{
  "analysis_id": "8f0da1cd-9998-4d41-9fc7-683302a6ee24",
  "session_id": "2b5677d6-f466-4831-89aa-be3126dddaef",
  "database_context": {
    "mode": "local-only",
    "matches": [],
    "coverage": {
      "truncated": false,
      "no_exact_match": 512,
      "observable_limit": 5000,
      "observables_total": 512,
      "matched_observables": 0,
      "observables_checked": 512,
      "prior_cases_checked": 14,
      "prior_case_limit_reached": false
    },
    "created_at": "2026-09-19T12:10:24.874416+00:00",
    "session_id": "2b5677d6-f466-4831-89aa-be3126dddaef",
    "techniques": [],
    "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.",
    "schema_version": "pcap-context-v1",
    "snapshot_sha256": "5222f776b8c48e86a0c8622f8a6c5757c219009df704244b52c91467fdafc237",
    "source_actor_links": [],
    "external_enrichment": {
      "reason": "Requires explicit provider consent and privacy review",
      "status": "not-requested",
      "requests": 0
    },
    "source_semantic_sha256": "e2a781b6839946af3b4581e8fbaa850bc68bbe393fce12f786178323e0ccd04d",
    "cross_case_correlations": [
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "69fc74e8-a685-4c8b-bde3-5ee0bb1190f6",
        "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
        "shared_count": 31,
        "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "inbound.att.net"
          },
          {
            "type": "domain",
            "value": "mail.otenet.gr"
          },
          {
            "type": "domain",
            "value": "nexusrules.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "ns0.ovh.net"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settingsfd-geo.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "smtp-com.netzero.net"
          },
          {
            "type": "domain",
            "value": "smtp.forpsi.com"
          },
          {
            "type": "domain",
            "value": "smtp.netzero.com"
          },
          {
            "type": "domain",
            "value": "smtpa.forpsi.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "domain",
            "value": "www.microsoft.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.21.200"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "193.70.18.144"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.200"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "62.103.147.201"
          },
          {
            "type": "ipv4",
            "value": "64.136.44.50"
          },
          {
            "type": "ipv4",
            "value": "64.136.52.50"
          },
          {
            "type": "ipv4",
            "value": "66.163.170.35"
          },
          {
            "type": "ipv4",
            "value": "81.2.195.204"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "91100160-1a16-4165-bf1d-6b5876fb4e11",
        "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d",
        "shared_count": 25,
        "source_sha256": "a86b11ee443ee59d95e4590bdf761235c5d240128d6d195233d065ab57777e8b",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "fe2cr.update.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe3cr.delivery.mp.microsoft.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "self.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settingsfd-geo.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "wpad.localdomain"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.21.200"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.50.80.210"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.200"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "52.183.220.149"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "bfa8693a-227f-4f5d-8e70-aff8c425ac42",
        "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
        "shared_count": 69,
        "source_sha256": "eefc7e61b50e7846f5a3282d7645539d7b2b4b85aa08a09d0b823896c9449d1f",
        "shared_observables": [
          {
            "type": "domain",
            "value": "a-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "b-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "c-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "fe2cr.update.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe3cr.delivery.mp.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fp-afd.azurefd.us"
          },
          {
            "type": "domain",
            "value": "fp-as.azureedge.net"
          },
          {
            "type": "domain",
            "value": "imap.gmail.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "nexusrules.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "prod.nexusrules.live.com.akadns.net"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "self.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "wpad.localdomain"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.21.200"
          },
          {
            "type": "ipv4",
            "value": "13.107.246.254"
          },
          {
            "type": "ipv4",
            "value": "13.107.4.254"
          },
          {
            "type": "ipv4",
            "value": "13.107.6.254"
          },
          {
            "type": "ipv4",
            "value": "13.89.178.27"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "20.50.80.210"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.200"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.254"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.18"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.20"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.21"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.15"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.32"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.35"
          },
          {
            "type": "ipv4",
            "value": "40.97.199.114"
          },
          {
            "type": "ipv4",
            "value": "52.109.76.31"
          },
          {
            "type": "ipv4",
            "value": "52.109.8.20"
          },
          {
            "type": "ipv4",
            "value": "52.183.220.149"
          },
          {
            "type": "ipv4",
            "value": "52.185.211.133"
          },
          {
            "type": "ipv4",
            "value": "52.96.122.242"
          },
          {
            "type": "ipv4",
            "value": "52.96.191.98"
          },
          {
            "type": "ipv4",
            "value": "72.21.81.200"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "2571013a-e926-41d7-b13c-b180a0720a96",
        "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
        "shared_count": 37,
        "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "fp-vs-nocache.azureedge.net"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "nexusrules.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "prod.nexusrules.live.com.akadns.net"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "spo-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "t-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "teams-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "domain",
            "value": "x1.c.lencr.org"
          },
          {
            "type": "ipv4",
            "value": "13.107.136.254"
          },
          {
            "type": "ipv4",
            "value": "13.107.21.200"
          },
          {
            "type": "ipv4",
            "value": "13.107.246.254"
          },
          {
            "type": "ipv4",
            "value": "13.107.42.16"
          },
          {
            "type": "ipv4",
            "value": "13.89.179.10"
          },
          {
            "type": "ipv4",
            "value": "13.89.179.9"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.44.10.123"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.200"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "52.109.8.20"
          },
          {
            "type": "ipv4",
            "value": "52.113.196.254"
          },
          {
            "type": "ipv4",
            "value": "52.182.143.210"
          },
          {
            "type": "ipv4",
            "value": "52.183.220.149"
          },
          {
            "type": "ipv4",
            "value": "52.185.211.133"
          },
          {
            "type": "ipv4",
            "value": "72.21.81.200"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "ce8cf5b8-2927-4b30-804c-2fedaec840f1",
        "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142",
        "shared_count": 27,
        "source_sha256": "c48854c24223cf7b4e9880ea72a21a877e4138e4ce36df7b7656e5c6c4043f68",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.42.16"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.97.199.114"
          },
          {
            "type": "ipv4",
            "value": "52.96.121.130"
          },
          {
            "type": "ipv4",
            "value": "52.96.57.2"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa",
        "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
        "shared_count": 30,
        "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "c-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe2cr.update.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe3cr.delivery.mp.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.4.254"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.219"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.15"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51",
        "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c",
        "shared_count": 27,
        "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "domain",
            "value": "x1.c.lencr.org"
          },
          {
            "type": "ipv4",
            "value": "13.89.179.9"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.18"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.20"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.21"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.32"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.35"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739",
        "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
        "shared_count": 22,
        "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe3cr.delivery.mp.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.32"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c",
        "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785",
        "shared_count": 16,
        "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df",
        "shared_observables": [
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "104.208.16.94"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.20"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.21"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.35"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b",
        "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826",
        "shared_count": 22,
        "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe2cr.update.microsoft.com"
          },
          {
            "type": "domain",
            "value": "imap.gmail.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.22"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62",
        "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2",
        "shared_count": 43,
        "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "self.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.89.178.27"
          },
          {
            "type": "ipv4",
            "value": "13.89.179.9"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.18"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.20"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.21"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.15"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.32"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.35"
          },
          {
            "type": "ipv4",
            "value": "52.183.220.149"
          },
          {
            "type": "ipv4",
            "value": "52.185.211.133"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa",
        "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa",
        "shared_count": 24,
        "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.15"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda",
        "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908",
        "shared_count": 34,
        "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "k-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "teams-ring.msedge.net"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.18.254"
          },
          {
            "type": "ipv4",
            "value": "13.107.42.16"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.13"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          },
          {
            "type": "ipv4",
            "value": "52.113.196.254"
          }
        ]
      },
      {
        "status": "shared-observation-not-common-campaign",
        "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866",
        "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c",
        "shared_count": 43,
        "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586",
        "shared_observables": [
          {
            "type": "domain",
            "value": "api.msn.com"
          },
          {
            "type": "domain",
            "value": "client.wns.windows.com"
          },
          {
            "type": "domain",
            "value": "config.edge.skype.com"
          },
          {
            "type": "domain",
            "value": "ctldl.windowsupdate.com"
          },
          {
            "type": "domain",
            "value": "dns.msftncsi.com"
          },
          {
            "type": "domain",
            "value": "edge.microsoft.com"
          },
          {
            "type": "domain",
            "value": "fe2cr.update.microsoft.com"
          },
          {
            "type": "domain",
            "value": "login.live.com"
          },
          {
            "type": "domain",
            "value": "login.microsoftonline.com"
          },
          {
            "type": "domain",
            "value": "odc.officeapps.live.com"
          },
          {
            "type": "domain",
            "value": "pti.store.microsoft.com"
          },
          {
            "type": "domain",
            "value": "settings-win.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v10.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "v20.events.data.microsoft.com"
          },
          {
            "type": "domain",
            "value": "wns.notify.trafficmanager.net"
          },
          {
            "type": "domain",
            "value": "www.bing.com"
          },
          {
            "type": "domain",
            "value": "www.microsoft.com"
          },
          {
            "type": "ipv4",
            "value": "13.107.42.16"
          },
          {
            "type": "ipv4",
            "value": "131.107.255.255"
          },
          {
            "type": "ipv4",
            "value": "20.190.157.11"
          },
          {
            "type": "ipv4",
            "value": "204.79.197.203"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.251"
          },
          {
            "type": "ipv4",
            "value": "224.0.0.252"
          },
          {
            "type": "ipv4",
            "value": "239.255.255.250"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.18"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.19"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.20"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.21"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.22"
          },
          {
            "type": "ipv4",
            "value": "40.126.28.23"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.10"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.11"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.12"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.14"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.15"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.5"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.7"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.8"
          },
          {
            "type": "ipv4",
            "value": "40.126.29.9"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.32"
          },
          {
            "type": "ipv4",
            "value": "40.126.7.35"
          }
        ]
      }
    ]
  },
  "capture_retained_sha256": "95074aea864749524df5b0a6c9fd58a3111038157b3400902486b96d902b3455",
  "capture_retained_matches": true,
  "ioc_expected_count": 0,
  "ioc_actual_count": 0,
  "ioc_exact": true,
  "ioc_missing_ids": [],
  "ioc_unexpected_ids": [],
  "actors_expected": 0,
  "actors_actual": 0,
  "actors_exact": true,
  "techniques_exact": true,
  "detection_checks": [],
  "cross_case_expected": 14,
  "cross_case_actual": 14,
  "cross_case_exact": true,
  "cross_case_checks": [
    {
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "shared_count": 31,
      "expected_count": 31,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "6e50c68f-5552-400c-9835-15867ddb022d",
      "shared_count": 25,
      "expected_count": 25,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "43bc93eb-d6db-4400-b983-b0dd404c8ca4",
      "shared_count": 69,
      "expected_count": 69,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "shared_count": 37,
      "expected_count": 37,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "29aa3ef8-47c9-4c47-b4cc-1ff3e0708142",
      "shared_count": 27,
      "expected_count": 27,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "shared_count": 30,
      "expected_count": 30,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c",
      "shared_count": 27,
      "expected_count": 27,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "08324647-35af-4af2-8d82-4387eec03918",
      "shared_count": 22,
      "expected_count": 22,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785",
      "shared_count": 16,
      "expected_count": 16,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826",
      "shared_count": 22,
      "expected_count": 22,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2",
      "shared_count": 43,
      "expected_count": 43,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa",
      "shared_count": 24,
      "expected_count": 24,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908",
      "shared_count": 34,
      "expected_count": 34,
      "exact": true,
      "attribution_guard": true
    },
    {
      "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c",
      "shared_count": 43,
      "expected_count": 43,
      "exact": true,
      "attribution_guard": true
    }
  ],
  "review_count": 1,
  "review_states": [
    "draft"
  ],
  "promotion_count": 0,
  "read_only_audit": true,
  "database_equals_api": true,
  "database_semantic_valid": true,
  "audit_seconds": 2.0531706269830465,
  "public_note": "Duplicate native database payload omitted. Equality and semantic audit checks retained; compare api-upload.json."
}