{
  "id": "7ebcdf06-0ce2-42bb-aa0c-6cd478f63e57",
  "name": "PCAP verified workflow 2022-02-23 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [
    "T1105"
  ],
  "report_ids": [],
  "evidence_nodes": [
    {
      "id": "log-pcap:43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "type": "log-pcap-analysis",
      "label": "2022-02-23-traffic-analysis-exercise.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-02-23-traffic-analysis-exercise.pcap\nCapture SHA-256: `eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f`\nSemantic result SHA-256: `8a329890ed01eedca67808c92bdfa492463b036b435540749e5ff2e599d7deee`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 30023 packets across 143 IP endpoints and 809 transport flows. Observed 499 DNS events, 43 HTTP requests, 111 TLS ClientHello events, and 500 exported HTTP object(s). Deterministic rules produced 57 finding(s): 0 high, 39 medium, and 18 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 30023\n- Duration: 2680.736661 seconds\n- Captured bytes: 19277433\n- Endpoints: 143\n- Flows: 809\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 3995 / TCP stream 186, frame 4675 / TCP stream 186.\n\nMetrics: `{\"content_type\":\"application/x-msdownload\",\"declared_body_bytes\":593920,\"destination\":\"172.16.0.149\",\"response_count\":1,\"source\":\"64.34.171.228\",\"uri\":\"/c7g8t/zbBYgukXYxzAF2hZc/\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 178 / TCP stream 8, frame 180 / TCP stream 8, frame 182 / TCP stream 8, frame 184 / TCP stream 8, frame 1710 / TCP stream 8.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.131\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 100 / TCP stream 5, frame 117 / TCP stream 5, frame 120 / TCP stream 5, frame 212 / TCP stream 13, frame 229 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.131\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1785 / TCP stream 87, frame 1787 / TCP stream 87, frame 1790 / TCP stream 87, frame 1793 / TCP stream 87, frame 1795 / TCP stream 87.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.131\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2143 / TCP stream 101, frame 2159 / TCP stream 101, frame 2162 / TCP stream 101, frame 2168 / TCP stream 101, frame 2214 / TCP stream 111.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.149\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1944 / TCP stream 94, frame 2015 / TCP stream 94, frame 2018 / TCP stream 94, frame 2055 / TCP stream 102, frame 2091 / TCP stream 102.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":103,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.149\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2867 / TCP stream 95, frame 2869 / TCP stream 95, frame 2871 / TCP stream 95, frame 2873 / TCP stream 95, frame 2875 / TCP stream 95.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.149\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 746 / TCP stream 43, frame 748 / TCP stream 43, frame 750 / TCP stream 43, frame 752 / TCP stream 43, frame 784 / TCP stream 45.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.170\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 577 / TCP stream 32, frame 618 / TCP stream 35, frame 673 / TCP stream 35, frame 682 / TCP stream 35, frame 684 / TCP stream 35.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":98,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.170\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1424 / TCP stream 31, frame 1430 / TCP stream 31, frame 1435 / TCP stream 31, frame 1437 / TCP stream 31, frame 1439 / TCP stream 31.\n\nMetrics: `{\"destination\":\"172.16.0.52\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.170\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 179 / TCP stream 8, frame 181 / TCP stream 8, frame 183 / TCP stream 8, frame 185 / TCP stream 8, frame 1711 / TCP stream 8.\n\nMetrics: `{\"destination\":\"172.16.0.131\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 102 / TCP stream 5, frame 119 / TCP stream 5, frame 214 / TCP stream 13, frame 231 / TCP stream 13, frame 233 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.16.0.131\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1786 / TCP stream 87, frame 1788 / TCP stream 87, frame 1792 / TCP stream 87, frame 1794 / TCP stream 87, frame 1796 / TCP stream 87.\n\nMetrics: `{\"destination\":\"172.16.0.131\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2147 / TCP stream 101, frame 2161 / TCP stream 101, frame 2164 / TCP stream 101, frame 2169 / TCP stream 101, frame 2215 / TCP stream 111.\n\nMetrics: `{\"destination\":\"172.16.0.149\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1946 / TCP stream 94, frame 2017 / TCP stream 94, frame 2057 / TCP stream 102, frame 2093 / TCP stream 102, frame 2099 / TCP stream 102.\n\nMetrics: `{\"destination\":\"172.16.0.149\",\"event_count\":83,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 2868 / TCP stream 95, frame 2870 / TCP stream 95, frame 2872 / TCP stream 95, frame 2874 / TCP stream 95, frame 2876 / TCP stream 95.\n\nMetrics: `{\"destination\":\"172.16.0.149\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 747 / TCP stream 43, frame 749 / TCP stream 43, frame 751 / TCP stream 43, frame 753 / TCP stream 43, frame 785 / TCP stream 45.\n\nMetrics: `{\"destination\":\"172.16.0.170\",\"event_count\":53,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\"],\"protocol\":\"drsuapi\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 579 / TCP stream 32, frame 620 / TCP stream 35, frame 681 / TCP stream 35, frame 683 / TCP stream 35, frame 686 / TCP stream 35.\n\nMetrics: `{\"destination\":\"172.16.0.170\",\"event_count\":79,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.16.0.52\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1427 / TCP stream 31, frame 1433 / TCP stream 31, frame 1436 / TCP stream 31, frame 1438 / TCP stream 31, frame 1440 / TCP stream 31.\n\nMetrics: `{\"destination\":\"172.16.0.170\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.16.0.52\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 4679 / TCP stream 187.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":52.845,\"packets\":127,\"source\":\"172.16.0.149\",\"wire_bytes\":87055}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 4802 / TCP stream 188.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":96.025,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2721}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 5068 / TCP stream 198.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":47.78,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2517}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 6688 / TCP stream 203.\n\nMetrics: `{\"destination\":\"27.254.174.84\",\"destination_port\":8080,\"duration_seconds\":60.005,\"packets\":117,\"source\":\"172.16.0.170\",\"wire_bytes\":86156}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 6805 / TCP stream 204.\n\nMetrics: `{\"destination\":\"27.254.174.84\",\"destination_port\":8080,\"duration_seconds\":104.051,\"packets\":20,\"source\":\"172.16.0.170\",\"wire_bytes\":3034}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 7688 / TCP stream 213.\n\nMetrics: `{\"destination\":\"27.254.174.84\",\"destination_port\":8080,\"duration_seconds\":49.984,\"packets\":18,\"source\":\"172.16.0.170\",\"wire_bytes\":2793}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 7719 / TCP stream 214.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":46.582,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2755}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 7792 / TCP stream 216.\n\nMetrics: `{\"destination\":\"27.254.174.84\",\"destination_port\":8080,\"duration_seconds\":41.718,\"packets\":76,\"source\":\"172.16.0.170\",\"wire_bytes\":54377}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 8729 / TCP stream 221.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":51.375,\"packets\":412,\"source\":\"172.16.0.149\",\"wire_bytes\":320581}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 9146 / TCP stream 222.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":76.16,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":3342}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 9331 / TCP stream 227.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":117.001,\"packets\":559,\"source\":\"172.16.0.170\",\"wire_bytes\":492888}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 10803 / TCP stream 236.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":66.043,\"packets\":21,\"source\":\"172.16.0.170\",\"wire_bytes\":3237}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 10835 / TCP stream 237.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":61.284,\"packets\":117,\"source\":\"172.16.0.149\",\"wire_bytes\":89737}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 10946 / TCP stream 238.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":61.474,\"packets\":21,\"source\":\"172.16.0.149\",\"wire_bytes\":3151}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 11650 / TCP stream 247.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":46.562,\"packets\":412,\"source\":\"172.16.0.149\",\"wire_bytes\":340415}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 11743 / TCP stream 249.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":95.062,\"packets\":19,\"source\":\"172.16.0.170\",\"wire_bytes\":2986}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 12139 / TCP stream 251.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":44.834,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":3271}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13103 / TCP stream 261.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":48.149,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2678}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13119 / TCP stream 262.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":79.426,\"packets\":19,\"source\":\"172.16.0.170\",\"wire_bytes\":3058}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13219 / TCP stream 268.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":94.94,\"packets\":398,\"source\":\"172.16.0.170\",\"wire_bytes\":319970}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13452 / TCP stream 272.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":49.955,\"packets\":132,\"source\":\"172.16.0.149\",\"wire_bytes\":101806}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13684 / TCP stream 274.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":55.29,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2461}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 14063 / TCP stream 281.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":90.205,\"packets\":19,\"source\":\"172.16.0.170\",\"wire_bytes\":2359}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 14528 / TCP stream 293.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":34.782,\"packets\":21,\"source\":\"172.16.0.170\",\"wire_bytes\":4464}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 14623 / TCP stream 298.\n\nMetrics: `{\"destination\":\"168.197.250.14\",\"destination_port\":80,\"duration_seconds\":40.858,\"packets\":201,\"source\":\"172.16.0.170\",\"wire_bytes\":159636}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 16159 / TCP stream 306.\n\nMetrics: `{\"destination\":\"162.144.76.184\",\"destination_port\":8080,\"duration_seconds\":32.803,\"packets\":767,\"source\":\"172.16.0.170\",\"wire_bytes\":545561}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 17066 / TCP stream 311.\n\nMetrics: `{\"destination\":\"128.199.93.156\",\"destination_port\":8080,\"duration_seconds\":36.477,\"packets\":767,\"source\":\"172.16.0.170\",\"wire_bytes\":546358}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 18531 / TCP stream 324.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":51.515,\"packets\":422,\"source\":\"172.16.0.149\",\"wire_bytes\":342682}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 18949 / TCP stream 325.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":83.461,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2922}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 19849 / TCP stream 329.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":35.196,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":2531}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 20080 / TCP stream 333.\n\nMetrics: `{\"destination\":\"135.148.121.246\",\"destination_port\":8080,\"duration_seconds\":85.095,\"packets\":19,\"source\":\"172.16.0.149\",\"wire_bytes\":3198}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 20948 / TCP stream 367.\n\nMetrics: `{\"destination\":\"139.196.72.155\",\"destination_port\":8080,\"duration_seconds\":51.093,\"packets\":124,\"source\":\"172.16.0.170\",\"wire_bytes\":101936}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 21069 / TCP stream 368.\n\nMetrics: `{\"destination\":\"139.196.72.155\",\"destination_port\":8080,\"duration_seconds\":38.15,\"packets\":19,\"source\":\"172.16.0.170\",\"wire_bytes\":3125}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 21121 / TCP stream 369.\n\nMetrics: `{\"destination\":\"139.196.72.155\",\"destination_port\":8080,\"duration_seconds\":58.283,\"packets\":413,\"source\":\"172.16.0.170\",\"wire_bytes\":356002}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 21759 / TCP stream 390.\n\nMetrics: `{\"destination\":\"185.184.25.78\",\"destination_port\":8080,\"duration_seconds\":123.7,\"packets\":1334,\"source\":\"172.16.0.170\",\"wire_bytes\":1155759}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 23259 / TCP stream 411.\n\nMetrics: `{\"destination\":\"54.37.106.167\",\"destination_port\":8080,\"duration_seconds\":122.065,\"packets\":23,\"source\":\"172.16.0.170\",\"wire_bytes\":4023}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 23301 / TCP stream 417.\n\nMetrics: `{\"destination\":\"198.199.98.78\",\"destination_port\":8080,\"duration_seconds\":95.397,\"packets\":890,\"source\":\"172.16.0.170\",\"wire_bytes\":789030}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 24437 / TCP stream 469.\n\nMetrics: `{\"destination\":\"128.199.192.135\",\"destination_port\":8080,\"duration_seconds\":49.124,\"packets\":302,\"source\":\"172.16.0.170\",\"wire_bytes\":248547}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-kpq9fdb$`; client IPs: 172.16.0.149; frames: 1987, 1995, 1997, 2009, 2062\n- account: `desktop-vd151o7$`; client IPs: 172.16.0.131; frames: 30, 38, 40, 52, 64\n- account: `desktop-w5tftqy$`; client IPs: 172.16.0.170; frames: 625, 633, 637, 647, 663\n- account: `everett.french`; client IPs: 172.16.0.170; frames: 1337, 1345, 1347, 1359, 1373\n- account: `nick.montgomery`; client IPs: 172.16.0.149; frames: 2755, 2763, 2765, 2777, 2787\n- account: `tricia.becker`; client IPs: 172.16.0.131; frames: 1658, 1666, 1668, 1680, 1699\n- domain: `SUNNYSTATION`; client IPs: 172.16.0.131; frames: 1750\n- full-name: `Everett French`; client IPs: 172.16.0.170; frames: 1448\n- full-name: `Nick Montgomery`; client IPs: 172.16.0.149; frames: 2882\n- full-name: `Tricia Becker`; client IPs: 172.16.0.131; frames: 1802\n- hostname: `DESKTOP-KPQ9FDB`; client IPs: 172.16.0.149; frames: 1915, 1937, 2040, 2281, 2327\n- hostname: `DESKTOP-VD151O7`; client IPs: 172.16.0.131; frames: 1, 10, 99, 293, 361\n- hostname: `DESKTOP-W5TFTQY`; client IPs: 172.16.0.170; frames: 519, 538, 797, 867, 1074\n- netbios-group: `SUNNYSTATION`; client IPs: unbound subject; frames: 11, 292, 389, 393, 397\n\n## IOC and artifact candidates\n\n- domain: `a-0010.a-msedge.net`; roles: dns-cname\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `ajaxmatters.com`; roles: dns-cname\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `autodiscover.sunnystation.com`; roles: dns-query\n- domain: `awridahmed.com`; roles: dns-cname\n- domain: `b-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `dalgahavuzu.com`; roles: dns-query, tls-sni\n- domain: `desktop-kpq9fdb.sunnystation.com`; roles: dns-query\n- domain: `desktop-vd151o7.sunnystation.com`; roles: dns-query\n- domain: `desktop-w5tftqy.sunnystation.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `ext-cust.squarespace.com`; roles: dns-cname\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.msft.com.trafficmanager.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-afd-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-afd.azureedge.us`; roles: dns-query, tls-sni\n- domain: `fp-afd.azurefd.us`; roles: dns-query, tls-sni\n- domain: `fp-as-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-as.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vp.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fs.microsoft.com`; roles: dns-query, tls-sni\n- domain: `gator4020.hostgator.com`; roles: dns-query\n- domain: `ghs.googlehosted.com`; roles: dns-cname\n- domain: `globalsovereignbank.com`; roles: dns-cname\n- domain: `imap.123-reg.co.uk`; roles: dns-query\n- domain: `imap.aol.com`; roles: dns-query\n- domain: `imap.gmail.com`; roles: dns-query\n- domain: `imap.ionos.mx`; roles: dns-query\n- domain: `imap.secureserver.net`; roles: dns-query\n- domain: `internal-aol.imap.mail.g03.yahoodns.net`; roles: dns-cname\n- domain: `ipv6.msftncsi.com`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `isatap.sunnystation.com`; roles: dns-query\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mail.alienergy.com.pk`; roles: dns-query\n- domain: `mail.gmail.com`; roles: dns-query\n- domain: `mail.idn-ltd.com`; roles: dns-query\n- domain: `mail.ionos.com`; roles: dns-query\n- domain: `mail.mail.com`; roles: dns-query\n- domain: `mail.mail.yahoo.com`; roles: dns-query\n- domain: `mail.mitsuwagroup.co.jp`; roles: dns-query\n- domain: `mail.proteinchile.cl`; roles: dns-query\n- domain: `mail.sapporo-kiden.co.jp`; roles: dns-query\n- domain: `mail.zoho.com`; roles: dns-query\n- domain: `mitsuwagroup.co.jp`; roles: dns-cname\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `ow1.res.office365.com`; roles: dns-query, tls-sni\n- domain: `parkingpage.namecheap.com`; roles: dns-cname\n- domain: `pop.km-plan.co.jp`; roles: dns-query\n- domain: `privilegetroissecurity.com`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `proteinchile.cl`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `riskprotek.com`; roles: dns-cname\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `shops.myshopify.com`; roles: dns-cname\n- domain: `smtp.aruba.it`; roles: dns-query\n- domain: `smtp.bstem.jp`; roles: dns-query\n- domain: `smtp.hanwa-net.co.jp`; roles: dns-query\n- domain: `smtp.live.com`; roles: dns-query\n- domain: `smtp.mail.com`; roles: dns-query\n- domain: `smtp.nifty.com`; roles: dns-query\n- domain: `smtp.ocn.ne.jp`; roles: dns-query\n- domain: `smtp.office365.com`; roles: dns-query\n- domain: `smtp.secureserver.net`; roles: dns-query\n- domain: `sunnyfileserver.sunnystation.com`; roles: dns-query\n- domain: `sunnystation-dc.sunnystation.com`; roles: dns-query\n- domain: `sunnystation.com`; roles: dns-query\n- domain: `target.clickfunnels.com`; roles: dns-cname\n- domain: `tring.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.sunnystation.com`; roles: dns-query\n- domain: `www.32342240.xyz`; roles: dns-query\n- domain: `www.ajaxmatters.com`; roles: dns-query, http-host\n- domain: `www.awridahmed.com`; roles: dns-query, http-host\n- domain: `www.ban-click.com`; roles: dns-query, http-host\n- domain: `www.barrcoplumbingsupply.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.byaliciafryearson.com`; roles: dns-query\n- domain: `www.campdiscount.info`; roles: dns-query, http-host\n- domain: `www.centroimprenta.xyz`; roles: dns-query\n- domain: `www.chinadqwx.com`; roles: dns-query, http-host\n- domain: `www.czzhudi.com`; roles: dns-query, http-host\n- domain: `www.db-propertygroup.com`; roles: dns-query, http-host\n- domain: `www.e-scooters.frl`; roles: dns-query\n- domain: `www.elsiepupz.com`; roles: dns-query, http-host\n- domain: `www.freedomteaminc.com`; roles: dns-query\n- domain: `www.globalsovereignbank.com`; roles: dns-query, http-host\n- domain: `www.hentainftxxx.com`; roles: dns-query, http-host\n- domain: `www.hydrocheats.com`; roles: dns-query, http-host\n- domain: `www.jmtmjz.com`; roles: dns-query\n- domain: `www.jogoreviravolta.com`; roles: dns-query, http-host\n- domain: `www.katchybugonsale.com`; roles: dns-query, http-host\n- domain: `www.keysine.com`; roles: dns-query, http-host\n- domain: `www.klassociates.info`; roles: dns-query\n- domain: `www.krpano.pro`; roles: dns-query\n- domain: `www.moonshot.properties`; roles: dns-query, http-host\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- domain: `www.mystore.guide`; roles: dns-query, http-host\n- domain: `www.nt-renewable.com`; roles: dns-query, http-host\n- domain: `www.privilegetroissecurity.com`; roles: dns-query, http-host\n- domain: `www.riskprotek.com`; roles: dns-query, http-host\n- domain: `www.seo-python.com`; roles: dns-query, http-host\n- domain: `www.theperfecttrainer.com`; roles: dns-query, http-host\n- domain: `www.xn--pckwb0cye6947ajzku8opzi.com`; roles: dns-query, http-host\n- domain: `yahoo.com`; roles: dns-query\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `103.41.204.169`; roles: network-endpoint\n- ipv4: `103.42.57.17`; roles: network-endpoint\n- ipv4: `104.131.62.48`; roles: network-endpoint\n- ipv4: `104.16.12.194`; roles: dns-answer, network-endpoint\n- ipv4: `104.16.13.194`; roles: dns-answer\n- ipv4: `104.16.14.194`; roles: dns-answer\n- ipv4: `104.16.15.194`; roles: dns-answer\n- ipv4: `104.16.16.194`; roles: dns-answer\n- ipv4: `104.21.89.147`; roles: dns-answer, network-endpoint\n- ipv4: `104.212.67.52`; roles: dns-answer, network-endpoint\n- ipv4: `104.212.67.71`; roles: dns-answer, network-endpoint\n- ipv4: `116.254.112.253`; roles: dns-answer, network-endpoint\n- ipv4: `118.98.72.86`; roles: network-endpoint\n- ipv4: `120.55.51.124`; roles: dns-answer, network-endpoint\n- ipv4: `122.17.147.238`; roles: dns-answer, network-endpoint\n- ipv4: `128.199.192.135`; roles: network-endpoint\n- ipv4: `128.199.93.156`; roles: network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.213.57`; roles: dns-answer\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.178.27`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `134.209.156.68`; roles: network-endpoint\n- ipv4: `135.148.121.246`; roles: network-endpoint\n- ipv4: `136.143.191.104`; roles: dns-answer, network-endpoint\n- ipv4: `139.196.72.155`; roles: network-endpoint\n- ipv4: `142.250.138.108`; roles: dns-answer\n- ipv4: `142.250.138.109`; roles: dns-answer, network-endpoint\n- ipv4: `144.217.88.125`; roles: network-endpoint\n- ipv4: `154.206.65.249`; roles: dns-answer, network-endpoint\n- ipv4: `156.96.154.210`; roles: http-host, network-endpoint\n- ipv4: `159.69.237.188`; roles: network-endpoint\n- ipv4: `162.144.76.184`; roles: network-endpoint\n- ipv4: `168.197.250.14`; roles: network-endpoint\n- ipv4: `172.16.0.1`; roles: network-endpoint\n- ipv4: `172.16.0.131`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.0.149`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.0.170`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.0.255`; roles: network-endpoint\n- ipv4: `172.16.0.52`; roles: dns-answer, network-endpoint\n- ipv4: `172.16.0.53`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.160.224`; roles: dns-answer\n- ipv4: `173.201.192.129`; roles: dns-answer\n- ipv4: `173.201.192.158`; roles: dns-answer\n- ipv4: `173.201.193.240`; roles: dns-answer, network-endpoint\n- ipv4: `173.201.193.97`; roles: dns-answer\n- ipv4: `173.231.37.114`; roles: dns-answer, network-endpoint\n- ipv4: `178.211.56.194`; roles: dns-answer, network-endpoint\n- ipv4: `180.250.21.2`; roles: network-endpoint\n- ipv4: `184.168.99.26`; roles: dns-answer, network-endpoint\n- ipv4: `185.148.168.15`; roles: network-endpoint\n- ipv4: `185.148.168.220`; roles: network-endpoint\n- ipv4: `185.184.25.78`; roles: network-endpoint\n- ipv4: `190.90.233.66`; roles: network-endpoint\n- ipv4: `191.252.103.16`; roles: network-endpoint\n- ipv4: `192.185.4.31`; roles: dns-answer, network-endpoint\n- ipv4: `194.9.172.107`; roles: network-endpoint\n- ipv4: `194.9.94.85`; roles: dns-answer, network-endpoint\n- ipv4: `194.9.94.86`; roles: dns-answer\n- ipv4: `195.154.146.35`; roles: network-endpoint\n- ipv4: `198.185.159.144`; roles: dns-answer, network-endpoint\n- ipv4: `198.185.159.145`; roles: dns-answer\n- ipv4: `198.199.98.78`; roles: network-endpoint\n- ipv4: `198.49.23.144`; roles: dns-answer\n- ipv4: `198.49.23.145`; roles: dns-answer\n- ipv4: `198.54.117.210`; roles: dns-answer, network-endpoint\n- ipv4: `198.54.117.211`; roles: dns-answer\n- ipv4: `198.54.117.212`; roles: dns-answer\n- ipv4: `198.54.117.215`; roles: dns-answer, network-endpoint\n- ipv4: `198.54.117.216`; roles: dns-answer\n- ipv4: `198.54.117.217`; roles: dns-answer\n- ipv4: `198.54.117.218`; roles: dns-answer\n- ipv4: `20.140.147.202`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.11`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.15`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.3`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.9`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.11`; roles: dns-answer\n- ipv4: `20.42.73.24`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.122`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.80.210`; roles: dns-answer, network-endpoint\n- ipv4: `20.54.89.15`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.212`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `209.17.116.163`; roles: dns-answer, network-endpoint\n- ipv4: `210.131.2.36`; roles: dns-answer, network-endpoint\n- ipv4: `210.57.209.142`; roles: network-endpoint\n- ipv4: `211.13.204.5`; roles: dns-answer, network-endpoint\n- ipv4: `211.16.12.137`; roles: dns-answer, network-endpoint\n- ipv4: `213.186.33.5`; roles: dns-answer, network-endpoint\n- ipv4: `216.172.184.77`; roles: dns-answer, network-endpoint\n- ipv4: `216.230.252.20`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.193.147`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.218.224.137`; roles: dns-answer, network-endpoint\n- ipv4: `23.218.224.148`; roles: dns-answer\n- ipv4: `23.218.224.151`; roles: dns-answer, network-endpoint\n- ipv4: `23.218.224.154`; roles: dns-answer, network-endpoint\n- ipv4: `23.227.38.74`; roles: dns-answer, network-endpoint\n- ipv4: `23.29.115.34`; roles: dns-answer, network-endpoint\n- ipv4: `23.38.92.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.47.49.133`; roles: dns-answer, network-endpoint\n- ipv4: `23.47.49.165`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `27.254.174.84`; roles: network-endpoint\n- ipv4: `27.34.147.95`; roles: dns-answer, network-endpoint\n- ipv4: `3.130.204.160`; roles: dns-answer\n- ipv4: `3.130.253.23`; roles: dns-answer, network-endpoint\n- ipv4: `37.44.244.177`; roles: network-endpoint\n- ipv4: `37.59.209.141`; roles: network-endpoint\n- ipv4: `40.125.122.151`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.11`; roles: dns-answer\n- ipv4: `40.126.28.12`; roles: dns-answer\n- ipv4: `40.126.28.13`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.14`; roles: dns-answer\n- ipv4: `40.126.28.18`; roles: dns-answer\n- ipv4: `40.126.28.19`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.20`; roles: dns-answer\n- ipv4: `40.126.28.21`; roles: dns-answer\n- ipv4: `40.126.28.22`; roles: dns-answer\n- ipv4: `40.126.28.23`; roles: dns-answer\n- ipv4: `40.126.29.10`; roles: dns-answer\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.12`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer\n- ipv4: `40.126.29.15`; roles: dns-answer\n- ipv4: `40.126.29.5`; roles: dns-answer\n- ipv4: `40.126.29.6`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.7.32`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.7.35`; roles: dns-answer, network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.120.162`; roles: dns-answer, network-endpoint\n- ipv4: `40.97.199.114`; roles: dns-answer\n- ipv4: `45.71.195.104`; roles: network-endpoint\n- ipv4: `52.109.20.76`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.31`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.19`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.169`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.141.63`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.185.211.133`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.0`; roles: dns-answer\n- ipv4: `52.238.248.1`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.4`; roles: dns-answer, network-endpoint\n- ipv4: `52.96.122.242`; roles: dns-answer\n- ipv4: `52.96.191.98`; roles: dns-answer\n- ipv4: `54.37.106.167`; roles: network-endpoint\n- ipv4: `54.37.228.122`; roles: network-endpoint\n- ipv4: `54.38.242.185`; roles: network-endpoint\n- ipv4: `59.148.253.194`; roles: network-endpoint\n- ipv4: `61.7.231.226`; roles: network-endpoint\n- ipv4: `61.7.231.229`; roles: network-endpoint\n- ipv4: `64.34.171.228`; roles: dns-answer, network-endpoint\n- ipv4: `65.52.5.117`; roles: dns-answer, network-endpoint\n- ipv4: `66.218.86.51`; roles: dns-answer, network-endpoint\n- ipv4: `66.235.200.112`; roles: dns-answer, network-endpoint\n- ipv4: `66.29.145.216`; roles: dns-answer, network-endpoint\n- ipv4: `68.178.213.203`; roles: dns-answer, network-endpoint\n- ipv4: `68.178.213.37`; roles: dns-answer\n- ipv4: `68.178.252.117`; roles: dns-answer\n- ipv4: `68.183.93.250`; roles: network-endpoint\n- ipv4: `72.167.191.69`; roles: dns-answer, network-endpoint\n- ipv4: `72.167.218.138`; roles: dns-answer\n- ipv4: `72.167.238.29`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `74.208.255.201`; roles: dns-answer, network-endpoint\n- ipv4: `74.208.5.10`; roles: dns-answer, network-endpoint\n- ipv4: `74.208.5.15`; roles: dns-answer, network-endpoint\n- ipv4: `74.6.141.28`; roles: dns-answer\n- ipv4: `74.6.143.25`; roles: dns-answer\n- ipv4: `74.6.143.26`; roles: dns-answer\n- ipv4: `74.6.229.28`; roles: dns-answer\n- ipv4: `74.6.231.20`; roles: dns-answer, network-endpoint\n- ipv4: `74.6.231.21`; roles: dns-answer\n- ipv4: `78.46.73.125`; roles: network-endpoint\n- ipv4: `85.214.67.203`; roles: network-endpoint\n- ipv4: `94.136.40.232`; roles: dns-answer, network-endpoint\n- ipv4: `94.177.209.30`; roles: dns-answer, network-endpoint\n- ipv4: `96.7.168.59`; roles: dns-answer, network-endpoint\n- ipv4: `97.74.135.10`; roles: dns-answer\n- ipv4: `97.74.135.143`; roles: dns-answer\n- ipv4: `98.137.11.163`; roles: dns-answer\n- ipv4: `98.137.11.164`; roles: dns-answer\n- ipv4: `98.137.159.60`; roles: dns-answer\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37cdab6ff1bd1c195bacb776c5213bf2`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `004599278fd2775eb468eac406e47dab4e5775c32eeb98a0f7ff21768aa2fdcf`; roles: exported-object\n- sha256: `0119adca455bfe449a3b6d30660b9a4fb4d7f9b1a42504166debbe61bc7a1a64`; roles: exported-object\n- sha256: `012525bd08b8856409471857cdde9928f6f5505e0eedfdc05880783621712242`; roles: exported-object\n- sha256: `02751d70749d493ba1989b74765a1cd1c56294db42c8b7775b3c0172828df4a6`; roles: exported-object\n- sha256: `03e81cfa927c6cdce33587023c24bb89f21cf506458598c7624bc61c8d3f8e58`; roles: exported-object\n- sha256: `0417dd954d3695d2bf400f237806c505bf8cccf07c44ce9467d98ed4175ea255`; roles: exported-object\n- sha256: `04b3ca7f09694f7f1b8e7b71f3503d325b75d3ff938ed24eeb9939714635f0d2`; roles: exported-object\n- sha256: `04b4f6035a50b1f58ebddb3f5a3e8cf1949a9b6b36b497c86b2b8c2b91e7ad4f`; roles: exported-object\n- sha256: `04ded8bd35a45a9dd083f3cc32056559c2d62739e5edebdaf1be2b5bf6133ea3`; roles: exported-object\n- sha256: `051f4c30c5306ffeff3f92010446f0aa0c420978da429cb787c50604c5944174`; roles: exported-object\n- sha256: `05497fa07eb6f2ee015c09ace90d0423c20136b9c6e4a52ee3e4c60c376eacf3`; roles: exported-object\n- sha256: `05b0dc4e3b3623d8fe2e6d653af5f42f73ce33b8d5461de62b0b113aa5f3caa0`; roles: exported-object\n- sha256: `05ba7c0984a69934dba3a41191243d8dc8fd5abf2fea86a4ead813cf2a9d9dee`; roles: exported-object\n- sha256: `05dfb38ed78ba413e07d3e01d40dd139683aa9b4715d3f000abc9d95e16205a6`; roles: exported-object\n- sha256: `0604cda2873562b6894fce5ef33aab23eeb01abae54bfd1a3ade48e85e54f266`; roles: exported-object\n- sha256: `0609a4da54220690f415ac4d27cee84f2eea7d6a39ae990017ac25889ca2ca54`; roles: exported-object\n- sha256: `06af7d2c9ddd3737f67c6789e4fa2610ed99d3d4aeb157e15c9f0b3eab46ceed`; roles: exported-object\n- sha256: `08387b61ba8264eef8f26f5d669b04b28b0ae71ee8ffe4de6852c8c2b9668d3d`; roles: exported-object\n- sha256: `08ff66f98bdcf6573485fb6a07e45b72de258edb90706aa75260b1f541a961eb`; roles: exported-object\n- sha256: `0965a8861f7f70048f6251a520c65bf2930b3b9265e0e55142aa384f4da36f24`; roles: exported-object\n- sha256: `09b156788ec22bd98b36d95565ab19199d442dc653c73ddbab3525792130b593`; roles: exported-object\n- sha256: `09ba1e573a77d25cfe065aa002a155189ce4f5cbfb0251ab61dc3b5eea9569f5`; roles: exported-object\n- sha256: `0a1b9616d1191c67cb63f7b1b8bd9809f43c94a183eb23527df28490ac9666f7`; roles: exported-object\n- sha256: `0aa09ec450e32afa62a72eeb252e83ad291b68ed378fb455ee4cb618ba04849a`; roles: exported-object\n- sha256: `0b0e4ae56a34d0aa05dca4d67700c3964c649f66bc9d9afd2c430bdb1f063be8`; roles: exported-object\n- sha256: `0b500a7b1a98e79df9f948812495251061d45e48ee19eb795810272216b6fbc9`; roles: exported-object\n- sha256: `0bd44562868ac54cb8c1043310b8f1d8267e681908bbd1d5e14b27ce796b977d`; roles: exported-object\n- sha256: `0ded265abee66125302a95e54828bf136e471f93d1c6ddbaec3513f4960254b6`; roles: exported-object\n- sha256: `0df6c8212c4a7361f440ffbd61ee76222cbc3d4e24b3c2716946800e13fd8ce8`; roles: exported-object\n- sha256: `0e60578c595f5d1d852562e954c270edcaeac54de126892ebf8dc2a60c9b1503`; roles: exported-object\n- sha256: `0ec2306524e6c599765d5d1223e9a33329d8c0793039e8d26c15de173d79e958`; roles: exported-object\n- sha256: `0f102e9552d90e78af23de4a7b4411569878a3149aaebc38e5168e422c5d247e`; roles: exported-object\n- sha256: `0f99ac235c51cdff782c4f8193f4698892a38d6365845031d7b20f976196fe4f`; roles: exported-object\n- sha256: `0ff8e752caa95643bf7b3776d821737814f87ffe3d6925701a3183971391edcf`; roles: exported-object\n- sha256: `0ffbddc5bc92b9e3b50893241fa9a182f02ab2a61054568668bec4f2e8a08fe9`; roles: exported-object\n- sha256: `10570ef48a963eeab20a1bd339618b44d213b436c19c51fb05099183a9999f4b`; roles: exported-object\n- sha256: `10e9248a956dcfbdb1d4c8b70dd05ee54605208b614d10ceb7b8b88d150cb0ef`; roles: exported-object\n- sha256: `118a94f5308fb6dd5bf0096ef766eb9fdc207a1c05fc23c7186aba49100ee508`; roles: exported-object\n- sha256: `120f7dd788fe12ca8c9af5f9d47d1fa963b0f63bc63cef3afcdd28ab66bdbf6f`; roles: exported-object\n- sha256: `121098e0cde0a928173ac2ba2da6dd82b1b626453b296059c60926787b1e4546`; roles: exported-object\n- sha256: `1235888074ede34f4f78e3108c85f05795ab16d8fb72b534547fb0da3e6a234e`; roles: exported-object\n- sha256: `129c768192359093317c1b658b106ba3d9968476a695fef49ea9e6d118467767`; roles: exported-object\n- sha256: `139f6fa785927256480056be4662ba4122fa4e5a18d7b63752f8d2ae6c9395b6`; roles: exported-object\n- sha256: `13bf0aa04849e77d7914f426c28a54bb49f547cc004ae800af68864980a4a88d`; roles: exported-object\n- sha256: `14245b645e4103d8713e7f916fc7d4d10ae98146a05af38d2b800d52c8acc717`; roles: exported-object\n- sha256: `142855918acb873018e7afb636a8f9d0495b3028b4d16b4cf706d68b3a7f8ce3`; roles: exported-object\n- sha256: `147f4226dc3c57cb9d2536c745013d7145af769c26fc6b37d0848a01af884865`; roles: exported-object\n- sha256: `148dd3a46202949f4ff34c20da8804f68644abec319cbfd57efb774b9b3ebf5d`; roles: exported-object\n- sha256: `14a5cc536d16a41573e57bfe68ede705cb5850500eaa5ec123c42784903055c0`; roles: exported-object\n- sha256: `14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3`; roles: exported-object\n- sha256: `14c39252741654b6e9872383aa869070317abb18e91f2d5dbbb1341b3abe62c4`; roles: exported-object\n- sha256: `14cd9376ff8f1a914c40168783efb3d4e8f53c2526378000a0190478621eac9f`; roles: exported-object\n- sha256: `157889eb6bfdc5fb11eca24228c4f9ae1a176455785456ca79849fb0bb5c2792`; roles: exported-object\n- sha256: `15861b469b40931e7dbe3a8b6aacb1ee6824b431fea25281840e1db28086d255`; roles: exported-object\n- sha256: `161004698346c45313eef873dc3e555f83bf5f4fd616d1f67947fbc8cf3b2660`; roles: exported-object\n- sha256: `1694f0ee7be6029fe279792606f74d0e0c156eedf216eb6d30753048e33ac95c`; roles: exported-object\n- sha256: `16f02f7a9a59c59bf6b7651c334043da2c43d100661c8345dce857c8743374b0`; roles: exported-object\n- sha256: `178252c182d98d603e7235df45e57e1d92aa93fc0c3b71d5c27bc1b7b1c7c310`; roles: exported-object\n- sha256: `178ca47275e40b28d97e3f2445c90926cecad89d7679ee5eb59cd1917041f61e`; roles: exported-object\n- sha256: `18ce8668476bb27422129bf09e3992cafb555779513b7c73daa5e1b07577dbf1`; roles: exported-object\n- sha256: `191a086e159061a0c87247adcfe042e6c15854fca15397fe2dc99a0f35efa1ed`; roles: exported-object\n- sha256: `195aaab78e060cb793d406f91c91592c44a15d944ae7662a5fd8dc7750a121dd`; roles: exported-object\n- sha256: `1970d832434fda01eee7325d7882f19089ff3dc6b6e623be0e2be3e21da60290`; roles: exported-object\n- sha256: `199efb2dba801fbe4f06b60162b3cc083a63d6078f6b56224f5dc538ded3bdf4`; roles: exported-object\n- sha256: `1a188e05405f1ce01789dc73de2d60632eade6ad95ff36cec29b988444861eb1`; roles: exported-object\n- sha256: `1a281a2d280c6d1f1f205d3f8210057b1b555794f6c12db57e4e8e4816cb9036`; roles: exported-object\n- sha256: `1bc147f6a38ee4f00397689ae7cbaae2a9807b40d9092404c90dbe97611ab079`; roles: exported-object\n- sha256: `1c0c79371604a7e57f527a518397cbbfc312314c6213ac27b44d3a62abd87f17`; roles: exported-object\n- sha256: `1c19ebc675280676ea53db434f16e8f1b97b729785511d5c82ebb610fb53f08d`; roles: exported-object\n- sha256: `1c3694a1647d000fce54a9d5a30c1a06da57a9e6fab75870993b4d5653577417`; roles: exported-object\n- sha256: `1cd3bcddfa4cebaeba570316c23a0248dfb1dd90898bca8e1bf01596b5beedcc`; roles: exported-object\n- sha256: `1d16bd195b28177d0030375134b90eab863a25458c56d05c7e72ecfcda8ddfb8`; roles: exported-object\n- sha256: `1d21900f027764a25c787c4e444214277ab36e2074037e5d5a8ce6f0efbb004e`; roles: exported-object\n- sha256: `1d71eef40b1c844cb461ecc7197ed8eef6bc582ba1e5dc287c3bf5fc15e1b4af`; roles: exported-object\n- sha256: `1db156538dd79f08b09c654f86b8f6d481d588fa44cc51f02c4e42fdcdca7913`; roles: exported-object\n- sha256: `1de41672c3a500d7321663f486920a8fb5f29e8801f92be3e1aa60cb78bddbf7`; roles: exported-object\n- sha256: `1f0fd84ce2a8a3ae572963ae3ad0937920664b081fe79acf87fde2b13acc77be`; roles: exported-object\n- sha256: `1f68d99e75eaed0dbd08ee26e222e4a21040c56a6266f1d0d9b385730ca12fc0`; roles: exported-object\n- sha256: `1fe5730bb3502850c53ca50dc874702126977f857a47c3dbe5d1a1226afd5c08`; roles: exported-object\n- sha256: `206abeeaebf598ad3c984ba9e8b3d56d663989b35c5074ef330514b5841e1a6e`; roles: exported-object\n- sha256: `209565664129ec0b9c01867286aa093f1ca15e4ad12093aac53bc290925ae39f`; roles: exported-object\n- sha256: `211aa041d8b4ea3a643d44eb8f538f6caa0a5e0e3b63a802de3fbf0a9011a1f1`; roles: exported-object\n- sha256: `2143e3b14753fe28b4e495e57c087ef8fea10cbd644761105d607d90b9d23633`; roles: exported-object\n- sha256: `2194c3bdb83d8e73218ec1fc36977bd7566500eb0cc264750ce08248f7575543`; roles: exported-object\n- sha256: `21abcfcccf584af261252953ef89fd36141f086a365fbd9d2066ae94b3c4bd76`; roles: exported-object\n- sha256: `2251efee138848fe36171baae0d12828489e0bcc3b063bc509e2724cf671c01f`; roles: exported-object\n- sha256: `2269981a9b387528f38aaa58c273b3a203ba1ce1e4ab7d369210e411cedaef46`; roles: exported-object\n- sha256: `22704106a20c5a5a5f4c78a113092eade0f683945a2496a9a0d5bc69c52bd814`; roles: exported-object\n- sha256: `2321ba015f0e7a3d74e190c407ecc25f0b772956eb0645036818a324965264ee`; roles: exported-object\n- sha256: `2330b96b60d76e24f5bfcc6d9a4e415cb57d4a8c18d95d50566701d112ab2ca9`; roles: exported-object\n- sha256: `23f00aaf4245b4855825f38da30d464bef3c6f81eea7235c99fc7bd5d6b726a3`; roles: exported-object\n- sha256: `23f6e432c83a9a3dcb731391e864afb6129df0a7eedda745e7cc51baf1ea1ad2`; roles: exported-object\n- sha256: `248430bf42f12f2b4e703bb156543d496f2890ad08148d590f93348830c1ad52`; roles: exported-object\n- sha256: `24ec4098e828c89dfb5810b1e4df67cd3e8987e672b16a393e1045ba3ded185e`; roles: exported-object\n- sha256: `24feb82784833ef28e43907591d6823fb703d92e6a3960435bea7934a35f15e1`; roles: exported-object\n- sha256: `253dd1918125d171a4877950898de2ca26060c40b1d05c8fe31cc9fb56776472`; roles: exported-object\n- sha256: `25911c516fcaaded9ea55ede4e30828fe8e21e9a895f5e8948034e9621343854`; roles: exported-object\n- sha256: `2620bf96201e9f328aee98a74ce5b87f221e761a8b2662974b35f90991404337`; roles: exported-object\n- sha256: `263bc7831746b36b6903d8f193117e6f1e777b2e8765086740b8c0b2af19630e`; roles: exported-object\n- sha256: `26d630a69965af7110e23e7d89e870aa432f466b8e25d825ba90a1d615b74765`; roles: exported-object\n- sha256: `2741234de895bed810734f6b55872a58fc208957ab25ecea14b7aed45f7c5726`; roles: exported-object\n- sha256: `274e7318a4440240d24701135a3a037ffc4064ab6e18b7683968d7ad7557823c`; roles: exported-object\n- sha256: `2756bae8f350efe025c1a19b8c04b741660f265fa60d9accbdcee7575d65a301`; roles: exported-object\n- sha256: `276fdf588903250404f05a86da40c2e5c26360c7dd2cfce409d8eaf30640e1e6`; roles: exported-object\n- sha256: `28204d9f1d7b8c17b7cd049bf7f32b5dc41e538ad9c17d884c1e06eab2d8dd39`; roles: exported-object\n- sha256: `28c04e7c2529f941c2276321566ed73a1cd75404e1b419a0ed1afe2ef1e4bb5c`; roles: exported-object\n- sha256: `29804a73896b8364000f4c23c69de02f4b4305e30f21c39a39097ac982863ee8`; roles: exported-object\n- sha256: `29a06c4b40fada661ba0e4f26673529c42d9bd1fffb629bfed06cdea351634ae`; roles: exported-object\n- sha256: `29b84a0556ab8203d2e5fde7529491a0253e9586cf9506583cf50acf715f08cc`; roles: exported-object\n- sha256: `29bce0e3976c1a4b0c5a3dedaf4c1df15560fed60eefc170b4e8f1bfd72e881e`; roles: exported-object\n- sha256: `2a223bc66bee6f01307afacca8cd03c762c109e39095bf5329d7d70920cdf601`; roles: exported-object\n- sha256: `2b785b0137066ea6c9bcb8baa757e5633539962796080eeb05ccd3d775f40845`; roles: exported-object\n- sha256: `2b79250e166209b04e6221f70295861958a9388503c781ddd638cc3864843f5a`; roles: exported-object\n- sha256: `2b999f47b936dc400728793101b43657b4e9410a7267fb92cd15fac90fd2a482`; roles: exported-object\n- sha256: `2ba817fc45bb0dec23acca80833f3e7d19a99b3fc71f3e2fa673ef4c38cf533c`; roles: exported-object\n- sha256: `2c1b8be8a085bd2d29dc9c0fdc032117a77193dad38602390554138f7cdfe4cf`; roles: exported-object\n- sha256: `2cc04e0598d2938235c3ef5eeca39c65285f0dcb3149c70fc0a7362a4ea3f490`; roles: exported-object\n- sha256: `2d3a83cf33a1a7bbe0b8d0d003e520924b0aa95732828cc17290fb9d461ab96b`; roles: exported-object\n- sha256: `2d4829a665a6465d8a67a009389b86e8068c01ce3d094f0459de4ed5f4ef2199`; roles: exported-object\n- sha256: `2d4c01d66de1641649052c860fd1a8788f5193f3db96487f4f2d6d82a35d6d07`; roles: exported-object\n- sha256: `2de61824c9fdc4a84764dee59289619829a98149225fc246989abf4dfcd5913a`; roles: exported-object\n- sha256: `2df0449ed47af8473f3b17afa4cdffb3ed4b11a0df006bc7b090fe4f4f74b59f`; roles: exported-object\n- sha256: `2e24ef287ea02c7f4c4cc2826389e7b69d3d559d35adbcbdc9b3d7437bd772f5`; roles: exported-object\n- sha256: `2e3c4533bd6dbe6301f70359c32ff7b03f3c6599208e18fec224196b77ae633d`; roles: exported-object\n- sha256: `2ef86698bfc9c4ce9dacd4733967d03b4b58e2130c0905f1ae479e689c767234`; roles: exported-object\n- sha256: `2f41a6bbfe2c57b767df989d53cad14278bcaa7b0fe886f8c6b1e7f0cab3c019`; roles: exported-object\n- sha256: `2f6d5d053ebbfcb3abd90f94bc862175c2782dd5cc60fb9dbb82a2fe9e8ebaf2`; roles: exported-object\n- sha256: `311456b3d2193c6a82531c7338dba44beae1363a17ecfcaee9ead85549f3f666`; roles: exported-object\n- sha256: `311b06d1311f38632a53291a497a27877e1d9bed83ed7d344fb3110938ceb1fa`; roles: exported-object\n- sha256: `313ac03b87cec74ab7068a0c183daed376e45377fa754059eb752e64fa5c5186`; roles: exported-object\n- sha256: `31b2c11ae258a1e49a65bfc346e74b260221370dcd5ccf9f3761399de9f71b3d`; roles: exported-object\n- sha256: `31f63b033376b7488674789fd49cd0698a60403347bc2168cd5de0a8491349b7`; roles: exported-object\n- sha256: `327eb44a247ac6e38b3d02b76dcdbdaf66a7c7064bf4f3c9fdfd4484a80452ce`; roles: exported-object\n- sha256: `32c47cc6b8a9063141d7559f8c0a4c356571b38bba3864d454029bd2c2f0ffde`; roles: exported-object\n- sha256: `33421c7d3bc5bae96cfb722a18967bcbbe8ff21e863a802150fe5fbbbdd04ca6`; roles: exported-object\n- sha256: `336b14c1f82c04eb8bfd490b73dade0d1a084108f5f43af7d1ab5a5de7e3ccff`; roles: exported-object\n- sha256: `3376656a1065f217ece24cf4039aaba336fe35a6c6e29be159fb03cb712ef62d`; roles: exported-object\n- sha256: `3443f2dc0c7b74b068d09f28b4ad0e322d341983f4c57893f2eda38427dbd65e`; roles: exported-object\n- sha256: `347c0bc98abf0e16e86f72cc7058b8290880c7e089d83d19cbf80aa295e142e6`; roles: exported-object\n- sha256: `352dd136c9810049178064b46cfeb6149a21cf74198d62455be96509ec710262`; roles: exported-object\n- sha256: `35714a390651048138a4be4ddeaceb8234628ae85b8f508f3ef4879adcabacb2`; roles: exported-object\n- sha256: `384b409d1a3538287c7be92f275d5388cd10d404aac05286d0031e384d110558`; roles: exported-object\n- sha256: `38dbf8fe6f99d95e30c7264d7e6bc83d61d675636a461affdc7dedb3bc96439f`; roles: exported-object\n- sha256: `3916a0813dfb36961722d081fe5a4835a4e8ccf57258402b6417700b70e71966`; roles: exported-object\n- sha256: `3a200099bd79b734329a90776df195da10460140051847e25e839069912dcf1c`; roles: exported-object\n- sha256: `3b163eb96641057909fb4f1a4fd2d42771dcf7c8961a4e9d1862e681037afe86`; roles: exported-object\n- sha256: `3b967843e46088c05b6f3563768f1046ff9b2a132740ba90c9cb9657632f443a`; roles: exported-object\n- sha256: `3ba62e70a1c2b45133051bf258188a375751d777542eba48cdb7c6e219d4d052`; roles: exported-object\n- sha256: `3c235f28b3544e94b6cb9b106fbed857e46407f2edaeab306ec9f044dc1561c6`; roles: exported-object\n- sha256: `3c24ca5e6fc65f64bc89254b7b65a57ce91d2f94a0669264d29cff8b7bee1a6d`; roles: exported-object\n- sha256: `3c3fc27182b240f7ef25684b89055f2fb6104216d204c2858ff2f4cc5c5aad73`; roles: exported-object\n- sha256: `3c6209fdc3f7b8ab8749023d1c5fd58ac6fcc0cca7f25bedff908e9cb0c32aa5`; roles: exported-object\n- sha256: `3cbf196455ce3dc4596ef48d543346ba6019cee0ec3037214ec0e53a023d33db`; roles: exported-object\n- sha256: `3cc8277d0766bef38be25da17bc2a547529710bf31e228cdf62b0dac9e218801`; roles: exported-object\n- sha256: `3d44c0dfce89c86e116520de3075683d7d7d829e5f450632a37ecccbafda0bdc`; roles: exported-object\n- sha256: `3dc4423e315cbeb8e53913228588374f6b5e95c702acd32a1663d0175d92edd0`; roles: exported-object\n- sha256: `3edd8e1011fa1e97cdc6dc3d2985ec4ff531fb3ae3c674053341df220b2e4590`; roles: exported-object\n- sha256: `3ee2866b868219e05cb89be1f203e90124621837871344428e9c0b2b73a53500`; roles: exported-object\n- sha256: `3fa3195a19af437b9c8356765972bb2af3ababa3bb5563fda1770a04b8e0d958`; roles: exported-object\n- sha256: `3fb33da40450b7b4c991439b671829118e433f2b30e6a9aa69b9d4e3e21ffd17`; roles: exported-object\n- sha256: `3ff8a8023e97907778f39cd4ce45bc69e65f719162ae3a0618a8db425416fd78`; roles: exported-object\n- sha256: `40487f3ccba51bd4740d8e296129781a2d40293fcff0e8688c6b9c47b48a3e64`; roles: exported-object\n- sha256: `415401907436fd5ce187fdaf01b06dd9c25620971a900cd48d396af77ca1cc16`; roles: exported-object\n- sha256: `4226968bc416ca4299ceed0b41b92a0bd28ba32dd6964c95919eed35001769ac`; roles: exported-object\n- sha256: `42a8a1c74a9fcf27a35963517aae581973e0f89b65bef4cf7bc8bf835364ade1`; roles: exported-object\n- sha256: `42b7c8ac10d317ebce9ddcac972286ca8f3cea590d578ae5dc853ceecc946c2a`; roles: exported-object\n- sha256: `42bb95c4eb86938a55171e950d23e21b10d70ea15943c2432a6afb5f4ef163a5`; roles: exported-object\n- sha256: `435c771adb307c3456f296da31f2000676759f1481c2484c7ec38751fb153b10`; roles: exported-object\n- sha256: `4385a17fa2ce6c83c6079bb0593482b48df5bc4b5bd15f913225d7076d5574f8`; roles: exported-object\n- sha256: `43e5e8f4682cf04c0a879423e15449b67785926aaf6bb3752d2c019ebf06e6e3`; roles: exported-object\n- sha256: `43fc9856c71f37798d1793f95080fdcbd6925cddc9427b68237453a4f7a6801e`; roles: exported-object\n- sha256: `445bca5a135f9179c266dcff83841f82fd4637a22ccc7ae656e4e41e20fc9d16`; roles: exported-object\n- sha256: `45100f25534e7567b0d6894478c2fcf74a259d0e1938d6ef1c3e152bedbc9275`; roles: exported-object\n- exported object `zbBYgukXYxzAF2hZc`; SHA-256 `14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3`; size 593920 bytes\n  Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `object26220`; SHA-256 `abca26cf70ef57ef879c81a3b45d9fc5ce4437f54bda65d0170f3f5bae8a54f5`; size 1376 bytes\n  Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"iex\",\"feature\":\"dynamic-evaluation\",\"offset\":827}],\"inspected_bytes\":1376,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `Ocklqc.jpg`; SHA-256 `2620bf96201e9f328aee98a74ce5b87f221e761a8b2662974b35f90991404337`; size 719872 bytes\n- exported object `%3fOXtd9L=cFNTMFX8k4Sl&WN68=YMSFGVfdS9ONGuAKqerSFa9naGdXyzjeSZBgl3Bk94ai8h1oihtuDN4qXdcs1YMbgxqWO7UijFru1VtwMrj0Yg==`; SHA-256 `1a281a2d280c6d1f1f205d3f8210057b1b555794f6c12db57e4e8e4816cb9036`; size 5149 bytes\n- exported object `object27533`; SHA-256 `4662635889a87f2f39280975ae841f8ff9c51a45cee3c5922e08778dae69b077`; size 1528 bytes\n- exported object `object17412`; SHA-256 `004599278fd2775eb468eac406e47dab4e5775c32eeb98a0f7ff21768aa2fdcf`; size 1460 bytes\n- exported object `object23470`; SHA-256 `0119adca455bfe449a3b6d30660b9a4fb4d7f9b1a42504166debbe61bc7a1a64`; size 1460 bytes\n- exported object `object17433`; SHA-256 `012525bd08b8856409471857cdde9928f6f5505e0eedfdc05880783621712242`; size 1460 bytes\n- exported object `object11310`; SHA-256 `02751d70749d493ba1989b74765a1cd1c56294db42c8b7775b3c0172828df4a6`; size 1460 bytes\n- exported object `object27642`; SHA-256 `03e81cfa927c6cdce33587023c24bb89f21cf506458598c7624bc61c8d3f8e58`; size 1460 bytes\n- exported object `object24152`; SHA-256 `0417dd954d3695d2bf400f237806c505bf8cccf07c44ce9467d98ed4175ea255`; size 1460 bytes\n- exported object `object9566`; SHA-256 `04b3ca7f09694f7f1b8e7b71f3503d325b75d3ff938ed24eeb9939714635f0d2`; size 1460 bytes\n- exported object `object10926`; SHA-256 `04b4f6035a50b1f58ebddb3f5a3e8cf1949a9b6b36b497c86b2b8c2b91e7ad4f`; size 1460 bytes\n- exported object `object24077`; SHA-256 `04ded8bd35a45a9dd083f3cc32056559c2d62739e5edebdaf1be2b5bf6133ea3`; size 1460 bytes\n- exported object `object25436`; SHA-256 `051f4c30c5306ffeff3f92010446f0aa0c420978da429cb787c50604c5944174`; size 1460 bytes\n- exported object `object21540`; SHA-256 `05497fa07eb6f2ee015c09ace90d0423c20136b9c6e4a52ee3e4c60c376eacf3`; size 1460 bytes\n- exported object `object17594`; SHA-256 `05b0dc4e3b3623d8fe2e6d653af5f42f73ce33b8d5461de62b0b113aa5f3caa0`; size 1460 bytes\n- exported object `object16434`; SHA-256 `05ba7c0984a69934dba3a41191243d8dc8fd5abf2fea86a4ead813cf2a9d9dee`; size 1460 bytes\n- exported object `object11911`; SHA-256 `05dfb38ed78ba413e07d3e01d40dd139683aa9b4715d3f000abc9d95e16205a6`; size 1460 bytes\n- exported object `object11550`; SHA-256 `0604cda2873562b6894fce5ef33aab23eeb01abae54bfd1a3ade48e85e54f266`; size 1460 bytes\n- exported object `object24129`; SHA-256 `0609a4da54220690f415ac4d27cee84f2eea7d6a39ae990017ac25889ca2ca54`; size 1460 bytes\n- exported object `object21424`; SHA-256 `06af7d2c9ddd3737f67c6789e4fa2610ed99d3d4aeb157e15c9f0b3eab46ceed`; size 1460 bytes\n- exported object `object21425`; SHA-256 `08387b61ba8264eef8f26f5d669b04b28b0ae71ee8ffe4de6852c8c2b9668d3d`; size 1460 bytes\n- exported object `object7819`; SHA-256 `08ff66f98bdcf6573485fb6a07e45b72de258edb90706aa75260b1f541a961eb`; size 1460 bytes\n- exported object `object9111`; SHA-256 `0965a8861f7f70048f6251a520c65bf2930b3b9265e0e55142aa384f4da36f24`; size 1460 bytes\n- exported object `object23590`; SHA-256 `09b156788ec22bd98b36d95565ab19199d442dc653c73ddbab3525792130b593`; size 1460 bytes\n- exported object `object16612`; SHA-256 `09ba1e573a77d25cfe065aa002a155189ce4f5cbfb0251ab61dc3b5eea9569f5`; size 1460 bytes\n- exported object `object23550`; SHA-256 `0a1b9616d1191c67cb63f7b1b8bd9809f43c94a183eb23527df28490ac9666f7`; size 1460 bytes\n- exported object `object25308`; SHA-256 `0aa09ec450e32afa62a72eeb252e83ad291b68ed378fb455ee4cb618ba04849a`; size 1460 bytes\n- exported object `object11969`; SHA-256 `0b0e4ae56a34d0aa05dca4d67700c3964c649f66bc9d9afd2c430bdb1f063be8`; size 1460 bytes\n- exported object `object25385`; SHA-256 `0b500a7b1a98e79df9f948812495251061d45e48ee19eb795810272216b6fbc9`; size 1460 bytes\n- exported object `object13663`; SHA-256 `0bd44562868ac54cb8c1043310b8f1d8267e681908bbd1d5e14b27ce796b977d`; size 1460 bytes\n- exported object `object23853`; SHA-256 `0ded265abee66125302a95e54828bf136e471f93d1c6ddbaec3513f4960254b6`; size 1460 bytes\n- exported object `object23927`; SHA-256 `0df6c8212c4a7361f440ffbd61ee76222cbc3d4e24b3c2716946800e13fd8ce8`; size 1460 bytes\n- exported object `object17580`; SHA-256 `0e60578c595f5d1d852562e954c270edcaeac54de126892ebf8dc2a60c9b1503`; size 1460 bytes\n- exported object `object17735`; SHA-256 `0ec2306524e6c599765d5d1223e9a33329d8c0793039e8d26c15de173d79e958`; size 1460 bytes\n- exported object `object22136`; SHA-256 `0f102e9552d90e78af23de4a7b4411569878a3149aaebc38e5168e422c5d247e`; size 1460 bytes\n- exported object `object10934`; SHA-256 `0f99ac235c51cdff782c4f8193f4698892a38d6365845031d7b20f976196fe4f`; size 1460 bytes\n- exported object `object16749`; SHA-256 `0ff8e752caa95643bf7b3776d821737814f87ffe3d6925701a3183971391edcf`; size 1460 bytes\n- exported object `object23930`; SHA-256 `0ffbddc5bc92b9e3b50893241fa9a182f02ab2a61054568668bec4f2e8a08fe9`; size 1460 bytes\n- exported object `object11134`; SHA-256 `10570ef48a963eeab20a1bd339618b44d213b436c19c51fb05099183a9999f4b`; size 1460 bytes\n- exported object `object16496`; SHA-256 `10e9248a956dcfbdb1d4c8b70dd05ee54605208b614d10ceb7b8b88d150cb0ef`; size 1460 bytes\n- exported object `object21251`; SHA-256 `118a94f5308fb6dd5bf0096ef766eb9fdc207a1c05fc23c7186aba49100ee508`; size 1460 bytes\n- exported object `object17490`; SHA-256 `120f7dd788fe12ca8c9af5f9d47d1fa963b0f63bc63cef3afcdd28ab66bdbf6f`; size 1460 bytes\n- exported object `object17178`; SHA-256 `121098e0cde0a928173ac2ba2da6dd82b1b626453b296059c60926787b1e4546`; size 1460 bytes\n- exported object `object17210`; SHA-256 `1235888074ede34f4f78e3108c85f05795ab16d8fb72b534547fb0da3e6a234e`; size 1460 bytes\n- exported object `object22466`; SHA-256 `129c768192359093317c1b658b106ba3d9968476a695fef49ea9e6d118467767`; size 1460 bytes\n- exported object `object26286`; SHA-256 `139f6fa785927256480056be4662ba4122fa4e5a18d7b63752f8d2ae6c9395b6`; size 1460 bytes\n- exported object `object11872`; SHA-256 `13bf0aa04849e77d7914f426c28a54bb49f547cc004ae800af68864980a4a88d`; size 1460 bytes\n- exported object `object13662`; SHA-256 `14245b645e4103d8713e7f916fc7d4d10ae98146a05af38d2b800d52c8acc717`; size 1460 bytes\n- exported object `object24538`; SHA-256 `142855918acb873018e7afb636a8f9d0495b3028b4d16b4cf706d68b3a7f8ce3`; size 1460 bytes\n- exported object `object16912`; SHA-256 `147f4226dc3c57cb9d2536c745013d7145af769c26fc6b37d0848a01af884865`; size 1460 bytes\n- exported object `object17734`; SHA-256 `148dd3a46202949f4ff34c20da8804f68644abec319cbfd57efb774b9b3ebf5d`; size 1460 bytes\n- exported object `object16512`; SHA-256 `14a5cc536d16a41573e57bfe68ede705cb5850500eaa5ec123c42784903055c0`; size 1460 bytes\n- exported object `object11546`; SHA-256 `14c39252741654b6e9872383aa869070317abb18e91f2d5dbbb1341b3abe62c4`; size 1460 bytes\n- exported object `object26741`; SHA-256 `14cd9376ff8f1a914c40168783efb3d4e8f53c2526378000a0190478621eac9f`; size 1460 bytes\n- exported object `object21920`; SHA-256 `157889eb6bfdc5fb11eca24228c4f9ae1a176455785456ca79849fb0bb5c2792`; size 1460 bytes\n- exported object `object16587`; SHA-256 `15861b469b40931e7dbe3a8b6aacb1ee6824b431fea25281840e1db28086d255`; size 1460 bytes\n- exported object `object16905`; SHA-256 `161004698346c45313eef873dc3e555f83bf5f4fd616d1f67947fbc8cf3b2660`; size 1460 bytes\n- exported object `object11466`; SHA-256 `1694f0ee7be6029fe279792606f74d0e0c156eedf216eb6d30753048e33ac95c`; size 1460 bytes\n- exported object `object16517`; SHA-256 `16f02f7a9a59c59bf6b7651c334043da2c43d100661c8345dce857c8743374b0`; size 1460 bytes\n- exported object `object14759`; SHA-256 `178252c182d98d603e7235df45e57e1d92aa93fc0c3b71d5c27bc1b7b1c7c310`; size 1460 bytes\n- exported object `object16254`; SHA-256 `178ca47275e40b28d97e3f2445c90926cecad89d7679ee5eb59cd1917041f61e`; size 1460 bytes\n- exported object `object21272`; SHA-256 `18ce8668476bb27422129bf09e3992cafb555779513b7c73daa5e1b07577dbf1`; size 1460 bytes\n- exported object `object10754`; SHA-256 `191a086e159061a0c87247adcfe042e6c15854fca15397fe2dc99a0f35efa1ed`; size 1460 bytes\n- exported object `object21917`; SHA-256 `195aaab78e060cb793d406f91c91592c44a15d944ae7662a5fd8dc7750a121dd`; size 1460 bytes\n- exported object `object16797`; SHA-256 `1970d832434fda01eee7325d7882f19089ff3dc6b6e623be0e2be3e21da60290`; size 1460 bytes\n- exported object `object16273`; SHA-256 `199efb2dba801fbe4f06b60162b3cc083a63d6078f6b56224f5dc538ded3bdf4`; size 1460 bytes\n- exported object `object16871`; SHA-256 `1a188e05405f1ce01789dc73de2d60632eade6ad95ff36cec29b988444861eb1`; size 1460 bytes\n- exported object `object16257`; SHA-256 `1bc147f6a38ee4f00397689ae7cbaae2a9807b40d9092404c90dbe97611ab079`; size 1460 bytes\n- exported object `object16374`; SHA-256 `1c0c79371604a7e57f527a518397cbbfc312314c6213ac27b44d3a62abd87f17`; size 1460 bytes\n- exported object `object25354`; SHA-256 `1c19ebc675280676ea53db434f16e8f1b97b729785511d5c82ebb610fb53f08d`; size 1460 bytes\n- exported object `object17272`; SHA-256 `1c3694a1647d000fce54a9d5a30c1a06da57a9e6fab75870993b4d5653577417`; size 1460 bytes\n- exported object `object27275`; SHA-256 `1cd3bcddfa4cebaeba570316c23a0248dfb1dd90898bca8e1bf01596b5beedcc`; size 1460 bytes\n- exported object `object21299`; SHA-256 `1d16bd195b28177d0030375134b90eab863a25458c56d05c7e72ecfcda8ddfb8`; size 1460 bytes\n- exported object `object14756`; SHA-256 `1d21900f027764a25c787c4e444214277ab36e2074037e5d5a8ce6f0efbb004e`; size 1460 bytes\n- exported object `object11261`; SHA-256 `1d71eef40b1c844cb461ecc7197ed8eef6bc582ba1e5dc287c3bf5fc15e1b4af`; size 1460 bytes\n- exported object `object17680`; SHA-256 `1db156538dd79f08b09c654f86b8f6d481d588fa44cc51f02c4e42fdcdca7913`; size 1460 bytes\n- exported object `object8253`; SHA-256 `1de41672c3a500d7321663f486920a8fb5f29e8801f92be3e1aa60cb78bddbf7`; size 1460 bytes\n- exported object `object10548`; SHA-256 `1f0fd84ce2a8a3ae572963ae3ad0937920664b081fe79acf87fde2b13acc77be`; size 1460 bytes\n- exported object `object16737`; SHA-256 `1f68d99e75eaed0dbd08ee26e222e4a21040c56a6266f1d0d9b385730ca12fc0`; size 1460 bytes\n- exported object `object25391`; SHA-256 `1fe5730bb3502850c53ca50dc874702126977f857a47c3dbe5d1a1226afd5c08`; size 1460 bytes\n- exported object `object16725`; SHA-256 `206abeeaebf598ad3c984ba9e8b3d56d663989b35c5074ef330514b5841e1a6e`; size 1460 bytes\n- exported object `object17689`; SHA-256 `209565664129ec0b9c01867286aa093f1ca15e4ad12093aac53bc290925ae39f`; size 1460 bytes\n- exported object `object8292`; SHA-256 `211aa041d8b4ea3a643d44eb8f538f6caa0a5e0e3b63a802de3fbf0a9011a1f1`; size 1460 bytes\n- exported object `object23923`; SHA-256 `2143e3b14753fe28b4e495e57c087ef8fea10cbd644761105d607d90b9d23633`; size 1460 bytes\n- exported object `object17692`; SHA-256 `2194c3bdb83d8e73218ec1fc36977bd7566500eb0cc264750ce08248f7575543`; size 1460 bytes\n- exported object `object7549`; SHA-256 `21abcfcccf584af261252953ef89fd36141f086a365fbd9d2066ae94b3c4bd76`; size 1460 bytes\n- exported object `object23085`; SHA-256 `2251efee138848fe36171baae0d12828489e0bcc3b063bc509e2724cf671c01f`; size 1460 bytes\n- exported object `object11399`; SHA-256 `2269981a9b387528f38aaa58c273b3a203ba1ce1e4ab7d369210e411cedaef46`; size 1460 bytes\n- exported object `object24672`; SHA-256 `22704106a20c5a5a5f4c78a113092eade0f683945a2496a9a0d5bc69c52bd814`; size 1460 bytes\n- exported object `object16263`; SHA-256 `2321ba015f0e7a3d74e190c407ecc25f0b772956eb0645036818a324965264ee`; size 1460 bytes\n- exported object `object25375`; SHA-256 `2330b96b60d76e24f5bfcc6d9a4e415cb57d4a8c18d95d50566701d112ab2ca9`; size 1460 bytes\n- exported object `object24844`; SHA-256 `23f00aaf4245b4855825f38da30d464bef3c6f81eea7235c99fc7bd5d6b726a3`; size 1460 bytes\n- exported object `object17105`; SHA-256 `23f6e432c83a9a3dcb731391e864afb6129df0a7eedda745e7cc51baf1ea1ad2`; size 1460 bytes\n- exported object `object11458`; SHA-256 `248430bf42f12f2b4e703bb156543d496f2890ad08148d590f93348830c1ad52`; size 1460 bytes\n- exported object `object21888`; SHA-256 `24ec4098e828c89dfb5810b1e4df67cd3e8987e672b16a393e1045ba3ded185e`; size 1460 bytes\n- exported object `object10704`; SHA-256 `24feb82784833ef28e43907591d6823fb703d92e6a3960435bea7934a35f15e1`; size 1460 bytes\n- exported object `object11569`; SHA-256 `253dd1918125d171a4877950898de2ca26060c40b1d05c8fe31cc9fb56776472`; size 1460 bytes\n- exported object `object11545`; SHA-256 `25911c516fcaaded9ea55ede4e30828fe8e21e9a895f5e8948034e9621343854`; size 1460 bytes\n- exported object `object22695`; SHA-256 `263bc7831746b36b6903d8f193117e6f1e777b2e8765086740b8c0b2af19630e`; size 1460 bytes\n- exported object `object12127`; SHA-256 `26d630a69965af7110e23e7d89e870aa432f466b8e25d825ba90a1d615b74765`; size 1460 bytes\n- exported object `object10927`; SHA-256 `2741234de895bed810734f6b55872a58fc208957ab25ecea14b7aed45f7c5726`; size 1460 bytes\n- exported object `object21048`; SHA-256 `274e7318a4440240d24701135a3a037ffc4064ab6e18b7683968d7ad7557823c`; size 1460 bytes\n- exported object `object10936`; SHA-256 `2756bae8f350efe025c1a19b8c04b741660f265fa60d9accbdcee7575d65a301`; size 1460 bytes\n- exported object `object23410`; SHA-256 `276fdf588903250404f05a86da40c2e5c26360c7dd2cfce409d8eaf30640e1e6`; size 1460 bytes\n- exported object `object9386`; SHA-256 `28204d9f1d7b8c17b7cd049bf7f32b5dc41e538ad9c17d884c1e06eab2d8dd39`; size 1460 bytes\n- exported object `object17777`; SHA-256 `28c04e7c2529f941c2276321566ed73a1cd75404e1b419a0ed1afe2ef1e4bb5c`; size 1460 bytes\n- exported object `object11451`; SHA-256 `29804a73896b8364000f4c23c69de02f4b4305e30f21c39a39097ac982863ee8`; size 1460 bytes\n- exported object `object23095`; SHA-256 `29a06c4b40fada661ba0e4f26673529c42d9bd1fffb629bfed06cdea351634ae`; size 1460 bytes\n- exported object `object22946`; SHA-256 `29b84a0556ab8203d2e5fde7529491a0253e9586cf9506583cf50acf715f08cc`; size 1460 bytes\n- exported object `object26524`; SHA-256 `29bce0e3976c1a4b0c5a3dedaf4c1df15560fed60eefc170b4e8f1bfd72e881e`; size 1460 bytes\n- exported object `object17748`; SHA-256 `2a223bc66bee6f01307afacca8cd03c762c109e39095bf5329d7d70920cdf601`; size 1460 bytes\n- exported object `object18886`; SHA-256 `2b785b0137066ea6c9bcb8baa757e5633539962796080eeb05ccd3d775f40845`; size 1460 bytes\n- exported object `object11115`; SHA-256 `2b79250e166209b04e6221f70295861958a9388503c781ddd638cc3864843f5a`; size 1460 bytes\n- exported object `object17615`; SHA-256 `2b999f47b936dc400728793101b43657b4e9410a7267fb92cd15fac90fd2a482`; size 1460 bytes\n- exported object `object7437`; SHA-256 `2ba817fc45bb0dec23acca80833f3e7d19a99b3fc71f3e2fa673ef4c38cf533c`; size 1460 bytes\n- exported object `object12132`; SHA-256 `2c1b8be8a085bd2d29dc9c0fdc032117a77193dad38602390554138f7cdfe4cf`; size 1460 bytes\n- exported object `object22156`; SHA-256 `2cc04e0598d2938235c3ef5eeca39c65285f0dcb3149c70fc0a7362a4ea3f490`; size 1460 bytes\n- exported object `object17468`; SHA-256 `2d3a83cf33a1a7bbe0b8d0d003e520924b0aa95732828cc17290fb9d461ab96b`; size 1460 bytes\n- exported object `object11999`; SHA-256 `2d4829a665a6465d8a67a009389b86e8068c01ce3d094f0459de4ed5f4ef2199`; size 1460 bytes\n- exported object `object16315`; SHA-256 `2d4c01d66de1641649052c860fd1a8788f5193f3db96487f4f2d6d82a35d6d07`; size 1460 bytes\n- exported object `object24106`; SHA-256 `2de61824c9fdc4a84764dee59289619829a98149225fc246989abf4dfcd5913a`; size 1460 bytes\n- exported object `object11971`; SHA-256 `2df0449ed47af8473f3b17afa4cdffb3ed4b11a0df006bc7b090fe4f4f74b59f`; size 1460 bytes\n- exported object `object16563`; SHA-256 `2e24ef287ea02c7f4c4cc2826389e7b69d3d559d35adbcbdc9b3d7437bd772f5`; size 1460 bytes\n- exported object `object17774`; SHA-256 `2e3c4533bd6dbe6301f70359c32ff7b03f3c6599208e18fec224196b77ae633d`; size 1460 bytes\n- exported object `object21024`; SHA-256 `2ef86698bfc9c4ce9dacd4733967d03b4b58e2130c0905f1ae479e689c767234`; size 1460 bytes\n- exported object `object22062`; SHA-256 `2f41a6bbfe2c57b767df989d53cad14278bcaa7b0fe886f8c6b1e7f0cab3c019`; size 1460 bytes\n- exported object `object11479`; SHA-256 `2f6d5d053ebbfcb3abd90f94bc862175c2782dd5cc60fb9dbb82a2fe9e8ebaf2`; size 1460 bytes\n- exported object `object21961`; SHA-256 `311456b3d2193c6a82531c7338dba44beae1363a17ecfcaee9ead85549f3f666`; size 1460 bytes\n- exported object `object23442`; SHA-256 `311b06d1311f38632a53291a497a27877e1d9bed83ed7d344fb3110938ceb1fa`; size 1460 bytes\n- exported object `object12055`; SHA-256 `313ac03b87cec74ab7068a0c183daed376e45377fa754059eb752e64fa5c5186`; size 1460 bytes\n- exported object `object22064`; SHA-256 `31b2c11ae258a1e49a65bfc346e74b260221370dcd5ccf9f3761399de9f71b3d`; size 1460 bytes\n- exported object `object17181`; SHA-256 `31f63b033376b7488674789fd49cd0698a60403347bc2168cd5de0a8491349b7`; size 1460 bytes\n- exported object `object8754`; SHA-256 `327eb44a247ac6e38b3d02b76dcdbdaf66a7c7064bf4f3c9fdfd4484a80452ce`; size 1460 bytes\n- exported object `object26365`; SHA-256 `32c47cc6b8a9063141d7559f8c0a4c356571b38bba3864d454029bd2c2f0ffde`; size 1460 bytes\n- exported object `object9380`; SHA-256 `33421c7d3bc5bae96cfb722a18967bcbbe8ff21e863a802150fe5fbbbdd04ca6`; size 1460 bytes\n- exported object `object17514`; SHA-256 `336b14c1f82c04eb8bfd490b73dade0d1a084108f5f43af7d1ab5a5de7e3ccff`; size 1460 bytes\n- exported object `object16485`; SHA-256 `3376656a1065f217ece24cf4039aaba336fe35a6c6e29be159fb03cb712ef62d`; size 1460 bytes\n- exported object `object22208`; SHA-256 `3443f2dc0c7b74b068d09f28b4ad0e322d341983f4c57893f2eda38427dbd65e`; size 1460 bytes\n- exported object `object11525`; SHA-256 `347c0bc98abf0e16e86f72cc7058b8290880c7e089d83d19cbf80aa295e142e6`; size 1460 bytes\n- exported object `object25421`; SHA-256 `352dd136c9810049178064b46cfeb6149a21cf74198d62455be96509ec710262`; size 1460 bytes\n- exported object `object16734`; SHA-256 `35714a390651048138a4be4ddeaceb8234628ae85b8f508f3ef4879adcabacb2`; size 1460 bytes\n- exported object `object16216`; SHA-256 `384b409d1a3538287c7be92f275d5388cd10d404aac05286d0031e384d110558`; size 1460 bytes\n- exported object `object21421`; SHA-256 `38dbf8fe6f99d95e30c7264d7e6bc83d61d675636a461affdc7dedb3bc96439f`; size 1460 bytes\n- exported object `object23852`; SHA-256 `3916a0813dfb36961722d081fe5a4835a4e8ccf57258402b6417700b70e71966`; size 1460 bytes\n- exported object `object16789`; SHA-256 `3a200099bd79b734329a90776df195da10460140051847e25e839069912dcf1c`; size 1460 bytes\n- exported object `object16322`; SHA-256 `3b163eb96641057909fb4f1a4fd2d42771dcf7c8961a4e9d1862e681037afe86`; size 1460 bytes\n- exported object `object22152`; SHA-256 `3b967843e46088c05b6f3563768f1046ff9b2a132740ba90c9cb9657632f443a`; size 1460 bytes\n- exported object `object17273`; SHA-256 `3ba62e70a1c2b45133051bf258188a375751d777542eba48cdb7c6e219d4d052`; size 1460 bytes\n- exported object `object17421`; SHA-256 `3c235f28b3544e94b6cb9b106fbed857e46407f2edaeab306ec9f044dc1561c6`; size 1460 bytes\n- exported object `object22858`; SHA-256 `3c24ca5e6fc65f64bc89254b7b65a57ce91d2f94a0669264d29cff8b7bee1a6d`; size 1460 bytes\n- exported object `object11547`; SHA-256 `3c3fc27182b240f7ef25684b89055f2fb6104216d204c2858ff2f4cc5c5aad73`; size 1460 bytes\n- exported object `object23850`; SHA-256 `3c6209fdc3f7b8ab8749023d1c5fd58ac6fcc0cca7f25bedff908e9cb0c32aa5`; size 1460 bytes\n- exported object `object17435`; SHA-256 `3cbf196455ce3dc4596ef48d543346ba6019cee0ec3037214ec0e53a023d33db`; size 1460 bytes\n- exported object `object8057`; SHA-256 `3cc8277d0766bef38be25da17bc2a547529710bf31e228cdf62b0dac9e218801`; size 1460 bytes\n- exported object `object9465`; SHA-256 `3d44c0dfce89c86e116520de3075683d7d7d829e5f450632a37ecccbafda0bdc`; size 1460 bytes\n- exported object `object28195`; SHA-256 `3dc4423e315cbeb8e53913228588374f6b5e95c702acd32a1663d0175d92edd0`; size 1460 bytes\n- exported object `object25402`; SHA-256 `3edd8e1011fa1e97cdc6dc3d2985ec4ff531fb3ae3c674053341df220b2e4590`; size 1460 bytes\n- exported object `object7902`; SHA-256 `3ee2866b868219e05cb89be1f203e90124621837871344428e9c0b2b73a53500`; size 1460 bytes\n- exported object `object24486`; SHA-256 `3fa3195a19af437b9c8356765972bb2af3ababa3bb5563fda1770a04b8e0d958`; size 1460 bytes\n- exported object `object24104`; SHA-256 `3fb33da40450b7b4c991439b671829118e433f2b30e6a9aa69b9d4e3e21ffd17`; size 1460 bytes\n- exported object `object17228`; SHA-256 `3ff8a8023e97907778f39cd4ce45bc69e65f719162ae3a0618a8db425416fd78`; size 1460 bytes\n- exported object `object18660`; SHA-256 `40487f3ccba51bd4740d8e296129781a2d40293fcff0e8688c6b9c47b48a3e64`; size 1460 bytes\n- exported object `object16647`; SHA-256 `415401907436fd5ce187fdaf01b06dd9c25620971a900cd48d396af77ca1cc16`; size 1460 bytes\n- exported object `object17114`; SHA-256 `4226968bc416ca4299ceed0b41b92a0bd28ba32dd6964c95919eed35001769ac`; size 1460 bytes\n- exported object `object24858`; SHA-256 `42a8a1c74a9fcf27a35963517aae581973e0f89b65bef4cf7bc8bf835364ade1`; size 1460 bytes\n- exported object `object10748`; SHA-256 `42b7c8ac10d317ebce9ddcac972286ca8f3cea590d578ae5dc853ceecc946c2a`; size 1460 bytes\n- exported object `object6726`; SHA-256 `42bb95c4eb86938a55171e950d23e21b10d70ea15943c2432a6afb5f4ef163a5`; size 1460 bytes\n- exported object `object16237`; SHA-256 `435c771adb307c3456f296da31f2000676759f1481c2484c7ec38751fb153b10`; size 1460 bytes\n- exported object `object17792`; SHA-256 `4385a17fa2ce6c83c6079bb0593482b48df5bc4b5bd15f913225d7076d5574f8`; size 1460 bytes\n- exported object `object21854`; SHA-256 `43e5e8f4682cf04c0a879423e15449b67785926aaf6bb3752d2c019ebf06e6e3`; size 1460 bytes\n- exported object `object21420`; SHA-256 `43fc9856c71f37798d1793f95080fdcbd6925cddc9427b68237453a4f7a6801e`; size 1460 bytes\n- exported object `object17350`; SHA-256 `445bca5a135f9179c266dcff83841f82fd4637a22ccc7ae656e4e41e20fc9d16`; size 1460 bytes\n- exported object `object22139`; SHA-256 `45100f25534e7567b0d6894478c2fcf74a259d0e1938d6ef1c3e152bedbc9275`; size 1460 bytes\n- exported object `object28025`; SHA-256 `4555fab8ca58e6531304dbf84796b86c0a8aeb95708120c29191f52d26c4ae7a`; size 1460 bytes\n- exported object `object23825`; SHA-256 `458cf2b38545678d1498b3421a870e90f30d351db27e24179a6763846ff23d19`; size 1460 bytes\n- exported object `object9345`; SHA-256 `45974b10e99ee53cbd42b5c87ecd4f1b95d7d0e55deec332973245d450df28ee`; size 1460 bytes\n- exported object `object26211`; SHA-256 `45cc01eea937401159bab02926bc7c8fa12b6abd5edbe27e84662ee6fe2f4a78`; size 1460 bytes\n- exported object `object23401`; SHA-256 `46e2824454f8e01957f504c3ea01016f6e4e555e313cae11814c23931a7d3694`; size 1460 bytes\n- exported object `object16839`; SHA-256 `46f4a99d212ea9ee939197ff520853f8ce77a42cb3d927ff8e30b083e481c995`; size 1460 bytes\n- exported object `object16250`; SHA-256 `470265729c00e3bcbda9f914676782eb091be09a456a33e3fedc7baf31a4016c`; size 1460 bytes\n- exported object `object18776`; SHA-256 `470566239f44e73efaee1810cec3843e5febe44fd291bfbede8addc4f3c446be`; size 1460 bytes\n- exported object `object22920`; SHA-256 `4827626c1838692796d0f167b74b839d36668d4dff4858f71ac7a9cb71816a9d`; size 1460 bytes\n- exported object `object16690`; SHA-256 `483e04ca9f7fb302c5dd99db40bb808a64c04248218362a86d73a96f4354ab1b`; size 1460 bytes\n- exported object `object11785`; SHA-256 `48bd20a01954fbab1004775b2dab614c0263b425e5c2ddaa634a7172a03f1bad`; size 1460 bytes\n- exported object `object23431`; SHA-256 `48c2f29bc316db8422e221b3fd10dc1560eda97df6d5f465f6e1a077f92a527d`; size 1460 bytes\n- exported object `object16731`; SHA-256 `48e600b7724a48ec70eba63611a2d56b390a0c3a6879946b25e604f573abf59f`; size 1460 bytes\n- exported object `object16531`; SHA-256 `493f648828927027e221562702d50127b5666dec98de5c51008f342bdb3f6102`; size 1460 bytes\n- exported object `object13914`; SHA-256 `496dff3fb8bc99c8d9b06d06831c28e36fa4c23090034654ccb35d3c8ed91581`; size 1460 bytes\n- exported object `object4765`; SHA-256 `49e4663867cb56cd43920fb62bd661c360fdbbba47a4192105c6e5131138b1a0`; size 1460 bytes\n- exported object `object22686`; SHA-256 `4bad85e1a0939636cd9279ff7e57378973d6871337d78d1d8b133694656a3e20`; size 1460 bytes\n- exported object `object16621`; SHA-256 `4bc2d63ee2dd6106fb98a65debb9630a485b2c3d1cec7ae9e79b604307583dc2`; size 1460 bytes\n- exported object `object24139`; SHA-256 `4bdf2e59647db894d51afb06855b310b1ee57c2ddc04a411002681d0dc3d7f10`; size 1460 bytes\n- exported object `object23658`; SHA-256 `4c5231a06021c2fa48a0a9d5e98b3d703a0cfa9dc99257d89146ea79712f6df9`; size 1460 bytes\n- exported object `object7871`; SHA-256 `4cea0c8974225cb7875e6c44d41fb0138d0ce2b92bde96161c3569ff5730c07a`; size 1460 bytes\n- exported object `object16511`; SHA-256 `4cebf9ed49197981b171430848037b9115e2d361f5d33fefe4ae85912ff69772`; size 1460 bytes\n- exported object `object8843`; SHA-256 `4d2d2217e048300dd1f29754b980ed31c578404e59bc93078be9b5c38f22ea08`; size 1460 bytes\n- exported object `object16736`; SHA-256 `4d9180d2c2d43c67c8347589226fa9cae45fb9a94d35c04ad732e7187bd05ff5`; size 1460 bytes\n- exported object `object21843`; SHA-256 `4de5765591e01487bc7f0e2d135b3a3158603eda8c6016aa8576a7ea2ad7dbfd`; size 1460 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `27cd896e9110b1fda7f2da6c5f4df9153ce2ef635709a10b488145ec018823aa`; recorded 2026-09-19T12:09:25.907745+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":2994,\"observable_limit\":5000,\"observables_checked\":2994,\"observables_total\":2994,\"prior_case_limit_reached\":false,\"prior_cases_checked\":11,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 24 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 36 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 28 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 43 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 29 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 44 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":2136,\"complete\":true,\"detailed_objects\":500,\"exported_objects\":2638,\"hashed_bytes\":4922527,\"hashed_objects\":2638,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2636,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2636}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 57/57, identities 14/14, observables 500/2994, artifacts 200/500. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 30023 packets across 143 IP endpoints and 809 transport flows. Observed 499 DNS events, 43 HTTP requests, 111 TLS ClientHello events, and 500 exported HTTP object(s). Deterministic rules produced 57 finding(s): 0 high, 39 medium, and 18 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "observables": [
        {
          "type": "domain",
          "value": "a-0010.a-msedge.net",
          "confidence": 1,
          "description": "dns-cname; frame 29197 / UDP stream 280"
        },
        {
          "type": "domain",
          "value": "a-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3078 / UDP stream 129, frame 3118 / UDP stream 129, frame 3226 / TCP stream 157"
        },
        {
          "type": "domain",
          "value": "ajaxmatters.com",
          "confidence": 1,
          "description": "dns-cname; frame 3991 / UDP stream 144"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1560 / UDP stream 74, frame 1561 / UDP stream 74, frame 2995 / UDP stream 117, frame 2996 / UDP stream 117, frame 1565 / TCP stream 79 +1 more"
        },
        {
          "type": "domain",
          "value": "autodiscover.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 3943 / UDP stream 142, frame 3944 / UDP stream 142"
        },
        {
          "type": "domain",
          "value": "awridahmed.com",
          "confidence": 1,
          "description": "dns-cname; frame 14386 / UDP stream 201"
        },
        {
          "type": "domain",
          "value": "b-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3072 / UDP stream 128, frame 3111 / UDP stream 128, frame 3191 / TCP stream 156"
        },
        {
          "type": "domain",
          "value": "c-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3056 / UDP stream 127, frame 3092 / UDP stream 127, frame 3181 / TCP stream 155"
        },
        {
          "type": "domain",
          "value": "checkappexec.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1879 / UDP stream 79, frame 1880 / UDP stream 79, frame 3448 / UDP stream 134, frame 3449 / UDP stream 134, frame 1884 / TCP stream 93 +1 more"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5118 / UDP stream 152, frame 5119 / UDP stream 152, frame 10430 / UDP stream 160, frame 10431 / UDP stream 160, frame 5128 / TCP stream 200 +1 more"
        },
        {
          "type": "domain",
          "value": "ctldl.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 14575 / UDP stream 208, frame 14576 / UDP stream 208, frame 14577 / UDP stream 208, frame 20920 / UDP stream 261, frame 20921 / UDP stream 261 +4 more"
        },
        {
          "type": "domain",
          "value": "dalgahavuzu.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5086 / UDP stream 151, frame 5087 / UDP stream 151, frame 5091 / TCP stream 199"
        },
        {
          "type": "domain",
          "value": "desktop-kpq9fdb.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 17894 / UDP stream 225, frame 17895 / UDP stream 225, frame 20392 / UDP stream 247, frame 20393 / UDP stream 247"
        },
        {
          "type": "domain",
          "value": "desktop-vd151o7.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 410 / UDP stream 24, frame 411 / UDP stream 24, frame 16105 / UDP stream 214, frame 16106 / UDP stream 214, frame 16109 / UDP stream 216 +5 more"
        },
        {
          "type": "domain",
          "value": "desktop-w5tftqy.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 1169 / UDP stream 61, frame 1170 / UDP stream 61, frame 16950 / UDP stream 221, frame 16951 / UDP stream 221, frame 20184 / UDP stream 242 +1 more"
        },
        {
          "type": "domain",
          "value": "dns.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 581 / UDP stream 44, frame 584 / UDP stream 44, frame 1968 / UDP stream 92, frame 1969 / UDP stream 92, frame 14316 / UDP stream 199 +5 more"
        },
        {
          "type": "domain",
          "value": "ecs.office.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 9158 / UDP stream 156, frame 9160 / UDP stream 156, frame 12155 / UDP stream 173, frame 12156 / UDP stream 173, frame 14070 / UDP stream 194 +7 more"
        },
        {
          "type": "domain",
          "value": "ext-cust.squarespace.com",
          "confidence": 1,
          "description": "dns-cname; frame 11282 / UDP stream 170"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 13230 / UDP stream 187, frame 13231 / UDP stream 187, frame 14220 / UDP stream 197, frame 14221 / UDP stream 197, frame 13235 / TCP stream 269 +1 more"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.msft.com.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 13231 / UDP stream 187, frame 14221 / UDP stream 197"
        },
        {
          "type": "domain",
          "value": "fe3cr.delivery.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 13357 / UDP stream 189, frame 13376 / UDP stream 189, frame 14377 / UDP stream 200, frame 14378 / UDP stream 200, frame 14379 / UDP stream 200 +2 more"
        },
        {
          "type": "domain",
          "value": "fp-afd-nocache.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3033 / UDP stream 120, frame 3052 / UDP stream 120, frame 3103 / TCP stream 149"
        },
        {
          "type": "domain",
          "value": "fp-afd.azureedge.us",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3037 / UDP stream 122, frame 3057 / UDP stream 122, frame 3101 / TCP stream 151"
        },
        {
          "type": "domain",
          "value": "fp-afd.azurefd.us",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3030 / UDP stream 119, frame 3045 / UDP stream 119, frame 3075 / TCP stream 148"
        },
        {
          "type": "domain",
          "value": "fp-as-nocache.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3038 / UDP stream 123, frame 3058 / UDP stream 123, frame 3119 / TCP stream 152"
        },
        {
          "type": "domain",
          "value": "fp-as.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3079 / UDP stream 130, frame 3135 / UDP stream 130, frame 3239 / TCP stream 158"
        },
        {
          "type": "domain",
          "value": "fp-vp.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3034 / UDP stream 121, frame 3035 / UDP stream 121, frame 3049 / TCP stream 147"
        },
        {
          "type": "domain",
          "value": "fs.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20615 / UDP stream 254, frame 20616 / UDP stream 254, frame 20617 / UDP stream 254, frame 20621 / TCP stream 353, frame 20640 / TCP stream 354 +1 more"
        },
        {
          "type": "domain",
          "value": "gator4020.hostgator.com",
          "confidence": 1,
          "description": "dns-query; frame 29506 / UDP stream 294, frame 29532 / UDP stream 294, frame 29540 / UDP stream 294"
        },
        {
          "type": "domain",
          "value": "ghs.googlehosted.com",
          "confidence": 1,
          "description": "dns-cname; frame 11086 / UDP stream 169, frame 13019 / UDP stream 175"
        },
        {
          "type": "domain",
          "value": "globalsovereignbank.com",
          "confidence": 1,
          "description": "dns-cname; frame 13181 / UDP stream 186"
        },
        {
          "type": "domain",
          "value": "imap.123-reg.co.uk",
          "confidence": 1,
          "description": "dns-query; frame 29175 / UDP stream 277, frame 29195 / UDP stream 277"
        },
        {
          "type": "domain",
          "value": "imap.aol.com",
          "confidence": 1,
          "description": "dns-query; frame 29172 / UDP stream 274, frame 29188 / UDP stream 274"
        },
        {
          "type": "domain",
          "value": "imap.gmail.com",
          "confidence": 1,
          "description": "dns-query; frame 29502 / UDP stream 290, frame 29521 / UDP stream 290"
        },
        {
          "type": "domain",
          "value": "imap.ionos.mx",
          "confidence": 1,
          "description": "dns-query; frame 29174 / UDP stream 276, frame 29196 / UDP stream 276"
        },
        {
          "type": "domain",
          "value": "imap.secureserver.net",
          "confidence": 1,
          "description": "dns-query; frame 29185 / UDP stream 287, frame 29189 / UDP stream 287"
        },
        {
          "type": "domain",
          "value": "internal-aol.imap.mail.g03.yahoodns.net",
          "confidence": 1,
          "description": "dns-cname; frame 29188 / UDP stream 274"
        },
        {
          "type": "domain",
          "value": "ipv6.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 385 / UDP stream 22, frame 386 / UDP stream 22"
        },
        {
          "type": "domain",
          "value": "isatap.localdomain",
          "confidence": 1,
          "description": "dns-query; frame 89 / UDP stream 10, frame 90 / UDP stream 10, frame 418 / UDP stream 27, frame 419 / UDP stream 27"
        },
        {
          "type": "domain",
          "value": "isatap.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 87 / UDP stream 9, frame 88 / UDP stream 9, frame 416 / UDP stream 26, frame 417 / UDP stream 26"
        },
        {
          "type": "domain",
          "value": "login.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 20780 / UDP stream 259, frame 20781 / UDP stream 259, frame 20782 / UDP stream 259, frame 20787 / TCP stream 356"
        },
        {
          "type": "domain",
          "value": "login.microsoftonline.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3578 / UDP stream 137, frame 3649 / UDP stream 137, frame 3650 / UDP stream 137, frame 3651 / UDP stream 137, frame 3904 / UDP stream 140 +15 more"
        },
        {
          "type": "domain",
          "value": "mail.alienergy.com.pk",
          "confidence": 1,
          "description": "dns-query; frame 29510 / UDP stream 297, frame 29529 / UDP stream 297, frame 29545 / UDP stream 297"
        },
        {
          "type": "domain",
          "value": "mail.gmail.com",
          "confidence": 1,
          "description": "dns-query; frame 29505 / UDP stream 293, frame 29514 / UDP stream 293"
        },
        {
          "type": "domain",
          "value": "mail.idn-ltd.com",
          "confidence": 1,
          "description": "dns-query; frame 29183 / UDP stream 285, frame 29206 / UDP stream 285, frame 29210 / UDP stream 285"
        },
        {
          "type": "domain",
          "value": "mail.ionos.com",
          "confidence": 1,
          "description": "dns-query; frame 29512 / UDP stream 299, frame 29525 / UDP stream 299, frame 29538 / UDP stream 299"
        },
        {
          "type": "domain",
          "value": "mail.mail.com",
          "confidence": 1,
          "description": "dns-query; frame 29511 / UDP stream 298, frame 29526 / UDP stream 298, frame 29753 / UDP stream 298"
        },
        {
          "type": "domain",
          "value": "mail.mail.yahoo.com",
          "confidence": 1,
          "description": "dns-query; frame 29179 / UDP stream 281, frame 29190 / UDP stream 281"
        },
        {
          "type": "domain",
          "value": "mail.mitsuwagroup.co.jp",
          "confidence": 1,
          "description": "dns-query; frame 29501 / UDP stream 289, frame 29528 / UDP stream 289, frame 29567 / UDP stream 289"
        },
        {
          "type": "domain",
          "value": "mail.proteinchile.cl",
          "confidence": 1,
          "description": "dns-query; frame 29173 / UDP stream 275, frame 29205 / UDP stream 275, frame 29226 / UDP stream 275"
        },
        {
          "type": "domain",
          "value": "mail.sapporo-kiden.co.jp",
          "confidence": 1,
          "description": "dns-query; frame 29504 / UDP stream 292, frame 29533 / UDP stream 292, frame 29606 / UDP stream 292"
        },
        {
          "type": "domain",
          "value": "mail.zoho.com",
          "confidence": 1,
          "description": "dns-query; frame 29176 / UDP stream 278, frame 29186 / UDP stream 278"
        },
        {
          "type": "domain",
          "value": "mitsuwagroup.co.jp",
          "confidence": 1,
          "description": "dns-cname; frame 29567 / UDP stream 289"
        },
        {
          "type": "domain",
          "value": "nexusrules.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5016 / UDP stream 150, frame 5017 / UDP stream 150, frame 12154 / UDP stream 172, frame 12158 / UDP stream 172, frame 14068 / UDP stream 193 +15 more"
        },
        {
          "type": "domain",
          "value": "odc.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3813 / UDP stream 139, frame 3814 / UDP stream 139, frame 3818 / TCP stream 174"
        },
        {
          "type": "domain",
          "value": "ow1.res.office365.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3042 / UDP stream 125, frame 3068 / UDP stream 125, frame 3112 / TCP stream 153"
        },
        {
          "type": "domain",
          "value": "parkingpage.namecheap.com",
          "confidence": 1,
          "description": "dns-cname; frame 11032 / UDP stream 167, frame 13094 / UDP stream 181"
        },
        {
          "type": "domain",
          "value": "pop.km-plan.co.jp",
          "confidence": 1,
          "description": "dns-query; frame 29509 / UDP stream 296, frame 29530 / UDP stream 296, frame 29562 / UDP stream 296"
        },
        {
          "type": "domain",
          "value": "privilegetroissecurity.com",
          "confidence": 1,
          "description": "dns-cname; frame 11002 / UDP stream 165"
        },
        {
          "type": "domain",
          "value": "prod.nexusrules.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 5017 / UDP stream 150, frame 12158 / UDP stream 172, frame 14069 / UDP stream 193, frame 15273 / UDP stream 211, frame 18962 / UDP stream 233 +1 more"
        },
        {
          "type": "domain",
          "value": "proteinchile.cl",
          "confidence": 1,
          "description": "dns-cname; frame 29226 / UDP stream 275"
        },
        {
          "type": "domain",
          "value": "pti.store.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5125 / UDP stream 153, frame 5130 / UDP stream 153, frame 10433 / UDP stream 161, frame 10438 / UDP stream 161, frame 5160 / TCP stream 201 +1 more"
        },
        {
          "type": "domain",
          "value": "riskprotek.com",
          "confidence": 1,
          "description": "dns-cname; frame 13070 / UDP stream 180"
        },
        {
          "type": "domain",
          "value": "s-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3039 / UDP stream 124, frame 3054 / UDP stream 124, frame 3099 / TCP stream 150"
        },
        {
          "type": "domain",
          "value": "self.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1284 / UDP stream 68, frame 1286 / UDP stream 68, frame 2714 / UDP stream 111, frame 2715 / UDP stream 111, frame 3706 / UDP stream 138 +11 more"
        },
        {
          "type": "domain",
          "value": "settings-win.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1613 / UDP stream 76, frame 1614 / UDP stream 76, frame 7737 / UDP stream 155, frame 7738 / UDP stream 155, frame 17963 / UDP stream 227 +8 more"
        },
        {
          "type": "domain",
          "value": "shops.myshopify.com",
          "confidence": 1,
          "description": "dns-cname; frame 10989 / UDP stream 164, frame 13005 / UDP stream 174"
        },
        {
          "type": "domain",
          "value": "smtp.aruba.it",
          "confidence": 1,
          "description": "dns-query; frame 29184 / UDP stream 286, frame 29207 / UDP stream 286, frame 29228 / UDP stream 286"
        },
        {
          "type": "domain",
          "value": "smtp.bstem.jp",
          "confidence": 1,
          "description": "dns-query; frame 29508 / UDP stream 295, frame 29531 / UDP stream 295, frame 29565 / UDP stream 295"
        },
        {
          "type": "domain",
          "value": "smtp.hanwa-net.co.jp",
          "confidence": 1,
          "description": "dns-query; frame 29503 / UDP stream 291, frame 29527 / UDP stream 291, frame 29572 / UDP stream 291"
        },
        {
          "type": "domain",
          "value": "smtp.live.com",
          "confidence": 1,
          "description": "dns-query; frame 29178 / UDP stream 280, frame 29197 / UDP stream 280"
        },
        {
          "type": "domain",
          "value": "smtp.mail.com",
          "confidence": 1,
          "description": "dns-query; frame 29181 / UDP stream 283, frame 29199 / UDP stream 283"
        },
        {
          "type": "domain",
          "value": "smtp.nifty.com",
          "confidence": 1,
          "description": "dns-query; frame 29180 / UDP stream 282, frame 29208 / UDP stream 282, frame 29230 / UDP stream 282"
        },
        {
          "type": "domain",
          "value": "smtp.ocn.ne.jp",
          "confidence": 1,
          "description": "dns-query; frame 29182 / UDP stream 284, frame 29209 / UDP stream 284, frame 29232 / UDP stream 284"
        },
        {
          "type": "domain",
          "value": "smtp.office365.com",
          "confidence": 1,
          "description": "dns-query; frame 29500 / UDP stream 288, frame 29522 / UDP stream 288"
        },
        {
          "type": "domain",
          "value": "smtp.secureserver.net",
          "confidence": 1,
          "description": "dns-query; frame 29177 / UDP stream 279, frame 29187 / UDP stream 279"
        },
        {
          "type": "domain",
          "value": "sunnyfileserver.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 1469 / UDP stream 72, frame 1470 / UDP stream 72, frame 1741 / UDP stream 78, frame 1742 / UDP stream 78, frame 2901 / UDP stream 113 +1 more"
        },
        {
          "type": "domain",
          "value": "sunnystation-dc.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 16 / UDP stream 5, frame 17 / UDP stream 5, frame 423 / UDP stream 29, frame 424 / UDP stream 29, frame 550 / UDP stream 38 +15 more"
        },
        {
          "type": "domain",
          "value": "sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 412 / UDP stream 25, frame 413 / UDP stream 25, frame 1171 / UDP stream 62, frame 1172 / UDP stream 62, frame 1197 / UDP stream 63 +15 more"
        },
        {
          "type": "domain",
          "value": "target.clickfunnels.com",
          "confidence": 1,
          "description": "dns-cname; frame 13167 / UDP stream 185"
        },
        {
          "type": "domain",
          "value": "tring.clo.footprintdns.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3051 / UDP stream 126, frame 3091 / UDP stream 126, frame 3139 / TCP stream 154"
        },
        {
          "type": "domain",
          "value": "v10.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2586 / UDP stream 106, frame 2587 / UDP stream 106, frame 6629 / UDP stream 154, frame 6630 / UDP stream 154, frame 13276 / UDP stream 188 +15 more"
        },
        {
          "type": "domain",
          "value": "v20.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1533 / UDP stream 73, frame 1534 / UDP stream 73, frame 2964 / UDP stream 114, frame 2965 / UDP stream 114, frame 1539 / TCP stream 78 +1 more"
        },
        {
          "type": "domain",
          "value": "wns.notify.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 5119 / UDP stream 152, frame 10431 / UDP stream 160"
        },
        {
          "type": "domain",
          "value": "wpad.localdomain",
          "confidence": 1,
          "description": "dns-query; frame 371 / UDP stream 20, frame 372 / UDP stream 20, frame 558 / UDP stream 42, frame 559 / UDP stream 42, frame 1330 / UDP stream 70 +15 more"
        },
        {
          "type": "domain",
          "value": "wpad.sunnystation.com",
          "confidence": 1,
          "description": "dns-query; frame 369 / UDP stream 19, frame 370 / UDP stream 19, frame 556 / UDP stream 41, frame 557 / UDP stream 41, frame 1328 / UDP stream 69 +15 more"
        },
        {
          "type": "domain",
          "value": "www.32342240.xyz",
          "confidence": 1,
          "description": "dns-query; frame 13067 / UDP stream 179, frame 13068 / UDP stream 179"
        },
        {
          "type": "domain",
          "value": "www.ajaxmatters.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 3990 / UDP stream 144, frame 3991 / UDP stream 144, frame 3995 / TCP stream 186"
        },
        {
          "type": "domain",
          "value": "www.awridahmed.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 14381 / UDP stream 201, frame 14386 / UDP stream 201, frame 14410 / TCP stream 290"
        },
        {
          "type": "domain",
          "value": "www.ban-click.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 14564 / UDP stream 207, frame 14565 / UDP stream 207, frame 14569 / TCP stream 296"
        },
        {
          "type": "domain",
          "value": "www.barrcoplumbingsupply.com",
          "confidence": 1,
          "description": "dns-query; frame 13063 / UDP stream 178, frame 13064 / UDP stream 178"
        },
        {
          "type": "domain",
          "value": "www.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1590 / UDP stream 75, frame 1591 / UDP stream 75, frame 3029 / UDP stream 118, frame 3031 / UDP stream 118, frame 3411 / UDP stream 131 +9 more"
        },
        {
          "type": "domain",
          "value": "www.byaliciafryearson.com",
          "confidence": 1,
          "description": "dns-query; frame 10969 / UDP stream 162, frame 10970 / UDP stream 162"
        },
        {
          "type": "domain",
          "value": "www.campdiscount.info",
          "confidence": 1,
          "description": "dns-query, http-host; frame 13093 / UDP stream 181, frame 13094 / UDP stream 181, frame 13098 / TCP stream 260"
        },
        {
          "type": "domain",
          "value": "www.centroimprenta.xyz",
          "confidence": 1,
          "description": "dns-query; frame 14215 / UDP stream 196, frame 14216 / UDP stream 196, frame 14219 / UDP stream 196, frame 14267 / UDP stream 196, frame 14312 / UDP stream 196 +1 more"
        },
        {
          "type": "domain",
          "value": "www.chinadqwx.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 14186 / UDP stream 195, frame 14187 / UDP stream 195, frame 14191 / TCP stream 285"
        },
        {
          "type": "domain",
          "value": "www.czzhudi.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 13033 / UDP stream 176, frame 13034 / UDP stream 176, frame 13038 / TCP stream 257, frame 13897 / TCP stream 278"
        },
        {
          "type": "domain",
          "value": "www.db-propertygroup.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 13004 / UDP stream 174, frame 13005 / UDP stream 174, frame 13009 / TCP stream 255, frame 13874 / TCP stream 276"
        },
        {
          "type": "domain",
          "value": "www.e-scooters.frl",
          "confidence": 1,
          "description": "dns-query; frame 14494 / UDP stream 203, frame 14495 / UDP stream 203"
        },
        {
          "type": "domain",
          "value": "www.elsiepupz.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 11085 / UDP stream 169, frame 11086 / UDP stream 169, frame 11090 / TCP stream 245"
        }
      ],
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap"
      ],
      "source_sha256": "eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f",
      "semantic_sha256": "8a329890ed01eedca67808c92bdfa492463b036b435540749e5ff2e599d7deee",
      "observable_count": 2994,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "suspicious_findings": [
        {
          "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.",
          "category": "Script, archive, or executable transfer candidate",
          "evidence": "frame 3995 / TCP stream 186, frame 4675 / TCP stream 186",
          "severity": "medium"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 178 / TCP stream 8, frame 180 / TCP stream 8, frame 182 / TCP stream 8, frame 184 / TCP stream 8, frame 1710 / TCP stream 8 +3 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 100 / TCP stream 5, frame 117 / TCP stream 5, frame 120 / TCP stream 5, frame 212 / TCP stream 13, frame 229 / TCP stream 13 +36 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1785 / TCP stream 87, frame 1787 / TCP stream 87, frame 1790 / TCP stream 87, frame 1793 / TCP stream 87, frame 1795 / TCP stream 87 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 2143 / TCP stream 101, frame 2159 / TCP stream 101, frame 2162 / TCP stream 101, frame 2168 / TCP stream 101, frame 2214 / TCP stream 111 +48 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1944 / TCP stream 94, frame 2015 / TCP stream 94, frame 2018 / TCP stream 94, frame 2055 / TCP stream 102, frame 2091 / TCP stream 102 +95 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 2867 / TCP stream 95, frame 2869 / TCP stream 95, frame 2871 / TCP stream 95, frame 2873 / TCP stream 95, frame 2875 / TCP stream 95 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 746 / TCP stream 43, frame 748 / TCP stream 43, frame 750 / TCP stream 43, frame 752 / TCP stream 43, frame 784 / TCP stream 45 +48 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 577 / TCP stream 32, frame 618 / TCP stream 35, frame 673 / TCP stream 35, frame 682 / TCP stream 35, frame 684 / TCP stream 35 +93 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1424 / TCP stream 31, frame 1430 / TCP stream 31, frame 1435 / TCP stream 31, frame 1437 / TCP stream 31, frame 1439 / TCP stream 31 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 179 / TCP stream 8, frame 181 / TCP stream 8, frame 183 / TCP stream 8, frame 185 / TCP stream 8, frame 1711 / TCP stream 8 +3 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 102 / TCP stream 5, frame 119 / TCP stream 5, frame 214 / TCP stream 13, frame 231 / TCP stream 13, frame 233 / TCP stream 13 +28 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1786 / TCP stream 87, frame 1788 / TCP stream 87, frame 1792 / TCP stream 87, frame 1794 / TCP stream 87, frame 1796 / TCP stream 87 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 2147 / TCP stream 101, frame 2161 / TCP stream 101, frame 2164 / TCP stream 101, frame 2169 / TCP stream 101, frame 2215 / TCP stream 111 +48 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1946 / TCP stream 94, frame 2017 / TCP stream 94, frame 2057 / TCP stream 102, frame 2093 / TCP stream 102, frame 2099 / TCP stream 102 +78 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 2868 / TCP stream 95, frame 2870 / TCP stream 95, frame 2872 / TCP stream 95, frame 2874 / TCP stream 95, frame 2876 / TCP stream 95 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 747 / TCP stream 43, frame 749 / TCP stream 43, frame 751 / TCP stream 43, frame 753 / TCP stream 43, frame 785 / TCP stream 45 +48 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 579 / TCP stream 32, frame 620 / TCP stream 35, frame 681 / TCP stream 35, frame 683 / TCP stream 35, frame 686 / TCP stream 35 +74 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1427 / TCP stream 31, frame 1433 / TCP stream 31, frame 1436 / TCP stream 31, frame 1438 / TCP stream 31, frame 1440 / TCP stream 31 +10 more",
          "severity": "low"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 4679 / TCP stream 187",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 4802 / TCP stream 188",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 5068 / TCP stream 198",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 6688 / TCP stream 203",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 6805 / TCP stream 204",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 7688 / TCP stream 213",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 7719 / TCP stream 214",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 7792 / TCP stream 216",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 8729 / TCP stream 221",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 9146 / TCP stream 222",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 9331 / TCP stream 227",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 10803 / TCP stream 236",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 10835 / TCP stream 237",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 10946 / TCP stream 238",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 11650 / TCP stream 247",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 11743 / TCP stream 249",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 12139 / TCP stream 251",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13103 / TCP stream 261",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13119 / TCP stream 262",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13219 / TCP stream 268",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13452 / TCP stream 272",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13684 / TCP stream 274",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 14063 / TCP stream 281",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 14528 / TCP stream 293",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 14623 / TCP stream 298",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 16159 / TCP stream 306",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 17066 / TCP stream 311",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 18531 / TCP stream 324",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 18949 / TCP stream 325",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 19849 / TCP stream 329",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 20080 / TCP stream 333",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 20948 / TCP stream 367",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 21069 / TCP stream 368",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 21121 / TCP stream 369",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 21759 / TCP stream 390",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 23259 / TCP stream 411",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 23301 / TCP stream 417",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 24437 / TCP stream 469",
          "severity": "medium"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Volatile Cedar",
          "similarity": 0.2,
          "shared_count": 1,
          "group_attack_id": "G0123",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Winnti Group",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G0044",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Ajax Security Team",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G0130",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "IndigoZebra",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0136",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Nomadic Octopus",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0133",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Whitefly",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0107",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Metador",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G1013",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Elderwood",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0066",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Rancor",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0075",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Evilnum",
          "similarity": 0.0909,
          "shared_count": 1,
          "group_attack_id": "G0120",
          "shared_techniques": [
            "T1105"
          ]
        }
      ],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ttp-evidence:43bc93eb-d6db-4400-b983-b0dd404c8ca4:T1105",
      "type": "ttp-evidence",
      "label": "T1105 Ingress Tool Transfer",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "command-and-control",
      "evidence": "T1105 Ingress Tool Transfer",
      "attack_id": "T1105",
      "confidence": 0.8,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a-0010.a-msedge.net",
      "type": "ioc",
      "value": "a-0010.a-msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 29197 / UDP stream 280",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a-ring.msedge.net",
      "type": "ioc",
      "value": "a-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3078 / UDP stream 129, frame 3118 / UDP stream 129, frame 3226 / TCP stream 157",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ajaxmatters.com",
      "type": "ioc",
      "value": "ajaxmatters.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 3991 / UDP stream 144",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1560 / UDP stream 74, frame 1561 / UDP stream 74, frame 2995 / UDP stream 117, frame 2996 / UDP stream 117, frame 1565 / TCP stream 79 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:autodiscover.sunnystation.com",
      "type": "ioc",
      "value": "autodiscover.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 3943 / UDP stream 142, frame 3944 / UDP stream 142",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:awridahmed.com",
      "type": "ioc",
      "value": "awridahmed.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 14386 / UDP stream 201",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:b-ring.msedge.net",
      "type": "ioc",
      "value": "b-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3072 / UDP stream 128, frame 3111 / UDP stream 128, frame 3191 / TCP stream 156",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c-ring.msedge.net",
      "type": "ioc",
      "value": "c-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3056 / UDP stream 127, frame 3092 / UDP stream 127, frame 3181 / TCP stream 155",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:checkappexec.microsoft.com",
      "type": "ioc",
      "value": "checkappexec.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1879 / UDP stream 79, frame 1880 / UDP stream 79, frame 3448 / UDP stream 134, frame 3449 / UDP stream 134, frame 1884 / TCP stream 93 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 5118 / UDP stream 152, frame 5119 / UDP stream 152, frame 10430 / UDP stream 160, frame 10431 / UDP stream 160, frame 5128 / TCP stream 200 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ctldl.windowsupdate.com",
      "type": "ioc",
      "value": "ctldl.windowsupdate.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 14575 / UDP stream 208, frame 14576 / UDP stream 208, frame 14577 / UDP stream 208, frame 20920 / UDP stream 261, frame 20921 / UDP stream 261 +4 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dalgahavuzu.com",
      "type": "ioc",
      "value": "dalgahavuzu.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 5086 / UDP stream 151, frame 5087 / UDP stream 151, frame 5091 / TCP stream 199",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-kpq9fdb.sunnystation.com",
      "type": "ioc",
      "value": "desktop-kpq9fdb.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 17894 / UDP stream 225, frame 17895 / UDP stream 225, frame 20392 / UDP stream 247, frame 20393 / UDP stream 247",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-vd151o7.sunnystation.com",
      "type": "ioc",
      "value": "desktop-vd151o7.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 410 / UDP stream 24, frame 411 / UDP stream 24, frame 16105 / UDP stream 214, frame 16106 / UDP stream 214, frame 16109 / UDP stream 216 +5 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-w5tftqy.sunnystation.com",
      "type": "ioc",
      "value": "desktop-w5tftqy.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 1169 / UDP stream 61, frame 1170 / UDP stream 61, frame 16950 / UDP stream 221, frame 16951 / UDP stream 221, frame 20184 / UDP stream 242 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dns.msftncsi.com",
      "type": "ioc",
      "value": "dns.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 581 / UDP stream 44, frame 584 / UDP stream 44, frame 1968 / UDP stream 92, frame 1969 / UDP stream 92, frame 14316 / UDP stream 199 +5 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ecs.office.com",
      "type": "ioc",
      "value": "ecs.office.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 9158 / UDP stream 156, frame 9160 / UDP stream 156, frame 12155 / UDP stream 173, frame 12156 / UDP stream 173, frame 14070 / UDP stream 194 +7 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ext-cust.squarespace.com",
      "type": "ioc",
      "value": "ext-cust.squarespace.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 11282 / UDP stream 170",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.microsoft.com",
      "type": "ioc",
      "value": "fe2cr.update.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 13230 / UDP stream 187, frame 13231 / UDP stream 187, frame 14220 / UDP stream 197, frame 14221 / UDP stream 197, frame 13235 / TCP stream 269 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.msft.com.trafficmanager.net",
      "type": "ioc",
      "value": "fe2cr.update.msft.com.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 13231 / UDP stream 187, frame 14221 / UDP stream 197",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe3cr.delivery.mp.microsoft.com",
      "type": "ioc",
      "value": "fe3cr.delivery.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 13357 / UDP stream 189, frame 13376 / UDP stream 189, frame 14377 / UDP stream 200, frame 14378 / UDP stream 200, frame 14379 / UDP stream 200 +2 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-afd-nocache.azureedge.net",
      "type": "ioc",
      "value": "fp-afd-nocache.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3033 / UDP stream 120, frame 3052 / UDP stream 120, frame 3103 / TCP stream 149",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-afd.azureedge.us",
      "type": "ioc",
      "value": "fp-afd.azureedge.us",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3037 / UDP stream 122, frame 3057 / UDP stream 122, frame 3101 / TCP stream 151",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-afd.azurefd.us",
      "type": "ioc",
      "value": "fp-afd.azurefd.us",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3030 / UDP stream 119, frame 3045 / UDP stream 119, frame 3075 / TCP stream 148",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-as-nocache.azureedge.net",
      "type": "ioc",
      "value": "fp-as-nocache.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3038 / UDP stream 123, frame 3058 / UDP stream 123, frame 3119 / TCP stream 152",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-as.azureedge.net",
      "type": "ioc",
      "value": "fp-as.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3079 / UDP stream 130, frame 3135 / UDP stream 130, frame 3239 / TCP stream 158",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-vp.azureedge.net",
      "type": "ioc",
      "value": "fp-vp.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3034 / UDP stream 121, frame 3035 / UDP stream 121, frame 3049 / TCP stream 147",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fs.microsoft.com",
      "type": "ioc",
      "value": "fs.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 20615 / UDP stream 254, frame 20616 / UDP stream 254, frame 20617 / UDP stream 254, frame 20621 / TCP stream 353, frame 20640 / TCP stream 354 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gator4020.hostgator.com",
      "type": "ioc",
      "value": "gator4020.hostgator.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29506 / UDP stream 294, frame 29532 / UDP stream 294, frame 29540 / UDP stream 294",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ghs.googlehosted.com",
      "type": "ioc",
      "value": "ghs.googlehosted.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 11086 / UDP stream 169, frame 13019 / UDP stream 175",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:globalsovereignbank.com",
      "type": "ioc",
      "value": "globalsovereignbank.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 13181 / UDP stream 186",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.123-reg.co.uk",
      "type": "ioc",
      "value": "imap.123-reg.co.uk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29175 / UDP stream 277, frame 29195 / UDP stream 277",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.aol.com",
      "type": "ioc",
      "value": "imap.aol.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29172 / UDP stream 274, frame 29188 / UDP stream 274",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.gmail.com",
      "type": "ioc",
      "value": "imap.gmail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29502 / UDP stream 290, frame 29521 / UDP stream 290",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.ionos.mx",
      "type": "ioc",
      "value": "imap.ionos.mx",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29174 / UDP stream 276, frame 29196 / UDP stream 276",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.secureserver.net",
      "type": "ioc",
      "value": "imap.secureserver.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29185 / UDP stream 287, frame 29189 / UDP stream 287",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:internal-aol.imap.mail.g03.yahoodns.net",
      "type": "ioc",
      "value": "internal-aol.imap.mail.g03.yahoodns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 29188 / UDP stream 274",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ipv6.msftncsi.com",
      "type": "ioc",
      "value": "ipv6.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 385 / UDP stream 22, frame 386 / UDP stream 22",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:isatap.localdomain",
      "type": "ioc",
      "value": "isatap.localdomain",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 89 / UDP stream 10, frame 90 / UDP stream 10, frame 418 / UDP stream 27, frame 419 / UDP stream 27",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:isatap.sunnystation.com",
      "type": "ioc",
      "value": "isatap.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 87 / UDP stream 9, frame 88 / UDP stream 9, frame 416 / UDP stream 26, frame 417 / UDP stream 26",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.live.com",
      "type": "ioc",
      "value": "login.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 20780 / UDP stream 259, frame 20781 / UDP stream 259, frame 20782 / UDP stream 259, frame 20787 / TCP stream 356",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.microsoftonline.com",
      "type": "ioc",
      "value": "login.microsoftonline.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3578 / UDP stream 137, frame 3649 / UDP stream 137, frame 3650 / UDP stream 137, frame 3651 / UDP stream 137, frame 3904 / UDP stream 140 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.alienergy.com.pk",
      "type": "ioc",
      "value": "mail.alienergy.com.pk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29510 / UDP stream 297, frame 29529 / UDP stream 297, frame 29545 / UDP stream 297",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.gmail.com",
      "type": "ioc",
      "value": "mail.gmail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29505 / UDP stream 293, frame 29514 / UDP stream 293",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.idn-ltd.com",
      "type": "ioc",
      "value": "mail.idn-ltd.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29183 / UDP stream 285, frame 29206 / UDP stream 285, frame 29210 / UDP stream 285",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.ionos.com",
      "type": "ioc",
      "value": "mail.ionos.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29512 / UDP stream 299, frame 29525 / UDP stream 299, frame 29538 / UDP stream 299",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.mail.com",
      "type": "ioc",
      "value": "mail.mail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29511 / UDP stream 298, frame 29526 / UDP stream 298, frame 29753 / UDP stream 298",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.mail.yahoo.com",
      "type": "ioc",
      "value": "mail.mail.yahoo.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29179 / UDP stream 281, frame 29190 / UDP stream 281",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.mitsuwagroup.co.jp",
      "type": "ioc",
      "value": "mail.mitsuwagroup.co.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29501 / UDP stream 289, frame 29528 / UDP stream 289, frame 29567 / UDP stream 289",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.proteinchile.cl",
      "type": "ioc",
      "value": "mail.proteinchile.cl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29173 / UDP stream 275, frame 29205 / UDP stream 275, frame 29226 / UDP stream 275",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.sapporo-kiden.co.jp",
      "type": "ioc",
      "value": "mail.sapporo-kiden.co.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29504 / UDP stream 292, frame 29533 / UDP stream 292, frame 29606 / UDP stream 292",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.zoho.com",
      "type": "ioc",
      "value": "mail.zoho.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29176 / UDP stream 278, frame 29186 / UDP stream 278",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mitsuwagroup.co.jp",
      "type": "ioc",
      "value": "mitsuwagroup.co.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 29567 / UDP stream 289",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nexusrules.officeapps.live.com",
      "type": "ioc",
      "value": "nexusrules.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 5016 / UDP stream 150, frame 5017 / UDP stream 150, frame 12154 / UDP stream 172, frame 12158 / UDP stream 172, frame 14068 / UDP stream 193 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:odc.officeapps.live.com",
      "type": "ioc",
      "value": "odc.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3813 / UDP stream 139, frame 3814 / UDP stream 139, frame 3818 / TCP stream 174",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ow1.res.office365.com",
      "type": "ioc",
      "value": "ow1.res.office365.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3042 / UDP stream 125, frame 3068 / UDP stream 125, frame 3112 / TCP stream 153",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:parkingpage.namecheap.com",
      "type": "ioc",
      "value": "parkingpage.namecheap.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 11032 / UDP stream 167, frame 13094 / UDP stream 181",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:pop.km-plan.co.jp",
      "type": "ioc",
      "value": "pop.km-plan.co.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29509 / UDP stream 296, frame 29530 / UDP stream 296, frame 29562 / UDP stream 296",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:privilegetroissecurity.com",
      "type": "ioc",
      "value": "privilegetroissecurity.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 11002 / UDP stream 165",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod.nexusrules.live.com.akadns.net",
      "type": "ioc",
      "value": "prod.nexusrules.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 5017 / UDP stream 150, frame 12158 / UDP stream 172, frame 14069 / UDP stream 193, frame 15273 / UDP stream 211, frame 18962 / UDP stream 233 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:proteinchile.cl",
      "type": "ioc",
      "value": "proteinchile.cl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 29226 / UDP stream 275",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:pti.store.microsoft.com",
      "type": "ioc",
      "value": "pti.store.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 5125 / UDP stream 153, frame 5130 / UDP stream 153, frame 10433 / UDP stream 161, frame 10438 / UDP stream 161, frame 5160 / TCP stream 201 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:riskprotek.com",
      "type": "ioc",
      "value": "riskprotek.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 13070 / UDP stream 180",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:s-ring.msedge.net",
      "type": "ioc",
      "value": "s-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3039 / UDP stream 124, frame 3054 / UDP stream 124, frame 3099 / TCP stream 150",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:self.events.data.microsoft.com",
      "type": "ioc",
      "value": "self.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1284 / UDP stream 68, frame 1286 / UDP stream 68, frame 2714 / UDP stream 111, frame 2715 / UDP stream 111, frame 3706 / UDP stream 138 +11 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:settings-win.data.microsoft.com",
      "type": "ioc",
      "value": "settings-win.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1613 / UDP stream 76, frame 1614 / UDP stream 76, frame 7737 / UDP stream 155, frame 7738 / UDP stream 155, frame 17963 / UDP stream 227 +8 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:shops.myshopify.com",
      "type": "ioc",
      "value": "shops.myshopify.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 10989 / UDP stream 164, frame 13005 / UDP stream 174",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.aruba.it",
      "type": "ioc",
      "value": "smtp.aruba.it",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29184 / UDP stream 286, frame 29207 / UDP stream 286, frame 29228 / UDP stream 286",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.bstem.jp",
      "type": "ioc",
      "value": "smtp.bstem.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29508 / UDP stream 295, frame 29531 / UDP stream 295, frame 29565 / UDP stream 295",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.hanwa-net.co.jp",
      "type": "ioc",
      "value": "smtp.hanwa-net.co.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29503 / UDP stream 291, frame 29527 / UDP stream 291, frame 29572 / UDP stream 291",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.live.com",
      "type": "ioc",
      "value": "smtp.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29178 / UDP stream 280, frame 29197 / UDP stream 280",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.mail.com",
      "type": "ioc",
      "value": "smtp.mail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29181 / UDP stream 283, frame 29199 / UDP stream 283",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.nifty.com",
      "type": "ioc",
      "value": "smtp.nifty.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29180 / UDP stream 282, frame 29208 / UDP stream 282, frame 29230 / UDP stream 282",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.ocn.ne.jp",
      "type": "ioc",
      "value": "smtp.ocn.ne.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29182 / UDP stream 284, frame 29209 / UDP stream 284, frame 29232 / UDP stream 284",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.office365.com",
      "type": "ioc",
      "value": "smtp.office365.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29500 / UDP stream 288, frame 29522 / UDP stream 288",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:smtp.secureserver.net",
      "type": "ioc",
      "value": "smtp.secureserver.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 29177 / UDP stream 279, frame 29187 / UDP stream 279",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:sunnyfileserver.sunnystation.com",
      "type": "ioc",
      "value": "sunnyfileserver.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 1469 / UDP stream 72, frame 1470 / UDP stream 72, frame 1741 / UDP stream 78, frame 1742 / UDP stream 78, frame 2901 / UDP stream 113 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:sunnystation-dc.sunnystation.com",
      "type": "ioc",
      "value": "sunnystation-dc.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 16 / UDP stream 5, frame 17 / UDP stream 5, frame 423 / UDP stream 29, frame 424 / UDP stream 29, frame 550 / UDP stream 38 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:sunnystation.com",
      "type": "ioc",
      "value": "sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 412 / UDP stream 25, frame 413 / UDP stream 25, frame 1171 / UDP stream 62, frame 1172 / UDP stream 62, frame 1197 / UDP stream 63 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:target.clickfunnels.com",
      "type": "ioc",
      "value": "target.clickfunnels.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 13167 / UDP stream 185",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:tring.clo.footprintdns.com",
      "type": "ioc",
      "value": "tring.clo.footprintdns.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 3051 / UDP stream 126, frame 3091 / UDP stream 126, frame 3139 / TCP stream 154",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v10.events.data.microsoft.com",
      "type": "ioc",
      "value": "v10.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 2586 / UDP stream 106, frame 2587 / UDP stream 106, frame 6629 / UDP stream 154, frame 6630 / UDP stream 154, frame 13276 / UDP stream 188 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v20.events.data.microsoft.com",
      "type": "ioc",
      "value": "v20.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1533 / UDP stream 73, frame 1534 / UDP stream 73, frame 2964 / UDP stream 114, frame 2965 / UDP stream 114, frame 1539 / TCP stream 78 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wns.notify.trafficmanager.net",
      "type": "ioc",
      "value": "wns.notify.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-cname; frame 5119 / UDP stream 152, frame 10431 / UDP stream 160",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.localdomain",
      "type": "ioc",
      "value": "wpad.localdomain",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 371 / UDP stream 20, frame 372 / UDP stream 20, frame 558 / UDP stream 42, frame 559 / UDP stream 42, frame 1330 / UDP stream 70 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.sunnystation.com",
      "type": "ioc",
      "value": "wpad.sunnystation.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 369 / UDP stream 19, frame 370 / UDP stream 19, frame 556 / UDP stream 41, frame 557 / UDP stream 41, frame 1328 / UDP stream 69 +15 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.32342240.xyz",
      "type": "ioc",
      "value": "www.32342240.xyz",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 13067 / UDP stream 179, frame 13068 / UDP stream 179",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.ajaxmatters.com",
      "type": "ioc",
      "value": "www.ajaxmatters.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 3990 / UDP stream 144, frame 3991 / UDP stream 144, frame 3995 / TCP stream 186",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.awridahmed.com",
      "type": "ioc",
      "value": "www.awridahmed.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 14381 / UDP stream 201, frame 14386 / UDP stream 201, frame 14410 / TCP stream 290",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.ban-click.com",
      "type": "ioc",
      "value": "www.ban-click.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 14564 / UDP stream 207, frame 14565 / UDP stream 207, frame 14569 / TCP stream 296",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.barrcoplumbingsupply.com",
      "type": "ioc",
      "value": "www.barrcoplumbingsupply.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 13063 / UDP stream 178, frame 13064 / UDP stream 178",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.bing.com",
      "type": "ioc",
      "value": "www.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, tls-sni; frame 1590 / UDP stream 75, frame 1591 / UDP stream 75, frame 3029 / UDP stream 118, frame 3031 / UDP stream 118, frame 3411 / UDP stream 131 +9 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.byaliciafryearson.com",
      "type": "ioc",
      "value": "www.byaliciafryearson.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 10969 / UDP stream 162, frame 10970 / UDP stream 162",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.campdiscount.info",
      "type": "ioc",
      "value": "www.campdiscount.info",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 13093 / UDP stream 181, frame 13094 / UDP stream 181, frame 13098 / TCP stream 260",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.centroimprenta.xyz",
      "type": "ioc",
      "value": "www.centroimprenta.xyz",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 14215 / UDP stream 196, frame 14216 / UDP stream 196, frame 14219 / UDP stream 196, frame 14267 / UDP stream 196, frame 14312 / UDP stream 196 +1 more",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.chinadqwx.com",
      "type": "ioc",
      "value": "www.chinadqwx.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 14186 / UDP stream 195, frame 14187 / UDP stream 195, frame 14191 / TCP stream 285",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.czzhudi.com",
      "type": "ioc",
      "value": "www.czzhudi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 13033 / UDP stream 176, frame 13034 / UDP stream 176, frame 13038 / TCP stream 257, frame 13897 / TCP stream 278",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.db-propertygroup.com",
      "type": "ioc",
      "value": "www.db-propertygroup.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 13004 / UDP stream 174, frame 13005 / UDP stream 174, frame 13009 / TCP stream 255, frame 13874 / TCP stream 276",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.e-scooters.frl",
      "type": "ioc",
      "value": "www.e-scooters.frl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query; frame 14494 / UDP stream 203, frame 14495 / UDP stream 203",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.elsiepupz.com",
      "type": "ioc",
      "value": "www.elsiepupz.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "description": "dns-query, http-host; frame 11085 / UDP stream 169, frame 11086 / UDP stream 169, frame 11090 / TCP stream 245",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-c4b3ede19e037293a23e0a33",
      "type": "pcap-finding",
      "label": "Script, archive, or executable transfer candidate",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "/c7g8t/zbBYgukXYxzAF2hZc/",
        "source": "64.34.171.228",
        "destination": "172.16.0.149",
        "content_type": "application/x-msdownload",
        "response_count": 1,
        "declared_body_bytes": 593920
      },
      "rule_id": "script-or-executable-transfer",
      "severity": "medium",
      "confidence": 0.86,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 186,
          "frame_number": 3995,
          "display_filter": "frame.number == 3995",
          "timestamp_epoch": "1645640674.594654000"
        },
        {
          "tcp_stream": 186,
          "frame_number": 4675,
          "display_filter": "frame.number == 4675",
          "timestamp_epoch": "1645640675.465005000"
        }
      ]
    },
    {
      "id": "finding-89db59c8203533a965127481",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.131",
        "protocol": "drsuapi",
        "destination": "172.16.0.52",
        "event_count": 8,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 178,
          "display_filter": "frame.number == 178",
          "timestamp_epoch": "1645640546.177209000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 180,
          "display_filter": "frame.number == 180",
          "timestamp_epoch": "1645640546.181261000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 182,
          "display_filter": "frame.number == 182",
          "timestamp_epoch": "1645640546.181796000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 184,
          "display_filter": "frame.number == 184",
          "timestamp_epoch": "1645640546.182385000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1710,
          "display_filter": "frame.number == 1710",
          "timestamp_epoch": "1645640598.024384000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1712,
          "display_filter": "frame.number == 1712",
          "timestamp_epoch": "1645640598.024919000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1714,
          "display_filter": "frame.number == 1714",
          "timestamp_epoch": "1645640598.025486000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1716,
          "display_filter": "frame.number == 1716",
          "timestamp_epoch": "1645640598.026415000"
        }
      ]
    },
    {
      "id": "finding-93ee3895891a1dc59c13112d",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.131",
        "protocol": "ldap",
        "destination": "172.16.0.52",
        "event_count": 41,
        "operation_numbers": [
          "",
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 5,
          "frame_number": 100,
          "display_filter": "frame.number == 100",
          "timestamp_epoch": "1645640545.845892000"
        },
        {
          "tcp_stream": 5,
          "frame_number": 117,
          "display_filter": "frame.number == 117",
          "timestamp_epoch": "1645640545.851445000"
        },
        {
          "tcp_stream": 5,
          "frame_number": 120,
          "display_filter": "frame.number == 120",
          "timestamp_epoch": "1645640545.853874000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 212,
          "display_filter": "frame.number == 212",
          "timestamp_epoch": "1645640546.381964000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 229,
          "display_filter": "frame.number == 229",
          "timestamp_epoch": "1645640546.385376000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 232,
          "display_filter": "frame.number == 232",
          "timestamp_epoch": "1645640546.386493000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 234,
          "display_filter": "frame.number == 234",
          "timestamp_epoch": "1645640546.387036000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 250,
          "display_filter": "frame.number == 250",
          "timestamp_epoch": "1645640546.489025000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 265,
          "display_filter": "frame.number == 265",
          "timestamp_epoch": "1645640546.590145000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 274,
          "display_filter": "frame.number == 274",
          "timestamp_epoch": "1645640546.593249000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 282,
          "display_filter": "frame.number == 282",
          "timestamp_epoch": "1645640546.596482000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 285,
          "display_filter": "frame.number == 285",
          "timestamp_epoch": "1645640546.597035000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 287,
          "display_filter": "frame.number == 287",
          "timestamp_epoch": "1645640546.597566000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 297,
          "display_filter": "frame.number == 297",
          "timestamp_epoch": "1645640546.830026000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 302,
          "display_filter": "frame.number == 302",
          "timestamp_epoch": "1645640546.832061000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 317,
          "display_filter": "frame.number == 317",
          "timestamp_epoch": "1645640546.846691000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 342,
          "display_filter": "frame.number == 342",
          "timestamp_epoch": "1645640546.851778000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 349,
          "display_filter": "frame.number == 349",
          "timestamp_epoch": "1645640546.853345000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 351,
          "display_filter": "frame.number == 351",
          "timestamp_epoch": "1645640546.853795000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 353,
          "display_filter": "frame.number == 353",
          "timestamp_epoch": "1645640546.854385000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 355,
          "display_filter": "frame.number == 355",
          "timestamp_epoch": "1645640546.855962000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 359,
          "display_filter": "frame.number == 359",
          "timestamp_epoch": "1645640547.116464000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 436,
          "display_filter": "frame.number == 436",
          "timestamp_epoch": "1645640556.007691000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 441,
          "display_filter": "frame.number == 441",
          "timestamp_epoch": "1645640556.010840000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 444,
          "display_filter": "frame.number == 444",
          "timestamp_epoch": "1645640556.013550000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 446,
          "display_filter": "frame.number == 446",
          "timestamp_epoch": "1645640556.013948000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 448,
          "display_filter": "frame.number == 448",
          "timestamp_epoch": "1645640556.014384000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 450,
          "display_filter": "frame.number == 450",
          "timestamp_epoch": "1645640556.014793000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 456,
          "display_filter": "frame.number == 456",
          "timestamp_epoch": "1645640556.024673000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 459,
          "display_filter": "frame.number == 459",
          "timestamp_epoch": "1645640556.025739000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 491,
          "display_filter": "frame.number == 491",
          "timestamp_epoch": "1645640556.032159000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 493,
          "display_filter": "frame.number == 493",
          "timestamp_epoch": "1645640556.032547000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 495,
          "display_filter": "frame.number == 495",
          "timestamp_epoch": "1645640556.032847000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1826,
          "display_filter": "frame.number == 1826",
          "timestamp_epoch": "1645640598.547256000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1829,
          "display_filter": "frame.number == 1829",
          "timestamp_epoch": "1645640598.551494000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1835,
          "display_filter": "frame.number == 1835",
          "timestamp_epoch": "1645640598.556478000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1838,
          "display_filter": "frame.number == 1838",
          "timestamp_epoch": "1645640598.557877000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1840,
          "display_filter": "frame.number == 1840",
          "timestamp_epoch": "1645640598.558342000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1842,
          "display_filter": "frame.number == 1842",
          "timestamp_epoch": "1645640598.558836000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1844,
          "display_filter": "frame.number == 1844",
          "timestamp_epoch": "1645640598.560185000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1850,
          "display_filter": "frame.number == 1850",
          "timestamp_epoch": "1645640599.076955000"
        }
      ]
    },
    {
      "id": "finding-c360c1fe590855e6c67c00ac",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.131",
        "protocol": "samr",
        "destination": "172.16.0.52",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 87,
          "frame_number": 1785,
          "display_filter": "frame.number == 1785",
          "timestamp_epoch": "1645640598.091368000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1787,
          "display_filter": "frame.number == 1787",
          "timestamp_epoch": "1645640598.092111000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1790,
          "display_filter": "frame.number == 1790",
          "timestamp_epoch": "1645640598.092540000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1793,
          "display_filter": "frame.number == 1793",
          "timestamp_epoch": "1645640598.093075000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1795,
          "display_filter": "frame.number == 1795",
          "timestamp_epoch": "1645640598.093670000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1797,
          "display_filter": "frame.number == 1797",
          "timestamp_epoch": "1645640598.094127000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1799,
          "display_filter": "frame.number == 1799",
          "timestamp_epoch": "1645640598.094657000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1801,
          "display_filter": "frame.number == 1801",
          "timestamp_epoch": "1645640598.095217000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1803,
          "display_filter": "frame.number == 1803",
          "timestamp_epoch": "1645640598.095833000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1805,
          "display_filter": "frame.number == 1805",
          "timestamp_epoch": "1645640598.096460000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1807,
          "display_filter": "frame.number == 1807",
          "timestamp_epoch": "1645640598.096927000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1809,
          "display_filter": "frame.number == 1809",
          "timestamp_epoch": "1645640598.097793000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1811,
          "display_filter": "frame.number == 1811",
          "timestamp_epoch": "1645640598.099591000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1813,
          "display_filter": "frame.number == 1813",
          "timestamp_epoch": "1645640598.101785000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1815,
          "display_filter": "frame.number == 1815",
          "timestamp_epoch": "1645640598.102299000"
        }
      ]
    },
    {
      "id": "finding-6c9838cf291926a10a3e461f",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "protocol": "drsuapi",
        "destination": "172.16.0.52",
        "event_count": 53,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 101,
          "frame_number": 2143,
          "display_filter": "frame.number == 2143",
          "timestamp_epoch": "1645640616.235912000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2159,
          "display_filter": "frame.number == 2159",
          "timestamp_epoch": "1645640616.237893000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2162,
          "display_filter": "frame.number == 2162",
          "timestamp_epoch": "1645640616.239413000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2168,
          "display_filter": "frame.number == 2168",
          "timestamp_epoch": "1645640616.240317000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2214,
          "display_filter": "frame.number == 2214",
          "timestamp_epoch": "1645640616.377331000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2216,
          "display_filter": "frame.number == 2216",
          "timestamp_epoch": "1645640616.378198000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2218,
          "display_filter": "frame.number == 2218",
          "timestamp_epoch": "1645640616.379078000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2220,
          "display_filter": "frame.number == 2220",
          "timestamp_epoch": "1645640616.379663000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2514,
          "display_filter": "frame.number == 2514",
          "timestamp_epoch": "1645640619.781434000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2516,
          "display_filter": "frame.number == 2516",
          "timestamp_epoch": "1645640619.782533000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2518,
          "display_filter": "frame.number == 2518",
          "timestamp_epoch": "1645640619.783000000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2522,
          "display_filter": "frame.number == 2522",
          "timestamp_epoch": "1645640619.784988000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2524,
          "display_filter": "frame.number == 2524",
          "timestamp_epoch": "1645640619.785634000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2526,
          "display_filter": "frame.number == 2526",
          "timestamp_epoch": "1645640619.786141000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2840,
          "display_filter": "frame.number == 2840",
          "timestamp_epoch": "1645640629.287815000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2849,
          "display_filter": "frame.number == 2849",
          "timestamp_epoch": "1645640629.288571000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2851,
          "display_filter": "frame.number == 2851",
          "timestamp_epoch": "1645640629.289082000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2855,
          "display_filter": "frame.number == 2855",
          "timestamp_epoch": "1645640629.289722000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3848,
          "display_filter": "frame.number == 3848",
          "timestamp_epoch": "1645640665.119617000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3850,
          "display_filter": "frame.number == 3850",
          "timestamp_epoch": "1645640665.120719000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3852,
          "display_filter": "frame.number == 3852",
          "timestamp_epoch": "1645640665.121441000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3856,
          "display_filter": "frame.number == 3856",
          "timestamp_epoch": "1645640665.141200000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3858,
          "display_filter": "frame.number == 3858",
          "timestamp_epoch": "1645640665.141685000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3860,
          "display_filter": "frame.number == 3860",
          "timestamp_epoch": "1645640665.142220000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4897,
          "display_filter": "frame.number == 4897",
          "timestamp_epoch": "1645640690.237814000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4899,
          "display_filter": "frame.number == 4899",
          "timestamp_epoch": "1645640690.238357000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4901,
          "display_filter": "frame.number == 4901",
          "timestamp_epoch": "1645640690.238864000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4905,
          "display_filter": "frame.number == 4905",
          "timestamp_epoch": "1645640690.240144000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4907,
          "display_filter": "frame.number == 4907",
          "timestamp_epoch": "1645640690.240548000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4909,
          "display_filter": "frame.number == 4909",
          "timestamp_epoch": "1645640690.241067000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20485,
          "display_filter": "frame.number == 20485",
          "timestamp_epoch": "1645642430.650174000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20487,
          "display_filter": "frame.number == 20487",
          "timestamp_epoch": "1645642430.651324000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20489,
          "display_filter": "frame.number == 20489",
          "timestamp_epoch": "1645642430.651950000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20491,
          "display_filter": "frame.number == 20491",
          "timestamp_epoch": "1645642430.652963000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20493,
          "display_filter": "frame.number == 20493",
          "timestamp_epoch": "1645642430.653628000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20511,
          "display_filter": "frame.number == 20511",
          "timestamp_epoch": "1645642430.664995000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20513,
          "display_filter": "frame.number == 20513",
          "timestamp_epoch": "1645642430.665566000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20515,
          "display_filter": "frame.number == 20515",
          "timestamp_epoch": "1645642430.666128000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20519,
          "display_filter": "frame.number == 20519",
          "timestamp_epoch": "1645642430.668882000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20521,
          "display_filter": "frame.number == 20521",
          "timestamp_epoch": "1645642430.669335000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20523,
          "display_filter": "frame.number == 20523",
          "timestamp_epoch": "1645642430.669992000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21334,
          "display_filter": "frame.number == 21334",
          "timestamp_epoch": "1645642782.739341000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21336,
          "display_filter": "frame.number == 21336",
          "timestamp_epoch": "1645642782.739982000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21338,
          "display_filter": "frame.number == 21338",
          "timestamp_epoch": "1645642782.740593000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21342,
          "display_filter": "frame.number == 21342",
          "timestamp_epoch": "1645642782.743275000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21344,
          "display_filter": "frame.number == 21344",
          "timestamp_epoch": "1645642782.743782000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21346,
          "display_filter": "frame.number == 21346",
          "timestamp_epoch": "1645642782.744460000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21655,
          "display_filter": "frame.number == 21655",
          "timestamp_epoch": "1645642791.148568000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21657,
          "display_filter": "frame.number == 21657",
          "timestamp_epoch": "1645642791.149233000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21659,
          "display_filter": "frame.number == 21659",
          "timestamp_epoch": "1645642791.149840000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21663,
          "display_filter": "frame.number == 21663",
          "timestamp_epoch": "1645642791.151586000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21665,
          "display_filter": "frame.number == 21665",
          "timestamp_epoch": "1645642791.152044000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21667,
          "display_filter": "frame.number == 21667",
          "timestamp_epoch": "1645642791.152614000"
        }
      ]
    },
    {
      "id": "finding-e08b47808b58c51917c4b879",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "protocol": "ldap",
        "destination": "172.16.0.52",
        "event_count": 103,
        "operation_numbers": [
          "",
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 94,
          "frame_number": 1944,
          "display_filter": "frame.number == 1944",
          "timestamp_epoch": "1645640614.754258000"
        },
        {
          "tcp_stream": 94,
          "frame_number": 2015,
          "display_filter": "frame.number == 2015",
          "timestamp_epoch": "1645640616.150008000"
        },
        {
          "tcp_stream": 94,
          "frame_number": 2018,
          "display_filter": "frame.number == 2018",
          "timestamp_epoch": "1645640616.153547000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2055,
          "display_filter": "frame.number == 2055",
          "timestamp_epoch": "1645640616.192049000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2091,
          "display_filter": "frame.number == 2091",
          "timestamp_epoch": "1645640616.213634000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2098,
          "display_filter": "frame.number == 2098",
          "timestamp_epoch": "1645640616.216217000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2100,
          "display_filter": "frame.number == 2100",
          "timestamp_epoch": "1645640616.216983000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2233,
          "display_filter": "frame.number == 2233",
          "timestamp_epoch": "1645640616.482745000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2248,
          "display_filter": "frame.number == 2248",
          "timestamp_epoch": "1645640616.591072000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2265,
          "display_filter": "frame.number == 2265",
          "timestamp_epoch": "1645640616.699941000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2272,
          "display_filter": "frame.number == 2272",
          "timestamp_epoch": "1645640616.702811000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2275,
          "display_filter": "frame.number == 2275",
          "timestamp_epoch": "1645640616.703454000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2277,
          "display_filter": "frame.number == 2277",
          "timestamp_epoch": "1645640616.703884000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2286,
          "display_filter": "frame.number == 2286",
          "timestamp_epoch": "1645640617.401902000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2291,
          "display_filter": "frame.number == 2291",
          "timestamp_epoch": "1645640617.404790000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2308,
          "display_filter": "frame.number == 2308",
          "timestamp_epoch": "1645640617.559790000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2314,
          "display_filter": "frame.number == 2314",
          "timestamp_epoch": "1645640617.565431000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2317,
          "display_filter": "frame.number == 2317",
          "timestamp_epoch": "1645640617.566716000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2319,
          "display_filter": "frame.number == 2319",
          "timestamp_epoch": "1645640617.567085000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2321,
          "display_filter": "frame.number == 2321",
          "timestamp_epoch": "1645640617.568538000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2480,
          "display_filter": "frame.number == 2480",
          "timestamp_epoch": "1645640618.051867000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2484,
          "display_filter": "frame.number == 2484",
          "timestamp_epoch": "1645640618.076130000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2531,
          "display_filter": "frame.number == 2531",
          "timestamp_epoch": "1645640619.789425000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2536,
          "display_filter": "frame.number == 2536",
          "timestamp_epoch": "1645640619.793394000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2539,
          "display_filter": "frame.number == 2539",
          "timestamp_epoch": "1645640619.794483000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2541,
          "display_filter": "frame.number == 2541",
          "timestamp_epoch": "1645640619.795508000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2543,
          "display_filter": "frame.number == 2543",
          "timestamp_epoch": "1645640619.796531000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2549,
          "display_filter": "frame.number == 2549",
          "timestamp_epoch": "1645640619.800582000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2552,
          "display_filter": "frame.number == 2552",
          "timestamp_epoch": "1645640619.801788000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2557,
          "display_filter": "frame.number == 2557",
          "timestamp_epoch": "1645640619.802526000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2559,
          "display_filter": "frame.number == 2559",
          "timestamp_epoch": "1645640619.803049000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2563,
          "display_filter": "frame.number == 2563",
          "timestamp_epoch": "1645640619.803444000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2646,
          "display_filter": "frame.number == 2646",
          "timestamp_epoch": "1645640624.984041000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2651,
          "display_filter": "frame.number == 2651",
          "timestamp_epoch": "1645640624.985913000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2654,
          "display_filter": "frame.number == 2654",
          "timestamp_epoch": "1645640624.989087000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2656,
          "display_filter": "frame.number == 2656",
          "timestamp_epoch": "1645640624.989547000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2658,
          "display_filter": "frame.number == 2658",
          "timestamp_epoch": "1645640624.989996000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2660,
          "display_filter": "frame.number == 2660",
          "timestamp_epoch": "1645640624.990499000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2662,
          "display_filter": "frame.number == 2662",
          "timestamp_epoch": "1645640624.991125000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2694,
          "display_filter": "frame.number == 2694",
          "timestamp_epoch": "1645640625.007516000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2933,
          "display_filter": "frame.number == 2933",
          "timestamp_epoch": "1645640629.626994000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2938,
          "display_filter": "frame.number == 2938",
          "timestamp_epoch": "1645640629.632694000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2944,
          "display_filter": "frame.number == 2944",
          "timestamp_epoch": "1645640629.643721000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2947,
          "display_filter": "frame.number == 2947",
          "timestamp_epoch": "1645640629.645183000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2949,
          "display_filter": "frame.number == 2949",
          "timestamp_epoch": "1645640629.645617000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2951,
          "display_filter": "frame.number == 2951",
          "timestamp_epoch": "1645640629.647361000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2957,
          "display_filter": "frame.number == 2957",
          "timestamp_epoch": "1645640630.003612000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2959,
          "display_filter": "frame.number == 2959",
          "timestamp_epoch": "1645640630.020936000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3797,
          "display_filter": "frame.number == 3797",
          "timestamp_epoch": "1645640664.607238000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3802,
          "display_filter": "frame.number == 3802",
          "timestamp_epoch": "1645640664.612027000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3805,
          "display_filter": "frame.number == 3805",
          "timestamp_epoch": "1645640664.621108000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3807,
          "display_filter": "frame.number == 3807",
          "timestamp_epoch": "1645640664.621835000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3809,
          "display_filter": "frame.number == 3809",
          "timestamp_epoch": "1645640664.623524000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3865,
          "display_filter": "frame.number == 3865",
          "timestamp_epoch": "1645640665.155921000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3870,
          "display_filter": "frame.number == 3870",
          "timestamp_epoch": "1645640665.159000000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3873,
          "display_filter": "frame.number == 3873",
          "timestamp_epoch": "1645640665.161670000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3875,
          "display_filter": "frame.number == 3875",
          "timestamp_epoch": "1645640665.162262000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3877,
          "display_filter": "frame.number == 3877",
          "timestamp_epoch": "1645640665.162654000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3884,
          "display_filter": "frame.number == 3884",
          "timestamp_epoch": "1645640665.179627000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3887,
          "display_filter": "frame.number == 3887",
          "timestamp_epoch": "1645640665.181676000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3892,
          "display_filter": "frame.number == 3892",
          "timestamp_epoch": "1645640665.183383000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3894,
          "display_filter": "frame.number == 3894",
          "timestamp_epoch": "1645640665.184060000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3900,
          "display_filter": "frame.number == 3900",
          "timestamp_epoch": "1645640665.186410000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4914,
          "display_filter": "frame.number == 4914",
          "timestamp_epoch": "1645640690.243295000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4919,
          "display_filter": "frame.number == 4919",
          "timestamp_epoch": "1645640690.244410000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4922,
          "display_filter": "frame.number == 4922",
          "timestamp_epoch": "1645640690.245532000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4924,
          "display_filter": "frame.number == 4924",
          "timestamp_epoch": "1645640690.245987000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4926,
          "display_filter": "frame.number == 4926",
          "timestamp_epoch": "1645640690.246347000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4932,
          "display_filter": "frame.number == 4932",
          "timestamp_epoch": "1645640690.249247000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4935,
          "display_filter": "frame.number == 4935",
          "timestamp_epoch": "1645640690.250393000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4940,
          "display_filter": "frame.number == 4940",
          "timestamp_epoch": "1645640690.250921000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4942,
          "display_filter": "frame.number == 4942",
          "timestamp_epoch": "1645640690.251315000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4944,
          "display_filter": "frame.number == 4944",
          "timestamp_epoch": "1645640690.251630000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20539,
          "display_filter": "frame.number == 20539",
          "timestamp_epoch": "1645642430.775306000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20544,
          "display_filter": "frame.number == 20544",
          "timestamp_epoch": "1645642430.776620000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20547,
          "display_filter": "frame.number == 20547",
          "timestamp_epoch": "1645642430.777647000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20549,
          "display_filter": "frame.number == 20549",
          "timestamp_epoch": "1645642430.777977000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20551,
          "display_filter": "frame.number == 20551",
          "timestamp_epoch": "1645642430.778260000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20557,
          "display_filter": "frame.number == 20557",
          "timestamp_epoch": "1645642430.782184000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20560,
          "display_filter": "frame.number == 20560",
          "timestamp_epoch": "1645642430.784271000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20565,
          "display_filter": "frame.number == 20565",
          "timestamp_epoch": "1645642430.785906000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20567,
          "display_filter": "frame.number == 20567",
          "timestamp_epoch": "1645642430.786348000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20569,
          "display_filter": "frame.number == 20569",
          "timestamp_epoch": "1645642430.786737000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21351,
          "display_filter": "frame.number == 21351",
          "timestamp_epoch": "1645642782.748384000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21356,
          "display_filter": "frame.number == 21356",
          "timestamp_epoch": "1645642782.749739000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21359,
          "display_filter": "frame.number == 21359",
          "timestamp_epoch": "1645642782.750981000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21361,
          "display_filter": "frame.number == 21361",
          "timestamp_epoch": "1645642782.751507000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21363,
          "display_filter": "frame.number == 21363",
          "timestamp_epoch": "1645642782.751938000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21369,
          "display_filter": "frame.number == 21369",
          "timestamp_epoch": "1645642782.756357000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21372,
          "display_filter": "frame.number == 21372",
          "timestamp_epoch": "1645642782.757905000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21377,
          "display_filter": "frame.number == 21377",
          "timestamp_epoch": "1645642782.758597000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21379,
          "display_filter": "frame.number == 21379",
          "timestamp_epoch": "1645642782.759153000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21381,
          "display_filter": "frame.number == 21381",
          "timestamp_epoch": "1645642782.759544000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21672,
          "display_filter": "frame.number == 21672",
          "timestamp_epoch": "1645642791.155121000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21677,
          "display_filter": "frame.number == 21677",
          "timestamp_epoch": "1645642791.156425000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21680,
          "display_filter": "frame.number == 21680",
          "timestamp_epoch": "1645642791.157784000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21682,
          "display_filter": "frame.number == 21682",
          "timestamp_epoch": "1645642791.158533000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21684,
          "display_filter": "frame.number == 21684",
          "timestamp_epoch": "1645642791.159112000"
        },
        {
          "tcp_stream": 378,
          "frame_number": 21690,
          "display_filter": "frame.number == 21690",
          "timestamp_epoch": "1645642791.163153000"
        },
        {
          "tcp_stream": 378,
          "frame_number": 21693,
          "display_filter": "frame.number == 21693",
          "timestamp_epoch": "1645642791.164548000"
        }
      ]
    },
    {
      "id": "finding-a454d3da3ae17130e1ab69f5",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "protocol": "samr",
        "destination": "172.16.0.52",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 95,
          "frame_number": 2867,
          "display_filter": "frame.number == 2867",
          "timestamp_epoch": "1645640629.296865000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2869,
          "display_filter": "frame.number == 2869",
          "timestamp_epoch": "1645640629.297709000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2871,
          "display_filter": "frame.number == 2871",
          "timestamp_epoch": "1645640629.298262000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2873,
          "display_filter": "frame.number == 2873",
          "timestamp_epoch": "1645640629.298825000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2875,
          "display_filter": "frame.number == 2875",
          "timestamp_epoch": "1645640629.299432000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2877,
          "display_filter": "frame.number == 2877",
          "timestamp_epoch": "1645640629.299985000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2879,
          "display_filter": "frame.number == 2879",
          "timestamp_epoch": "1645640629.300935000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2881,
          "display_filter": "frame.number == 2881",
          "timestamp_epoch": "1645640629.301639000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2883,
          "display_filter": "frame.number == 2883",
          "timestamp_epoch": "1645640629.302584000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2885,
          "display_filter": "frame.number == 2885",
          "timestamp_epoch": "1645640629.303859000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2887,
          "display_filter": "frame.number == 2887",
          "timestamp_epoch": "1645640629.304752000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2889,
          "display_filter": "frame.number == 2889",
          "timestamp_epoch": "1645640629.305653000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2891,
          "display_filter": "frame.number == 2891",
          "timestamp_epoch": "1645640629.306803000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2893,
          "display_filter": "frame.number == 2893",
          "timestamp_epoch": "1645640629.307501000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2895,
          "display_filter": "frame.number == 2895",
          "timestamp_epoch": "1645640629.308014000"
        }
      ]
    },
    {
      "id": "finding-aa23e2e5b7d7c99a174b8e5e",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "protocol": "drsuapi",
        "destination": "172.16.0.52",
        "event_count": 53,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 43,
          "frame_number": 746,
          "display_filter": "frame.number == 746",
          "timestamp_epoch": "1645640567.543288000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 748,
          "display_filter": "frame.number == 748",
          "timestamp_epoch": "1645640567.544005000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 750,
          "display_filter": "frame.number == 750",
          "timestamp_epoch": "1645640567.544419000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 752,
          "display_filter": "frame.number == 752",
          "timestamp_epoch": "1645640567.544764000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 784,
          "display_filter": "frame.number == 784",
          "timestamp_epoch": "1645640567.664374000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 786,
          "display_filter": "frame.number == 786",
          "timestamp_epoch": "1645640567.664960000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 788,
          "display_filter": "frame.number == 788",
          "timestamp_epoch": "1645640567.665492000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 790,
          "display_filter": "frame.number == 790",
          "timestamp_epoch": "1645640567.666201000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1098,
          "display_filter": "frame.number == 1098",
          "timestamp_epoch": "1645640570.622806000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1100,
          "display_filter": "frame.number == 1100",
          "timestamp_epoch": "1645640570.625076000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1102,
          "display_filter": "frame.number == 1102",
          "timestamp_epoch": "1645640570.625646000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1106,
          "display_filter": "frame.number == 1106",
          "timestamp_epoch": "1645640570.631360000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1108,
          "display_filter": "frame.number == 1108",
          "timestamp_epoch": "1645640570.632093000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1110,
          "display_filter": "frame.number == 1110",
          "timestamp_epoch": "1645640570.635479000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1422,
          "display_filter": "frame.number == 1422",
          "timestamp_epoch": "1645640588.974250000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1426,
          "display_filter": "frame.number == 1426",
          "timestamp_epoch": "1645640588.974813000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1429,
          "display_filter": "frame.number == 1429",
          "timestamp_epoch": "1645640588.975536000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1432,
          "display_filter": "frame.number == 1432",
          "timestamp_epoch": "1645640588.976125000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3520,
          "display_filter": "frame.number == 3520",
          "timestamp_epoch": "1645640650.196296000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3522,
          "display_filter": "frame.number == 3522",
          "timestamp_epoch": "1645640650.196744000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3524,
          "display_filter": "frame.number == 3524",
          "timestamp_epoch": "1645640650.197199000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3528,
          "display_filter": "frame.number == 3528",
          "timestamp_epoch": "1645640650.200837000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3530,
          "display_filter": "frame.number == 3530",
          "timestamp_epoch": "1645640650.201565000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3532,
          "display_filter": "frame.number == 3532",
          "timestamp_epoch": "1645640650.202430000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3592,
          "display_filter": "frame.number == 3592",
          "timestamp_epoch": "1645640650.318927000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3594,
          "display_filter": "frame.number == 3594",
          "timestamp_epoch": "1645640650.319800000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3596,
          "display_filter": "frame.number == 3596",
          "timestamp_epoch": "1645640650.320343000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3600,
          "display_filter": "frame.number == 3600",
          "timestamp_epoch": "1645640650.322177000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3602,
          "display_filter": "frame.number == 3602",
          "timestamp_epoch": "1645640650.322743000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3604,
          "display_filter": "frame.number == 3604",
          "timestamp_epoch": "1645640650.323346000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9700,
          "display_filter": "frame.number == 9700",
          "timestamp_epoch": "1645640959.792831000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9702,
          "display_filter": "frame.number == 9702",
          "timestamp_epoch": "1645640959.793376000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9704,
          "display_filter": "frame.number == 9704",
          "timestamp_epoch": "1645640959.794059000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9708,
          "display_filter": "frame.number == 9708",
          "timestamp_epoch": "1645640959.795886000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9710,
          "display_filter": "frame.number == 9710",
          "timestamp_epoch": "1645640959.796449000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9712,
          "display_filter": "frame.number == 9712",
          "timestamp_epoch": "1645640959.797120000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20267,
          "display_filter": "frame.number == 20267",
          "timestamp_epoch": "1645642390.516003000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20269,
          "display_filter": "frame.number == 20269",
          "timestamp_epoch": "1645642390.517364000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20271,
          "display_filter": "frame.number == 20271",
          "timestamp_epoch": "1645642390.517902000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20273,
          "display_filter": "frame.number == 20273",
          "timestamp_epoch": "1645642390.518368000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20275,
          "display_filter": "frame.number == 20275",
          "timestamp_epoch": "1645642390.518996000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20293,
          "display_filter": "frame.number == 20293",
          "timestamp_epoch": "1645642390.532025000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20297,
          "display_filter": "frame.number == 20297",
          "timestamp_epoch": "1645642390.532674000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20299,
          "display_filter": "frame.number == 20299",
          "timestamp_epoch": "1645642390.533211000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20303,
          "display_filter": "frame.number == 20303",
          "timestamp_epoch": "1645642390.536189000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20305,
          "display_filter": "frame.number == 20305",
          "timestamp_epoch": "1645642390.536776000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20307,
          "display_filter": "frame.number == 20307",
          "timestamp_epoch": "1645642390.541696000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23143,
          "display_filter": "frame.number == 23143",
          "timestamp_epoch": "1645642945.279267000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23145,
          "display_filter": "frame.number == 23145",
          "timestamp_epoch": "1645642945.279881000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23147,
          "display_filter": "frame.number == 23147",
          "timestamp_epoch": "1645642945.280496000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23151,
          "display_filter": "frame.number == 23151",
          "timestamp_epoch": "1645642945.282938000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23153,
          "display_filter": "frame.number == 23153",
          "timestamp_epoch": "1645642945.283384000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23155,
          "display_filter": "frame.number == 23155",
          "timestamp_epoch": "1645642945.283898000"
        }
      ]
    },
    {
      "id": "finding-58216542f215b005cf8f39a7",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "protocol": "ldap",
        "destination": "172.16.0.52",
        "event_count": 98,
        "operation_numbers": [
          "",
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 32,
          "frame_number": 577,
          "display_filter": "frame.number == 577",
          "timestamp_epoch": "1645640566.798957000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 618,
          "display_filter": "frame.number == 618",
          "timestamp_epoch": "1645640567.307841000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 673,
          "display_filter": "frame.number == 673",
          "timestamp_epoch": "1645640567.334882000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 682,
          "display_filter": "frame.number == 682",
          "timestamp_epoch": "1645640567.338259000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 684,
          "display_filter": "frame.number == 684",
          "timestamp_epoch": "1645640567.339254000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 813,
          "display_filter": "frame.number == 813",
          "timestamp_epoch": "1645640567.918332000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 816,
          "display_filter": "frame.number == 816",
          "timestamp_epoch": "1645640567.920871000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 825,
          "display_filter": "frame.number == 825",
          "timestamp_epoch": "1645640568.030510000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 839,
          "display_filter": "frame.number == 839",
          "timestamp_epoch": "1645640568.228202000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 851,
          "display_filter": "frame.number == 851",
          "timestamp_epoch": "1645640568.337063000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 859,
          "display_filter": "frame.number == 859",
          "timestamp_epoch": "1645640568.338704000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 863,
          "display_filter": "frame.number == 863",
          "timestamp_epoch": "1645640568.339316000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 865,
          "display_filter": "frame.number == 865",
          "timestamp_epoch": "1645640568.339662000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 874,
          "display_filter": "frame.number == 874",
          "timestamp_epoch": "1645640568.908135000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 879,
          "display_filter": "frame.number == 879",
          "timestamp_epoch": "1645640568.910519000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 896,
          "display_filter": "frame.number == 896",
          "timestamp_epoch": "1645640568.937677000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 902,
          "display_filter": "frame.number == 902",
          "timestamp_epoch": "1645640568.943334000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 905,
          "display_filter": "frame.number == 905",
          "timestamp_epoch": "1645640568.944794000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 907,
          "display_filter": "frame.number == 907",
          "timestamp_epoch": "1645640568.945597000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 909,
          "display_filter": "frame.number == 909",
          "timestamp_epoch": "1645640568.947238000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 1066,
          "display_filter": "frame.number == 1066",
          "timestamp_epoch": "1645640569.169979000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 1070,
          "display_filter": "frame.number == 1070",
          "timestamp_epoch": "1645640569.181199000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1115,
          "display_filter": "frame.number == 1115",
          "timestamp_epoch": "1645640570.647919000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1120,
          "display_filter": "frame.number == 1120",
          "timestamp_epoch": "1645640570.651877000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1123,
          "display_filter": "frame.number == 1123",
          "timestamp_epoch": "1645640570.655864000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1125,
          "display_filter": "frame.number == 1125",
          "timestamp_epoch": "1645640570.657663000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1127,
          "display_filter": "frame.number == 1127",
          "timestamp_epoch": "1645640570.658222000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1133,
          "display_filter": "frame.number == 1133",
          "timestamp_epoch": "1645640570.665173000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1136,
          "display_filter": "frame.number == 1136",
          "timestamp_epoch": "1645640570.666260000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1141,
          "display_filter": "frame.number == 1141",
          "timestamp_epoch": "1645640570.666814000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1143,
          "display_filter": "frame.number == 1143",
          "timestamp_epoch": "1645640570.667285000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1147,
          "display_filter": "frame.number == 1147",
          "timestamp_epoch": "1645640570.667642000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1226,
          "display_filter": "frame.number == 1226",
          "timestamp_epoch": "1645640576.823656000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1231,
          "display_filter": "frame.number == 1231",
          "timestamp_epoch": "1645640576.825579000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1234,
          "display_filter": "frame.number == 1234",
          "timestamp_epoch": "1645640576.828694000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1236,
          "display_filter": "frame.number == 1236",
          "timestamp_epoch": "1645640576.829140000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1238,
          "display_filter": "frame.number == 1238",
          "timestamp_epoch": "1645640576.829589000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1240,
          "display_filter": "frame.number == 1240",
          "timestamp_epoch": "1645640576.830077000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1242,
          "display_filter": "frame.number == 1242",
          "timestamp_epoch": "1645640576.830679000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1274,
          "display_filter": "frame.number == 1274",
          "timestamp_epoch": "1645640576.840514000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1503,
          "display_filter": "frame.number == 1503",
          "timestamp_epoch": "1645640589.338229000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1506,
          "display_filter": "frame.number == 1506",
          "timestamp_epoch": "1645640589.345818000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1512,
          "display_filter": "frame.number == 1512",
          "timestamp_epoch": "1645640589.356278000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1515,
          "display_filter": "frame.number == 1515",
          "timestamp_epoch": "1645640589.360987000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1517,
          "display_filter": "frame.number == 1517",
          "timestamp_epoch": "1645640589.361584000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1519,
          "display_filter": "frame.number == 1519",
          "timestamp_epoch": "1645640589.363940000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1524,
          "display_filter": "frame.number == 1524",
          "timestamp_epoch": "1645640589.739466000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1528,
          "display_filter": "frame.number == 1528",
          "timestamp_epoch": "1645640589.755147000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3537,
          "display_filter": "frame.number == 3537",
          "timestamp_epoch": "1645640650.206899000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3542,
          "display_filter": "frame.number == 3542",
          "timestamp_epoch": "1645640650.209544000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3545,
          "display_filter": "frame.number == 3545",
          "timestamp_epoch": "1645640650.210848000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3547,
          "display_filter": "frame.number == 3547",
          "timestamp_epoch": "1645640650.211757000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3549,
          "display_filter": "frame.number == 3549",
          "timestamp_epoch": "1645640650.212124000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3555,
          "display_filter": "frame.number == 3555",
          "timestamp_epoch": "1645640650.217843000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3558,
          "display_filter": "frame.number == 3558",
          "timestamp_epoch": "1645640650.219904000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3563,
          "display_filter": "frame.number == 3563",
          "timestamp_epoch": "1645640650.220671000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3565,
          "display_filter": "frame.number == 3565",
          "timestamp_epoch": "1645640650.221225000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3569,
          "display_filter": "frame.number == 3569",
          "timestamp_epoch": "1645640650.221677000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3609,
          "display_filter": "frame.number == 3609",
          "timestamp_epoch": "1645640650.336187000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3614,
          "display_filter": "frame.number == 3614",
          "timestamp_epoch": "1645640650.347244000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3617,
          "display_filter": "frame.number == 3617",
          "timestamp_epoch": "1645640650.349745000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3619,
          "display_filter": "frame.number == 3619",
          "timestamp_epoch": "1645640650.350412000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3621,
          "display_filter": "frame.number == 3621",
          "timestamp_epoch": "1645640650.354244000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3631,
          "display_filter": "frame.number == 3631",
          "timestamp_epoch": "1645640650.359705000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3634,
          "display_filter": "frame.number == 3634",
          "timestamp_epoch": "1645640650.361420000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3639,
          "display_filter": "frame.number == 3639",
          "timestamp_epoch": "1645640650.363163000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3641,
          "display_filter": "frame.number == 3641",
          "timestamp_epoch": "1645640650.364204000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3643,
          "display_filter": "frame.number == 3643",
          "timestamp_epoch": "1645640650.369815000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9717,
          "display_filter": "frame.number == 9717",
          "timestamp_epoch": "1645640959.799358000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9722,
          "display_filter": "frame.number == 9722",
          "timestamp_epoch": "1645640959.800260000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9725,
          "display_filter": "frame.number == 9725",
          "timestamp_epoch": "1645640959.801260000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9727,
          "display_filter": "frame.number == 9727",
          "timestamp_epoch": "1645640959.801708000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9729,
          "display_filter": "frame.number == 9729",
          "timestamp_epoch": "1645640959.802085000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9735,
          "display_filter": "frame.number == 9735",
          "timestamp_epoch": "1645640959.805010000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9738,
          "display_filter": "frame.number == 9738",
          "timestamp_epoch": "1645640959.806102000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9743,
          "display_filter": "frame.number == 9743",
          "timestamp_epoch": "1645640959.806910000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9745,
          "display_filter": "frame.number == 9745",
          "timestamp_epoch": "1645640959.807400000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9749,
          "display_filter": "frame.number == 9749",
          "timestamp_epoch": "1645640959.807656000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20320,
          "display_filter": "frame.number == 20320",
          "timestamp_epoch": "1645642390.649070000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20325,
          "display_filter": "frame.number == 20325",
          "timestamp_epoch": "1645642390.650547000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20328,
          "display_filter": "frame.number == 20328",
          "timestamp_epoch": "1645642390.653885000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20330,
          "display_filter": "frame.number == 20330",
          "timestamp_epoch": "1645642390.654397000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20332,
          "display_filter": "frame.number == 20332",
          "timestamp_epoch": "1645642390.654737000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20338,
          "display_filter": "frame.number == 20338",
          "timestamp_epoch": "1645642390.658998000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20341,
          "display_filter": "frame.number == 20341",
          "timestamp_epoch": "1645642390.660334000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20346,
          "display_filter": "frame.number == 20346",
          "timestamp_epoch": "1645642390.660967000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20348,
          "display_filter": "frame.number == 20348",
          "timestamp_epoch": "1645642390.661461000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20350,
          "display_filter": "frame.number == 20350",
          "timestamp_epoch": "1645642390.661893000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23160,
          "display_filter": "frame.number == 23160",
          "timestamp_epoch": "1645642945.287690000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23165,
          "display_filter": "frame.number == 23165",
          "timestamp_epoch": "1645642945.289349000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23168,
          "display_filter": "frame.number == 23168",
          "timestamp_epoch": "1645642945.290594000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23170,
          "display_filter": "frame.number == 23170",
          "timestamp_epoch": "1645642945.291107000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23172,
          "display_filter": "frame.number == 23172",
          "timestamp_epoch": "1645642945.291526000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23178,
          "display_filter": "frame.number == 23178",
          "timestamp_epoch": "1645642945.296383000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23181,
          "display_filter": "frame.number == 23181",
          "timestamp_epoch": "1645642945.297686000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23186,
          "display_filter": "frame.number == 23186",
          "timestamp_epoch": "1645642945.298357000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23188,
          "display_filter": "frame.number == 23188",
          "timestamp_epoch": "1645642945.298856000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23192,
          "display_filter": "frame.number == 23192",
          "timestamp_epoch": "1645642945.299373000"
        }
      ]
    },
    {
      "id": "finding-128f7922eadfd1dac0223690",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "protocol": "samr",
        "destination": "172.16.0.52",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 31,
          "frame_number": 1424,
          "display_filter": "frame.number == 1424",
          "timestamp_epoch": "1645640588.974536000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1430,
          "display_filter": "frame.number == 1430",
          "timestamp_epoch": "1645640588.975657000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1435,
          "display_filter": "frame.number == 1435",
          "timestamp_epoch": "1645640588.976794000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1437,
          "display_filter": "frame.number == 1437",
          "timestamp_epoch": "1645640588.977416000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1439,
          "display_filter": "frame.number == 1439",
          "timestamp_epoch": "1645640588.978022000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1441,
          "display_filter": "frame.number == 1441",
          "timestamp_epoch": "1645640588.978886000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1443,
          "display_filter": "frame.number == 1443",
          "timestamp_epoch": "1645640588.979477000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1445,
          "display_filter": "frame.number == 1445",
          "timestamp_epoch": "1645640588.980161000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1449,
          "display_filter": "frame.number == 1449",
          "timestamp_epoch": "1645640588.981080000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1451,
          "display_filter": "frame.number == 1451",
          "timestamp_epoch": "1645640588.981925000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1453,
          "display_filter": "frame.number == 1453",
          "timestamp_epoch": "1645640588.983031000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1455,
          "display_filter": "frame.number == 1455",
          "timestamp_epoch": "1645640588.983836000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1457,
          "display_filter": "frame.number == 1457",
          "timestamp_epoch": "1645640588.984690000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1459,
          "display_filter": "frame.number == 1459",
          "timestamp_epoch": "1645640588.985447000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1461,
          "display_filter": "frame.number == 1461",
          "timestamp_epoch": "1645640588.986045000"
        }
      ]
    },
    {
      "id": "finding-c9f5b823d81c582fb65971dd",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "drsuapi",
        "destination": "172.16.0.131",
        "event_count": 8,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 179,
          "display_filter": "frame.number == 179",
          "timestamp_epoch": "1645640546.177462000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 181,
          "display_filter": "frame.number == 181",
          "timestamp_epoch": "1645640546.181620000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 183,
          "display_filter": "frame.number == 183",
          "timestamp_epoch": "1645640546.182100000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 185,
          "display_filter": "frame.number == 185",
          "timestamp_epoch": "1645640546.182557000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1711,
          "display_filter": "frame.number == 1711",
          "timestamp_epoch": "1645640598.024584000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1713,
          "display_filter": "frame.number == 1713",
          "timestamp_epoch": "1645640598.025260000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1715,
          "display_filter": "frame.number == 1715",
          "timestamp_epoch": "1645640598.025736000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 1717,
          "display_filter": "frame.number == 1717",
          "timestamp_epoch": "1645640598.026558000"
        }
      ]
    },
    {
      "id": "finding-bc1fde8a87ab7b056b52d10d",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "ldap",
        "destination": "172.16.0.131",
        "event_count": 33,
        "operation_numbers": [
          "",
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 5,
          "frame_number": 102,
          "display_filter": "frame.number == 102",
          "timestamp_epoch": "1645640545.846208000"
        },
        {
          "tcp_stream": 5,
          "frame_number": 119,
          "display_filter": "frame.number == 119",
          "timestamp_epoch": "1645640545.852148000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 214,
          "display_filter": "frame.number == 214",
          "timestamp_epoch": "1645640546.382338000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 231,
          "display_filter": "frame.number == 231",
          "timestamp_epoch": "1645640546.386145000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 233,
          "display_filter": "frame.number == 233",
          "timestamp_epoch": "1645640546.386698000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 235,
          "display_filter": "frame.number == 235",
          "timestamp_epoch": "1645640546.387491000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 253,
          "display_filter": "frame.number == 253",
          "timestamp_epoch": "1645640546.489358000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 268,
          "display_filter": "frame.number == 268",
          "timestamp_epoch": "1645640546.590591000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 276,
          "display_filter": "frame.number == 276",
          "timestamp_epoch": "1645640546.593542000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 284,
          "display_filter": "frame.number == 284",
          "timestamp_epoch": "1645640546.596707000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 286,
          "display_filter": "frame.number == 286",
          "timestamp_epoch": "1645640546.597299000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 299,
          "display_filter": "frame.number == 299",
          "timestamp_epoch": "1645640546.830632000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 304,
          "display_filter": "frame.number == 304",
          "timestamp_epoch": "1645640546.833068000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 319,
          "display_filter": "frame.number == 319",
          "timestamp_epoch": "1645640546.847021000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 348,
          "display_filter": "frame.number == 348",
          "timestamp_epoch": "1645640546.852792000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 350,
          "display_filter": "frame.number == 350",
          "timestamp_epoch": "1645640546.853542000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 352,
          "display_filter": "frame.number == 352",
          "timestamp_epoch": "1645640546.854028000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 354,
          "display_filter": "frame.number == 354",
          "timestamp_epoch": "1645640546.854824000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 438,
          "display_filter": "frame.number == 438",
          "timestamp_epoch": "1645640556.008197000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 443,
          "display_filter": "frame.number == 443",
          "timestamp_epoch": "1645640556.011697000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 445,
          "display_filter": "frame.number == 445",
          "timestamp_epoch": "1645640556.013757000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 447,
          "display_filter": "frame.number == 447",
          "timestamp_epoch": "1645640556.014196000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 449,
          "display_filter": "frame.number == 449",
          "timestamp_epoch": "1645640556.014614000"
        },
        {
          "tcp_stream": 26,
          "frame_number": 451,
          "display_filter": "frame.number == 451",
          "timestamp_epoch": "1645640556.015114000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 458,
          "display_filter": "frame.number == 458",
          "timestamp_epoch": "1645640556.025419000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 460,
          "display_filter": "frame.number == 460",
          "timestamp_epoch": "1645640556.025896000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 492,
          "display_filter": "frame.number == 492",
          "timestamp_epoch": "1645640556.032414000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1828,
          "display_filter": "frame.number == 1828",
          "timestamp_epoch": "1645640598.548103000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1830,
          "display_filter": "frame.number == 1830",
          "timestamp_epoch": "1645640598.551901000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1837,
          "display_filter": "frame.number == 1837",
          "timestamp_epoch": "1645640598.557216000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1839,
          "display_filter": "frame.number == 1839",
          "timestamp_epoch": "1645640598.558094000"
        },
        {
          "tcp_stream": 92,
          "frame_number": 1841,
          "display_filter": "frame.number == 1841",
          "timestamp_epoch": "1645640598.558555000"
        },
        {
          "tcp_stream": 91,
          "frame_number": 1843,
          "display_filter": "frame.number == 1843",
          "timestamp_epoch": "1645640598.559172000"
        }
      ]
    },
    {
      "id": "finding-e93e83f1be22c3d3bbd460e8",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "samr",
        "destination": "172.16.0.131",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 87,
          "frame_number": 1786,
          "display_filter": "frame.number == 1786",
          "timestamp_epoch": "1645640598.091725000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1788,
          "display_filter": "frame.number == 1788",
          "timestamp_epoch": "1645640598.092396000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1792,
          "display_filter": "frame.number == 1792",
          "timestamp_epoch": "1645640598.092895000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1794,
          "display_filter": "frame.number == 1794",
          "timestamp_epoch": "1645640598.093409000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1796,
          "display_filter": "frame.number == 1796",
          "timestamp_epoch": "1645640598.093948000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1798,
          "display_filter": "frame.number == 1798",
          "timestamp_epoch": "1645640598.094440000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1800,
          "display_filter": "frame.number == 1800",
          "timestamp_epoch": "1645640598.095027000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1802,
          "display_filter": "frame.number == 1802",
          "timestamp_epoch": "1645640598.095549000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1804,
          "display_filter": "frame.number == 1804",
          "timestamp_epoch": "1645640598.096125000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1806,
          "display_filter": "frame.number == 1806",
          "timestamp_epoch": "1645640598.096697000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1808,
          "display_filter": "frame.number == 1808",
          "timestamp_epoch": "1645640598.097171000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1810,
          "display_filter": "frame.number == 1810",
          "timestamp_epoch": "1645640598.098020000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1812,
          "display_filter": "frame.number == 1812",
          "timestamp_epoch": "1645640598.099935000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1814,
          "display_filter": "frame.number == 1814",
          "timestamp_epoch": "1645640598.102089000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1816,
          "display_filter": "frame.number == 1816",
          "timestamp_epoch": "1645640598.102650000"
        }
      ]
    },
    {
      "id": "finding-2d33f3af543b11e2df0c7f81",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "drsuapi",
        "destination": "172.16.0.149",
        "event_count": 53,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 101,
          "frame_number": 2147,
          "display_filter": "frame.number == 2147",
          "timestamp_epoch": "1645640616.236065000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2161,
          "display_filter": "frame.number == 2161",
          "timestamp_epoch": "1645640616.238201000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2164,
          "display_filter": "frame.number == 2164",
          "timestamp_epoch": "1645640616.239593000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2169,
          "display_filter": "frame.number == 2169",
          "timestamp_epoch": "1645640616.240456000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2215,
          "display_filter": "frame.number == 2215",
          "timestamp_epoch": "1645640616.377567000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2217,
          "display_filter": "frame.number == 2217",
          "timestamp_epoch": "1645640616.378628000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2219,
          "display_filter": "frame.number == 2219",
          "timestamp_epoch": "1645640616.379475000"
        },
        {
          "tcp_stream": 111,
          "frame_number": 2221,
          "display_filter": "frame.number == 2221",
          "timestamp_epoch": "1645640616.379815000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2515,
          "display_filter": "frame.number == 2515",
          "timestamp_epoch": "1645640619.781683000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2517,
          "display_filter": "frame.number == 2517",
          "timestamp_epoch": "1645640619.782829000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2519,
          "display_filter": "frame.number == 2519",
          "timestamp_epoch": "1645640619.783149000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2523,
          "display_filter": "frame.number == 2523",
          "timestamp_epoch": "1645640619.785170000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2525,
          "display_filter": "frame.number == 2525",
          "timestamp_epoch": "1645640619.785877000"
        },
        {
          "tcp_stream": 123,
          "frame_number": 2527,
          "display_filter": "frame.number == 2527",
          "timestamp_epoch": "1645640619.786287000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2845,
          "display_filter": "frame.number == 2845",
          "timestamp_epoch": "1645640629.288327000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2850,
          "display_filter": "frame.number == 2850",
          "timestamp_epoch": "1645640629.288837000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2853,
          "display_filter": "frame.number == 2853",
          "timestamp_epoch": "1645640629.289413000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 2856,
          "display_filter": "frame.number == 2856",
          "timestamp_epoch": "1645640629.289817000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3849,
          "display_filter": "frame.number == 3849",
          "timestamp_epoch": "1645640665.119969000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3851,
          "display_filter": "frame.number == 3851",
          "timestamp_epoch": "1645640665.121092000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3853,
          "display_filter": "frame.number == 3853",
          "timestamp_epoch": "1645640665.121600000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3857,
          "display_filter": "frame.number == 3857",
          "timestamp_epoch": "1645640665.141511000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3859,
          "display_filter": "frame.number == 3859",
          "timestamp_epoch": "1645640665.142044000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 3861,
          "display_filter": "frame.number == 3861",
          "timestamp_epoch": "1645640665.142373000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4898,
          "display_filter": "frame.number == 4898",
          "timestamp_epoch": "1645640690.238033000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4900,
          "display_filter": "frame.number == 4900",
          "timestamp_epoch": "1645640690.238637000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4902,
          "display_filter": "frame.number == 4902",
          "timestamp_epoch": "1645640690.238961000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4906,
          "display_filter": "frame.number == 4906",
          "timestamp_epoch": "1645640690.240370000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4908,
          "display_filter": "frame.number == 4908",
          "timestamp_epoch": "1645640690.240894000"
        },
        {
          "tcp_stream": 193,
          "frame_number": 4910,
          "display_filter": "frame.number == 4910",
          "timestamp_epoch": "1645640690.241167000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20486,
          "display_filter": "frame.number == 20486",
          "timestamp_epoch": "1645642430.650475000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20488,
          "display_filter": "frame.number == 20488",
          "timestamp_epoch": "1645642430.651732000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20490,
          "display_filter": "frame.number == 20490",
          "timestamp_epoch": "1645642430.652223000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20492,
          "display_filter": "frame.number == 20492",
          "timestamp_epoch": "1645642430.653251000"
        },
        {
          "tcp_stream": 347,
          "frame_number": 20494,
          "display_filter": "frame.number == 20494",
          "timestamp_epoch": "1645642430.653780000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20512,
          "display_filter": "frame.number == 20512",
          "timestamp_epoch": "1645642430.665275000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20514,
          "display_filter": "frame.number == 20514",
          "timestamp_epoch": "1645642430.665900000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20516,
          "display_filter": "frame.number == 20516",
          "timestamp_epoch": "1645642430.666323000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20520,
          "display_filter": "frame.number == 20520",
          "timestamp_epoch": "1645642430.669146000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20522,
          "display_filter": "frame.number == 20522",
          "timestamp_epoch": "1645642430.669732000"
        },
        {
          "tcp_stream": 349,
          "frame_number": 20524,
          "display_filter": "frame.number == 20524",
          "timestamp_epoch": "1645642430.670163000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21335,
          "display_filter": "frame.number == 21335",
          "timestamp_epoch": "1645642782.739611000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21337,
          "display_filter": "frame.number == 21337",
          "timestamp_epoch": "1645642782.740330000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21339,
          "display_filter": "frame.number == 21339",
          "timestamp_epoch": "1645642782.740750000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21343,
          "display_filter": "frame.number == 21343",
          "timestamp_epoch": "1645642782.743511000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21345,
          "display_filter": "frame.number == 21345",
          "timestamp_epoch": "1645642782.744114000"
        },
        {
          "tcp_stream": 371,
          "frame_number": 21347,
          "display_filter": "frame.number == 21347",
          "timestamp_epoch": "1645642782.744600000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21656,
          "display_filter": "frame.number == 21656",
          "timestamp_epoch": "1645642791.148818000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21658,
          "display_filter": "frame.number == 21658",
          "timestamp_epoch": "1645642791.149567000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21660,
          "display_filter": "frame.number == 21660",
          "timestamp_epoch": "1645642791.150005000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21664,
          "display_filter": "frame.number == 21664",
          "timestamp_epoch": "1645642791.151797000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21666,
          "display_filter": "frame.number == 21666",
          "timestamp_epoch": "1645642791.152333000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 21668,
          "display_filter": "frame.number == 21668",
          "timestamp_epoch": "1645642791.152808000"
        }
      ]
    },
    {
      "id": "finding-e4c9ca230db573e97a5ec601",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "ldap",
        "destination": "172.16.0.149",
        "event_count": 83,
        "operation_numbers": [
          "",
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 94,
          "frame_number": 1946,
          "display_filter": "frame.number == 1946",
          "timestamp_epoch": "1645640614.754498000"
        },
        {
          "tcp_stream": 94,
          "frame_number": 2017,
          "display_filter": "frame.number == 2017",
          "timestamp_epoch": "1645640616.150961000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2057,
          "display_filter": "frame.number == 2057",
          "timestamp_epoch": "1645640616.192490000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2093,
          "display_filter": "frame.number == 2093",
          "timestamp_epoch": "1645640616.214288000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2099,
          "display_filter": "frame.number == 2099",
          "timestamp_epoch": "1645640616.216395000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2101,
          "display_filter": "frame.number == 2101",
          "timestamp_epoch": "1645640616.217286000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2236,
          "display_filter": "frame.number == 2236",
          "timestamp_epoch": "1645640616.483184000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2250,
          "display_filter": "frame.number == 2250",
          "timestamp_epoch": "1645640616.591375000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2266,
          "display_filter": "frame.number == 2266",
          "timestamp_epoch": "1645640616.700230000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2274,
          "display_filter": "frame.number == 2274",
          "timestamp_epoch": "1645640616.703149000"
        },
        {
          "tcp_stream": 102,
          "frame_number": 2276,
          "display_filter": "frame.number == 2276",
          "timestamp_epoch": "1645640616.703692000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2288,
          "display_filter": "frame.number == 2288",
          "timestamp_epoch": "1645640617.402199000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2293,
          "display_filter": "frame.number == 2293",
          "timestamp_epoch": "1645640617.405751000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2309,
          "display_filter": "frame.number == 2309",
          "timestamp_epoch": "1645640617.560322000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2316,
          "display_filter": "frame.number == 2316",
          "timestamp_epoch": "1645640617.566206000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2318,
          "display_filter": "frame.number == 2318",
          "timestamp_epoch": "1645640617.566885000"
        },
        {
          "tcp_stream": 119,
          "frame_number": 2320,
          "display_filter": "frame.number == 2320",
          "timestamp_epoch": "1645640617.567254000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 2322,
          "display_filter": "frame.number == 2322",
          "timestamp_epoch": "1645640617.568866000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2533,
          "display_filter": "frame.number == 2533",
          "timestamp_epoch": "1645640619.789694000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2538,
          "display_filter": "frame.number == 2538",
          "timestamp_epoch": "1645640619.794060000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2540,
          "display_filter": "frame.number == 2540",
          "timestamp_epoch": "1645640619.794709000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2542,
          "display_filter": "frame.number == 2542",
          "timestamp_epoch": "1645640619.795689000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 2544,
          "display_filter": "frame.number == 2544",
          "timestamp_epoch": "1645640619.796712000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2551,
          "display_filter": "frame.number == 2551",
          "timestamp_epoch": "1645640619.801362000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2555,
          "display_filter": "frame.number == 2555",
          "timestamp_epoch": "1645640619.802052000"
        },
        {
          "tcp_stream": 125,
          "frame_number": 2558,
          "display_filter": "frame.number == 2558",
          "timestamp_epoch": "1645640619.802809000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2648,
          "display_filter": "frame.number == 2648",
          "timestamp_epoch": "1645640624.984590000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2653,
          "display_filter": "frame.number == 2653",
          "timestamp_epoch": "1645640624.986887000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2655,
          "display_filter": "frame.number == 2655",
          "timestamp_epoch": "1645640624.989313000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2657,
          "display_filter": "frame.number == 2657",
          "timestamp_epoch": "1645640624.989770000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2659,
          "display_filter": "frame.number == 2659",
          "timestamp_epoch": "1645640624.990246000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2661,
          "display_filter": "frame.number == 2661",
          "timestamp_epoch": "1645640624.990799000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 2663,
          "display_filter": "frame.number == 2663",
          "timestamp_epoch": "1645640624.991371000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2935,
          "display_filter": "frame.number == 2935",
          "timestamp_epoch": "1645640629.627828000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2939,
          "display_filter": "frame.number == 2939",
          "timestamp_epoch": "1645640629.633371000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2946,
          "display_filter": "frame.number == 2946",
          "timestamp_epoch": "1645640629.644681000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2948,
          "display_filter": "frame.number == 2948",
          "timestamp_epoch": "1645640629.645400000"
        },
        {
          "tcp_stream": 143,
          "frame_number": 2950,
          "display_filter": "frame.number == 2950",
          "timestamp_epoch": "1645640629.645802000"
        },
        {
          "tcp_stream": 142,
          "frame_number": 2952,
          "display_filter": "frame.number == 2952",
          "timestamp_epoch": "1645640629.647789000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3799,
          "display_filter": "frame.number == 3799",
          "timestamp_epoch": "1645640664.607659000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3804,
          "display_filter": "frame.number == 3804",
          "timestamp_epoch": "1645640664.613088000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3806,
          "display_filter": "frame.number == 3806",
          "timestamp_epoch": "1645640664.621466000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 3808,
          "display_filter": "frame.number == 3808",
          "timestamp_epoch": "1645640664.622973000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3867,
          "display_filter": "frame.number == 3867",
          "timestamp_epoch": "1645640665.156322000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3872,
          "display_filter": "frame.number == 3872",
          "timestamp_epoch": "1645640665.159997000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3874,
          "display_filter": "frame.number == 3874",
          "timestamp_epoch": "1645640665.161987000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3876,
          "display_filter": "frame.number == 3876",
          "timestamp_epoch": "1645640665.162472000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 3878,
          "display_filter": "frame.number == 3878",
          "timestamp_epoch": "1645640665.162823000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3886,
          "display_filter": "frame.number == 3886",
          "timestamp_epoch": "1645640665.180605000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3890,
          "display_filter": "frame.number == 3890",
          "timestamp_epoch": "1645640665.181942000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 3893,
          "display_filter": "frame.number == 3893",
          "timestamp_epoch": "1645640665.183745000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4916,
          "display_filter": "frame.number == 4916",
          "timestamp_epoch": "1645640690.243652000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4921,
          "display_filter": "frame.number == 4921",
          "timestamp_epoch": "1645640690.245134000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4923,
          "display_filter": "frame.number == 4923",
          "timestamp_epoch": "1645640690.245759000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4925,
          "display_filter": "frame.number == 4925",
          "timestamp_epoch": "1645640690.246154000"
        },
        {
          "tcp_stream": 194,
          "frame_number": 4927,
          "display_filter": "frame.number == 4927",
          "timestamp_epoch": "1645640690.246504000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4934,
          "display_filter": "frame.number == 4934",
          "timestamp_epoch": "1645640690.249999000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4938,
          "display_filter": "frame.number == 4938",
          "timestamp_epoch": "1645640690.250641000"
        },
        {
          "tcp_stream": 195,
          "frame_number": 4941,
          "display_filter": "frame.number == 4941",
          "timestamp_epoch": "1645640690.251106000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20541,
          "display_filter": "frame.number == 20541",
          "timestamp_epoch": "1645642430.775530000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20546,
          "display_filter": "frame.number == 20546",
          "timestamp_epoch": "1645642430.777261000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20548,
          "display_filter": "frame.number == 20548",
          "timestamp_epoch": "1645642430.777828000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20550,
          "display_filter": "frame.number == 20550",
          "timestamp_epoch": "1645642430.778102000"
        },
        {
          "tcp_stream": 350,
          "frame_number": 20552,
          "display_filter": "frame.number == 20552",
          "timestamp_epoch": "1645642430.778378000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20559,
          "display_filter": "frame.number == 20559",
          "timestamp_epoch": "1645642430.783381000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20563,
          "display_filter": "frame.number == 20563",
          "timestamp_epoch": "1645642430.784559000"
        },
        {
          "tcp_stream": 351,
          "frame_number": 20566,
          "display_filter": "frame.number == 20566",
          "timestamp_epoch": "1645642430.786084000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21353,
          "display_filter": "frame.number == 21353",
          "timestamp_epoch": "1645642782.748644000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21358,
          "display_filter": "frame.number == 21358",
          "timestamp_epoch": "1645642782.750486000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21360,
          "display_filter": "frame.number == 21360",
          "timestamp_epoch": "1645642782.751209000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21362,
          "display_filter": "frame.number == 21362",
          "timestamp_epoch": "1645642782.751673000"
        },
        {
          "tcp_stream": 372,
          "frame_number": 21364,
          "display_filter": "frame.number == 21364",
          "timestamp_epoch": "1645642782.752114000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21371,
          "display_filter": "frame.number == 21371",
          "timestamp_epoch": "1645642782.757273000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21375,
          "display_filter": "frame.number == 21375",
          "timestamp_epoch": "1645642782.758270000"
        },
        {
          "tcp_stream": 373,
          "frame_number": 21378,
          "display_filter": "frame.number == 21378",
          "timestamp_epoch": "1645642782.758865000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21674,
          "display_filter": "frame.number == 21674",
          "timestamp_epoch": "1645642791.155402000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21679,
          "display_filter": "frame.number == 21679",
          "timestamp_epoch": "1645642791.157283000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21681,
          "display_filter": "frame.number == 21681",
          "timestamp_epoch": "1645642791.158088000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21683,
          "display_filter": "frame.number == 21683",
          "timestamp_epoch": "1645642791.158789000"
        },
        {
          "tcp_stream": 377,
          "frame_number": 21685,
          "display_filter": "frame.number == 21685",
          "timestamp_epoch": "1645642791.159360000"
        },
        {
          "tcp_stream": 378,
          "frame_number": 21692,
          "display_filter": "frame.number == 21692",
          "timestamp_epoch": "1645642791.164100000"
        },
        {
          "tcp_stream": 378,
          "frame_number": 21696,
          "display_filter": "frame.number == 21696",
          "timestamp_epoch": "1645642791.164878000"
        },
        {
          "tcp_stream": 378,
          "frame_number": 21699,
          "display_filter": "frame.number == 21699",
          "timestamp_epoch": "1645642791.165456000"
        }
      ]
    },
    {
      "id": "finding-e21bf086fcc90082a9637598",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "samr",
        "destination": "172.16.0.149",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 95,
          "frame_number": 2868,
          "display_filter": "frame.number == 2868",
          "timestamp_epoch": "1645640629.297222000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2870,
          "display_filter": "frame.number == 2870",
          "timestamp_epoch": "1645640629.298063000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2872,
          "display_filter": "frame.number == 2872",
          "timestamp_epoch": "1645640629.298501000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2874,
          "display_filter": "frame.number == 2874",
          "timestamp_epoch": "1645640629.299163000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2876,
          "display_filter": "frame.number == 2876",
          "timestamp_epoch": "1645640629.299774000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2878,
          "display_filter": "frame.number == 2878",
          "timestamp_epoch": "1645640629.300345000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2880,
          "display_filter": "frame.number == 2880",
          "timestamp_epoch": "1645640629.301392000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2882,
          "display_filter": "frame.number == 2882",
          "timestamp_epoch": "1645640629.302147000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2884,
          "display_filter": "frame.number == 2884",
          "timestamp_epoch": "1645640629.302923000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2886,
          "display_filter": "frame.number == 2886",
          "timestamp_epoch": "1645640629.304151000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2888,
          "display_filter": "frame.number == 2888",
          "timestamp_epoch": "1645640629.305023000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2890,
          "display_filter": "frame.number == 2890",
          "timestamp_epoch": "1645640629.305894000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2892,
          "display_filter": "frame.number == 2892",
          "timestamp_epoch": "1645640629.307087000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2894,
          "display_filter": "frame.number == 2894",
          "timestamp_epoch": "1645640629.307759000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2896,
          "display_filter": "frame.number == 2896",
          "timestamp_epoch": "1645640629.308244000"
        }
      ]
    },
    {
      "id": "finding-faae96d9ebfc30ef0306a4b7",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "drsuapi",
        "destination": "172.16.0.170",
        "event_count": 53,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 43,
          "frame_number": 747,
          "display_filter": "frame.number == 747",
          "timestamp_epoch": "1645640567.543562000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 749,
          "display_filter": "frame.number == 749",
          "timestamp_epoch": "1645640567.544286000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 751,
          "display_filter": "frame.number == 751",
          "timestamp_epoch": "1645640567.544586000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 753,
          "display_filter": "frame.number == 753",
          "timestamp_epoch": "1645640567.544855000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 785,
          "display_filter": "frame.number == 785",
          "timestamp_epoch": "1645640567.664602000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 787,
          "display_filter": "frame.number == 787",
          "timestamp_epoch": "1645640567.665346000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 789,
          "display_filter": "frame.number == 789",
          "timestamp_epoch": "1645640567.665874000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 791,
          "display_filter": "frame.number == 791",
          "timestamp_epoch": "1645640567.666298000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1099,
          "display_filter": "frame.number == 1099",
          "timestamp_epoch": "1645640570.623014000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1101,
          "display_filter": "frame.number == 1101",
          "timestamp_epoch": "1645640570.625352000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1103,
          "display_filter": "frame.number == 1103",
          "timestamp_epoch": "1645640570.625805000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1107,
          "display_filter": "frame.number == 1107",
          "timestamp_epoch": "1645640570.631531000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1109,
          "display_filter": "frame.number == 1109",
          "timestamp_epoch": "1645640570.632332000"
        },
        {
          "tcp_stream": 58,
          "frame_number": 1111,
          "display_filter": "frame.number == 1111",
          "timestamp_epoch": "1645640570.635631000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1425,
          "display_filter": "frame.number == 1425",
          "timestamp_epoch": "1645640588.974540000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1428,
          "display_filter": "frame.number == 1428",
          "timestamp_epoch": "1645640588.975109000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1431,
          "display_filter": "frame.number == 1431",
          "timestamp_epoch": "1645640588.975937000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 1434,
          "display_filter": "frame.number == 1434",
          "timestamp_epoch": "1645640588.976383000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3521,
          "display_filter": "frame.number == 3521",
          "timestamp_epoch": "1645640650.196489000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3523,
          "display_filter": "frame.number == 3523",
          "timestamp_epoch": "1645640650.197031000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3525,
          "display_filter": "frame.number == 3525",
          "timestamp_epoch": "1645640650.197368000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3529,
          "display_filter": "frame.number == 3529",
          "timestamp_epoch": "1645640650.201221000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3531,
          "display_filter": "frame.number == 3531",
          "timestamp_epoch": "1645640650.201992000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 3533,
          "display_filter": "frame.number == 3533",
          "timestamp_epoch": "1645640650.202576000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3593,
          "display_filter": "frame.number == 3593",
          "timestamp_epoch": "1645640650.319340000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3595,
          "display_filter": "frame.number == 3595",
          "timestamp_epoch": "1645640650.320117000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3597,
          "display_filter": "frame.number == 3597",
          "timestamp_epoch": "1645640650.320502000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3601,
          "display_filter": "frame.number == 3601",
          "timestamp_epoch": "1645640650.322363000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3603,
          "display_filter": "frame.number == 3603",
          "timestamp_epoch": "1645640650.323055000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 3605,
          "display_filter": "frame.number == 3605",
          "timestamp_epoch": "1645640650.323487000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9701,
          "display_filter": "frame.number == 9701",
          "timestamp_epoch": "1645640959.793026000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9703,
          "display_filter": "frame.number == 9703",
          "timestamp_epoch": "1645640959.793722000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9705,
          "display_filter": "frame.number == 9705",
          "timestamp_epoch": "1645640959.794290000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9709,
          "display_filter": "frame.number == 9709",
          "timestamp_epoch": "1645640959.796109000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9711,
          "display_filter": "frame.number == 9711",
          "timestamp_epoch": "1645640959.796781000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 9713,
          "display_filter": "frame.number == 9713",
          "timestamp_epoch": "1645640959.797268000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20268,
          "display_filter": "frame.number == 20268",
          "timestamp_epoch": "1645642390.516219000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20270,
          "display_filter": "frame.number == 20270",
          "timestamp_epoch": "1645642390.517721000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20272,
          "display_filter": "frame.number == 20272",
          "timestamp_epoch": "1645642390.518167000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20274,
          "display_filter": "frame.number == 20274",
          "timestamp_epoch": "1645642390.518650000"
        },
        {
          "tcp_stream": 338,
          "frame_number": 20276,
          "display_filter": "frame.number == 20276",
          "timestamp_epoch": "1645642390.519153000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20294,
          "display_filter": "frame.number == 20294",
          "timestamp_epoch": "1645642390.532339000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20298,
          "display_filter": "frame.number == 20298",
          "timestamp_epoch": "1645642390.532999000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20300,
          "display_filter": "frame.number == 20300",
          "timestamp_epoch": "1645642390.533392000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20304,
          "display_filter": "frame.number == 20304",
          "timestamp_epoch": "1645642390.536398000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20306,
          "display_filter": "frame.number == 20306",
          "timestamp_epoch": "1645642390.537045000"
        },
        {
          "tcp_stream": 340,
          "frame_number": 20308,
          "display_filter": "frame.number == 20308",
          "timestamp_epoch": "1645642390.541861000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23144,
          "display_filter": "frame.number == 23144",
          "timestamp_epoch": "1645642945.279567000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23146,
          "display_filter": "frame.number == 23146",
          "timestamp_epoch": "1645642945.280239000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23148,
          "display_filter": "frame.number == 23148",
          "timestamp_epoch": "1645642945.280709000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23152,
          "display_filter": "frame.number == 23152",
          "timestamp_epoch": "1645642945.283152000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23154,
          "display_filter": "frame.number == 23154",
          "timestamp_epoch": "1645642945.283686000"
        },
        {
          "tcp_stream": 392,
          "frame_number": 23156,
          "display_filter": "frame.number == 23156",
          "timestamp_epoch": "1645642945.284029000"
        }
      ]
    },
    {
      "id": "finding-391ccad363429c759ce187a4",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "ldap",
        "destination": "172.16.0.170",
        "event_count": 79,
        "operation_numbers": [
          "",
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 32,
          "frame_number": 579,
          "display_filter": "frame.number == 579",
          "timestamp_epoch": "1645640566.799387000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 620,
          "display_filter": "frame.number == 620",
          "timestamp_epoch": "1645640567.308114000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 681,
          "display_filter": "frame.number == 681",
          "timestamp_epoch": "1645640567.336670000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 683,
          "display_filter": "frame.number == 683",
          "timestamp_epoch": "1645640567.338454000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 686,
          "display_filter": "frame.number == 686",
          "timestamp_epoch": "1645640567.339566000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 815,
          "display_filter": "frame.number == 815",
          "timestamp_epoch": "1645640567.919198000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 827,
          "display_filter": "frame.number == 827",
          "timestamp_epoch": "1645640568.030847000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 841,
          "display_filter": "frame.number == 841",
          "timestamp_epoch": "1645640568.228556000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 854,
          "display_filter": "frame.number == 854",
          "timestamp_epoch": "1645640568.337408000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 862,
          "display_filter": "frame.number == 862",
          "timestamp_epoch": "1645640568.339013000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 864,
          "display_filter": "frame.number == 864",
          "timestamp_epoch": "1645640568.339520000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 876,
          "display_filter": "frame.number == 876",
          "timestamp_epoch": "1645640568.908477000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 881,
          "display_filter": "frame.number == 881",
          "timestamp_epoch": "1645640568.911706000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 897,
          "display_filter": "frame.number == 897",
          "timestamp_epoch": "1645640568.938019000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 904,
          "display_filter": "frame.number == 904",
          "timestamp_epoch": "1645640568.944099000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 906,
          "display_filter": "frame.number == 906",
          "timestamp_epoch": "1645640568.945025000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 908,
          "display_filter": "frame.number == 908",
          "timestamp_epoch": "1645640568.946051000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 910,
          "display_filter": "frame.number == 910",
          "timestamp_epoch": "1645640568.947643000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1117,
          "display_filter": "frame.number == 1117",
          "timestamp_epoch": "1645640570.648348000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1122,
          "display_filter": "frame.number == 1122",
          "timestamp_epoch": "1645640570.652765000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1124,
          "display_filter": "frame.number == 1124",
          "timestamp_epoch": "1645640570.656233000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1126,
          "display_filter": "frame.number == 1126",
          "timestamp_epoch": "1645640570.657957000"
        },
        {
          "tcp_stream": 59,
          "frame_number": 1128,
          "display_filter": "frame.number == 1128",
          "timestamp_epoch": "1645640570.658418000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1135,
          "display_filter": "frame.number == 1135",
          "timestamp_epoch": "1645640570.665952000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1139,
          "display_filter": "frame.number == 1139",
          "timestamp_epoch": "1645640570.666493000"
        },
        {
          "tcp_stream": 60,
          "frame_number": 1142,
          "display_filter": "frame.number == 1142",
          "timestamp_epoch": "1645640570.667024000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1228,
          "display_filter": "frame.number == 1228",
          "timestamp_epoch": "1645640576.824364000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1233,
          "display_filter": "frame.number == 1233",
          "timestamp_epoch": "1645640576.826502000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1235,
          "display_filter": "frame.number == 1235",
          "timestamp_epoch": "1645640576.828895000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1237,
          "display_filter": "frame.number == 1237",
          "timestamp_epoch": "1645640576.829358000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1239,
          "display_filter": "frame.number == 1239",
          "timestamp_epoch": "1645640576.829845000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1241,
          "display_filter": "frame.number == 1241",
          "timestamp_epoch": "1645640576.830364000"
        },
        {
          "tcp_stream": 63,
          "frame_number": 1243,
          "display_filter": "frame.number == 1243",
          "timestamp_epoch": "1645640576.830935000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1505,
          "display_filter": "frame.number == 1505",
          "timestamp_epoch": "1645640589.339179000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1507,
          "display_filter": "frame.number == 1507",
          "timestamp_epoch": "1645640589.346256000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1514,
          "display_filter": "frame.number == 1514",
          "timestamp_epoch": "1645640589.357184000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1516,
          "display_filter": "frame.number == 1516",
          "timestamp_epoch": "1645640589.361255000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 1518,
          "display_filter": "frame.number == 1518",
          "timestamp_epoch": "1645640589.361834000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 1520,
          "display_filter": "frame.number == 1520",
          "timestamp_epoch": "1645640589.364352000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3539,
          "display_filter": "frame.number == 3539",
          "timestamp_epoch": "1645640650.207217000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3544,
          "display_filter": "frame.number == 3544",
          "timestamp_epoch": "1645640650.210299000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3546,
          "display_filter": "frame.number == 3546",
          "timestamp_epoch": "1645640650.211073000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3548,
          "display_filter": "frame.number == 3548",
          "timestamp_epoch": "1645640650.211934000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 3550,
          "display_filter": "frame.number == 3550",
          "timestamp_epoch": "1645640650.212317000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3557,
          "display_filter": "frame.number == 3557",
          "timestamp_epoch": "1645640650.219054000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3561,
          "display_filter": "frame.number == 3561",
          "timestamp_epoch": "1645640650.220236000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 3564,
          "display_filter": "frame.number == 3564",
          "timestamp_epoch": "1645640650.220934000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3611,
          "display_filter": "frame.number == 3611",
          "timestamp_epoch": "1645640650.336691000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3616,
          "display_filter": "frame.number == 3616",
          "timestamp_epoch": "1645640650.348458000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3618,
          "display_filter": "frame.number == 3618",
          "timestamp_epoch": "1645640650.350042000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3620,
          "display_filter": "frame.number == 3620",
          "timestamp_epoch": "1645640650.350587000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 3622,
          "display_filter": "frame.number == 3622",
          "timestamp_epoch": "1645640650.354539000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3633,
          "display_filter": "frame.number == 3633",
          "timestamp_epoch": "1645640650.360555000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3637,
          "display_filter": "frame.number == 3637",
          "timestamp_epoch": "1645640650.361737000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 3640,
          "display_filter": "frame.number == 3640",
          "timestamp_epoch": "1645640650.363417000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9719,
          "display_filter": "frame.number == 9719",
          "timestamp_epoch": "1645640959.799564000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9724,
          "display_filter": "frame.number == 9724",
          "timestamp_epoch": "1645640959.800922000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9726,
          "display_filter": "frame.number == 9726",
          "timestamp_epoch": "1645640959.801465000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9728,
          "display_filter": "frame.number == 9728",
          "timestamp_epoch": "1645640959.801857000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 9730,
          "display_filter": "frame.number == 9730",
          "timestamp_epoch": "1645640959.802227000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9737,
          "display_filter": "frame.number == 9737",
          "timestamp_epoch": "1645640959.805631000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9741,
          "display_filter": "frame.number == 9741",
          "timestamp_epoch": "1645640959.806533000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 9744,
          "display_filter": "frame.number == 9744",
          "timestamp_epoch": "1645640959.807153000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20322,
          "display_filter": "frame.number == 20322",
          "timestamp_epoch": "1645642390.649409000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20327,
          "display_filter": "frame.number == 20327",
          "timestamp_epoch": "1645642390.651452000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20329,
          "display_filter": "frame.number == 20329",
          "timestamp_epoch": "1645642390.654167000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20331,
          "display_filter": "frame.number == 20331",
          "timestamp_epoch": "1645642390.654558000"
        },
        {
          "tcp_stream": 341,
          "frame_number": 20333,
          "display_filter": "frame.number == 20333",
          "timestamp_epoch": "1645642390.654888000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20340,
          "display_filter": "frame.number == 20340",
          "timestamp_epoch": "1645642390.659896000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20344,
          "display_filter": "frame.number == 20344",
          "timestamp_epoch": "1645642390.660656000"
        },
        {
          "tcp_stream": 342,
          "frame_number": 20347,
          "display_filter": "frame.number == 20347",
          "timestamp_epoch": "1645642390.661220000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23162,
          "display_filter": "frame.number == 23162",
          "timestamp_epoch": "1645642945.287986000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23167,
          "display_filter": "frame.number == 23167",
          "timestamp_epoch": "1645642945.290130000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23169,
          "display_filter": "frame.number == 23169",
          "timestamp_epoch": "1645642945.290862000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23171,
          "display_filter": "frame.number == 23171",
          "timestamp_epoch": "1645642945.291310000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 23173,
          "display_filter": "frame.number == 23173",
          "timestamp_epoch": "1645642945.291720000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23180,
          "display_filter": "frame.number == 23180",
          "timestamp_epoch": "1645642945.297173000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23184,
          "display_filter": "frame.number == 23184",
          "timestamp_epoch": "1645642945.298004000"
        },
        {
          "tcp_stream": 394,
          "frame_number": 23187,
          "display_filter": "frame.number == 23187",
          "timestamp_epoch": "1645642945.298571000"
        }
      ]
    },
    {
      "id": "finding-4a343151f2b61f8841a32dc4",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.52",
        "protocol": "samr",
        "destination": "172.16.0.170",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 31,
          "frame_number": 1427,
          "display_filter": "frame.number == 1427",
          "timestamp_epoch": "1645640588.975010000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1433,
          "display_filter": "frame.number == 1433",
          "timestamp_epoch": "1645640588.976304000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1436,
          "display_filter": "frame.number == 1436",
          "timestamp_epoch": "1645640588.977191000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1438,
          "display_filter": "frame.number == 1438",
          "timestamp_epoch": "1645640588.977788000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1440,
          "display_filter": "frame.number == 1440",
          "timestamp_epoch": "1645640588.978465000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1442,
          "display_filter": "frame.number == 1442",
          "timestamp_epoch": "1645640588.979248000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1444,
          "display_filter": "frame.number == 1444",
          "timestamp_epoch": "1645640588.979958000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1448,
          "display_filter": "frame.number == 1448",
          "timestamp_epoch": "1645640588.980665000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1450,
          "display_filter": "frame.number == 1450",
          "timestamp_epoch": "1645640588.981444000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1452,
          "display_filter": "frame.number == 1452",
          "timestamp_epoch": "1645640588.982235000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1454,
          "display_filter": "frame.number == 1454",
          "timestamp_epoch": "1645640588.983436000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1456,
          "display_filter": "frame.number == 1456",
          "timestamp_epoch": "1645640588.984264000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1458,
          "display_filter": "frame.number == 1458",
          "timestamp_epoch": "1645640588.985239000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1460,
          "display_filter": "frame.number == 1460",
          "timestamp_epoch": "1645640588.985825000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1462,
          "display_filter": "frame.number == 1462",
          "timestamp_epoch": "1645640588.986504000"
        }
      ]
    },
    {
      "id": "finding-06d19ca04c2891c9d1974279",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 127,
        "wire_bytes": 87055,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 52.845
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 187,
          "frame_number": 4679,
          "display_filter": "tcp.stream == 187",
          "timestamp_epoch": "1645640683.773918"
        }
      ]
    },
    {
      "id": "finding-ca4895b03f074d80d78e7f8d",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2721,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 96.025
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 188,
          "frame_number": 4802,
          "display_filter": "tcp.stream == 188",
          "timestamp_epoch": "1645640686.046147"
        }
      ]
    },
    {
      "id": "finding-2c34427819addd990fa406fe",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2517,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 47.78
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 198,
          "frame_number": 5068,
          "display_filter": "tcp.stream == 198",
          "timestamp_epoch": "1645640736.619127"
        }
      ]
    },
    {
      "id": "finding-59c5a0156bfbaad87633a701",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 117,
        "wire_bytes": 86156,
        "destination": "27.254.174.84",
        "destination_port": 8080,
        "duration_seconds": 60.005
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 203,
          "frame_number": 6688,
          "display_filter": "tcp.stream == 203",
          "timestamp_epoch": "1645640753.128039"
        }
      ]
    },
    {
      "id": "finding-a85331d7b2b5a32af59d08b3",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 20,
        "wire_bytes": 3034,
        "destination": "27.254.174.84",
        "destination_port": 8080,
        "duration_seconds": 104.051
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 204,
          "frame_number": 6805,
          "display_filter": "tcp.stream == 204",
          "timestamp_epoch": "1645640759.066759"
        }
      ]
    },
    {
      "id": "finding-70dcd071122388f52f312df0",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 18,
        "wire_bytes": 2793,
        "destination": "27.254.174.84",
        "destination_port": 8080,
        "duration_seconds": 49.984
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 213,
          "frame_number": 7688,
          "display_filter": "tcp.stream == 213",
          "timestamp_epoch": "1645640813.133526"
        }
      ]
    },
    {
      "id": "finding-ab3fc5a0202cba0c5ae08e29",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2755,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 46.582
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 214,
          "frame_number": 7719,
          "display_filter": "tcp.stream == 214",
          "timestamp_epoch": "1645640832.307679"
        }
      ]
    },
    {
      "id": "finding-4b5200000e57b3249a9a2b26",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 76,
        "wire_bytes": 54377,
        "destination": "27.254.174.84",
        "destination_port": 8080,
        "duration_seconds": 41.718
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 216,
          "frame_number": 7792,
          "display_filter": "tcp.stream == 216",
          "timestamp_epoch": "1645640869.244491"
        }
      ]
    },
    {
      "id": "finding-bc2f3cbbabe40188235df653",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 412,
        "wire_bytes": 320581,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 51.375
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 221,
          "frame_number": 8729,
          "display_filter": "tcp.stream == 221",
          "timestamp_epoch": "1645640932.482644"
        }
      ]
    },
    {
      "id": "finding-9f2700a7561e24253691f1a8",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 3342,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 76.16
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 222,
          "frame_number": 9146,
          "display_filter": "tcp.stream == 222",
          "timestamp_epoch": "1645640937.604581"
        }
      ]
    },
    {
      "id": "finding-b8e0c122560fa6095aee53b1",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 559,
        "wire_bytes": 492888,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 117.001
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 227,
          "frame_number": 9331,
          "display_filter": "tcp.stream == 227",
          "timestamp_epoch": "1645640948.764198"
        }
      ]
    },
    {
      "id": "finding-12e9a2405def5181c6da8071",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 21,
        "wire_bytes": 3237,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 66.043
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 236,
          "frame_number": 10803,
          "display_filter": "tcp.stream == 236",
          "timestamp_epoch": "1645641012.302161"
        }
      ]
    },
    {
      "id": "finding-1e8cad87427d57ca55eb5a8c",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 117,
        "wire_bytes": 89737,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 61.284
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 237,
          "frame_number": 10835,
          "display_filter": "tcp.stream == 237",
          "timestamp_epoch": "1645641015.92095"
        }
      ]
    },
    {
      "id": "finding-9241cd6aefa4f5d857f2bbbd",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 21,
        "wire_bytes": 3151,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 61.474
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 238,
          "frame_number": 10946,
          "display_filter": "tcp.stream == 238",
          "timestamp_epoch": "1645641017.459389"
        }
      ]
    },
    {
      "id": "finding-fa9660903d9e030b24c720eb",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 412,
        "wire_bytes": 340415,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 46.562
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 247,
          "frame_number": 11650,
          "display_filter": "tcp.stream == 247",
          "timestamp_epoch": "1645641077.205749"
        }
      ]
    },
    {
      "id": "finding-6852f74e87cdf008a7f7762d",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 19,
        "wire_bytes": 2986,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 95.062
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 249,
          "frame_number": 11743,
          "display_filter": "tcp.stream == 249",
          "timestamp_epoch": "1645641078.346228"
        }
      ]
    },
    {
      "id": "finding-7ffad38452a160a9d855f48a",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 3271,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 44.834
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 251,
          "frame_number": 12139,
          "display_filter": "tcp.stream == 251",
          "timestamp_epoch": "1645641078.933946"
        }
      ]
    },
    {
      "id": "finding-11a291414d9764e861f0dca6",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2678,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 48.149
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 261,
          "frame_number": 13103,
          "display_filter": "tcp.stream == 261",
          "timestamp_epoch": "1645641130.331071"
        }
      ]
    },
    {
      "id": "finding-403403e44e8682dd981c1408",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 19,
        "wire_bytes": 3058,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 79.426
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 262,
          "frame_number": 13119,
          "display_filter": "tcp.stream == 262",
          "timestamp_epoch": "1645641133.501484"
        }
      ]
    },
    {
      "id": "finding-0d6b4f1875915bc35c20f64c",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 398,
        "wire_bytes": 319970,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 94.94
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 268,
          "frame_number": 13219,
          "display_filter": "tcp.stream == 268",
          "timestamp_epoch": "1645641173.40893"
        }
      ]
    },
    {
      "id": "finding-5b0f3cba25a944b87a0dd8d5",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 132,
        "wire_bytes": 101806,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 49.955
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 272,
          "frame_number": 13452,
          "display_filter": "tcp.stream == 272",
          "timestamp_epoch": "1645641177.113862"
        }
      ]
    },
    {
      "id": "finding-ba863356386c28bdd14e88d7",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2461,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 55.29
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 274,
          "frame_number": 13684,
          "display_filter": "tcp.stream == 274",
          "timestamp_epoch": "1645641178.480852"
        }
      ]
    },
    {
      "id": "finding-461b19b07f1c5852b3fec7f2",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 19,
        "wire_bytes": 2359,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 90.205
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 281,
          "frame_number": 14063,
          "display_filter": "tcp.stream == 281",
          "timestamp_epoch": "1645641212.927267"
        }
      ]
    },
    {
      "id": "finding-e202592fdb03a3280900f033",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 21,
        "wire_bytes": 4464,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 34.782
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 293,
          "frame_number": 14528,
          "display_filter": "tcp.stream == 293",
          "timestamp_epoch": "1645641268.349874"
        }
      ]
    },
    {
      "id": "finding-9f5796ff907da8e7c072dd3a",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 201,
        "wire_bytes": 159636,
        "destination": "168.197.250.14",
        "destination_port": 80,
        "duration_seconds": 40.858
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 298,
          "frame_number": 14623,
          "display_filter": "tcp.stream == 298",
          "timestamp_epoch": "1645641331.632906"
        }
      ]
    },
    {
      "id": "finding-f9a14b9c8478c0d41b8aaabe",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 767,
        "wire_bytes": 545561,
        "destination": "162.144.76.184",
        "destination_port": 8080,
        "duration_seconds": 32.803
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 306,
          "frame_number": 16159,
          "display_filter": "tcp.stream == 306",
          "timestamp_epoch": "1645641453.832013"
        }
      ]
    },
    {
      "id": "finding-2cde3930ce4a0b501d001ada",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 767,
        "wire_bytes": 546358,
        "destination": "128.199.93.156",
        "destination_port": 8080,
        "duration_seconds": 36.477
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 311,
          "frame_number": 17066,
          "display_filter": "tcp.stream == 311",
          "timestamp_epoch": "1645641486.643664"
        }
      ]
    },
    {
      "id": "finding-9ea0a6d8be0c51176d3dcba2",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 422,
        "wire_bytes": 342682,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 51.515
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 324,
          "frame_number": 18531,
          "display_filter": "tcp.stream == 324",
          "timestamp_epoch": "1645642135.363262"
        }
      ]
    },
    {
      "id": "finding-ed970b543e88bda6cb04c409",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2922,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 83.461
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 325,
          "frame_number": 18949,
          "display_filter": "tcp.stream == 325",
          "timestamp_epoch": "1645642137.105876"
        }
      ]
    },
    {
      "id": "finding-a49ada6920dd8f99a774a42a",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 2531,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 35.196
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 329,
          "frame_number": 19849,
          "display_filter": "tcp.stream == 329",
          "timestamp_epoch": "1645642186.87885"
        }
      ]
    },
    {
      "id": "finding-2d96e44efe6a7388ae5aaa06",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.149",
        "packets": 19,
        "wire_bytes": 3198,
        "destination": "135.148.121.246",
        "destination_port": 8080,
        "duration_seconds": 85.095
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 333,
          "frame_number": 20080,
          "display_filter": "tcp.stream == 333",
          "timestamp_epoch": "1645642270.288195"
        }
      ]
    },
    {
      "id": "finding-c6cb780367b0c8d188ae04b3",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 124,
        "wire_bytes": 101936,
        "destination": "139.196.72.155",
        "destination_port": 8080,
        "duration_seconds": 51.093
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 367,
          "frame_number": 20948,
          "display_filter": "tcp.stream == 367",
          "timestamp_epoch": "1645642703.769347"
        }
      ]
    },
    {
      "id": "finding-1fe471d17ec14e3cc77398df",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 19,
        "wire_bytes": 3125,
        "destination": "139.196.72.155",
        "destination_port": 8080,
        "duration_seconds": 38.15
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 368,
          "frame_number": 21069,
          "display_filter": "tcp.stream == 368",
          "timestamp_epoch": "1645642716.711457"
        }
      ]
    },
    {
      "id": "finding-401583dfe05e8d90426ca038",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 413,
        "wire_bytes": 356002,
        "destination": "139.196.72.155",
        "destination_port": 8080,
        "duration_seconds": 58.283
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 369,
          "frame_number": 21121,
          "display_filter": "tcp.stream == 369",
          "timestamp_epoch": "1645642764.595545"
        }
      ]
    },
    {
      "id": "finding-024a3be901244297c3264664",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 1334,
        "wire_bytes": 1155759,
        "destination": "185.184.25.78",
        "destination_port": 8080,
        "duration_seconds": 123.7
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 390,
          "frame_number": 21759,
          "display_filter": "tcp.stream == 390",
          "timestamp_epoch": "1645642830.18209"
        }
      ]
    },
    {
      "id": "finding-6ffdc53279e37b400961cafc",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 23,
        "wire_bytes": 4023,
        "destination": "54.37.106.167",
        "destination_port": 8080,
        "duration_seconds": 122.065
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 411,
          "frame_number": 23259,
          "display_filter": "tcp.stream == 411",
          "timestamp_epoch": "1645642962.805401"
        }
      ]
    },
    {
      "id": "finding-7d4b04f2874252a7bd7bf69a",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 890,
        "wire_bytes": 789030,
        "destination": "198.199.98.78",
        "destination_port": 8080,
        "duration_seconds": 95.397
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 417,
          "frame_number": 23301,
          "display_filter": "tcp.stream == 417",
          "timestamp_epoch": "1645642998.865202"
        }
      ]
    },
    {
      "id": "finding-3f376cc10fe35744747aa47a",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "172.16.0.170",
        "packets": 302,
        "wire_bytes": 248547,
        "destination": "128.199.192.135",
        "destination_port": 8080,
        "duration_seconds": 49.124
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 469,
          "frame_number": 24437,
          "display_filter": "tcp.stream == 469",
          "timestamp_epoch": "1645643168.280407"
        }
      ]
    },
    {
      "id": "identity-5c20057d369ec465eee986d8",
      "type": "identity",
      "label": "account: desktop-kpq9fdb$",
      "value": "desktop-kpq9fdb$",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.149"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 96,
          "frame_number": 1987,
          "display_filter": "frame.number == 1987",
          "timestamp_epoch": "1645640616.121378000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 1995,
          "display_filter": "frame.number == 1995",
          "timestamp_epoch": "1645640616.132424000"
        },
        {
          "tcp_stream": 97,
          "frame_number": 1997,
          "display_filter": "frame.number == 1997",
          "timestamp_epoch": "1645640616.133169000"
        },
        {
          "tcp_stream": 98,
          "frame_number": 2009,
          "display_filter": "frame.number == 2009",
          "timestamp_epoch": "1645640616.140408000"
        },
        {
          "tcp_stream": 103,
          "frame_number": 2062,
          "display_filter": "frame.number == 2062",
          "timestamp_epoch": "1645640616.194992000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 2071,
          "display_filter": "frame.number == 2071",
          "timestamp_epoch": "1645640616.206819000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 2073,
          "display_filter": "frame.number == 2073",
          "timestamp_epoch": "1645640616.207566000"
        },
        {
          "tcp_stream": 105,
          "frame_number": 2085,
          "display_filter": "frame.number == 2085",
          "timestamp_epoch": "1645640616.212646000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 2106,
          "display_filter": "frame.number == 2106",
          "timestamp_epoch": "1645640616.230906000"
        },
        {
          "tcp_stream": 107,
          "frame_number": 2116,
          "display_filter": "frame.number == 2116",
          "timestamp_epoch": "1645640616.232195000"
        },
        {
          "tcp_stream": 107,
          "frame_number": 2118,
          "display_filter": "frame.number == 2118",
          "timestamp_epoch": "1645640616.232774000"
        },
        {
          "tcp_stream": 108,
          "frame_number": 2135,
          "display_filter": "frame.number == 2135",
          "timestamp_epoch": "1645640616.234506000"
        },
        {
          "tcp_stream": 109,
          "frame_number": 2150,
          "display_filter": "frame.number == 2150",
          "timestamp_epoch": "1645640616.236540000"
        },
        {
          "tcp_stream": 112,
          "frame_number": 2203,
          "display_filter": "frame.number == 2203",
          "timestamp_epoch": "1645640616.372591000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 2303,
          "display_filter": "frame.number == 2303",
          "timestamp_epoch": "1645640617.525395000"
        },
        {
          "tcp_stream": 120,
          "frame_number": 2336,
          "display_filter": "frame.number == 2336",
          "timestamp_epoch": "1645640617.764050000"
        },
        {
          "tcp_stream": 121,
          "frame_number": 2348,
          "display_filter": "frame.number == 2348",
          "timestamp_epoch": "1645640617.765928000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 2667,
          "display_filter": "frame.number == 2667",
          "timestamp_epoch": "1645640624.996060000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 2675,
          "display_filter": "frame.number == 2675",
          "timestamp_epoch": "1645640624.997544000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 2677,
          "display_filter": "frame.number == 2677",
          "timestamp_epoch": "1645640624.998152000"
        }
      ]
    },
    {
      "id": "identity-3a13e1adda12b68c6ae2d52b",
      "type": "identity",
      "label": "account: desktop-vd151o7$",
      "value": "desktop-vd151o7$",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.131"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 30,
          "display_filter": "frame.number == 30",
          "timestamp_epoch": "1645640545.473340000"
        },
        {
          "tcp_stream": 2,
          "frame_number": 38,
          "display_filter": "frame.number == 38",
          "timestamp_epoch": "1645640545.484867000"
        },
        {
          "tcp_stream": 2,
          "frame_number": 40,
          "display_filter": "frame.number == 40",
          "timestamp_epoch": "1645640545.485823000"
        },
        {
          "tcp_stream": 3,
          "frame_number": 52,
          "display_filter": "frame.number == 52",
          "timestamp_epoch": "1645640545.490090000"
        },
        {
          "tcp_stream": 4,
          "frame_number": 64,
          "display_filter": "frame.number == 64",
          "timestamp_epoch": "1645640545.492233000"
        },
        {
          "tcp_stream": 6,
          "frame_number": 111,
          "display_filter": "frame.number == 111",
          "timestamp_epoch": "1645640545.850341000"
        },
        {
          "tcp_stream": 9,
          "frame_number": 143,
          "display_filter": "frame.number == 143",
          "timestamp_epoch": "1645640546.132692000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 151,
          "display_filter": "frame.number == 151",
          "timestamp_epoch": "1645640546.146611000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 153,
          "display_filter": "frame.number == 153",
          "timestamp_epoch": "1645640546.147903000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 167,
          "display_filter": "frame.number == 167",
          "timestamp_epoch": "1645640546.167016000"
        },
        {
          "tcp_stream": 14,
          "frame_number": 223,
          "display_filter": "frame.number == 223",
          "timestamp_epoch": "1645640546.384892000"
        },
        {
          "tcp_stream": 21,
          "frame_number": 312,
          "display_filter": "frame.number == 312",
          "timestamp_epoch": "1645640546.843410000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 326,
          "display_filter": "frame.number == 326",
          "timestamp_epoch": "1645640546.849084000"
        },
        {
          "tcp_stream": 28,
          "frame_number": 464,
          "display_filter": "frame.number == 464",
          "timestamp_epoch": "1645640556.027041000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 472,
          "display_filter": "frame.number == 472",
          "timestamp_epoch": "1645640556.028191000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 474,
          "display_filter": "frame.number == 474",
          "timestamp_epoch": "1645640556.029124000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 486,
          "display_filter": "frame.number == 486",
          "timestamp_epoch": "1645640556.030885000"
        }
      ]
    },
    {
      "id": "identity-df3e9c09c70b8ad989ad5495",
      "type": "identity",
      "label": "account: desktop-w5tftqy$",
      "value": "desktop-w5tftqy$",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.170"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 36,
          "frame_number": 625,
          "display_filter": "frame.number == 625",
          "timestamp_epoch": "1645640567.310885000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 633,
          "display_filter": "frame.number == 633",
          "timestamp_epoch": "1645640567.321568000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 637,
          "display_filter": "frame.number == 637",
          "timestamp_epoch": "1645640567.322711000"
        },
        {
          "tcp_stream": 38,
          "frame_number": 647,
          "display_filter": "frame.number == 647",
          "timestamp_epoch": "1645640567.323996000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 663,
          "display_filter": "frame.number == 663",
          "timestamp_epoch": "1645640567.329553000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 671,
          "display_filter": "frame.number == 671",
          "timestamp_epoch": "1645640567.334125000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 675,
          "display_filter": "frame.number == 675",
          "timestamp_epoch": "1645640567.335035000"
        },
        {
          "tcp_stream": 41,
          "frame_number": 694,
          "display_filter": "frame.number == 694",
          "timestamp_epoch": "1645640567.340784000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 707,
          "display_filter": "frame.number == 707",
          "timestamp_epoch": "1645640567.342325000"
        },
        {
          "tcp_stream": 46,
          "frame_number": 773,
          "display_filter": "frame.number == 773",
          "timestamp_epoch": "1645640567.660517000"
        },
        {
          "tcp_stream": 47,
          "frame_number": 807,
          "display_filter": "frame.number == 807",
          "timestamp_epoch": "1645640567.917288000"
        },
        {
          "tcp_stream": 53,
          "frame_number": 889,
          "display_filter": "frame.number == 889",
          "timestamp_epoch": "1645640568.930876000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 922,
          "display_filter": "frame.number == 922",
          "timestamp_epoch": "1645640569.016796000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 934,
          "display_filter": "frame.number == 934",
          "timestamp_epoch": "1645640569.018700000"
        },
        {
          "tcp_stream": 61,
          "frame_number": 1180,
          "display_filter": "frame.number == 1180",
          "timestamp_epoch": "1645640571.284719000"
        },
        {
          "tcp_stream": 64,
          "frame_number": 1247,
          "display_filter": "frame.number == 1247",
          "timestamp_epoch": "1645640576.834814000"
        },
        {
          "tcp_stream": 65,
          "frame_number": 1255,
          "display_filter": "frame.number == 1255",
          "timestamp_epoch": "1645640576.836309000"
        },
        {
          "tcp_stream": 65,
          "frame_number": 1257,
          "display_filter": "frame.number == 1257",
          "timestamp_epoch": "1645640576.836932000"
        },
        {
          "tcp_stream": 66,
          "frame_number": 1269,
          "display_filter": "frame.number == 1269",
          "timestamp_epoch": "1645640576.838646000"
        }
      ]
    },
    {
      "id": "identity-b57b9866a3fc92d2b4ca7a32",
      "type": "identity",
      "label": "account: everett.french",
      "value": "everett.french",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.170"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 68,
          "frame_number": 1337,
          "display_filter": "frame.number == 1337",
          "timestamp_epoch": "1645640588.866775000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 1345,
          "display_filter": "frame.number == 1345",
          "timestamp_epoch": "1645640588.873025000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 1347,
          "display_filter": "frame.number == 1347",
          "timestamp_epoch": "1645640588.873719000"
        },
        {
          "tcp_stream": 70,
          "frame_number": 1359,
          "display_filter": "frame.number == 1359",
          "timestamp_epoch": "1645640588.875352000"
        },
        {
          "tcp_stream": 71,
          "frame_number": 1373,
          "display_filter": "frame.number == 1373",
          "timestamp_epoch": "1645640588.956998000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 1385,
          "display_filter": "frame.number == 1385",
          "timestamp_epoch": "1645640588.958618000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 1404,
          "display_filter": "frame.number == 1404",
          "timestamp_epoch": "1645640588.971941000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 1448,
          "display_filter": "frame.number == 1448",
          "timestamp_epoch": "1645640588.980665000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 1485,
          "display_filter": "frame.number == 1485",
          "timestamp_epoch": "1645640589.230710000"
        }
      ]
    },
    {
      "id": "identity-239d7e1581777f0760b6f80f",
      "type": "identity",
      "label": "account: nick.montgomery",
      "value": "nick.montgomery",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.149"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 132,
          "frame_number": 2755,
          "display_filter": "frame.number == 2755",
          "timestamp_epoch": "1645640629.215607000"
        },
        {
          "tcp_stream": 133,
          "frame_number": 2763,
          "display_filter": "frame.number == 2763",
          "timestamp_epoch": "1645640629.224176000"
        },
        {
          "tcp_stream": 133,
          "frame_number": 2765,
          "display_filter": "frame.number == 2765",
          "timestamp_epoch": "1645640629.224805000"
        },
        {
          "tcp_stream": 134,
          "frame_number": 2777,
          "display_filter": "frame.number == 2777",
          "timestamp_epoch": "1645640629.226597000"
        },
        {
          "tcp_stream": 135,
          "frame_number": 2787,
          "display_filter": "frame.number == 2787",
          "timestamp_epoch": "1645640629.264147000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 2795,
          "display_filter": "frame.number == 2795",
          "timestamp_epoch": "1645640629.265602000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 2797,
          "display_filter": "frame.number == 2797",
          "timestamp_epoch": "1645640629.266173000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 2814,
          "display_filter": "frame.number == 2814",
          "timestamp_epoch": "1645640629.285145000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 2816,
          "display_filter": "frame.number == 2816",
          "timestamp_epoch": "1645640629.285263000"
        },
        {
          "tcp_stream": 139,
          "frame_number": 2837,
          "display_filter": "frame.number == 2837",
          "timestamp_epoch": "1645640629.287174000"
        },
        {
          "tcp_stream": 95,
          "frame_number": 2882,
          "display_filter": "frame.number == 2882",
          "timestamp_epoch": "1645640629.302147000"
        },
        {
          "tcp_stream": 141,
          "frame_number": 2915,
          "display_filter": "frame.number == 2915",
          "timestamp_epoch": "1645640629.510119000"
        }
      ]
    },
    {
      "id": "identity-1b8a18537a0b1d91f884881b",
      "type": "identity",
      "label": "account: tricia.becker",
      "value": "tricia.becker",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.131"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 82,
          "frame_number": 1658,
          "display_filter": "frame.number == 1658",
          "timestamp_epoch": "1645640597.551295000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 1666,
          "display_filter": "frame.number == 1666",
          "timestamp_epoch": "1645640597.559263000"
        },
        {
          "tcp_stream": 83,
          "frame_number": 1668,
          "display_filter": "frame.number == 1668",
          "timestamp_epoch": "1645640597.560105000"
        },
        {
          "tcp_stream": 84,
          "frame_number": 1680,
          "display_filter": "frame.number == 1680",
          "timestamp_epoch": "1645640597.563018000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 1699,
          "display_filter": "frame.number == 1699",
          "timestamp_epoch": "1645640598.022508000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1750,
          "display_filter": "frame.number == 1750",
          "timestamp_epoch": "1645640598.083029000"
        },
        {
          "tcp_stream": 90,
          "frame_number": 1768,
          "display_filter": "frame.number == 1768",
          "timestamp_epoch": "1645640598.089175000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1802,
          "display_filter": "frame.number == 1802",
          "timestamp_epoch": "1645640598.095549000"
        }
      ]
    },
    {
      "id": "identity-f03c61fce873a4ad0cefd357",
      "type": "identity",
      "label": "domain: SUNNYSTATION",
      "value": "SUNNYSTATION",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.131"
      ],
      "identity_type": "domain",
      "frame_evidence": [
        {
          "tcp_stream": 87,
          "frame_number": 1750,
          "display_filter": "frame.number == 1750",
          "timestamp_epoch": "1645640598.083029000"
        }
      ]
    },
    {
      "id": "identity-5eed7bcb14f4f15d069c4259",
      "type": "identity",
      "label": "full-name: Everett French",
      "value": "Everett French",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.170"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 31,
          "frame_number": 1448,
          "display_filter": "frame.number == 1448",
          "timestamp_epoch": "1645640588.980665000"
        }
      ]
    },
    {
      "id": "identity-9f3c89f7ebdaa12af508ed30",
      "type": "identity",
      "label": "full-name: Nick Montgomery",
      "value": "Nick Montgomery",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.149"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 95,
          "frame_number": 2882,
          "display_filter": "frame.number == 2882",
          "timestamp_epoch": "1645640629.302147000"
        }
      ]
    },
    {
      "id": "identity-ccd94887981d90d26538c777",
      "type": "identity",
      "label": "full-name: Tricia Becker",
      "value": "Tricia Becker",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.131"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 87,
          "frame_number": 1802,
          "display_filter": "frame.number == 1802",
          "timestamp_epoch": "1645640598.095549000"
        }
      ]
    },
    {
      "id": "identity-cfc2e5d8d23c1b898560b0d0",
      "type": "identity",
      "label": "hostname: DESKTOP-KPQ9FDB",
      "value": "DESKTOP-KPQ9FDB",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.149"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 1915,
          "display_filter": "frame.number == 1915",
          "timestamp_epoch": "1645640613.947609000"
        },
        {
          "udp_stream": 86,
          "frame_number": 1937,
          "display_filter": "frame.number == 1937",
          "timestamp_epoch": "1645640614.685709000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2040,
          "display_filter": "frame.number == 2040",
          "timestamp_epoch": "1645640616.183178000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2281,
          "display_filter": "frame.number == 2281",
          "timestamp_epoch": "1645640617.350514000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2327,
          "display_filter": "frame.number == 2327",
          "timestamp_epoch": "1645640617.701580000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2491,
          "display_filter": "frame.number == 2491",
          "timestamp_epoch": "1645640618.839523000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2492,
          "display_filter": "frame.number == 2492",
          "timestamp_epoch": "1645640619.245865000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2572,
          "display_filter": "frame.number == 2572",
          "timestamp_epoch": "1645640619.995855000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2579,
          "display_filter": "frame.number == 2579",
          "timestamp_epoch": "1645640620.386469000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2580,
          "display_filter": "frame.number == 2580",
          "timestamp_epoch": "1645640620.777136000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2584,
          "display_filter": "frame.number == 2584",
          "timestamp_epoch": "1645640621.589964000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2585,
          "display_filter": "frame.number == 2585",
          "timestamp_epoch": "1645640621.933407000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2615,
          "display_filter": "frame.number == 2615",
          "timestamp_epoch": "1645640622.714680000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2624,
          "display_filter": "frame.number == 2624",
          "timestamp_epoch": "1645640623.496487000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2639,
          "display_filter": "frame.number == 2639",
          "timestamp_epoch": "1645640624.279480000"
        },
        {
          "udp_stream": 109,
          "frame_number": 2700,
          "display_filter": "frame.number == 2700",
          "timestamp_epoch": "1645640625.073228000"
        },
        {
          "udp_stream": 109,
          "frame_number": 2710,
          "display_filter": "frame.number == 2710",
          "timestamp_epoch": "1645640626.050356000"
        },
        {
          "udp_stream": 109,
          "frame_number": 2711,
          "display_filter": "frame.number == 2711",
          "timestamp_epoch": "1645640626.055552000"
        },
        {
          "udp_stream": 109,
          "frame_number": 13060,
          "display_filter": "frame.number == 13060",
          "timestamp_epoch": "1645641105.089512000"
        },
        {
          "udp_stream": 109,
          "frame_number": 16092,
          "display_filter": "frame.number == 16092",
          "timestamp_epoch": "1645641440.115852000"
        }
      ]
    },
    {
      "id": "identity-b3852570358493347621582d",
      "type": "identity",
      "label": "hostname: DESKTOP-VD151O7",
      "value": "DESKTOP-VD151O7",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.131"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 1,
          "display_filter": "frame.number == 1",
          "timestamp_epoch": "1645640544.405139000"
        },
        {
          "udp_stream": 3,
          "frame_number": 10,
          "display_filter": "frame.number == 10",
          "timestamp_epoch": "1645640545.242568000"
        },
        {
          "udp_stream": 3,
          "frame_number": 99,
          "display_filter": "frame.number == 99",
          "timestamp_epoch": "1645640545.845293000"
        },
        {
          "udp_stream": 3,
          "frame_number": 293,
          "display_filter": "frame.number == 293",
          "timestamp_epoch": "1645640546.737900000"
        },
        {
          "udp_stream": 3,
          "frame_number": 361,
          "display_filter": "frame.number == 361",
          "timestamp_epoch": "1645640547.347146000"
        },
        {
          "udp_stream": 3,
          "frame_number": 388,
          "display_filter": "frame.number == 388",
          "timestamp_epoch": "1645640548.236406000"
        },
        {
          "udp_stream": 3,
          "frame_number": 391,
          "display_filter": "frame.number == 391",
          "timestamp_epoch": "1645640548.846663000"
        },
        {
          "udp_stream": 23,
          "frame_number": 394,
          "display_filter": "frame.number == 394",
          "timestamp_epoch": "1645640549.756598000"
        },
        {
          "udp_stream": 23,
          "frame_number": 395,
          "display_filter": "frame.number == 395",
          "timestamp_epoch": "1645640550.390103000"
        },
        {
          "udp_stream": 23,
          "frame_number": 396,
          "display_filter": "frame.number == 396",
          "timestamp_epoch": "1645640550.514553000"
        },
        {
          "udp_stream": 23,
          "frame_number": 400,
          "display_filter": "frame.number == 400",
          "timestamp_epoch": "1645640551.153824000"
        },
        {
          "udp_stream": 23,
          "frame_number": 402,
          "display_filter": "frame.number == 402",
          "timestamp_epoch": "1645640551.279051000"
        },
        {
          "udp_stream": 23,
          "frame_number": 404,
          "display_filter": "frame.number == 404",
          "timestamp_epoch": "1645640551.918387000"
        },
        {
          "udp_stream": 23,
          "frame_number": 405,
          "display_filter": "frame.number == 405",
          "timestamp_epoch": "1645640552.042557000"
        },
        {
          "udp_stream": 23,
          "frame_number": 409,
          "display_filter": "frame.number == 409",
          "timestamp_epoch": "1645640552.681829000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 1750,
          "display_filter": "frame.number == 1750",
          "timestamp_epoch": "1645640598.083029000"
        }
      ]
    },
    {
      "id": "identity-39bcef77b46de3839e01a1a6",
      "type": "identity",
      "label": "hostname: DESKTOP-W5TFTQY",
      "value": "DESKTOP-W5TFTQY",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "172.16.0.170"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 519,
          "display_filter": "frame.number == 519",
          "timestamp_epoch": "1645640566.157788000"
        },
        {
          "udp_stream": 35,
          "frame_number": 538,
          "display_filter": "frame.number == 538",
          "timestamp_epoch": "1645640566.244143000"
        },
        {
          "udp_stream": 35,
          "frame_number": 797,
          "display_filter": "frame.number == 797",
          "timestamp_epoch": "1645640567.741596000"
        },
        {
          "udp_stream": 35,
          "frame_number": 867,
          "display_filter": "frame.number == 867",
          "timestamp_epoch": "1645640568.379966000"
        },
        {
          "udp_stream": 35,
          "frame_number": 1074,
          "display_filter": "frame.number == 1074",
          "timestamp_epoch": "1645640569.241449000"
        },
        {
          "udp_stream": 35,
          "frame_number": 1077,
          "display_filter": "frame.number == 1077",
          "timestamp_epoch": "1645640569.882024000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1158,
          "display_filter": "frame.number == 1158",
          "timestamp_epoch": "1645640570.788708000"
        },
        {
          "udp_stream": 35,
          "frame_number": 1198,
          "display_filter": "frame.number == 1198",
          "timestamp_epoch": "1645640571.381962000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1200,
          "display_filter": "frame.number == 1200",
          "timestamp_epoch": "1645640571.569473000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1203,
          "display_filter": "frame.number == 1203",
          "timestamp_epoch": "1645640572.335237000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1204,
          "display_filter": "frame.number == 1204",
          "timestamp_epoch": "1645640572.913124000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1206,
          "display_filter": "frame.number == 1206",
          "timestamp_epoch": "1645640573.117847000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1215,
          "display_filter": "frame.number == 1215",
          "timestamp_epoch": "1645640573.726353000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1216,
          "display_filter": "frame.number == 1216",
          "timestamp_epoch": "1645640574.540119000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1217,
          "display_filter": "frame.number == 1217",
          "timestamp_epoch": "1645640575.351560000"
        },
        {
          "udp_stream": 65,
          "frame_number": 1220,
          "display_filter": "frame.number == 1220",
          "timestamp_epoch": "1645640576.191038000"
        },
        {
          "udp_stream": 65,
          "frame_number": 7689,
          "display_filter": "frame.number == 7689",
          "timestamp_epoch": "1645640813.688158000"
        },
        {
          "udp_stream": 65,
          "frame_number": 14598,
          "display_filter": "frame.number == 14598",
          "timestamp_epoch": "1645641292.343481000"
        },
        {
          "udp_stream": 65,
          "frame_number": 18500,
          "display_filter": "frame.number == 18500",
          "timestamp_epoch": "1645642010.231115000"
        },
        {
          "udp_stream": 65,
          "frame_number": 21091,
          "display_filter": "frame.number == 21091",
          "timestamp_epoch": "1645642729.853566000"
        }
      ]
    },
    {
      "id": "identity-637bb578aff51897cce146f8",
      "type": "identity",
      "label": "netbios-group: SUNNYSTATION",
      "value": "SUNNYSTATION",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 3,
          "frame_number": 11,
          "display_filter": "frame.number == 11",
          "timestamp_epoch": "1645640545.242626000"
        },
        {
          "udp_stream": 3,
          "frame_number": 292,
          "display_filter": "frame.number == 292",
          "timestamp_epoch": "1645640546.737842000"
        },
        {
          "udp_stream": 3,
          "frame_number": 389,
          "display_filter": "frame.number == 389",
          "timestamp_epoch": "1645640548.236459000"
        },
        {
          "udp_stream": 23,
          "frame_number": 393,
          "display_filter": "frame.number == 393",
          "timestamp_epoch": "1645640549.756386000"
        },
        {
          "udp_stream": 23,
          "frame_number": 397,
          "display_filter": "frame.number == 397",
          "timestamp_epoch": "1645640550.514786000"
        },
        {
          "udp_stream": 23,
          "frame_number": 401,
          "display_filter": "frame.number == 401",
          "timestamp_epoch": "1645640551.278903000"
        },
        {
          "udp_stream": 23,
          "frame_number": 406,
          "display_filter": "frame.number == 406",
          "timestamp_epoch": "1645640552.042695000"
        },
        {
          "udp_stream": 35,
          "frame_number": 539,
          "display_filter": "frame.number == 539",
          "timestamp_epoch": "1645640566.244717000"
        },
        {
          "udp_stream": 35,
          "frame_number": 796,
          "display_filter": "frame.number == 796",
          "timestamp_epoch": "1645640567.741545000"
        },
        {
          "udp_stream": 35,
          "frame_number": 1075,
          "display_filter": "frame.number == 1075",
          "timestamp_epoch": "1645640569.241521000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1157,
          "display_filter": "frame.number == 1157",
          "timestamp_epoch": "1645640570.788595000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1201,
          "display_filter": "frame.number == 1201",
          "timestamp_epoch": "1645640571.569639000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1202,
          "display_filter": "frame.number == 1202",
          "timestamp_epoch": "1645640572.335037000"
        },
        {
          "udp_stream": 60,
          "frame_number": 1205,
          "display_filter": "frame.number == 1205",
          "timestamp_epoch": "1645640573.117678000"
        },
        {
          "udp_stream": 86,
          "frame_number": 1938,
          "display_filter": "frame.number == 1938",
          "timestamp_epoch": "1645640614.686949000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2067,
          "display_filter": "frame.number == 2067",
          "timestamp_epoch": "1645640616.198797000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2328,
          "display_filter": "frame.number == 2328",
          "timestamp_epoch": "1645640617.730112000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2490,
          "display_filter": "frame.number == 2490",
          "timestamp_epoch": "1645640618.388653000"
        },
        {
          "udp_stream": 103,
          "frame_number": 2493,
          "display_filter": "frame.number == 2493",
          "timestamp_epoch": "1645640619.261419000"
        },
        {
          "udp_stream": 86,
          "frame_number": 2571,
          "display_filter": "frame.number == 2571",
          "timestamp_epoch": "1645640619.886659000"
        }
      ]
    },
    {
      "id": "artifact-a34d356fa65f0caf606cad18",
      "type": "file-artifact",
      "label": "zbBYgukXYxzAF2hZc",
      "value": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3",
      "sha256": "14b57211308ac8ad2a63c965783d9ba1c2d1930d0cafd884374d143a481f9bf3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 593920,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7bda7143ccb799b9933b5806",
      "type": "file-artifact",
      "label": "object26220",
      "value": "abca26cf70ef57ef879c81a3b45d9fc5ce4437f54bda65d0170f3f5bae8a54f5",
      "sha256": "abca26cf70ef57ef879c81a3b45d9fc5ce4437f54bda65d0170f3f5bae8a54f5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1376,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7f17bff5e8509e5be1f0f074",
      "type": "file-artifact",
      "label": "Ocklqc.jpg",
      "value": "2620bf96201e9f328aee98a74ce5b87f221e761a8b2662974b35f90991404337",
      "sha256": "2620bf96201e9f328aee98a74ce5b87f221e761a8b2662974b35f90991404337",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 719872,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "image/jpeg"
    },
    {
      "id": "artifact-198fb29c620fb17fd995963c",
      "type": "file-artifact",
      "label": "%3fOXtd9L=cFNTMFX8k4Sl&WN68=YMSFGVfdS9ONGuAKqerSFa9naGdXyzjeSZBgl3Bk94ai8h1oihtuDN4qXdcs1YMbgxqWO7UijFru1VtwMrj0Yg==",
      "value": "1a281a2d280c6d1f1f205d3f8210057b1b555794f6c12db57e4e8e4816cb9036",
      "sha256": "1a281a2d280c6d1f1f205d3f8210057b1b555794f6c12db57e4e8e4816cb9036",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 5149,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-56fe172c9839b43e04424c80",
      "type": "file-artifact",
      "label": "object27533",
      "value": "4662635889a87f2f39280975ae841f8ff9c51a45cee3c5922e08778dae69b077",
      "sha256": "4662635889a87f2f39280975ae841f8ff9c51a45cee3c5922e08778dae69b077",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1528,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f4838cc0bd8175d1e2ae8d11",
      "type": "file-artifact",
      "label": "object17412",
      "value": "004599278fd2775eb468eac406e47dab4e5775c32eeb98a0f7ff21768aa2fdcf",
      "sha256": "004599278fd2775eb468eac406e47dab4e5775c32eeb98a0f7ff21768aa2fdcf",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7e01dd7acca920072e2cdfce",
      "type": "file-artifact",
      "label": "object23470",
      "value": "0119adca455bfe449a3b6d30660b9a4fb4d7f9b1a42504166debbe61bc7a1a64",
      "sha256": "0119adca455bfe449a3b6d30660b9a4fb4d7f9b1a42504166debbe61bc7a1a64",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a3f1ac4729de28f8fbe675c3",
      "type": "file-artifact",
      "label": "object17433",
      "value": "012525bd08b8856409471857cdde9928f6f5505e0eedfdc05880783621712242",
      "sha256": "012525bd08b8856409471857cdde9928f6f5505e0eedfdc05880783621712242",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0eec94abda8d58ed0bd18b5f",
      "type": "file-artifact",
      "label": "object11310",
      "value": "02751d70749d493ba1989b74765a1cd1c56294db42c8b7775b3c0172828df4a6",
      "sha256": "02751d70749d493ba1989b74765a1cd1c56294db42c8b7775b3c0172828df4a6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6beecaf22e995a29ee8f61a0",
      "type": "file-artifact",
      "label": "object27642",
      "value": "03e81cfa927c6cdce33587023c24bb89f21cf506458598c7624bc61c8d3f8e58",
      "sha256": "03e81cfa927c6cdce33587023c24bb89f21cf506458598c7624bc61c8d3f8e58",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b69b3a52fb552470e0fb0c93",
      "type": "file-artifact",
      "label": "object24152",
      "value": "0417dd954d3695d2bf400f237806c505bf8cccf07c44ce9467d98ed4175ea255",
      "sha256": "0417dd954d3695d2bf400f237806c505bf8cccf07c44ce9467d98ed4175ea255",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b8e1d0d2711762e3946ef542",
      "type": "file-artifact",
      "label": "object9566",
      "value": "04b3ca7f09694f7f1b8e7b71f3503d325b75d3ff938ed24eeb9939714635f0d2",
      "sha256": "04b3ca7f09694f7f1b8e7b71f3503d325b75d3ff938ed24eeb9939714635f0d2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d050b3da71015e38ebfc1740",
      "type": "file-artifact",
      "label": "object10926",
      "value": "04b4f6035a50b1f58ebddb3f5a3e8cf1949a9b6b36b497c86b2b8c2b91e7ad4f",
      "sha256": "04b4f6035a50b1f58ebddb3f5a3e8cf1949a9b6b36b497c86b2b8c2b91e7ad4f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e9a06f48ebbd1499f6a33db0",
      "type": "file-artifact",
      "label": "object24077",
      "value": "04ded8bd35a45a9dd083f3cc32056559c2d62739e5edebdaf1be2b5bf6133ea3",
      "sha256": "04ded8bd35a45a9dd083f3cc32056559c2d62739e5edebdaf1be2b5bf6133ea3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ae93fb4955b3909febc0376a",
      "type": "file-artifact",
      "label": "object25436",
      "value": "051f4c30c5306ffeff3f92010446f0aa0c420978da429cb787c50604c5944174",
      "sha256": "051f4c30c5306ffeff3f92010446f0aa0c420978da429cb787c50604c5944174",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d3b73ecd167b7c363f078d7f",
      "type": "file-artifact",
      "label": "object21540",
      "value": "05497fa07eb6f2ee015c09ace90d0423c20136b9c6e4a52ee3e4c60c376eacf3",
      "sha256": "05497fa07eb6f2ee015c09ace90d0423c20136b9c6e4a52ee3e4c60c376eacf3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d7815e4494cd1069c2d4a1ee",
      "type": "file-artifact",
      "label": "object17594",
      "value": "05b0dc4e3b3623d8fe2e6d653af5f42f73ce33b8d5461de62b0b113aa5f3caa0",
      "sha256": "05b0dc4e3b3623d8fe2e6d653af5f42f73ce33b8d5461de62b0b113aa5f3caa0",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8fc0083d3b7d2e96d18b6fb5",
      "type": "file-artifact",
      "label": "object16434",
      "value": "05ba7c0984a69934dba3a41191243d8dc8fd5abf2fea86a4ead813cf2a9d9dee",
      "sha256": "05ba7c0984a69934dba3a41191243d8dc8fd5abf2fea86a4ead813cf2a9d9dee",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2a6ef724dde9583189cecac0",
      "type": "file-artifact",
      "label": "object11911",
      "value": "05dfb38ed78ba413e07d3e01d40dd139683aa9b4715d3f000abc9d95e16205a6",
      "sha256": "05dfb38ed78ba413e07d3e01d40dd139683aa9b4715d3f000abc9d95e16205a6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8ddf0a971ec37bb6d3e90f3e",
      "type": "file-artifact",
      "label": "object11550",
      "value": "0604cda2873562b6894fce5ef33aab23eeb01abae54bfd1a3ade48e85e54f266",
      "sha256": "0604cda2873562b6894fce5ef33aab23eeb01abae54bfd1a3ade48e85e54f266",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c9fdff8016be2b7c22e7580a",
      "type": "file-artifact",
      "label": "object24129",
      "value": "0609a4da54220690f415ac4d27cee84f2eea7d6a39ae990017ac25889ca2ca54",
      "sha256": "0609a4da54220690f415ac4d27cee84f2eea7d6a39ae990017ac25889ca2ca54",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e8dbf97b3d76e15f661a36cc",
      "type": "file-artifact",
      "label": "object21424",
      "value": "06af7d2c9ddd3737f67c6789e4fa2610ed99d3d4aeb157e15c9f0b3eab46ceed",
      "sha256": "06af7d2c9ddd3737f67c6789e4fa2610ed99d3d4aeb157e15c9f0b3eab46ceed",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-05605109f0fc4877f9ef451e",
      "type": "file-artifact",
      "label": "object21425",
      "value": "08387b61ba8264eef8f26f5d669b04b28b0ae71ee8ffe4de6852c8c2b9668d3d",
      "sha256": "08387b61ba8264eef8f26f5d669b04b28b0ae71ee8ffe4de6852c8c2b9668d3d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1e7c622a1bd81020e63b82de",
      "type": "file-artifact",
      "label": "object7819",
      "value": "08ff66f98bdcf6573485fb6a07e45b72de258edb90706aa75260b1f541a961eb",
      "sha256": "08ff66f98bdcf6573485fb6a07e45b72de258edb90706aa75260b1f541a961eb",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-fbd754b24c6f807f77f1de76",
      "type": "file-artifact",
      "label": "object9111",
      "value": "0965a8861f7f70048f6251a520c65bf2930b3b9265e0e55142aa384f4da36f24",
      "sha256": "0965a8861f7f70048f6251a520c65bf2930b3b9265e0e55142aa384f4da36f24",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-124d014f5ea7e7b90ccbd18a",
      "type": "file-artifact",
      "label": "object23590",
      "value": "09b156788ec22bd98b36d95565ab19199d442dc653c73ddbab3525792130b593",
      "sha256": "09b156788ec22bd98b36d95565ab19199d442dc653c73ddbab3525792130b593",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5a99dac4132444bfb7fb4008",
      "type": "file-artifact",
      "label": "object16612",
      "value": "09ba1e573a77d25cfe065aa002a155189ce4f5cbfb0251ab61dc3b5eea9569f5",
      "sha256": "09ba1e573a77d25cfe065aa002a155189ce4f5cbfb0251ab61dc3b5eea9569f5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7f1b7bd2ed196142da743863",
      "type": "file-artifact",
      "label": "object23550",
      "value": "0a1b9616d1191c67cb63f7b1b8bd9809f43c94a183eb23527df28490ac9666f7",
      "sha256": "0a1b9616d1191c67cb63f7b1b8bd9809f43c94a183eb23527df28490ac9666f7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-83b1d2ae66203a9c1986519c",
      "type": "file-artifact",
      "label": "object25308",
      "value": "0aa09ec450e32afa62a72eeb252e83ad291b68ed378fb455ee4cb618ba04849a",
      "sha256": "0aa09ec450e32afa62a72eeb252e83ad291b68ed378fb455ee4cb618ba04849a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4882e09d2cb3edbae52be4d0",
      "type": "file-artifact",
      "label": "object11969",
      "value": "0b0e4ae56a34d0aa05dca4d67700c3964c649f66bc9d9afd2c430bdb1f063be8",
      "sha256": "0b0e4ae56a34d0aa05dca4d67700c3964c649f66bc9d9afd2c430bdb1f063be8",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bdbbab2639954493c1a5c7db",
      "type": "file-artifact",
      "label": "object25385",
      "value": "0b500a7b1a98e79df9f948812495251061d45e48ee19eb795810272216b6fbc9",
      "sha256": "0b500a7b1a98e79df9f948812495251061d45e48ee19eb795810272216b6fbc9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e7e318c507457d17f8e55f86",
      "type": "file-artifact",
      "label": "object13663",
      "value": "0bd44562868ac54cb8c1043310b8f1d8267e681908bbd1d5e14b27ce796b977d",
      "sha256": "0bd44562868ac54cb8c1043310b8f1d8267e681908bbd1d5e14b27ce796b977d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-642052b299ad6a5be4eb978d",
      "type": "file-artifact",
      "label": "object23853",
      "value": "0ded265abee66125302a95e54828bf136e471f93d1c6ddbaec3513f4960254b6",
      "sha256": "0ded265abee66125302a95e54828bf136e471f93d1c6ddbaec3513f4960254b6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-26dde5054a19aba8778d859c",
      "type": "file-artifact",
      "label": "object23927",
      "value": "0df6c8212c4a7361f440ffbd61ee76222cbc3d4e24b3c2716946800e13fd8ce8",
      "sha256": "0df6c8212c4a7361f440ffbd61ee76222cbc3d4e24b3c2716946800e13fd8ce8",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b9c65159b9196216f3638439",
      "type": "file-artifact",
      "label": "object17580",
      "value": "0e60578c595f5d1d852562e954c270edcaeac54de126892ebf8dc2a60c9b1503",
      "sha256": "0e60578c595f5d1d852562e954c270edcaeac54de126892ebf8dc2a60c9b1503",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ce35f53720b38212db5ff9ef",
      "type": "file-artifact",
      "label": "object17735",
      "value": "0ec2306524e6c599765d5d1223e9a33329d8c0793039e8d26c15de173d79e958",
      "sha256": "0ec2306524e6c599765d5d1223e9a33329d8c0793039e8d26c15de173d79e958",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-521a04b5f435ccf5ec35135b",
      "type": "file-artifact",
      "label": "object22136",
      "value": "0f102e9552d90e78af23de4a7b4411569878a3149aaebc38e5168e422c5d247e",
      "sha256": "0f102e9552d90e78af23de4a7b4411569878a3149aaebc38e5168e422c5d247e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9d0f82851323a50f6678eeb8",
      "type": "file-artifact",
      "label": "object10934",
      "value": "0f99ac235c51cdff782c4f8193f4698892a38d6365845031d7b20f976196fe4f",
      "sha256": "0f99ac235c51cdff782c4f8193f4698892a38d6365845031d7b20f976196fe4f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8ce5e2a768dce14f45143304",
      "type": "file-artifact",
      "label": "object16749",
      "value": "0ff8e752caa95643bf7b3776d821737814f87ffe3d6925701a3183971391edcf",
      "sha256": "0ff8e752caa95643bf7b3776d821737814f87ffe3d6925701a3183971391edcf",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d9bcc67d7eed5926f991f65c",
      "type": "file-artifact",
      "label": "object23930",
      "value": "0ffbddc5bc92b9e3b50893241fa9a182f02ab2a61054568668bec4f2e8a08fe9",
      "sha256": "0ffbddc5bc92b9e3b50893241fa9a182f02ab2a61054568668bec4f2e8a08fe9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2a236fde4f91e5876ff1c147",
      "type": "file-artifact",
      "label": "object11134",
      "value": "10570ef48a963eeab20a1bd339618b44d213b436c19c51fb05099183a9999f4b",
      "sha256": "10570ef48a963eeab20a1bd339618b44d213b436c19c51fb05099183a9999f4b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-941b9ea972e12f5fb09cabc0",
      "type": "file-artifact",
      "label": "object16496",
      "value": "10e9248a956dcfbdb1d4c8b70dd05ee54605208b614d10ceb7b8b88d150cb0ef",
      "sha256": "10e9248a956dcfbdb1d4c8b70dd05ee54605208b614d10ceb7b8b88d150cb0ef",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-46426118d790f069d9621180",
      "type": "file-artifact",
      "label": "object21251",
      "value": "118a94f5308fb6dd5bf0096ef766eb9fdc207a1c05fc23c7186aba49100ee508",
      "sha256": "118a94f5308fb6dd5bf0096ef766eb9fdc207a1c05fc23c7186aba49100ee508",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e3896c9f41c4c9975ac9983e",
      "type": "file-artifact",
      "label": "object17490",
      "value": "120f7dd788fe12ca8c9af5f9d47d1fa963b0f63bc63cef3afcdd28ab66bdbf6f",
      "sha256": "120f7dd788fe12ca8c9af5f9d47d1fa963b0f63bc63cef3afcdd28ab66bdbf6f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-704ca7e31319f0a23efbe6a2",
      "type": "file-artifact",
      "label": "object17178",
      "value": "121098e0cde0a928173ac2ba2da6dd82b1b626453b296059c60926787b1e4546",
      "sha256": "121098e0cde0a928173ac2ba2da6dd82b1b626453b296059c60926787b1e4546",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f58f6b5e15fe5fcb984a208b",
      "type": "file-artifact",
      "label": "object17210",
      "value": "1235888074ede34f4f78e3108c85f05795ab16d8fb72b534547fb0da3e6a234e",
      "sha256": "1235888074ede34f4f78e3108c85f05795ab16d8fb72b534547fb0da3e6a234e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0f91958d45e09bac23e32c86",
      "type": "file-artifact",
      "label": "object22466",
      "value": "129c768192359093317c1b658b106ba3d9968476a695fef49ea9e6d118467767",
      "sha256": "129c768192359093317c1b658b106ba3d9968476a695fef49ea9e6d118467767",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9eca914b175163342f60c33b",
      "type": "file-artifact",
      "label": "object26286",
      "value": "139f6fa785927256480056be4662ba4122fa4e5a18d7b63752f8d2ae6c9395b6",
      "sha256": "139f6fa785927256480056be4662ba4122fa4e5a18d7b63752f8d2ae6c9395b6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1cbf57f29a8efe9e8df87cf0",
      "type": "file-artifact",
      "label": "object11872",
      "value": "13bf0aa04849e77d7914f426c28a54bb49f547cc004ae800af68864980a4a88d",
      "sha256": "13bf0aa04849e77d7914f426c28a54bb49f547cc004ae800af68864980a4a88d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5340adb03dec1d7adbf5d22a",
      "type": "file-artifact",
      "label": "object13662",
      "value": "14245b645e4103d8713e7f916fc7d4d10ae98146a05af38d2b800d52c8acc717",
      "sha256": "14245b645e4103d8713e7f916fc7d4d10ae98146a05af38d2b800d52c8acc717",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9039341f7d169ac76a0c6bf9",
      "type": "file-artifact",
      "label": "object24538",
      "value": "142855918acb873018e7afb636a8f9d0495b3028b4d16b4cf706d68b3a7f8ce3",
      "sha256": "142855918acb873018e7afb636a8f9d0495b3028b4d16b4cf706d68b3a7f8ce3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-fb9e2f0353944a1b6cd50b49",
      "type": "file-artifact",
      "label": "object16912",
      "value": "147f4226dc3c57cb9d2536c745013d7145af769c26fc6b37d0848a01af884865",
      "sha256": "147f4226dc3c57cb9d2536c745013d7145af769c26fc6b37d0848a01af884865",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-32d600a528e65759f5ce7a55",
      "type": "file-artifact",
      "label": "object17734",
      "value": "148dd3a46202949f4ff34c20da8804f68644abec319cbfd57efb774b9b3ebf5d",
      "sha256": "148dd3a46202949f4ff34c20da8804f68644abec319cbfd57efb774b9b3ebf5d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ddb9f6c41f98b8cb22c6f3e8",
      "type": "file-artifact",
      "label": "object16512",
      "value": "14a5cc536d16a41573e57bfe68ede705cb5850500eaa5ec123c42784903055c0",
      "sha256": "14a5cc536d16a41573e57bfe68ede705cb5850500eaa5ec123c42784903055c0",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-95de725f63c9664b8857bbc3",
      "type": "file-artifact",
      "label": "object11546",
      "value": "14c39252741654b6e9872383aa869070317abb18e91f2d5dbbb1341b3abe62c4",
      "sha256": "14c39252741654b6e9872383aa869070317abb18e91f2d5dbbb1341b3abe62c4",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2a4932512d0602cc3faf02d8",
      "type": "file-artifact",
      "label": "object26741",
      "value": "14cd9376ff8f1a914c40168783efb3d4e8f53c2526378000a0190478621eac9f",
      "sha256": "14cd9376ff8f1a914c40168783efb3d4e8f53c2526378000a0190478621eac9f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5dbb4338ac9f072062a19247",
      "type": "file-artifact",
      "label": "object21920",
      "value": "157889eb6bfdc5fb11eca24228c4f9ae1a176455785456ca79849fb0bb5c2792",
      "sha256": "157889eb6bfdc5fb11eca24228c4f9ae1a176455785456ca79849fb0bb5c2792",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-54bf39c7bd605b93b328033f",
      "type": "file-artifact",
      "label": "object16587",
      "value": "15861b469b40931e7dbe3a8b6aacb1ee6824b431fea25281840e1db28086d255",
      "sha256": "15861b469b40931e7dbe3a8b6aacb1ee6824b431fea25281840e1db28086d255",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-528a71aa8636ea15a7b91ed5",
      "type": "file-artifact",
      "label": "object16905",
      "value": "161004698346c45313eef873dc3e555f83bf5f4fd616d1f67947fbc8cf3b2660",
      "sha256": "161004698346c45313eef873dc3e555f83bf5f4fd616d1f67947fbc8cf3b2660",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d96e78cbd85a4b8fa727d621",
      "type": "file-artifact",
      "label": "object11466",
      "value": "1694f0ee7be6029fe279792606f74d0e0c156eedf216eb6d30753048e33ac95c",
      "sha256": "1694f0ee7be6029fe279792606f74d0e0c156eedf216eb6d30753048e33ac95c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-026ce0fe22c01302517ca369",
      "type": "file-artifact",
      "label": "object16517",
      "value": "16f02f7a9a59c59bf6b7651c334043da2c43d100661c8345dce857c8743374b0",
      "sha256": "16f02f7a9a59c59bf6b7651c334043da2c43d100661c8345dce857c8743374b0",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e3737629de0a1dc936da3e43",
      "type": "file-artifact",
      "label": "object14759",
      "value": "178252c182d98d603e7235df45e57e1d92aa93fc0c3b71d5c27bc1b7b1c7c310",
      "sha256": "178252c182d98d603e7235df45e57e1d92aa93fc0c3b71d5c27bc1b7b1c7c310",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8542e3e637470eeb0b1a6a3a",
      "type": "file-artifact",
      "label": "object16254",
      "value": "178ca47275e40b28d97e3f2445c90926cecad89d7679ee5eb59cd1917041f61e",
      "sha256": "178ca47275e40b28d97e3f2445c90926cecad89d7679ee5eb59cd1917041f61e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6bd7e1cae6cfc3a955799689",
      "type": "file-artifact",
      "label": "object21272",
      "value": "18ce8668476bb27422129bf09e3992cafb555779513b7c73daa5e1b07577dbf1",
      "sha256": "18ce8668476bb27422129bf09e3992cafb555779513b7c73daa5e1b07577dbf1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ba63c54b132bd6d3a8351acd",
      "type": "file-artifact",
      "label": "object10754",
      "value": "191a086e159061a0c87247adcfe042e6c15854fca15397fe2dc99a0f35efa1ed",
      "sha256": "191a086e159061a0c87247adcfe042e6c15854fca15397fe2dc99a0f35efa1ed",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-37c4ba3c5c08a08e9d16ff15",
      "type": "file-artifact",
      "label": "object21917",
      "value": "195aaab78e060cb793d406f91c91592c44a15d944ae7662a5fd8dc7750a121dd",
      "sha256": "195aaab78e060cb793d406f91c91592c44a15d944ae7662a5fd8dc7750a121dd",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-cd78345a88630f675e14f8dd",
      "type": "file-artifact",
      "label": "object16797",
      "value": "1970d832434fda01eee7325d7882f19089ff3dc6b6e623be0e2be3e21da60290",
      "sha256": "1970d832434fda01eee7325d7882f19089ff3dc6b6e623be0e2be3e21da60290",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-aa20f0e55d9405228539ead9",
      "type": "file-artifact",
      "label": "object16273",
      "value": "199efb2dba801fbe4f06b60162b3cc083a63d6078f6b56224f5dc538ded3bdf4",
      "sha256": "199efb2dba801fbe4f06b60162b3cc083a63d6078f6b56224f5dc538ded3bdf4",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-73418c7a5e6fb6f232ce8a74",
      "type": "file-artifact",
      "label": "object16871",
      "value": "1a188e05405f1ce01789dc73de2d60632eade6ad95ff36cec29b988444861eb1",
      "sha256": "1a188e05405f1ce01789dc73de2d60632eade6ad95ff36cec29b988444861eb1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d2ff8bd1f6b6d1934e4096ca",
      "type": "file-artifact",
      "label": "object16257",
      "value": "1bc147f6a38ee4f00397689ae7cbaae2a9807b40d9092404c90dbe97611ab079",
      "sha256": "1bc147f6a38ee4f00397689ae7cbaae2a9807b40d9092404c90dbe97611ab079",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-58b8d2e3645d1f6a6d7a980a",
      "type": "file-artifact",
      "label": "object16374",
      "value": "1c0c79371604a7e57f527a518397cbbfc312314c6213ac27b44d3a62abd87f17",
      "sha256": "1c0c79371604a7e57f527a518397cbbfc312314c6213ac27b44d3a62abd87f17",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7181f91c4ba18af223cc4a70",
      "type": "file-artifact",
      "label": "object25354",
      "value": "1c19ebc675280676ea53db434f16e8f1b97b729785511d5c82ebb610fb53f08d",
      "sha256": "1c19ebc675280676ea53db434f16e8f1b97b729785511d5c82ebb610fb53f08d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4a3a5daa71f17578a5f2a0c3",
      "type": "file-artifact",
      "label": "object17272",
      "value": "1c3694a1647d000fce54a9d5a30c1a06da57a9e6fab75870993b4d5653577417",
      "sha256": "1c3694a1647d000fce54a9d5a30c1a06da57a9e6fab75870993b4d5653577417",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b96d9b67ff27224b2d5ae3d7",
      "type": "file-artifact",
      "label": "object27275",
      "value": "1cd3bcddfa4cebaeba570316c23a0248dfb1dd90898bca8e1bf01596b5beedcc",
      "sha256": "1cd3bcddfa4cebaeba570316c23a0248dfb1dd90898bca8e1bf01596b5beedcc",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-34e560a3f49dab15c7aa2166",
      "type": "file-artifact",
      "label": "object21299",
      "value": "1d16bd195b28177d0030375134b90eab863a25458c56d05c7e72ecfcda8ddfb8",
      "sha256": "1d16bd195b28177d0030375134b90eab863a25458c56d05c7e72ecfcda8ddfb8",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-25b19239120779856704d70b",
      "type": "file-artifact",
      "label": "object14756",
      "value": "1d21900f027764a25c787c4e444214277ab36e2074037e5d5a8ce6f0efbb004e",
      "sha256": "1d21900f027764a25c787c4e444214277ab36e2074037e5d5a8ce6f0efbb004e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f7fb729ac49e37ceb7e94893",
      "type": "file-artifact",
      "label": "object11261",
      "value": "1d71eef40b1c844cb461ecc7197ed8eef6bc582ba1e5dc287c3bf5fc15e1b4af",
      "sha256": "1d71eef40b1c844cb461ecc7197ed8eef6bc582ba1e5dc287c3bf5fc15e1b4af",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a478dd3304ec064a1b96b36c",
      "type": "file-artifact",
      "label": "object17680",
      "value": "1db156538dd79f08b09c654f86b8f6d481d588fa44cc51f02c4e42fdcdca7913",
      "sha256": "1db156538dd79f08b09c654f86b8f6d481d588fa44cc51f02c4e42fdcdca7913",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-af1ab58fc1b96d42ddc57911",
      "type": "file-artifact",
      "label": "object8253",
      "value": "1de41672c3a500d7321663f486920a8fb5f29e8801f92be3e1aa60cb78bddbf7",
      "sha256": "1de41672c3a500d7321663f486920a8fb5f29e8801f92be3e1aa60cb78bddbf7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a2264d7aed79c59aa8d6d21e",
      "type": "file-artifact",
      "label": "object10548",
      "value": "1f0fd84ce2a8a3ae572963ae3ad0937920664b081fe79acf87fde2b13acc77be",
      "sha256": "1f0fd84ce2a8a3ae572963ae3ad0937920664b081fe79acf87fde2b13acc77be",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-00c04129a076c757e83478c5",
      "type": "file-artifact",
      "label": "object16737",
      "value": "1f68d99e75eaed0dbd08ee26e222e4a21040c56a6266f1d0d9b385730ca12fc0",
      "sha256": "1f68d99e75eaed0dbd08ee26e222e4a21040c56a6266f1d0d9b385730ca12fc0",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b86866a61c6a9268d7173bfa",
      "type": "file-artifact",
      "label": "object25391",
      "value": "1fe5730bb3502850c53ca50dc874702126977f857a47c3dbe5d1a1226afd5c08",
      "sha256": "1fe5730bb3502850c53ca50dc874702126977f857a47c3dbe5d1a1226afd5c08",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f6682e202639999eda97ac3d",
      "type": "file-artifact",
      "label": "object16725",
      "value": "206abeeaebf598ad3c984ba9e8b3d56d663989b35c5074ef330514b5841e1a6e",
      "sha256": "206abeeaebf598ad3c984ba9e8b3d56d663989b35c5074ef330514b5841e1a6e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2b4ae6b53436a1d70b804aa9",
      "type": "file-artifact",
      "label": "object17689",
      "value": "209565664129ec0b9c01867286aa093f1ca15e4ad12093aac53bc290925ae39f",
      "sha256": "209565664129ec0b9c01867286aa093f1ca15e4ad12093aac53bc290925ae39f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b028db0b11a0491dca72e98d",
      "type": "file-artifact",
      "label": "object8292",
      "value": "211aa041d8b4ea3a643d44eb8f538f6caa0a5e0e3b63a802de3fbf0a9011a1f1",
      "sha256": "211aa041d8b4ea3a643d44eb8f538f6caa0a5e0e3b63a802de3fbf0a9011a1f1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0e6f36b3acf115cb234bbdae",
      "type": "file-artifact",
      "label": "object23923",
      "value": "2143e3b14753fe28b4e495e57c087ef8fea10cbd644761105d607d90b9d23633",
      "sha256": "2143e3b14753fe28b4e495e57c087ef8fea10cbd644761105d607d90b9d23633",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4d8a8be16b40e9ebf2563d81",
      "type": "file-artifact",
      "label": "object17692",
      "value": "2194c3bdb83d8e73218ec1fc36977bd7566500eb0cc264750ce08248f7575543",
      "sha256": "2194c3bdb83d8e73218ec1fc36977bd7566500eb0cc264750ce08248f7575543",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-39af20cf72a30dec64b014a7",
      "type": "file-artifact",
      "label": "object7549",
      "value": "21abcfcccf584af261252953ef89fd36141f086a365fbd9d2066ae94b3c4bd76",
      "sha256": "21abcfcccf584af261252953ef89fd36141f086a365fbd9d2066ae94b3c4bd76",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bc2a85309108d19df5adf063",
      "type": "file-artifact",
      "label": "object23085",
      "value": "2251efee138848fe36171baae0d12828489e0bcc3b063bc509e2724cf671c01f",
      "sha256": "2251efee138848fe36171baae0d12828489e0bcc3b063bc509e2724cf671c01f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7ade7059107bf18a0b00ccd1",
      "type": "file-artifact",
      "label": "object11399",
      "value": "2269981a9b387528f38aaa58c273b3a203ba1ce1e4ab7d369210e411cedaef46",
      "sha256": "2269981a9b387528f38aaa58c273b3a203ba1ce1e4ab7d369210e411cedaef46",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b223163b17e113493ed5e100",
      "type": "file-artifact",
      "label": "object24672",
      "value": "22704106a20c5a5a5f4c78a113092eade0f683945a2496a9a0d5bc69c52bd814",
      "sha256": "22704106a20c5a5a5f4c78a113092eade0f683945a2496a9a0d5bc69c52bd814",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f0b2c121164d084bbea5735d",
      "type": "file-artifact",
      "label": "object16263",
      "value": "2321ba015f0e7a3d74e190c407ecc25f0b772956eb0645036818a324965264ee",
      "sha256": "2321ba015f0e7a3d74e190c407ecc25f0b772956eb0645036818a324965264ee",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-dce115e67b173777ccdf1583",
      "type": "file-artifact",
      "label": "object25375",
      "value": "2330b96b60d76e24f5bfcc6d9a4e415cb57d4a8c18d95d50566701d112ab2ca9",
      "sha256": "2330b96b60d76e24f5bfcc6d9a4e415cb57d4a8c18d95d50566701d112ab2ca9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-46fe9c99e4d9f56d1375857a",
      "type": "file-artifact",
      "label": "object24844",
      "value": "23f00aaf4245b4855825f38da30d464bef3c6f81eea7235c99fc7bd5d6b726a3",
      "sha256": "23f00aaf4245b4855825f38da30d464bef3c6f81eea7235c99fc7bd5d6b726a3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6f01f929657ebbf830bc35b2",
      "type": "file-artifact",
      "label": "object17105",
      "value": "23f6e432c83a9a3dcb731391e864afb6129df0a7eedda745e7cc51baf1ea1ad2",
      "sha256": "23f6e432c83a9a3dcb731391e864afb6129df0a7eedda745e7cc51baf1ea1ad2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f125486eba703cf01a4de262",
      "type": "file-artifact",
      "label": "object11458",
      "value": "248430bf42f12f2b4e703bb156543d496f2890ad08148d590f93348830c1ad52",
      "sha256": "248430bf42f12f2b4e703bb156543d496f2890ad08148d590f93348830c1ad52",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9c7ea38d1669bd6fbaccf8e4",
      "type": "file-artifact",
      "label": "object21888",
      "value": "24ec4098e828c89dfb5810b1e4df67cd3e8987e672b16a393e1045ba3ded185e",
      "sha256": "24ec4098e828c89dfb5810b1e4df67cd3e8987e672b16a393e1045ba3ded185e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e640789c6211fbd9afbdd690",
      "type": "file-artifact",
      "label": "object10704",
      "value": "24feb82784833ef28e43907591d6823fb703d92e6a3960435bea7934a35f15e1",
      "sha256": "24feb82784833ef28e43907591d6823fb703d92e6a3960435bea7934a35f15e1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6ae43d04cc1cba487eef3070",
      "type": "file-artifact",
      "label": "object11569",
      "value": "253dd1918125d171a4877950898de2ca26060c40b1d05c8fe31cc9fb56776472",
      "sha256": "253dd1918125d171a4877950898de2ca26060c40b1d05c8fe31cc9fb56776472",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4c1b43278a1228121a6a74bd",
      "type": "file-artifact",
      "label": "object11545",
      "value": "25911c516fcaaded9ea55ede4e30828fe8e21e9a895f5e8948034e9621343854",
      "sha256": "25911c516fcaaded9ea55ede4e30828fe8e21e9a895f5e8948034e9621343854",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1460,
      "source_ref": "2022-02-23-traffic-analysis-exercise.pcap",
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "source_refs": [
        "2022-02-23-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    }
  ],
  "evidence_edges": [],
  "timeline": [
    {
      "at": "2026-09-19T12:50:13.151Z",
      "event": "Added Log/PCAP analysis 2022-02-23-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2022-02-23-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T12:58:02.592Z",
      "event": "Added Log/PCAP analysis 2022-02-23-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2022-02-23-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    }
  ],
  "created_at": "2026-09-19T12:50:09.848838+00:00",
  "updated_at": "2026-09-19T12:58:02.639277+00:00"
}