Measured 19 September 2026 · Public derivative · Historical training evidence, not approved threat intelligence.

Ten malware PCAPs: public evidence supplement

Published 20 September 2026 by Andrey Pautov. Tests were recorded on 19 September 2026.

Read the full article · Ten full case reports · 20 original screenshots · Download the public evidence bundle · Bundle SHA-256

This supplement covers only the ten additional cases: 263,116 packets, 52/52 selected identity facts, 87/88 selected indicators, 52 unique enrichment lookups and 53 case-indicator joins. These are extraction and integration measurements, not detection accuracy or proof of human replacement.

Start with the evidence

Publication boundaries

The original local experiment is unchanged. This is an explicitly labeled public derivative, not a byte-identical release of the complete private evidence package.

Workstation paths, local-only HTTP links, access-key identifiers and credential-like URL parameters are removed from text/JSON. Session UUIDs remain correlation identifiers, not working public sessions or credentials. Hostnames, accounts, private LAN addresses and historical indicators from the public training captures remain as evidence. No raw capture, executable, exported payload, credential, database backup or publisher answer archive is included. Historical indicators are not a current blocklist; do not browse suspicious URLs.

Twenty article screenshots and ten native draft PDFs are byte-identical to the verified originals. Screenshots show actual saved results, including unfavorable outcomes; surrounding UI history is not part of the ten-case totals. The public reports retain the complete authored case analysis, extraction details and limitations. Duplicate database payloads are omitted while their audit outcomes and the native API payloads remain available.

The 52 provider JSON files contain derived platform summaries: query identity, source status, reported counts, heuristic score, ATT&CK leads and original response hashes. Bulk proprietary responses, unrelated infrastructure pivots and duplicated AI-input context are not redistributed. Public audit records support inspection of the author's checks; they do not let a reader independently replay every private provider-response comparison. A source hash is a provenance anchor, not proof of correctness or a recoverable copy of omitted data.

Native result checksums refer to the original semantic result, not to the formatted/redacted public JSON file. Use SHA256SUMS for public file integrity. Read transformation entries before comparing original and public hashes. Provider results are time-bound, techniques remain leads, and no actor attribution or automatic intelligence promotion was established.

Verify without contacting suspicious infrastructure

tar -xzf adversarygraph-ten-pcaps-public.tar.gz
cd adversarygraph-ten-pcaps-public
sha256sum -c SHA256SUMS
jq '.totals' evidence/summary.json
jq '.lookups | all(.stored_exact and .ai_disabled)' evidence/enrichment-database-audit.json

Checksums establish integrity against this release, not independent analytical correctness. SHA256SUMS covers evidence payloads, images, PDFs and Markdown; rendered HTML is excluded because the website adds deployment navigation and metadata. The separate bundle hash covers the entire downloadable archive. For packet-level reproduction, obtain the exact captures from the linked publisher, match acquisition hashes, and use the documented offline Wireshark/TShark filters in a patched analysis environment. Do not execute extracted content. Raw provider data and a timed human comparison are not supplied.

Original six-case AI-agent experiment · AdversaryGraph · Malware analysis · DFIR

Ten malware PCAPs: public evidence supplement

Start with the evidence

Publication boundaries

Verify without contacting suspicious infrastructure

Related research