{
  "tool_version": "TShark (Wireshark) 4.2.2 (Git v4.2.2 packaged as 4.2.2-1.1build3).",
  "checks": [
    {
      "date": "2024-11-26",
      "field": "c2_ip",
      "published": "194.180.191.164",
      "packet_value": "194.180.191.64",
      "reason": "Summary IOC conflicts with its own walkthrough and the packet destinations.",
      "display_filter": "ip.addr == 194.180.191.164 || ip.addr == 194.180.191.64",
      "observed_frame_count": 132,
      "published_frame_count": 0,
      "first_observed_frames": [
        [
          "20330",
          "10.11.26.183",
          "194.180.191.64"
        ],
        [
          "20338",
          "194.180.191.64",
          "10.11.26.183"
        ],
        [
          "20339",
          "10.11.26.183",
          "194.180.191.64"
        ],
        [
          "20340",
          "10.11.26.183",
          "194.180.191.64"
        ],
        [
          "20341",
          "194.180.191.64",
          "10.11.26.183"
        ]
      ],
      "verified_conflict": true
    },
    {
      "date": "2024-08-15",
      "field": "followup_ip",
      "published": "172.67.170.169",
      "packet_value": "172.67.170.159",
      "reason": "Packet TLS/flow evidence uses .159. The published full HTTPS path is not visible from encrypted PCAP metadata.",
      "display_filter": "ip.addr == 172.67.170.169 || ip.addr == 172.67.170.159",
      "observed_frame_count": 1143,
      "published_frame_count": 0,
      "first_observed_frames": [
        [
          "9028",
          "10.8.15.133",
          "172.67.170.159"
        ],
        [
          "9029",
          "172.67.170.159",
          "10.8.15.133"
        ],
        [
          "9030",
          "10.8.15.133",
          "172.67.170.159"
        ],
        [
          "9031",
          "10.8.15.133",
          "172.67.170.159"
        ],
        [
          "9032",
          "172.67.170.159",
          "10.8.15.133"
        ]
      ],
      "verified_conflict": true
    },
    {
      "date": "2024-07-30",
      "field": "c2_ip",
      "published": "141.98.10.69",
      "packet_value": "141.98.10.79",
      "reason": "Actual TCP/12132 endpoint is .79; frame 9119 includes the literal STRRAT software label.",
      "display_filter": "ip.addr == 141.98.10.69 || ip.addr == 141.98.10.79",
      "observed_frame_count": 411,
      "published_frame_count": 0,
      "first_observed_frames": [
        [
          "9066",
          "172.16.1.66",
          "141.98.10.79"
        ],
        [
          "9067",
          "141.98.10.79",
          "172.16.1.66"
        ],
        [
          "9068",
          "172.16.1.66",
          "141.98.10.79"
        ],
        [
          "9117",
          "172.16.1.66",
          "141.98.10.79"
        ],
        [
          "9118",
          "141.98.10.79",
          "172.16.1.66"
        ]
      ],
      "verified_conflict": true
    },
    {
      "date": "2022-03-21",
      "field": "ip",
      "published": "10.0.18.14",
      "packet_value": "10.0.19.14",
      "reason": "The capture and stated 10.0.19.0/24 LAN identify .19.14.",
      "display_filter": "ip.addr == 10.0.18.14 || ip.addr == 10.0.19.14",
      "observed_frame_count": 15350,
      "published_frame_count": 0,
      "first_observed_frames": [
        [
          "1",
          "10.0.19.14",
          "188.166.154.118"
        ],
        [
          "2",
          "188.166.154.118",
          "10.0.19.14"
        ],
        [
          "3",
          "10.0.19.14",
          "188.166.154.118"
        ],
        [
          "4",
          "10.0.19.14",
          "188.166.154.118"
        ],
        [
          "5",
          "188.166.154.118",
          "10.0.19.14"
        ]
      ],
      "verified_conflict": true
    },
    {
      "date": "2022-01-07",
      "field": "mac",
      "published": "95:5c:8e:32:58:f9",
      "packet_value": "9c:5c:8e:32:58:f9",
      "reason": "Ethernet source evidence is 9c, not 95.",
      "display_filter": "eth.addr == 95:5c:8e:32:58:f9 || eth.addr == 9c:5c:8e:32:58:f9",
      "observed_frame_count": 5880,
      "published_frame_count": 0,
      "first_observed_frames": [
        [
          "1",
          "9c:5c:8e:32:58:f9",
          "ff:ff:ff:ff:ff:ff"
        ],
        [
          "2",
          "1c:17:d3:f6:df:0a",
          "9c:5c:8e:32:58:f9"
        ],
        [
          "3",
          "9c:5c:8e:32:58:f9",
          "01:00:5e:00:00:16"
        ],
        [
          "4",
          "9c:5c:8e:32:58:f9",
          "01:00:5e:00:00:16"
        ],
        [
          "5",
          "9c:5c:8e:32:58:f9",
          "ff:ff:ff:ff:ff:ff"
        ]
      ],
      "verified_conflict": true
    }
  ]
}