{
  "scope": "ten additional PCAPs, excluding the original six",
  "cases": [
    {
      "date": "2021-09-10",
      "title": "AngryPoutine",
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "packets": 9221,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 5,
      "indicators_total": 5,
      "upload_seconds": 5.388952317996882,
      "findings": 9,
      "severity_counts": {
        "medium": 2,
        "low": 7
      },
      "unique_http_hashes": 45,
      "v2_unique_http_hashes": 45,
      "exercise_url": "https://www.malware-traffic-analysis.net/2021/09/10/index.html"
    },
    {
      "date": "2021-10-22",
      "title": "October ISC Forensic Contest",
      "source_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455",
      "packets": 84542,
      "facts_correct": 9,
      "facts_total": 9,
      "indicators_available": 5,
      "indicators_total": 5,
      "upload_seconds": 30.936571095022373,
      "findings": 37,
      "severity_counts": {
        "low": 24,
        "medium": 13
      },
      "unique_http_hashes": 4,
      "v2_unique_http_hashes": 4,
      "exercise_url": "https://www.malware-traffic-analysis.net/2021/10/22/index.html"
    },
    {
      "date": "2021-12-08",
      "title": "December ISC Forensic Contest",
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "packets": 55390,
      "facts_correct": 3,
      "facts_total": 3,
      "indicators_available": 4,
      "indicators_total": 4,
      "upload_seconds": 21.971787433023565,
      "findings": 18,
      "severity_counts": {
        "medium": 12,
        "low": 6
      },
      "unique_http_hashes": 2055,
      "v2_unique_http_hashes": 500,
      "exercise_url": "https://www.malware-traffic-analysis.net/2021/12/08/index.html"
    },
    {
      "date": "2022-01-07",
      "title": "Spoonwatch",
      "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b",
      "packets": 5880,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 6,
      "indicators_total": 6,
      "upload_seconds": 4.28949365101289,
      "findings": 8,
      "severity_counts": {
        "medium": 2,
        "low": 6
      },
      "unique_http_hashes": 14,
      "v2_unique_http_hashes": 14,
      "exercise_url": "https://www.malware-traffic-analysis.net/2022/01/07/index.html"
    },
    {
      "date": "2022-02-23",
      "title": "Sunnystation",
      "source_sha256": "eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f",
      "packets": 30023,
      "facts_correct": 12,
      "facts_total": 12,
      "indicators_available": 37,
      "indicators_total": 37,
      "upload_seconds": 14.593920854036696,
      "findings": 57,
      "severity_counts": {
        "medium": 39,
        "low": 18
      },
      "unique_http_hashes": 2636,
      "v2_unique_http_hashes": 500,
      "exercise_url": "https://www.malware-traffic-analysis.net/2022/02/23/index.html"
    },
    {
      "date": "2022-03-21",
      "title": "Burnincandle",
      "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d",
      "packets": 16296,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 14,
      "indicators_total": 14,
      "upload_seconds": 7.666308572981507,
      "findings": 8,
      "severity_counts": {
        "low": 8
      },
      "unique_http_hashes": 2,
      "v2_unique_http_hashes": 2,
      "exercise_url": "https://www.malware-traffic-analysis.net/2022/03/21/index3.html"
    },
    {
      "date": "2024-07-30",
      "title": "You dirty rat!",
      "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68",
      "packets": 11562,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 5,
      "indicators_total": 5,
      "upload_seconds": 5.404715574928559,
      "findings": 8,
      "severity_counts": {
        "low": 6,
        "high": 1,
        "medium": 1
      },
      "unique_http_hashes": 2,
      "v2_unique_http_hashes": 2,
      "exercise_url": "https://www.malware-traffic-analysis.net/2024/07/30/index.html"
    },
    {
      "date": "2024-08-15",
      "title": "WarmCookie",
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "packets": 18189,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 7,
      "indicators_total": 8,
      "upload_seconds": 11.403650803025812,
      "findings": 8,
      "severity_counts": {
        "high": 1,
        "low": 7
      },
      "unique_http_hashes": 18,
      "v2_unique_http_hashes": 18,
      "exercise_url": "https://www.malware-traffic-analysis.net/2024/08/15/index.html"
    },
    {
      "date": "2024-09-04",
      "title": "Big Fish in a Little Pond",
      "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e",
      "packets": 5091,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 1,
      "indicators_total": 1,
      "upload_seconds": 3.5573205950204283,
      "findings": 8,
      "severity_counts": {
        "medium": 1,
        "low": 7
      },
      "unique_http_hashes": 6,
      "v2_unique_http_hashes": 6,
      "exercise_url": "https://www.malware-traffic-analysis.net/2024/09/04/index.html"
    },
    {
      "date": "2024-11-26",
      "title": "Nemotodes",
      "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50",
      "packets": 26922,
      "facts_correct": 4,
      "facts_total": 4,
      "indicators_available": 3,
      "indicators_total": 3,
      "upload_seconds": 9.811652365955524,
      "findings": 12,
      "severity_counts": {
        "medium": 2,
        "high": 2,
        "low": 8
      },
      "unique_http_hashes": 11,
      "v2_unique_http_hashes": 11,
      "exercise_url": "https://www.malware-traffic-analysis.net/2024/11/26/index.html"
    }
  ],
  "source_commit": "93a79512f6304ce719d5d32cd1b6d26960865f75",
  "test_date": "2026-09-19",
  "totals": {
    "cases": 10,
    "packets": 263116,
    "facts_correct": 52,
    "facts_total": 52,
    "indicators_available": 87,
    "indicators_total": 88,
    "upload_seconds": 115.02437326300424,
    "findings": 173,
    "enriched_unique_indicators": 52,
    "case_indicator_associations": 53,
    "frame_backed_associations": 33,
    "export_record_backed_associations": 20,
    "provider_request_seconds": 402.6128314282978,
    "provider_errors": 0,
    "unique_technique_leads": 113,
    "current_catalog_matches": 99,
    "unresolved_technique_leads": 14,
    "catalog_detection_links": 99,
    "actor_leads": 0,
    "llm_calls": 0,
    "llm_tokens": 0
  },
  "providers_unique_indicator_denominator": {
    "local-db": {
      "ok": 52
    },
    "virustotal": {
      "ok": 50,
      "not_found": 2
    },
    "threatfox": {
      "not_found": 51,
      "ok": 1
    },
    "malwarebazaar": {
      "skipped": 32,
      "ok": 7,
      "not_found": 13
    },
    "otx": {
      "ok": 52
    },
    "urlscan": {
      "ok": 52
    },
    "greynoise": {
      "not_found": 16,
      "skipped": 36
    },
    "abuseipdb": {
      "ok": 16,
      "skipped": 36
    },
    "shodan": {
      "not_found": 7,
      "skipped": 36,
      "ok": 9
    },
    "censys": {
      "ok": 32,
      "skipped": 20
    }
  },
  "measurement_notes": [
    "Selected observable availability, not malicious-IOC recall or family accuracy.",
    "Provider time excludes preserved failed/superseded attempts, pacing and UI/report work.",
    "Captures were already inspected by the final live retest.",
    "No agent-only or human control was run for these ten cases."
  ]
}