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pictures.fasthealth.com/pictures/284675.png",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.22",
            "tcp_stream": 187,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6702,
            "response_frame": 6871
          }
        ],
        "size_bytes": 22714,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 187,
            "frame_number": 6871,
            "display_filter": "frame.number == 6871",
            "timestamp_epoch": "1573510943.150264000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9992cf4a1d874e0f100c5afa",
        "md5": "59ad6d49b145300d0f3d7b2192892f3e",
        "sha1": "22ce8cbb84d8db34964017023566abe44417a50c",
        "type": "file-artifact",
        "label": "025c1e6b256144e3e33ad0f875f0e4608736cd61-l.woff2",
        "value": "e3476a3b5d5234ac5600b211f27ac1c8c1e53d05e93ba969f811bbe90e2f62d2",
        "sha256": "e3476a3b5d5234ac5600b211f27ac1c8c1e53d05e93ba969f811bbe90e2f62d2",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/025c1e6b256144e3e33ad0f875f0e4608736cd61-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 133,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4340,
            "response_frame": 4503
          }
        ],
        "size_bytes": 22268,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 133,
            "frame_number": 4503,
            "display_filter": "frame.number == 4503",
            "timestamp_epoch": "1573510923.217005000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1eeb0fdb37fbf7eaa2b6a0b8",
        "md5": "76590a7d4bc9e8926edda1b713744b34",
        "sha1": "389c1521dea056b528ccd2eb876aaed1ba9e0859",
        "type": "file-artifact",
        "label": "f12a8892d5e5e951e97d6224e0cc979940704c9b-l.woff2",
        "value": "b57e59703787968123e13e1452aba6ea85e2bb5cc85734ada1188717b5dd3e56",
        "sha256": "b57e59703787968123e13e1452aba6ea85e2bb5cc85734ada1188717b5dd3e56",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/f12a8892d5e5e951e97d6224e0cc979940704c9b-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 134,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4350,
            "response_frame": 4511
          }
        ],
        "size_bytes": 22088,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 134,
            "frame_number": 4511,
            "display_filter": "frame.number == 4511",
            "timestamp_epoch": "1573510923.218360000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4f3f9e491a22f443a926c81c",
        "md5": "2e48b152471f197e075657cad7e6b39a",
        "sha1": "2c872709c18c04939b9c1cc6ed0ab665c74564a3",
        "type": "file-artifact",
        "label": "58e910a529b7e850fcf5972ceda8f9e76c2a4c5a-l.woff2",
        "value": "3ebe47f20081ad143711c282175da54b2897d5ca04ca197f310e5bfc6bbccc30",
        "sha256": "3ebe47f20081ad143711c282175da54b2897d5ca04ca197f310e5bfc6bbccc30",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/58e910a529b7e850fcf5972ceda8f9e76c2a4c5a-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4180,
            "response_frame": 4306
          }
        ],
        "size_bytes": 21304,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 4306,
            "display_filter": "frame.number == 4306",
            "timestamp_epoch": "1573510923.142473000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-81a689d0be7d82f66e9cb7e6",
        "md5": "229632eeaf98c18056698b6883f3239f",
        "sha1": "ec63333fe85834427790e738335271d6aa90e9d0",
        "type": "file-artifact",
        "label": "snowstorm.js%3f_=1573510907654",
        "value": "be3d446906ece42738125497492b453a0a7e21a952cbf4a94ecf11d8a43ffa8d",
        "sha256": "be3d446906ece42738125497492b453a0a7e21a952cbf4a94ecf11d8a43ffa8d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.chromebooktrivia.com/templates/black-friday/snowstorm.js?_=1573510907654",
            "client_ip": "10.11.11.94",
            "server_ip": "52.218.228.130",
            "tcp_stream": 94,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3096,
            "response_frame": 3114
          }
        ],
        "size_bytes": 21206,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 3114,
            "display_filter": "frame.number == 3114",
            "timestamp_epoch": "1573510899.057785000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d4e499997a9b9a5151d77ade",
        "md5": "ab5d742a917394ea54061d0fcd863ec5",
        "sha1": "315a7e6e13d7fe2270809d7974408118149f8a1c",
        "type": "file-artifact",
        "label": "fixed-header-footer.css",
        "value": "44b53447b74b3429694ae0ed7f8bd881409d494a123559095b5c45b4e60d1518",
        "sha256": "44b53447b74b3429694ae0ed7f8bd881409d494a123559095b5c45b4e60d1518",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/c/v4/fixed-header-footer.css",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 88,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2540,
            "response_frame": 2585
          }
        ],
        "size_bytes": 21095,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 88,
            "frame_number": 2585,
            "display_filter": "frame.number == 2585",
            "timestamp_epoch": "1573510898.340539000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-14aca4d77985b4543c0bb528",
        "md5": "d0aef2a0739d08eba13c609d261b12ec",
        "sha1": "0a0074c80b62002eef527efd988cbf2f6bb0ddf5",
        "type": "file-artifact",
        "label": "epq2dmc.js",
        "value": "61e9e4fabca279abc8d91ad02e51a597920dfb93d84186cad9531b5edefec4b9",
        "sha256": "61e9e4fabca279abc8d91ad02e51a597920dfb93d84186cad9531b5edefec4b9",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/epq2dmc.js",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2539,
            "response_frame": 2586
          }
        ],
        "size_bytes": 20609,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 2586,
            "display_filter": "frame.number == 2586",
            "timestamp_epoch": "1573510898.340728000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8f69960382c71426d56e8e23",
        "md5": "1c2b7ca1fba40197af11809ab5a2e151",
        "sha1": "df7a8c4f7161a9cb2b810f267058f0da1bab9de1",
        "type": "file-artifact",
        "label": "startup.js%3fscript_version=1567795643",
        "value": "b86da58d907cb2a1c99d3d3c4067b9cf0a2ac1cd70d19da8b41799c1ebc5d0bf",
        "sha256": "b86da58d907cb2a1c99d3d3c4067b9cf0a2ac1cd70d19da8b41799c1ebc5d0bf",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/js/startup.js?script_version=1567795643",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 179,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6488,
            "response_frame": 6503
          }
        ],
        "size_bytes": 19354,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 179,
            "frame_number": 6503,
            "display_filter": "frame.number == 6503",
            "timestamp_epoch": "1573510940.202037000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-101bd78c432ec19d0dfa21fb",
        "md5": "3d368e1a6b19126b48f3a1dab9f529b6",
        "sha1": "6f6e4ae5492fdfc6ddfc91d8f74b3bdc1925dc0c",
        "type": "file-artifact",
        "label": "login.html",
        "value": "01a653b4a4b428930004cf55ad4e07918e2df423a17191b29a1e697b578fabba",
        "sha256": "01a653b4a4b428930004cf55ad4e07918e2df423a17191b29a1e697b578fabba",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://subscription-assets.time.com/prod/assets/themes/magazines/SUBS/templates/velocity/site/td-pcslogin/login.html",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.72",
            "tcp_stream": 203,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 7026,
            "response_frame": 7135
          }
        ],
        "size_bytes": 17728,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/html",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 203,
            "frame_number": 7135,
            "display_filter": "frame.number == 7135",
            "timestamp_epoch": "1573510943.996497000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-64245814d6be3f4dbe212dd4",
        "md5": "9ad27f00d96fb59e7c24f48866a7f03a",
        "sha1": "533360e3dadd05a04327e856d1207bc70efa8664",
        "type": "file-artifact",
        "label": "MobileCompatibility.js",
        "value": "99c50e3babe3c9db03052d1578360e5f55b65a30a8ca3a789638b95faf91dac2",
        "sha256": "99c50e3babe3c9db03052d1578360e5f55b65a30a8ca3a789638b95faf91dac2",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/j/MobileCompatibility.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 92,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2670,
            "response_frame": 2707
          }
        ],
        "size_bytes": 16526,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 92,
            "frame_number": 2707,
            "display_filter": "frame.number == 2707",
            "timestamp_epoch": "1573510898.414769000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9cb4e045a64ce53a75aac109",
        "md5": "87aa6620cb82d6181e79f4c0b34ec506",
        "sha1": "a4743b25890faa5d9c5589a4d1edd2cce1e25b72",
        "type": "file-artifact",
        "label": "1609a37839f93dabc87a54ee53459226e2cf33fa-l.woff2",
        "value": "8e92dedb50b92efc8e23e3a4985fdb53e587e85139e113953e877320ec6d705c",
        "sha256": "8e92dedb50b92efc8e23e3a4985fdb53e587e85139e113953e877320ec6d705c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/1609a37839f93dabc87a54ee53459226e2cf33fa-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7722,
            "response_frame": 7774
          }
        ],
        "size_bytes": 16180,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 7774,
            "display_filter": "frame.number == 7774",
            "timestamp_epoch": "1573510948.318619000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-45bdd3523c3bfa329845a07d",
        "md5": "a00939510e1106ac8f4b9ba6e71a6a20",
        "sha1": "f078ad96abbdd7264860c0b86a29a7eb09f95b7a",
        "type": "file-artifact",
        "label": "1d346fd0d510a369fd4b9df2674c26d718e4beb1-l.woff2",
        "value": "68729ba42eb5861023b02ccacea9aa4c6195470f95c69d96c3740624bb2232da",
        "sha256": "68729ba42eb5861023b02ccacea9aa4c6195470f95c69d96c3740624bb2232da",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/1d346fd0d510a369fd4b9df2674c26d718e4beb1-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4518,
            "response_frame": 4614
          },
          {
            "url": "http://fonts.timeinc.net/k/e635a32183b71826a33896c1e974a70b184c6410-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 137,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7882,
            "response_frame": 8021
          }
        ],
        "size_bytes": 15988,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 4614,
            "display_filter": "frame.number == 4614",
            "timestamp_epoch": "1573510923.273126000"
          },
          {
            "tcp_stream": 137,
            "frame_number": 8021,
            "display_filter": "frame.number == 8021",
            "timestamp_epoch": "1573510948.392977000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9e9972a41eee1bfd78d9cf51",
        "md5": "20e5c133a3ab98a51afe5bb3229e2796",
        "sha1": "1461031f1c2c198aa016763058df26fcb6cb7001",
        "type": "file-artifact",
        "label": "3e086aeb55362e43507c520ea58b44ded4129782-l.woff2",
        "value": "e7c9c787c8499c5f11f27c0f54dc7e611c96011bcfa005b85a21cda11b5d0acd",
        "sha256": "e7c9c787c8499c5f11f27c0f54dc7e611c96011bcfa005b85a21cda11b5d0acd",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/3e086aeb55362e43507c520ea58b44ded4129782-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 134,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7861,
            "response_frame": 8000
          }
        ],
        "size_bytes": 15988,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 134,
            "frame_number": 8000,
            "display_filter": "frame.number == 8000",
            "timestamp_epoch": "1573510948.388391000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-456529dc9a6be39381bd05ea",
        "md5": "d8fa97b46de9dea6b251730396fc9ae9",
        "sha1": "5517db5a1f3e14dbf798f5ac4b44860c6165f934",
        "type": "file-artifact",
        "label": "7b2af211ab5ede3d9e2e5abdbe950886bb60f2f4-l.woff2",
        "value": "13237099700a0f42bf2e5ded9b77a90c67ae79e73596bf130ff608d9900c2da1",
        "sha256": "13237099700a0f42bf2e5ded9b77a90c67ae79e73596bf130ff608d9900c2da1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/7b2af211ab5ede3d9e2e5abdbe950886bb60f2f4-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 134,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7724,
            "response_frame": 7825
          }
        ],
        "size_bytes": 15828,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 134,
            "frame_number": 7825,
            "display_filter": "frame.number == 7825",
            "timestamp_epoch": "1573510948.326584000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-eea1140918bac1891aac8bbc",
        "md5": "b7deebfc306666659da80222c1defa56",
        "sha1": "63be3ce2602f9c86591afe0c4874a05eb5fc1821",
        "type": "file-artifact",
        "label": "effb6cf3199928b98bd968db011b591e8a169463-l.woff2",
        "value": "a92cd283b70a1a26da4b51225bd9afab8251d2f974d44a40da8063a34b6d5072",
        "sha256": "a92cd283b70a1a26da4b51225bd9afab8251d2f974d44a40da8063a34b6d5072",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/effb6cf3199928b98bd968db011b591e8a169463-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 136,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7873,
            "response_frame": 7992
          }
        ],
        "size_bytes": 15820,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 136,
            "frame_number": 7992,
            "display_filter": "frame.number == 7992",
            "timestamp_epoch": "1573510948.386993000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-387b59d59748df8574704ea9",
        "md5": "7e21bbcc3220973132f14ba310fe43b3",
        "sha1": "35ef671a91ff16501c0cb51bc017b348353d8a09",
        "type": "file-artifact",
        "label": "c45bae6e22820a1c32ae73ccc8809af6b552f0e3-l.woff2",
        "value": "f279c5eba813fab19d319704cfd342a90f37790638f76a0e9c2610b2f050f3e4",
        "sha256": "f279c5eba813fab19d319704cfd342a90f37790638f76a0e9c2610b2f050f3e4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/c45bae6e22820a1c32ae73ccc8809af6b552f0e3-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 135,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7725,
            "response_frame": 7864
          }
        ],
        "size_bytes": 15800,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 135,
            "frame_number": 7864,
            "display_filter": "frame.number == 7864",
            "timestamp_epoch": "1573510948.330196000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-818c06bf7675b27b10c9cf12",
        "md5": "4a2a4c703654b7c4c0bc1bd7fed05a06",
        "sha1": "1253c9e186e10c32f27204b9f171dab1c5a7f42b",
        "type": "file-artifact",
        "label": "1d28b5aae7bfe492e615a7b6ca691db0b71993b4-l.woff2",
        "value": "db31aef54315b605aca1530e6be9873be4635064521886a87defd8ce16da4acf",
        "sha256": "db31aef54315b605aca1530e6be9873be4635064521886a87defd8ce16da4acf",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/1d28b5aae7bfe492e615a7b6ca691db0b71993b4-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 137,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4352,
            "response_frame": 4492
          },
          {
            "url": "http://fonts.timeinc.net/k/6d8154d04c9106d6f957e8134bdeaf382bac1b04-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 137,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7727,
            "response_frame": 7859
          }
        ],
        "size_bytes": 15628,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 137,
            "frame_number": 4492,
            "display_filter": "frame.number == 4492",
            "timestamp_epoch": "1573510923.215583000"
          },
          {
            "tcp_stream": 137,
            "frame_number": 7859,
            "display_filter": "frame.number == 7859",
            "timestamp_epoch": "1573510948.329433000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0c854fc64902205fbebd50cb",
        "md5": "b454041c41cca65e0104fc7e3406f32e",
        "sha1": "68cab0d3d2f1546c0184fcbaa888711408e7c97e",
        "type": "file-artifact",
        "label": "b00aff8731cd28b72c02db34b387d7215d0799bb-l.woff2",
        "value": "d51d56f3bed1fd22a3bf9d07de256a921a5e666669236548f2eae1319c18d850",
        "sha256": "d51d56f3bed1fd22a3bf9d07de256a921a5e666669236548f2eae1319c18d850",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/b00aff8731cd28b72c02db34b387d7215d0799bb-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4323,
            "response_frame": 4464
          },
          {
            "url": "http://fonts.timeinc.net/k/b97852f0375ae24216aae8319949ea365cc1a093-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 133,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7786,
            "response_frame": 7920
          }
        ],
        "size_bytes": 15572,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 91,
            "frame_number": 4464,
            "display_filter": "frame.number == 4464",
            "timestamp_epoch": "1573510923.212980000"
          },
          {
            "tcp_stream": 133,
            "frame_number": 7920,
            "display_filter": "frame.number == 7920",
            "timestamp_epoch": "1573510948.378506000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f03f3866a2f36670d8258358",
        "md5": "ff934dcea0b9261335cee8b0a938ea74",
        "sha1": "56057497354d309d340241f3fb5a9bdb65d8a5c5",
        "type": "file-artifact",
        "label": "270545.png%3flast_modified=1541605401",
        "value": "695bdae25dc2974d6618325d6077e6a03fb86ca025e3fa0c35e891728559f84f",
        "sha256": "695bdae25dc2974d6618325d6077e6a03fb86ca025e3fa0c35e891728559f84f",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pictures.fasthealth.com/pictures/270545.png?last_modified=1541605401",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.22",
            "tcp_stream": 182,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6695,
            "response_frame": 6847
          }
        ],
        "size_bytes": 15525,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 182,
            "frame_number": 6847,
            "display_filter": "frame.number == 6847",
            "timestamp_epoch": "1573510943.132352000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-454f0da7e2ae9ff1245d74ca",
        "md5": "b651890ddd4fb2fceae100124eb35c5b",
        "sha1": "4f09c36417e1cacdcad7b8286b351fdf8ef539f4",
        "type": "file-artifact",
        "label": "remove-electra-jailbreak-semirestore-rollectra-194x129.png",
        "value": "115d9c8bfe90b5fdd688510b0fe56ac0ef35179ef373542eba56b999dafc9bd4",
        "sha256": "115d9c8bfe90b5fdd688510b0fe56ac0ef35179ef373542eba56b999dafc9bd4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.iphonehacks.com/wp-content/uploads/2018/08/remove-electra-jailbreak-semirestore-rollectra-194x129.png",
            "client_ip": "10.11.11.217",
            "server_ip": "94.31.29.96",
            "tcp_stream": 258,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 10391,
            "response_frame": 10460
          }
        ],
        "size_bytes": 15487,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 258,
            "frame_number": 10460,
            "display_filter": "frame.number == 10460",
            "timestamp_epoch": "1573510965.328497000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b6fa1f38129d375cb04488c3",
        "md5": "56e3f0713e074202a434ba287406076b",
        "sha1": "07e5a0b8d7e2c3dab2e1f0462ef6217ca62269b1",
        "type": "file-artifact",
        "label": "67c4fb1a46634d248fd36eaadb620898fcfa0445-l.woff2",
        "value": "137b49a2384e3e48bed18045fa7f21f724fe6a9134c503d6d0498d6642b165e5",
        "sha256": "137b49a2384e3e48bed18045fa7f21f724fe6a9134c503d6d0498d6642b165e5",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/67c4fb1a46634d248fd36eaadb620898fcfa0445-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 136,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7726,
            "response_frame": 7846
          }
        ],
        "size_bytes": 15208,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 136,
            "frame_number": 7846,
            "display_filter": "frame.number == 7846",
            "timestamp_epoch": "1573510948.328251000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4a7ed68fc02ddbb8a82b998c",
        "md5": "4ccfa58277df26acda5676c021fb50db",
        "sha1": "982ec59151af017506ddc1229dde1159d5614f48",
        "type": "file-artifact",
        "label": "db2b79d9fa270b33c74db7b7f188d29543113368-l.woff2",
        "value": "53a5b76ba1ae6e0a42d06abf20f1c727736fbaf8d9ff6ab2abbcf020bc146241",
        "sha256": "53a5b76ba1ae6e0a42d06abf20f1c727736fbaf8d9ff6ab2abbcf020bc146241",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/db2b79d9fa270b33c74db7b7f188d29543113368-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 133,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7723,
            "response_frame": 7773
          }
        ],
        "size_bytes": 15100,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 133,
            "frame_number": 7773,
            "display_filter": "frame.number == 7773",
            "timestamp_epoch": "1573510948.318427000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-cd19a25c50cb4bd3f9339f8d",
        "md5": "0edb76284a7a0f8db4665b560ee2b48f",
        "sha1": "02496387a5f7bf7b79df52c7b76ece4ebc7a0710",
        "type": "file-artifact",
        "label": "mem5YaGs126MiZpBA-UN7rgOUuhp.woff2",
        "value": "74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b",
        "sha256": "74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2",
            "client_ip": "10.11.11.195",
            "server_ip": "172.217.9.131",
            "tcp_stream": 224,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8385,
            "response_frame": 8433
          }
        ],
        "size_bytes": 15056,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 224,
            "frame_number": 8433,
            "display_filter": "frame.number == 8433",
            "timestamp_epoch": "1573510952.085079000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7c9e25fb2d2d30c93e8607f8",
        "md5": "520ee8dae0b02198a882dbee57170316",
        "sha1": "9f6ea0aeb50e03c237ddf7b4008d7104871a62b6",
        "type": "file-artifact",
        "label": "0,30172,,00.js",
        "value": "9a45766e1068ddb9bd0eb6870a48ba82ed17bcc49ea8bb7ed838d62dabb8feca",
        "sha256": "9a45766e1068ddb9bd0eb6870a48ba82ed17bcc49ea8bb7ed838d62dabb8feca",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://content.time.com/time/js/utils/0,30172,,00.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.34",
            "tcp_stream": 78,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2004,
            "response_frame": 2065
          }
        ],
        "size_bytes": 14992,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 78,
            "frame_number": 2065,
            "display_filter": "frame.number == 2065",
            "timestamp_epoch": "1573510890.561924000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-723b490656801f6efbc36f6c",
        "md5": "bc9a6589d0030ec960467084c62a5842",
        "sha1": "af9d47a62f5763c8d264d2e4e790fd68babb3aa3",
        "type": "file-artifact",
        "label": "photos.css",
        "value": "d1b2452c6efe92a963ad360b5d6147409e91af0a77853e2e62d97837130bc8ea",
        "sha256": "d1b2452c6efe92a963ad360b5d6147409e91af0a77853e2e62d97837130bc8ea",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/c/v2/photos.css",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 90,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2542,
            "response_frame": 2614
          }
        ],
        "size_bytes": 14844,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 90,
            "frame_number": 2614,
            "display_filter": "frame.number == 2614",
            "timestamp_epoch": "1573510898.348073000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f3c6e0ecf8c2c9d1fa913673",
        "md5": "1b104269912cd4aa67f7cb54ba4adbc7",
        "sha1": "0e01bb21c410af39a5fa6fab54a0ee713a0ed1d2",
        "type": "file-artifact",
        "label": "36a49c752e2d8a2d59b2844695d3d66d5ab1f8a0-l.woff2",
        "value": "70207fc0d0e6a494440227237d34d0bbd9fee69ae0d13db1cecfe268420f6596",
        "sha256": "70207fc0d0e6a494440227237d34d0bbd9fee69ae0d13db1cecfe268420f6596",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/36a49c752e2d8a2d59b2844695d3d66d5ab1f8a0-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 136,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4351,
            "response_frame": 4440
          }
        ],
        "size_bytes": 14824,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 136,
            "frame_number": 4440,
            "display_filter": "frame.number == 4440",
            "timestamp_epoch": "1573510923.209213000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8e3f7064509cf1f95944aeca",
        "md5": "9ff80602f107fd6c792d871d5cfc00de",
        "sha1": "62f6ebac70c22947d123eb16bfd1b62854ad9d0d",
        "type": "file-artifact",
        "label": "robotocondensed-bold-2.woff2",
        "value": "90088d7a63bccd9cae09c18892f78a93048d1c1b087c222a5bdd3fd586835eb6",
        "sha256": "90088d7a63bccd9cae09c18892f78a93048d1c1b087c222a5bdd3fd586835eb6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://assets.bounceexchange.com/fonts/robotocondensed_700_bold_normal/robotocondensed-bold-2.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "34.98.72.95",
            "tcp_stream": 160,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 9761,
            "response_frame": 9773
          }
        ],
        "size_bytes": 14540,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 160,
            "frame_number": 9773,
            "display_filter": "frame.number == 9773",
            "timestamp_epoch": "1573510960.549544000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-197a2d8588933e183053b96a",
        "md5": "33543c5cc5d88f5695dd08c87d280dfd",
        "sha1": "600db9374e47e4f73a59ccc0a99bcc42f4a3e02a",
        "type": "file-artifact",
        "label": "mem8YaGs126MiZpBA-UFVZ0b.woff2",
        "value": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52",
        "sha256": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2",
            "client_ip": "10.11.11.195",
            "server_ip": "172.217.9.131",
            "tcp_stream": 225,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8386,
            "response_frame": 8434
          }
        ],
        "size_bytes": 14380,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 225,
            "frame_number": 8434,
            "display_filter": "frame.number == 8434",
            "timestamp_epoch": "1573510952.085274000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-382851ac09ceb4ca131d2f84",
        "md5": "1fb00cbc32abdd17ae5dc7b092b5b302",
        "sha1": "8e21bca0bede115bac905fb3cf8659c0203546ee",
        "type": "file-artifact",
        "label": "black-friday.js%3f_=1573510907653",
        "value": "5a9e7c02983f4755bdf4a3b2fcbec67e73e7c0c904ec14b92ee6044935b65ac8",
        "sha256": "5a9e7c02983f4755bdf4a3b2fcbec67e73e7c0c904ec14b92ee6044935b65ac8",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.chromebooktrivia.com/templates/black-friday/black-friday.js?_=1573510907653",
            "client_ip": "10.11.11.94",
            "server_ip": "52.218.228.130",
            "tcp_stream": 94,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3078,
            "response_frame": 3093
          }
        ],
        "size_bytes": 14127,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 94,
            "frame_number": 3093,
            "display_filter": "frame.number == 3093",
            "timestamp_epoch": "1573510898.925949000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-176103ee585c28f4672f9d5a",
        "md5": "517712e8abea696e6937ba9e14a298aa",
        "sha1": "83eec6e0722857e96e7282af8daf52431a8b54da",
        "type": "file-artifact",
        "label": "5401d6e8dc676bddbf0d4e69de4a0b2885aeeb6d-l.woff2",
        "value": "68d2dd7a4704d8f706daa8e9edef04459afe162014caf197699a5249f8621714",
        "sha256": "68d2dd7a4704d8f706daa8e9edef04459afe162014caf197699a5249f8621714",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/5401d6e8dc676bddbf0d4e69de4a0b2885aeeb6d-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 134,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8018,
            "response_frame": 8098
          }
        ],
        "size_bytes": 13804,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 134,
            "frame_number": 8098,
            "display_filter": "frame.number == 8098",
            "timestamp_epoch": "1573510948.445579000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a121199a3d71c3ce80dca249",
        "md5": "d95d25b04feb27a7489d989d061ba178",
        "sha1": "4b13070e9748d8b00681d90a839ad7deb8805ac8",
        "type": "file-artifact",
        "label": "555e46b7f9838593f3cc153d5daf395bd63ebfc9-l.woff2",
        "value": "d69205ed7d66338bd8caf8c1c4a47b7951c03a9fcef851c07067d6959aab4c4b",
        "sha256": "d69205ed7d66338bd8caf8c1c4a47b7951c03a9fcef851c07067d6959aab4c4b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/555e46b7f9838593f3cc153d5daf395bd63ebfc9-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 137,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4522,
            "response_frame": 4629
          },
          {
            "url": "http://fonts.timeinc.net/k/bab29107ea4a13b6ec7a345a9b74c34c6b101d2a-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 135,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7884,
            "response_frame": 7999
          }
        ],
        "size_bytes": 13780,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 137,
            "frame_number": 4629,
            "display_filter": "frame.number == 4629",
            "timestamp_epoch": "1573510923.275722000"
          },
          {
            "tcp_stream": 135,
            "frame_number": 7999,
            "display_filter": "frame.number == 7999",
            "timestamp_epoch": "1573510948.388201000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7e260e830f93dc6e608233ca",
        "md5": "b61a9055d92ac56c15cacf4271d4f072",
        "sha1": "b908b01ccf478e0a72f8c6fbcfd5c31a6c61ba36",
        "type": "file-artifact",
        "label": "mem6YaGs126MiZpBA-UFUK0Zdc0.woff2",
        "value": "da407a15b1ea0c1b4bb774bd77bb608d6b1c90397b5a75b8895bbccfda5feb63",
        "sha256": "da407a15b1ea0c1b4bb774bd77bb608d6b1c90397b5a75b8895bbccfda5feb63",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.gstatic.com/s/opensans/v17/mem6YaGs126MiZpBA-UFUK0Zdc0.woff2",
            "client_ip": "10.11.11.195",
            "server_ip": "172.217.9.131",
            "tcp_stream": 226,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8387,
            "response_frame": 8438
          }
        ],
        "size_bytes": 13780,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 8438,
            "display_filter": "frame.number == 8438",
            "timestamp_epoch": "1573510952.089695000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9ab76827567388ec27224f65",
        "md5": "80a368d347a81bf096caf36df3747802",
        "sha1": "9382952a9e1d267bb8bef7a9193ec2acbbf72a94",
        "type": "file-artifact",
        "label": "css%3ffamily=Open+Sans%3A300%2C400%2C600%2C700%7CLora%3A400%2C700%7CDroid+Sans+Mono",
        "value": "33f2a237c6faa633a8ada5dd80217acd2e1605b6e4492b44bed3dc5b1980c7bc",
        "sha256": "33f2a237c6faa633a8ada5dd80217acd2e1605b6e4492b44bed3dc5b1980c7bc",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700%7CLora%3A400%2C700%7CDroid+Sans+Mono",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.6.170",
            "tcp_stream": 236,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8828,
            "response_frame": 8904
          }
        ],
        "size_bytes": 13535,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 236,
            "frame_number": 8904,
            "display_filter": "frame.number == 8904",
            "timestamp_epoch": "1573510957.591558000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e8b363fbb5c2112f39c6934d",
        "md5": "ed30ab3d18d80a4dd21272dfa85d1dc7",
        "sha1": "f210197b69040939eb2c50dad1ff609729acd3b9",
        "type": "file-artifact",
        "label": "newsletterLogo.png",
        "value": "401e3319d38b0269ee1f5adf5dd7ba23a80f298a8a8f0b775b054b53381717e0",
        "sha256": "401e3319d38b0269ee1f5adf5dd7ba23a80f298a8a8f0b775b054b53381717e0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/i/newsletterLogo.png",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 89,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4124,
            "response_frame": 4155
          }
        ],
        "size_bytes": 13017,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 89,
            "frame_number": 4155,
            "display_filter": "frame.number == 4155",
            "timestamp_epoch": "1573510923.043273000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9c84c3bfdf96ad92973a4c3e",
        "md5": "50b373d87e18f37ee1604b2cb260ad2c",
        "sha1": "7454376fc823e0d43fc2d021bceb9f0220d5e901",
        "type": "file-artifact",
        "label": "54b3f9d279f7b844581003b553052617b44910d9-l.woff2",
        "value": "ca70ca022338dbaa4133c73f381b168c0b43921de8cf5162f9ef45f92fd2b09d",
        "sha256": "ca70ca022338dbaa4133c73f381b168c0b43921de8cf5162f9ef45f92fd2b09d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/54b3f9d279f7b844581003b553052617b44910d9-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 135,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8017,
            "response_frame": 8082
          }
        ],
        "size_bytes": 12772,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 135,
            "frame_number": 8082,
            "display_filter": "frame.number == 8082",
            "timestamp_epoch": "1573510948.441347000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e27ac29ad98d5fd0a3b3ec2d",
        "md5": "e51dd5f2dc054d772bf1e14603cf9921",
        "sha1": "e6d976429d61cfe8340c653772538646673323c5",
        "type": "file-artifact",
        "label": "5ca81ad032eb2741cf7e54457b9477823027b078-l.woff2",
        "value": "1b144033e165bbeec6a0ba78c29b39a11befb67d796db6bab56c76ef54a76092",
        "sha256": "1b144033e165bbeec6a0ba78c29b39a11befb67d796db6bab56c76ef54a76092",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/5ca81ad032eb2741cf7e54457b9477823027b078-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 136,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4471,
            "response_frame": 4578
          },
          {
            "url": "http://fonts.timeinc.net/k/76cd09e152d82e5b89fde87cf199bdd0b0d03cf5-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 91,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7791,
            "response_frame": 8002
          }
        ],
        "size_bytes": 12396,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 136,
            "frame_number": 4578,
            "display_filter": "frame.number == 4578",
            "timestamp_epoch": "1573510923.266779000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 8002,
            "display_filter": "frame.number == 8002",
            "timestamp_epoch": "1573510948.389957000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-15d73dd93f6c370b64f0bdd7",
        "md5": "ca4e3c8038084ad465afb3049e1e9cd6",
        "sha1": "3e7733bc68a5111ab1b697a22791691d88d1922e",
        "type": "file-artifact",
        "label": "logo.png",
        "value": "51db93ab7adac8eaad7b03f723e9c9c132979e714e2908d2c931d48ff88f08c4",
        "sha256": "51db93ab7adac8eaad7b03f723e9c9c132979e714e2908d2c931d48ff88f08c4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/splash/logo.png",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 169,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6244,
            "response_frame": 6265
          }
        ],
        "size_bytes": 12329,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 169,
            "frame_number": 6265,
            "display_filter": "frame.number == 6265",
            "timestamp_epoch": "1573510939.850070000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f74740feebf886d210b5aa42",
        "md5": "c15274730d51e6d00ccd8872c853fc3b",
        "sha1": "5187175eac7cb6c5a50a5acbe4e6f28d014c40e6",
        "type": "file-artifact",
        "label": "2f802debf3e84952f6602d651b24eb94a2e68a14-l.woff2",
        "value": "490e100e1c6fcd4aa614b18acd9d3c53bd4bbc2ce7a4f085c6070047529e772a",
        "sha256": "490e100e1c6fcd4aa614b18acd9d3c53bd4bbc2ce7a4f085c6070047529e772a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/2f802debf3e84952f6602d651b24eb94a2e68a14-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 136,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 8009,
            "response_frame": 8086
          }
        ],
        "size_bytes": 12128,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 136,
            "frame_number": 8086,
            "display_filter": "frame.number == 8086",
            "timestamp_epoch": "1573510948.442224000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-6bfd67e407bac4298acb3c51",
        "md5": "852c84ff746789a6f40ba35bccac4ce4",
        "sha1": "77ca2848e8db2f13361fafc58e68266f2aaf688d",
        "type": "file-artifact",
        "label": "fc4554834092c20de5faa03f44afce842e8e74e8-l.woff2",
        "value": "51595c4ef28516f9f02a47fc2eb4ccd611e25e04056bd298e5bf024c26bde7d0",
        "sha256": "51595c4ef28516f9f02a47fc2eb4ccd611e25e04056bd298e5bf024c26bde7d0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/fc4554834092c20de5faa03f44afce842e8e74e8-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 133,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4533,
            "response_frame": 4638
          }
        ],
        "size_bytes": 11924,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 133,
            "frame_number": 4638,
            "display_filter": "frame.number == 4638",
            "timestamp_epoch": "1573510923.276359000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7633ae6d3ee2360e415a64e9",
        "md5": "d127fa27cd61c11de226838ba94e4c15",
        "sha1": "fd9ad9b96430bed7d4e569aec45dbd5408f41fa7",
        "type": "file-artifact",
        "label": "ktag.js%3ftid=KT-N2BAB-3ED",
        "value": "685671e3f0eff65b3895da8e05ce59a0c0ebfbe326c550a4c03fbbea45630566",
        "sha256": "685671e3f0eff65b3895da8e05ce59a0c0ebfbe326c550a4c03fbbea45630566",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N2BAB-3ED",
            "client_ip": "10.11.11.200",
            "server_ip": "34.194.61.181",
            "tcp_stream": 377,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21023,
            "response_frame": 21038
          }
        ],
        "size_bytes": 11751,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 377,
            "frame_number": 21038,
            "display_filter": "frame.number == 21038",
            "timestamp_epoch": "1573511048.453246000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-865ea788f03a5a15607c478d",
        "md5": "1801bee48240e018253f6554072bacca",
        "sha1": "657c42bb4efe515a4aaec458368bdec6c31232b3",
        "type": "file-artifact",
        "label": "4d88143aa0a800a715306813a156caf2273c861b-l.woff2",
        "value": "78c3a9e833d376f6966e2fae29f03ec3dadad2f71a598b031f932bf3bc7d03b6",
        "sha256": "78c3a9e833d376f6966e2fae29f03ec3dadad2f71a598b031f932bf3bc7d03b6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/4d88143aa0a800a715306813a156caf2273c861b-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 133,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 7936,
            "response_frame": 8040
          }
        ],
        "size_bytes": 11620,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 133,
            "frame_number": 8040,
            "display_filter": "frame.number == 8040",
            "timestamp_epoch": "1573510948.433724000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2b8eea2edc2bf8056809963d",
        "md5": "95781e988b8a96de2a58e1a00a36fb1f",
        "sha1": "8d9afca8391eceb6b6ac4ad03a809a4e1058a639",
        "type": "file-artifact",
        "label": "modernizr.js",
        "value": "7206e6d49d3a0b4083fb02efc7a5dd967f6dcf4b7a7b85655342db5bd38eb1b1",
        "sha256": "7206e6d49d3a0b4083fb02efc7a5dd967f6dcf4b7a7b85655342db5bd38eb1b1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/js/modernizr.js",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 232,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8942,
            "response_frame": 8964
          }
        ],
        "size_bytes": 11261,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 8964,
            "display_filter": "frame.number == 8964",
            "timestamp_epoch": "1573510957.679573000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-299222ebf51dfedaebd05464",
        "md5": "9cf5ed1f6460b84c8385818085cf6222",
        "sha1": "0f595709c92b1c7eb6385407238f4517ebc180e7",
        "type": "file-artifact",
        "label": "889b0469af9dcfc5f2728a48ce0365503f9996fc-l.woff2",
        "value": "514c7781614237bd5a047e9f22f5bde4e265e4fc440ae89bea4120115c68d4aa",
        "sha256": "514c7781614237bd5a047e9f22f5bde4e265e4fc440ae89bea4120115c68d4aa",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.timeinc.net/k/889b0469af9dcfc5f2728a48ce0365503f9996fc-l.woff2",
            "client_ip": "10.11.11.179",
            "server_ip": "13.33.255.25",
            "tcp_stream": 134,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4534,
            "response_frame": 4639
          }
        ],
        "size_bytes": 11220,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 134,
            "frame_number": 4639,
            "display_filter": "frame.number == 4639",
            "timestamp_epoch": "1573510923.276564000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5a73707c2e4d3fe0459b1698",
        "md5": "f50e4a0ce2644417bf56e62457ee8b94",
        "sha1": "0c1db54e9ed445e14ab96db6d74ca8cba0c13050",
        "type": "file-artifact",
        "label": "mobileExperience.js",
        "value": "15e3113bb35246b2f2b945ede2c0d8d02ceded8252fb177077e186b1497af3ab",
        "sha256": "15e3113bb35246b2f2b945ede2c0d8d02ceded8252fb177077e186b1497af3ab",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/j/mobileExperience.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 93,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2665,
            "response_frame": 2696
          }
        ],
        "size_bytes": 11126,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 93,
            "frame_number": 2696,
            "display_filter": "frame.number == 2696",
            "timestamp_epoch": "1573510898.406195000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-64308dff7f2df07050e0cca8",
        "md5": "56a690edac2c46a9e3f1abd7e2b2ab1a",
        "sha1": "42e4b86c71b6b51cbcac4781e533eeb27a7ec61c",
        "type": "file-artifact",
        "label": "articles.js",
        "value": "4c2e32bf0f129b1edcc7f2c22025ac62f707bece77d49c00a9055ff27b7cd4bf",
        "sha256": "4c2e32bf0f129b1edcc7f2c22025ac62f707bece77d49c00a9055ff27b7cd4bf",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://img.timeinc.net/time/rd/trunk/www/web/feds/j/articles.js",
            "client_ip": "10.11.11.179",
            "server_ip": "143.204.29.89",
            "tcp_stream": 87,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2573,
            "response_frame": 2678
          }
        ],
        "size_bytes": 10577,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 87,
            "frame_number": 2678,
            "display_filter": "frame.number == 2678",
            "timestamp_epoch": "1573510898.386847000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4b4790b4db908e4132d33870",
        "md5": "5d64d11a04895c3cf0607b12c07d4763",
        "sha1": "c5ed204840ce760ca3f01e968d5d4d9dd15d204a",
        "type": "file-artifact",
        "label": "ER1.jpg",
        "value": "417757ec6c3c8906c9cf0783900bfe04062a2076868a192ac40e5952241a8532",
        "sha256": "417757ec6c3c8906c9cf0783900bfe04062a2076868a192ac40e5952241a8532",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sabethahospital.com/splash/ER1.jpg",
            "client_ip": "10.11.11.195",
            "server_ip": "12.133.50.21",
            "tcp_stream": 173,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6406,
            "response_frame": 6449
          }
        ],
        "size_bytes": 10244,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 173,
            "frame_number": 6449,
            "display_filter": "frame.number == 6449",
            "timestamp_epoch": "1573510940.079431000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-bb70e818f7463814581bf050",
        "md5": "7121994eec5320fbe6586463bf9651c2",
        "sha1": "90532aff6d4121954254cdf04994d834f7ec169b",
        "type": "file-artifact",
        "label": "jquery-migrate.min.js",
        "value": "48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d",
        "sha256": "48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-includes/js/jquery/jquery-migrate.min.js",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 234,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8968,
            "response_frame": 8993
          }
        ],
        "size_bytes": 10056,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 8993,
            "display_filter": "frame.number == 8993",
            "timestamp_epoch": "1573510957.737887000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-13cd16bb94f715e0e52ffbe5",
        "md5": "2d898ae2fcdd5891d37e40036fdb6c50",
        "sha1": "ce073318388b70728f69f44cf5cb7f0c3d84c42c",
        "type": "file-artifact",
        "label": "style.css",
        "value": "91653d8a71a5063ba63a8f87bd80f3cbf71150ea6fda11529ad9a14540a7913d",
        "sha256": "91653d8a71a5063ba63a8f87bd80f3cbf71150ea6fda11529ad9a14540a7913d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.iphonehacks.com/wp-content/themes/iphonehacks/css/style.css",
            "client_ip": "10.11.11.217",
            "server_ip": "35.185.55.255",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 8920,
            "response_frame": 8945
          }
        ],
        "size_bytes": 9142,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 8945,
            "display_filter": "frame.number == 8945",
            "timestamp_epoch": "1573510957.656369000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d67e00aaa32e2f983edc365b",
        "md5": "358d3070946a90b4960cd111154fdc12",
        "sha1": "a0ba0bf47a7f905f9aa1a3ce15a39cdac62466ee",
        "type": "file-artifact",
        "label": "mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2",
        "value": "54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775",
        "sha256": "54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.9.131",
            "tcp_stream": 239,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 9081,
            "response_frame": 9115
          }
        ],
        "size_bytes": 9132,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 239,
            "frame_number": 9115,
            "display_filter": "frame.number == 9115",
            "timestamp_epoch": "1573510957.991092000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9127c32f1f944eeb00bbdb1d",
        "md5": "927f45f0c98e115c1f661f17d185771e",
        "sha1": "a4d63590c8393ae66bd712a0acd5105788c1a5b8",
        "type": "file-artifact",
        "label": "mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2",
        "value": "a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c",
        "sha256": "a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2",
            "client_ip": "10.11.11.217",
            "server_ip": "172.217.9.131",
            "tcp_stream": 239,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 9189,
            "response_frame": 9221
          }
        ],
        "size_bytes": 9080,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 239,
            "frame_number": 9221,
            "display_filter": "frame.number == 9221",
            "timestamp_epoch": "1573510958.147142000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-61f45198ab8e76f2a7a7cb86",
        "md5": "df8daf1b592f260843f2239dbe18053a",
        "sha1": "ba16cbbd68fd9df4f01fc007043fd6aa4422f799",
        "type": "file-artifact",
        "label": "css%3ffamily=Crete+Round%3a400,400italic%7cOpen+Sans%3a400,400italic,700",
        "value": "14b9cf0386c53f62ec4e87227ac0a818b0b28281c1cdcea7c5bfe11fd8497992",
        "sha256": "14b9cf0386c53f62ec4e87227ac0a818b0b28281c1cdcea7c5bfe11fd8497992",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://fonts.googleapis.com/css?family=Crete+Round:400,400italic|Open+Sans:400,400italic,700",
            "client_ip": "10.11.11.195",
            "server_ip": "172.217.6.170",
            "tcp_stream": 199,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 7016,
            "response_frame": 7094
          }
        ],
        "size_bytes": 8749,
        "source_ref": "2019-11-12-traffic-analysis-exercise.pcap",
        "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "source_refs": [
          "2019-11-12-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 7094,
            "display_filter": "frame.number == 7094",
            "timestamp_epoch": "1573510943.978343000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      }
    ],
    "evidence_edges": [
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-e09dcd9d5999adfb4b96a792",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-b1db1e019517fd380fd50502",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-9ed3252e2708dc1e517c661b",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-1e15bbf8465244261632ee5e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-9fcbb5d01fa384ab1385a32e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-889f290b8f53a9868abb30de",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c92d427366d0451d5686f9ae",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c1f2ee743395e3cad97763fb",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-2d07ca5aebed2a30d8113b0f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-109f67eef9a633811c65c6ef",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-13e470071a3e7e7e6ff09fa4",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-b4fd7f76a0a16972f06b11fd",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-07ec4387ee5d14368a6181b6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-3f64c7458ee1944f8674ee17",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-862d9fa4fc8ef720e6565ae1",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-99b47b9c79c9079e3c57be6c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-80dbd5fdd6d563d140210be9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-fab757687f59c26a07919583",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-f88653de25bb1b333b1f186b",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-15b886f995abce5913038bf9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-8c1c673d0e9fac826a1b652e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-88ff783e54a30dfd866a85e3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-4f791610c9e593fd1c347223",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-80570e7cac23d827d3bd2254",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-5118020d75cbb7a7b6033973",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-69f6050c83e7c2315cb9d251",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-14938d416d5ae1c43118ccd5",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-005d05b8f254e72eab9d87b8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-f721a3717e95fed869f9aefd",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-4ee4919d9d7374919cac7fe6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-ebb2b08079fab6587639ef20",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-6e2dde6b888d3bf34771669d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-1782958f58f8e457bf60ca27",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-555d6b58934875d3d475e781",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-6c74ec0fdc2b11fd98cefbe3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-576dee4ce3e7a4176e72f823",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-ce15f8bfe8a97eadf4ad73bc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-42719d747a18267a9db33f72",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-4d58cb2dcf80da97c75ca32d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-18f391f57758e43242e5ef76",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-7ae704bd8a5f6955c53c00bc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-b9d3c7f741c2440f58820e20",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-8eee3e84d71af9e6b26c005a",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-4d6e2490a3027fb815f25bce",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-45c32d99e77eec72658b89e0",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-1a4f9b687476ec68199d7f2d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c9ce41bbc7f9a4e002705d3f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c32e8af9e7c13d89bd24ecd3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-76add41a51f9a0d78cc5c0e1",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c621c3dc9f63451f9770bafb",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-c6545d58bc164226c2a508d7",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-3af5f3e570250f52bc922f4d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-002e225be391f268ae0235f6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-0eb12d02fc912d1a7b6527cb",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-ea33bddc54f82fe3782eebe6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-18b56c7bf1e5dc9c69c76750",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-2645f34515569b143cb49a19",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-9cab16d5972c4151b40608b3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-f95dce1faf44bb87f3de7058",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-932232688a89d49e3720be17",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-4a521052654cf6590cb0be74",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-121cf8282cdc958878f82b04",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-d8c964d840ad179845de017d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-cbe344269579cefde5fc84df",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-ccc9d4dff22262d92ee891a8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-9222a36bd2b6a4a5dd25a869",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-9e3ce7614406ea2f9860106b",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "finding-ebab3524b6002d526f7e0e9f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ],
        "source_analysis_ref": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7fdb67c0a4d9da83b868e919901fcc496082cf802e99902fa0c4bf903bc69864",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-78c10a5ae582533f5faf0807",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-86b99b01439d20dbcedf6528",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6c5ff7ea83e52bc381c96600e619db8f8661d88a11deeb63f9433f74c39c4531",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-3693529b3e790b61972b5b54",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e4980b12540ba3a4f5d64a559ddffd9afd16702d50e2ccbb25cdf8fa2f91a357",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-fdde86f7adb2fba5d136456f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "29d14c1ad2f8f1be84efd4d678ff3de9d6c3f94eb3b77894504c4824ff1a8ad4",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-6f71bc83b24223752c2585cc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a874f98ca9fc78c29ab6e41b58da4f4f4cb788b8ca8c535abc2ffaee241c35fc",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-1cb0558497210d8850a72912",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "02421b3b99f39a2e6c412a2a709b1e2685b8801e652ac5d01d7ab24a610375ef",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-aada23129476ece95a7a9bcd",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "726ba9071d0576e8b6da71500a5deffe7c6707b46855b42958f0e88d22ec5a6e",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e3d17eb3b3f32cfc1d6f3aa8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "9995757952af47309f1651f3eab89cc440f4483a8f4cae42d1235276dc87b0de",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-4e42e1cc78f734f93e20859f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7eaa8936ff23275cd41b71dd4a53b7568e42c3124f0f88b2b46624f92158b539",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-b1a85c7e7f76c13fb5b5b26d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-1230ac6447460ddc27de8850",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d815b63e6c3c0ee03db4360d364767b22958f01ab7902e828834eb46b8edf4ac",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-43cb59aef163ac1767094f1f",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "2741f3d57085857684637bd2f1f7cdc9f43398d604fd894ab7c4514a7647967e",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-df02e8c668e44ea738aed094",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "98bc475d844bdf3883722cecfeabc646fdef167cea0644c05ac8038e10b6b4cf",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-fc7bc9161ac5ff692b52439a",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a57d87401fa0f698c27986deb5f1feceaaedc19928fa2e63a417a374f43518f2",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-0639e279f4b88cccaeec678e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a1bf598f55e97c5fbb655bb7e989904b7242687431c4a77fb28d5831b155635b",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-16d89bab5a43fd2f826ce6c8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6a4907421b7075663cca082e973fcd4fa8ddaa393a1031718f327f5db4395dd5",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-b9bdba528cfb844a88082283",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4582858c4190dded337320ee561c74c4ff264e35eb1de0dd62dc9ff882e2a0c0",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-1d603e73a85168a923c3fba2",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8e37440d4a467d0e23fb778cb18dadb860516f19aad531bfe5c0b07c2c60dd47",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-ce2a6ae03c9bf20ea2aa3ee3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7dc6cd90d71e4f9210182fe795201941777a368761309cfd97bd95141c6fe027",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-fd4225b5b2971417479d4a52",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7a2cdbdee49d6f5ac7158962d48a61f758b17baac728fc73e2b3be7f0f736117",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-02b6d6a657ed5455428aa1bc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7dc3a731850430780c651245",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-f7d7d963fdeede1a9aab1418",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "31dacbcecc9839d6f68e83876207a19d2f28d22c56921d43c12c30ba7510b739",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7bea50abfa51742925f5ab13",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d97b87d9e5dde03b3fd701e5dfb5b55c8d1f606581a86f21b79ce627db7efaf5",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-5254002dbc6c374e23a27f5d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "98899dcb5dcd03f379d15ee123311e2d8f61e81060e8a4c7bc3d01864a528fd0",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e26932ebb690cbdfce69de96",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4ddf3cc87fdaa2a88ebadd0d9fa28a8850bb94aada3772ce152d9def51c3402e",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-2a9b3033149f4ca0fdc8ef9c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6c5e15629a0ff3c7ffbee8b660426bc165edf160b92f3a79030230f2ef70b263",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-709b452b8e622e55f9294bb3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1adeb9b7455c164e01a88173d356742be2a4b5dc4977f0f64fee5b5d4b38e0b3",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e74cd0b3b62a8ab659cd0ca1",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7594b96fd3ccb54319eb32a4",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b42989a0f2a1fb6d69e72c4f548ef2e73c4d3089d53649f5ed75e45c7b91cffb",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e79f3c6e232c70183f655f80",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "729ccb444da66d98803b01cecb8ffc4d6c046e09f5642f733daec6a1c53a9c3a",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-cc826620ce118cbfa0b108e4",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "ab8b92e2b5d66dcddb532092bfa5185ed6536feeaa0845bb3770da45e812fdae",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-3d79c57ff75149cab27693cc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f714ad11f67806cf22b6b019762efef7bea88162422616a9262056b12888a0b6",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7d1f59bfd8bc58bbe10b8557",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c3825ca33d7f23fa275f8c6287073ae8b36631f0a2dbd592071c812f37c2b938",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-a9facfda06f8be80d6e5cc91",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7a10b359e1a05ad63a7d3b4dbf2a78681b1c39fa6e40bff19d43cca8a93028ea",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-99075fd77e44b3f3acb3b8b2",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b45f1276da2af6391e64970f41c169b3bcea4d6e8bc2fdb491d0f47444482b04",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-5e5a5febefd25b4b3dc77e1a",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8dd9d7f81d78e4f07d4fd8a822f903222b9aadd2f81a83743bc04dadd0cd38ef",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-f07cc7c65848233b465eef50",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "502f0b5cfc3859d89aed3b5e79fd7cb45d76201862c9d28fcd32dbf939254ff1",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-070cb86df2d46752fbda2680",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "5e49bf693ec382ee689b0a8d062ebed44f3e5aacb9b70402423cb99901a2acc1",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-3065be636980645c615011d8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "acad7e7a54a533041f08a9179fb37b73826b1e5c937e4014a7b879b23256a321",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7f32f09260603fbd0cc96cc7",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "467adfd1e3a82ceb3820acd2a991360a8806c4efae6643b4be62e9994db03733",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-d625cd1dacc1757ed73b9597",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "69c0162d9102848858454ae467402cd402138ac95789c79947745cde0cf7b937",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-4ba08d6429e9309e30c2e398",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-fa295f77ea235fc035b9c8ac",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4dcc7f2174e5ff8c47c42436a4c603856fd7e752339cdc7d5161d9195d7e123e",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e3daf198c9cc1f251c3338f5",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7bc15c522a05ce0e56b8cb3fff83bc6e770130afdd840d469869db69663d78fe",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-db58d766b35cae1df9bc13c9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e38186eec3c4b4c967737af9191995d9e09972fe19b863d37ea83c064b149225",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-5b222c8f1a65394111172b73",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "0598bd5943d77dc98747798eb12ee9dd92dce1a85d9ac98c18b8e2de21857628",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-8dc53614b8cdc419baa5ab40",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7f709773527990d3cadd71e01685f54b8592f290716e3ca9b25a9e2b1daaf2a2",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-bdb027c8b30662430c1807db",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7e935ae772d2d67ed17e7e5ccacf7759d4876d275f534ded2950bad16fdfc95f",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-b8a285a821a832489fb2189e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e3476a3b5d5234ac5600b211f27ac1c8c1e53d05e93ba969f811bbe90e2f62d2",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9992cf4a1d874e0f100c5afa",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b57e59703787968123e13e1452aba6ea85e2bb5cc85734ada1188717b5dd3e56",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-1eeb0fdb37fbf7eaa2b6a0b8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "3ebe47f20081ad143711c282175da54b2897d5ca04ca197f310e5bfc6bbccc30",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-4f3f9e491a22f443a926c81c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "be3d446906ece42738125497492b453a0a7e21a952cbf4a94ecf11d8a43ffa8d",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-81a689d0be7d82f66e9cb7e6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "44b53447b74b3429694ae0ed7f8bd881409d494a123559095b5c45b4e60d1518",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-d4e499997a9b9a5151d77ade",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "61e9e4fabca279abc8d91ad02e51a597920dfb93d84186cad9531b5edefec4b9",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-14aca4d77985b4543c0bb528",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b86da58d907cb2a1c99d3d3c4067b9cf0a2ac1cd70d19da8b41799c1ebc5d0bf",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-8f69960382c71426d56e8e23",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "01a653b4a4b428930004cf55ad4e07918e2df423a17191b29a1e697b578fabba",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-101bd78c432ec19d0dfa21fb",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "99c50e3babe3c9db03052d1578360e5f55b65a30a8ca3a789638b95faf91dac2",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-64245814d6be3f4dbe212dd4",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8e92dedb50b92efc8e23e3a4985fdb53e587e85139e113953e877320ec6d705c",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9cb4e045a64ce53a75aac109",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "68729ba42eb5861023b02ccacea9aa4c6195470f95c69d96c3740624bb2232da",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-45bdd3523c3bfa329845a07d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e7c9c787c8499c5f11f27c0f54dc7e611c96011bcfa005b85a21cda11b5d0acd",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9e9972a41eee1bfd78d9cf51",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "13237099700a0f42bf2e5ded9b77a90c67ae79e73596bf130ff608d9900c2da1",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-456529dc9a6be39381bd05ea",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a92cd283b70a1a26da4b51225bd9afab8251d2f974d44a40da8063a34b6d5072",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-eea1140918bac1891aac8bbc",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f279c5eba813fab19d319704cfd342a90f37790638f76a0e9c2610b2f050f3e4",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-387b59d59748df8574704ea9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "db31aef54315b605aca1530e6be9873be4635064521886a87defd8ce16da4acf",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-818c06bf7675b27b10c9cf12",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d51d56f3bed1fd22a3bf9d07de256a921a5e666669236548f2eae1319c18d850",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-0c854fc64902205fbebd50cb",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "695bdae25dc2974d6618325d6077e6a03fb86ca025e3fa0c35e891728559f84f",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-f03f3866a2f36670d8258358",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "115d9c8bfe90b5fdd688510b0fe56ac0ef35179ef373542eba56b999dafc9bd4",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-454f0da7e2ae9ff1245d74ca",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "137b49a2384e3e48bed18045fa7f21f724fe6a9134c503d6d0498d6642b165e5",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-b6fa1f38129d375cb04488c3",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "53a5b76ba1ae6e0a42d06abf20f1c727736fbaf8d9ff6ab2abbcf020bc146241",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-4a7ed68fc02ddbb8a82b998c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-cd19a25c50cb4bd3f9339f8d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "9a45766e1068ddb9bd0eb6870a48ba82ed17bcc49ea8bb7ed838d62dabb8feca",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7c9e25fb2d2d30c93e8607f8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d1b2452c6efe92a963ad360b5d6147409e91af0a77853e2e62d97837130bc8ea",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-723b490656801f6efbc36f6c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "70207fc0d0e6a494440227237d34d0bbd9fee69ae0d13db1cecfe268420f6596",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-f3c6e0ecf8c2c9d1fa913673",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "90088d7a63bccd9cae09c18892f78a93048d1c1b087c222a5bdd3fd586835eb6",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-8e3f7064509cf1f95944aeca",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-197a2d8588933e183053b96a",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "5a9e7c02983f4755bdf4a3b2fcbec67e73e7c0c904ec14b92ee6044935b65ac8",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-382851ac09ceb4ca131d2f84",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "68d2dd7a4704d8f706daa8e9edef04459afe162014caf197699a5249f8621714",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-176103ee585c28f4672f9d5a",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d69205ed7d66338bd8caf8c1c4a47b7951c03a9fcef851c07067d6959aab4c4b",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-a121199a3d71c3ce80dca249",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "da407a15b1ea0c1b4bb774bd77bb608d6b1c90397b5a75b8895bbccfda5feb63",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7e260e830f93dc6e608233ca",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "33f2a237c6faa633a8ada5dd80217acd2e1605b6e4492b44bed3dc5b1980c7bc",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9ab76827567388ec27224f65",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "401e3319d38b0269ee1f5adf5dd7ba23a80f298a8a8f0b775b054b53381717e0",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e8b363fbb5c2112f39c6934d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "ca70ca022338dbaa4133c73f381b168c0b43921de8cf5162f9ef45f92fd2b09d",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9c84c3bfdf96ad92973a4c3e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1b144033e165bbeec6a0ba78c29b39a11befb67d796db6bab56c76ef54a76092",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-e27ac29ad98d5fd0a3b3ec2d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "51db93ab7adac8eaad7b03f723e9c9c132979e714e2908d2c931d48ff88f08c4",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-15d73dd93f6c370b64f0bdd7",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "490e100e1c6fcd4aa614b18acd9d3c53bd4bbc2ce7a4f085c6070047529e772a",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-f74740feebf886d210b5aa42",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "51595c4ef28516f9f02a47fc2eb4ccd611e25e04056bd298e5bf024c26bde7d0",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-6bfd67e407bac4298acb3c51",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "685671e3f0eff65b3895da8e05ce59a0c0ebfbe326c550a4c03fbbea45630566",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-7633ae6d3ee2360e415a64e9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "78c3a9e833d376f6966e2fae29f03ec3dadad2f71a598b031f932bf3bc7d03b6",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-865ea788f03a5a15607c478d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7206e6d49d3a0b4083fb02efc7a5dd967f6dcf4b7a7b85655342db5bd38eb1b1",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-2b8eea2edc2bf8056809963d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "514c7781614237bd5a047e9f22f5bde4e265e4fc440ae89bea4120115c68d4aa",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-299222ebf51dfedaebd05464",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "15e3113bb35246b2f2b945ede2c0d8d02ceded8252fb177077e186b1497af3ab",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-5a73707c2e4d3fe0459b1698",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4c2e32bf0f129b1edcc7f2c22025ac62f707bece77d49c00a9055ff27b7cd4bf",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-64308dff7f2df07050e0cca8",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "417757ec6c3c8906c9cf0783900bfe04062a2076868a192ac40e5952241a8532",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-4b4790b4db908e4132d33870",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-bb70e818f7463814581bf050",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "91653d8a71a5063ba63a8f87bd80f3cbf71150ea6fda11529ad9a14540a7913d",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-13cd16bb94f715e0e52ffbe5",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-d67e00aaa32e2f983edc365b",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-9127c32f1f944eeb00bbdb1d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "14b9cf0386c53f62ec4e87227ac0a818b0b28281c1cdcea7c5bfe11fd8497992",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "artifact-61f45198ab8e76f2a7a7cb86",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-6cfb7b383dce6ea9e971054d",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-5e30db390fb7f7764b27a059",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-1557e040b9d72aa2fe50e605",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-9da27d34e33fd292dddb7e99",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-cad02fad0f9cd802bac2a05e",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-b261ab0e719fd2014972fec4",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-9b61a66ab809319f81148d9c",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-529e078d621d93023b35afe6",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-90d805dca2df0d3700e31940",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-b0177ba21caafd8c9b5de271",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-e7a05d96e7ed7e5f4a557fe9",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
        "target": "identity-b4e29f93e57235fb501932e5",
        "source_refs": [
          "log-pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8"
        ]
      }
    ],
    "timeline": [
      {
        "at": "2026-09-22T18:30:04.273Z",
        "event": "Added Log/PCAP analysis 2019-11-12-traffic-analysis-exercise.pcap",
        "source": "Log/PCAP analysis 2019-11-12-traffic-analysis-exercise.pcap",
        "actor_count": 0,
        "report_count": 0,
        "technique_count": 1
      }
    ],
    "created_at": "2026-09-22T18:29:59.841823+00:00",
    "updated_at": "2026-09-22T18:30:04.304418+00:00"
  }
}