Measured 19 September 2026 · Public derivative · Historical training evidence, not approved threat intelligence.

Ten-case screenshot gallery

These are unaltered browser captures from the actual local AdversaryGraph instance. Saved responses were checked against archived results. No new analyses, provider lookups, or case writes were performed to produce them.

A screenshot verifies presentation, not malware classification. Surrounding application history may include other saved investigations. Native PCAP results are deterministic even when a general AI-provider selector appears in the screen.

Article · Report index · Capture verification and hashes

2021-09-10 — AngryPoutine

Full case report · Native JSON

2021-09-10: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2021-09-10: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2021-10-22 — October ISC Forensic Contest

Full case report · Native JSON

2021-10-22: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2021-10-22: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2021-12-08 — December ISC Forensic Contest

Full case report · Native JSON

2021-12-08: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2021-12-08: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2022-01-07 — Spoonwatch

Full case report · Native JSON

2022-01-07: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2022-01-07: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2022-02-23 — Sunnystation

Full case report · Native JSON

2022-02-23: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2022-02-23: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2022-03-21 — Burnincandle

Full case report · Native JSON

2022-03-21: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2022-03-21: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2024-07-30 — You dirty rat!

Full case report · Native JSON

2024-07-30: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2024-07-30: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2024-08-15 — WarmCookie

Full case report · Native JSON

2024-08-15: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2024-08-15: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2024-09-04 — Big Fish in a Little Pond

Full case report · Native JSON

2024-09-04: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2024-09-04: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.

2024-11-26 — Nemotodes

Full case report · Native JSON

2024-11-26: deterministic packet-analysis screen.

Packet view: capture facts and native rule findings. Visible severity and confidence are heuristic outputs.

2024-11-26: saved passive-enrichment screen.

Enrichment view: one saved indicator investigation from this case. A provider result or platform score is not independent proof of compromise.