{
  "id": "507c6eec-8119-424e-bada-fcd00ccff4f5",
  "name": "PCAP verified workflow 2021-09-10 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [
    "T1018",
    "T1036",
    "T1055",
    "T1059",
    "T1071",
    "T1082",
    "T1083",
    "T1105",
    "T1129",
    "T1218",
    "T1218.010",
    "T1218.011",
    "T1497",
    "T1518",
    "T1518.001",
    "T1573",
    "T1574",
    "T1574.002"
  ],
  "report_ids": [
    "144ab9a0-2681-49f4-a410-b126d75d334d",
    "84edb541-725a-4951-95f7-557c53fc8cf8",
    "89e9d15a-c2f9-4310-b3cd-0676c64daa28",
    "8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
    "997d0aa6-7dd5-4cbb-893d-72ff83b93601",
    "ececde00-c0d7-49bc-be9a-cc6bee393239"
  ],
  "evidence_nodes": [
    {
      "id": "log-pcap:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "type": "log-pcap-analysis",
      "label": "2021-09-10-traffic-analysis-exercise.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2021-09-10-traffic-analysis-exercise.pcap\nCapture SHA-256: `a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12`\nSemantic result SHA-256: `ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 9221\n- Duration: 4609.2884 seconds\n- Captured bytes: 6032490\n- Endpoints: 66\n- Flows: 263\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4193 / TCP stream 100, frame 4198 / TCP stream 100, frame 4200 / TCP stream 100, frame 6404 / TCP stream 100.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1048578,\"destination\":\"10.9.10.102\",\"response_count\":2,\"source\":\"23.1.237.216\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v3`; confidence: 0.86; evidence: frame 4195 / TCP stream 101, frame 4199 / TCP stream 101, frame 4201 / TCP stream 101, frame 6356 / TCP stream 101, frame 6371 / TCP stream 101.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":1970634,\"destination\":\"10.9.10.102\",\"response_count\":3,\"source\":\"23.1.237.225\",\"uri\":\"/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 19, frame 64, frame 134, frame 168, frame 7624.\n\nMetrics: `{\"domain\":\"wpad.angrypoutine.com\",\"response_count\":12,\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 389 / TCP stream 15, frame 398 / TCP stream 15, frame 404 / TCP stream 15, frame 417 / TCP stream 15, frame 2059 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 80 / TCP stream 1, frame 83 / TCP stream 1, frame 478 / TCP stream 22, frame 483 / TCP stream 22, frame 486 / TCP stream 22.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":50,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 440 / TCP stream 19, frame 442 / TCP stream 19, frame 444 / TCP stream 19, frame 446 / TCP stream 19, frame 448 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.9\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.102\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 391 / TCP stream 15, frame 401 / TCP stream 15, frame 406 / TCP stream 15, frame 418 / TCP stream 15, frame 2060 / TCP stream 67.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":25,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 82 / TCP stream 1, frame 480 / TCP stream 22, frame 485 / TCP stream 22, frame 487 / TCP stream 22, frame 495 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":39,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.9.10.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 441 / TCP stream 19, frame 443 / TCP stream 19, frame 445 / TCP stream 19, frame 447 / TCP stream 19, frame 449 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.9.10.102\",\"event_count\":57,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.9.10.9\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `hobart.gunnarsson`; client IPs: 10.9.10.102; frames: 300, 311, 315, 332, 341\n- full-name: `Hobart Gunnarsson`; client IPs: 10.9.10.102; frames: 455\n- hostname: `DESKTOP-KKITB6Q`; client IPs: 10.9.10.102, 169.254.181.227; frames: 1, 3, 5, 6, 9\n- netbios-group: `ANGRYPOUTINE`; client IPs: unbound subject; frames: 7, 8, 11, 35, 38\n\n## IOC and artifact candidates\n\n- domain: `68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `am2prdapp01-canary.cloudapp.net`; roles: dns-cname\n- domain: `angrypoutine-dc.angrypoutine.com`; roles: dns-query\n- domain: `angrypoutine.com`; roles: dns-query\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `au.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `bing.com`; roles: tls-sni\n- domain: `cdn.onenote.net`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: tls-sni\n- domain: `cp601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-kkitb6q.angrypoutine.com`; roles: dns-query\n- domain: `desktop-muyeyv7.angrypoutine.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `evoke-windowsservices-tas.msedge.net`; roles: dns-query, tls-sni\n- domain: `f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-afd.azureedge.us`; roles: dns-query, tls-sni\n- domain: `fp-afd.azurefd.us`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `fs.microsoft.com`; roles: dns-query, tls-sni\n- domain: `gameplayapi.intel.com`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `k-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `kv601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.live.com`; roles: dns-query, tls-sni\n- domain: `microsoft.com`; roles: dns-query, tls-sni\n- domain: `moiafdazure.clo.footprintdns.com`; roles: dns-query, tls-sni\n- domain: `myexternalip.com`; roles: dns-query, tls-sni\n- domain: `nexus.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `office15client.microsoft.com`; roles: dns-query\n- domain: `prod-w.nexus.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `q-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `settingsfd-geo.trafficmanager.net`; roles: dns-cname\n- domain: `simpsonsavingss.com`; roles: dns-query, http-host\n- domain: `slscr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `store-images.s-microsoft.com`; roles: dns-query, http-host\n- domain: `storeedgefd.dsx.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `update.googleapis.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wpad.angrypoutine.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.microsoft.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.9.10.102`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.103`; roles: dns-answer, network-endpoint\n- ipv4: `10.9.10.255`; roles: network-endpoint\n- ipv4: `10.9.10.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.125.253.131`; roles: dns-answer, network-endpoint\n- ipv4: `104.215.148.63`; roles: dns-answer, network-endpoint\n- ipv4: `104.46.162.226`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.18.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.49.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.88`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.72`; roles: dns-answer, network-endpoint\n- ipv4: `13.77.161.179`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `167.172.37.9`; roles: network-endpoint\n- ipv4: `169.254.181.227`; roles: network-endpoint\n- ipv4: `169.254.255.255`; roles: network-endpoint\n- ipv4: `172.217.168.195`; roles: dns-answer, network-endpoint\n- ipv4: `184.85.229.68`; roles: dns-answer, network-endpoint\n- ipv4: `194.62.42.206`; roles: dns-answer, network-endpoint\n- ipv4: `20.140.48.71`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.7`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.151.132`; roles: dns-answer\n- ipv4: `20.190.151.133`; roles: dns-answer\n- ipv4: `20.190.151.134`; roles: dns-answer\n- ipv4: `20.190.151.6`; roles: dns-answer\n- ipv4: `20.190.151.68`; roles: dns-answer\n- ipv4: `20.190.151.69`; roles: dns-answer\n- ipv4: `20.190.151.9`; roles: dns-answer\n- ipv4: `20.190.154.136`; roles: dns-answer\n- ipv4: `20.190.154.138`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.154.139`; roles: dns-answer\n- ipv4: `20.190.154.16`; roles: dns-answer\n- ipv4: `20.190.154.17`; roles: dns-answer\n- ipv4: `20.190.154.18`; roles: dns-answer\n- ipv4: `20.190.154.19`; roles: dns-answer\n- ipv4: `20.42.73.25`; roles: dns-answer, network-endpoint\n- ipv4: `20.50.73.10`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.1.237.200`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.201`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.209`; roles: dns-answer\n- ipv4: `23.1.237.216`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.237.225`; roles: dns-answer, network-endpoint\n- ipv4: `23.100.36.182`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.6.28`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.84.67`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.202`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.85.234`; roles: dns-answer, network-endpoint\n- ipv4: `23.3.86.10`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `34.117.59.81`; roles: dns-answer, network-endpoint\n- ipv4: `40.112.72.205`; roles: dns-answer\n- ipv4: `40.113.200.201`; roles: dns-answer\n- ipv4: `40.125.122.151`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.132`; roles: dns-answer\n- ipv4: `40.126.26.134`; roles: dns-answer\n- ipv4: `40.126.26.135`; roles: dns-answer, network-endpoint\n- ipv4: `40.76.4.15`; roles: dns-answer\n- ipv4: `40.83.240.146`; roles: network-endpoint\n- ipv4: `51.137.102.183`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.75`; roles: dns-answer\n- ipv4: `52.109.76.32`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.36`; roles: network-endpoint\n- ipv4: `52.109.8.19`; roles: network-endpoint\n- ipv4: `52.109.8.22`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.25`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.208`; roles: dns-answer, network-endpoint\n- ipv4: `52.184.217.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.238.248.6`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.101.226`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.97.97`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `94.158.245.52`; roles: network-endpoint\n- ipv4: `96.17.68.66`; roles: dns-answer, network-endpoint\n- ipv4: `96.17.68.83`; roles: dns-answer\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; roles: exported-object\n- sha256: `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; roles: exported-object\n- sha256: `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; roles: exported-object\n- sha256: `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; roles: exported-object\n- sha256: `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; roles: exported-object\n- sha256: `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; roles: exported-object\n- sha256: `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; roles: exported-object\n- sha256: `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; roles: exported-object\n- sha256: `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; roles: exported-object\n- sha256: `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; roles: exported-object\n- sha256: `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; roles: exported-object\n- sha256: `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; roles: exported-object\n- sha256: `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; roles: exported-object\n- sha256: `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; roles: exported-object\n- sha256: `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; roles: exported-object\n- sha256: `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; roles: exported-object\n- sha256: `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; roles: exported-object\n- sha256: `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; roles: exported-object\n- sha256: `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; roles: exported-object\n- sha256: `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; roles: exported-object\n- sha256: `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; roles: exported-object\n- sha256: `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; roles: exported-object\n- sha256: `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; roles: exported-object\n- sha256: `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; roles: exported-object\n- sha256: `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; roles: exported-object\n- sha256: `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; roles: exported-object\n- sha256: `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; roles: exported-object\n- sha256: `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; roles: exported-object\n- sha256: `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; roles: exported-object\n- sha256: `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; roles: exported-object\n- sha256: `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; roles: exported-object\n- sha256: `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; roles: exported-object\n- sha256: `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; roles: exported-object\n- sha256: `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; roles: exported-object\n- sha256: `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; roles: exported-object\n- sha256: `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; roles: exported-object\n- sha256: `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; roles: exported-object\n- sha256: `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; roles: exported-object\n- sha256: `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; roles: exported-object\n- sha256: `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; roles: exported-object\n- sha256: `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; roles: exported-object\n- sha256: `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; roles: exported-object\n- sha256: `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8afe60e61b27f828`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?22c230ae05c29e0f`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/c/msdownload/update/others/2021/09/35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; roles: http-request\n- url: `http://download.windowsupdate.com/d/msdownload/update/others/2021/09/35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; roles: http-request\n- url: `http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9?w=150&h=225`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8?w=150&h=150`; roles: http-request\n- url: `http://store-images.s-microsoft.com/image/apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477?w=150&h=150`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19043`; roles: http-client\n- user_agent: `Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.32`; roles: http-client\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe`; SHA-256 `1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431`; size 1048576 bytes\n  Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe`; SHA-256 `2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792`; size 1048576 bytes\n  Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"iEx\",\"feature\":\"dynamic-evaluation\",\"offset\":207057}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `date1%3fBNLv65=pAAS`; SHA-256 `eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8`; size 284816 bytes\n  Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe`; SHA-256 `0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f`; size 922056 bytes\n- exported object `apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150`; SHA-256 `c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652`; size 24101 bytes\n- exported object `apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150`; SHA-256 `f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43`; size 19230 bytes\n- exported object `apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150`; SHA-256 `0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c`; size 17906 bytes\n- exported object `apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225`; SHA-256 `4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e`; size 16870 bytes\n- exported object `apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150`; SHA-256 `0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca`; size 13972 bytes\n- exported object `35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab`; SHA-256 `4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4`; size 10821 bytes\n- exported object `35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab`; SHA-256 `4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34`; size 10791 bytes\n- exported object `35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab`; SHA-256 `cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7`; size 10789 bytes\n- exported object `35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab`; SHA-256 `2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51`; size 10781 bytes\n- exported object `35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab`; SHA-256 `8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c`; size 10767 bytes\n- exported object `35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab`; SHA-256 `1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb`; size 10765 bytes\n- exported object `35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab`; SHA-256 `80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1`; size 10763 bytes\n- exported object `35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab`; SHA-256 `07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196`; size 10623 bytes\n- exported object `35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab`; SHA-256 `e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a`; size 10621 bytes\n- exported object `35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab`; SHA-256 `dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d`; size 10593 bytes\n- exported object `35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab`; SHA-256 `0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5`; size 10589 bytes\n- exported object `35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab`; SHA-256 `9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886`; size 7287 bytes\n- exported object `35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab`; SHA-256 `01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc`; size 7285 bytes\n- exported object `35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab`; SHA-256 `2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f`; size 7285 bytes\n- exported object `35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab`; SHA-256 `6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee`; size 7283 bytes\n- exported object `35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab`; SHA-256 `d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2`; size 7277 bytes\n- exported object `35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab`; SHA-256 `ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f`; size 7277 bytes\n- exported object `35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab`; SHA-256 `153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d`; size 7275 bytes\n- exported object `35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab`; SHA-256 `729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d`; size 7275 bytes\n- exported object `35094711_e3993b23840c0d600179f647e9ac08158269c095.cab`; SHA-256 `e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21`; size 7275 bytes\n- exported object `35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab`; SHA-256 `8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5`; size 7273 bytes\n- exported object `35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab`; SHA-256 `3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864`; size 7267 bytes\n- exported object `35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab`; SHA-256 `f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7`; size 7261 bytes\n- exported object `35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab`; SHA-256 `6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d`; size 7189 bytes\n- exported object `35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab`; SHA-256 `0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7`; size 7185 bytes\n- exported object `35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab`; SHA-256 `b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4`; size 7183 bytes\n- exported object `35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab`; SHA-256 `36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219`; size 7181 bytes\n- exported object `35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab`; SHA-256 `e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe`; size 7181 bytes\n- exported object `35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab`; SHA-256 `809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a`; size 7175 bytes\n- exported object `35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab`; SHA-256 `b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334`; size 7175 bytes\n- exported object `35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab`; SHA-256 `6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c`; size 7171 bytes\n- exported object `35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab`; SHA-256 `b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe`; size 7171 bytes\n- exported object `35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab`; SHA-256 `eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74`; size 7171 bytes\n- exported object `apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150`; SHA-256 `84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411`; size 2222 bytes\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n- exported object `am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe`; SHA-256 `9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d`; size 2 bytes\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `fd1ef8f35792013eb051dd90b6a512f313f5655d99849d97a044c7dc6beb785f`; recorded 2026-09-19T12:10:32.214995+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":248,\"observable_limit\":5000,\"observables_checked\":248,\"observables_total\":248,\"prior_case_limit_reached\":false,\"prior_cases_checked\":15,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 51 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 21 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 18 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":45,\"exported_objects\":46,\"hashed_bytes\":3675348,\"hashed_objects\":46,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":45,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":45}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 9/9, identities 4/4, observables 248/248, artifacts 45/45. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 9221 packets across 66 IP endpoints and 263 transport flows. Observed 199 DNS events, 58 HTTP requests, 105 TLS ClientHello events, and 45 exported HTTP object(s). Deterministic rules produced 9 finding(s): 0 high, 2 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "observables": [
        {
          "type": "domain",
          "value": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 583 / UDP stream 29, frame 601 / UDP stream 29, frame 641 / TCP stream 33"
        },
        {
          "type": "domain",
          "value": "a-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 632 / UDP stream 36, frame 671 / UDP stream 36, frame 769 / TCP stream 39"
        },
        {
          "type": "domain",
          "value": "am2prdapp01-canary.cloudapp.net",
          "confidence": 1,
          "description": "dns-cname; frame 587 / UDP stream 25"
        },
        {
          "type": "domain",
          "value": "angrypoutine-dc.angrypoutine.com",
          "confidence": 1,
          "description": "dns-query; frame 41 / UDP stream 11, frame 42 / UDP stream 11, frame 44 / UDP stream 11, frame 45 / UDP stream 11, frame 8533 / UDP stream 92 +5 more"
        },
        {
          "type": "domain",
          "value": "angrypoutine.com",
          "confidence": 1,
          "description": "dns-query; frame 26 / UDP stream 5, frame 30 / UDP stream 5"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 555 / UDP stream 23, frame 556 / UDP stream 23, frame 560 / TCP stream 26, frame 970 / TCP stream 43"
        },
        {
          "type": "domain",
          "value": "au.download.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 4182 / UDP stream 72, frame 4187 / UDP stream 72, frame 4193 / TCP stream 100, frame 4195 / TCP stream 101, frame 4200 / TCP stream 100 +2 more"
        },
        {
          "type": "domain",
          "value": "bing.com",
          "confidence": 1,
          "description": "tls-sni; frame 594 / TCP stream 27"
        },
        {
          "type": "domain",
          "value": "cdn.onenote.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 510 / UDP stream 22, frame 511 / UDP stream 22, frame 518 / TCP stream 25, frame 519 / TCP stream 24"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "tls-sni; frame 97 / TCP stream 2"
        },
        {
          "type": "domain",
          "value": "cp601.prod.do.dsp.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4151 / UDP stream 71, frame 4159 / UDP stream 71, frame 4163 / TCP stream 99"
        },
        {
          "type": "domain",
          "value": "ctldl.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 8441 / UDP stream 91, frame 8442 / UDP stream 91, frame 8446 / TCP stream 137, frame 8449 / TCP stream 137"
        },
        {
          "type": "domain",
          "value": "desktop-kkitb6q.angrypoutine.com",
          "confidence": 1,
          "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4"
        },
        {
          "type": "domain",
          "value": "desktop-muyeyv7.angrypoutine.com",
          "confidence": 1,
          "description": "dns-query; frame 2636 / UDP stream 55, frame 2637 / UDP stream 55, frame 2638 / UDP stream 55, frame 2639 / UDP stream 55"
        },
        {
          "type": "domain",
          "value": "dns.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 8039 / UDP stream 83, frame 8040 / UDP stream 83, frame 8041 / UDP stream 83, frame 8042 / UDP stream 83"
        },
        {
          "type": "domain",
          "value": "download.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 3232 / UDP stream 66, frame 3233 / UDP stream 66, frame 3241 / TCP stream 93, frame 3254 / TCP stream 93, frame 3263 / TCP stream 93 +15 more"
        },
        {
          "type": "domain",
          "value": "evoke-windowsservices-tas.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 7989 / UDP stream 81, frame 7990 / UDP stream 81, frame 7995 / TCP stream 123"
        },
        {
          "type": "domain",
          "value": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 578 / UDP stream 25, frame 587 / UDP stream 25, frame 714 / TCP stream 29"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3049 / UDP stream 63, frame 3050 / UDP stream 63, frame 3054 / TCP stream 90"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.microsoft.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 3050 / UDP stream 63"
        },
        {
          "type": "domain",
          "value": "fe3cr.delivery.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4022 / UDP stream 67, frame 4023 / UDP stream 67, frame 4024 / UDP stream 67, frame 4028 / TCP stream 94"
        },
        {
          "type": "domain",
          "value": "fp-afd.azureedge.us",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 634 / UDP stream 38, frame 706 / UDP stream 38, frame 712 / UDP stream 38, frame 870 / TCP stream 42"
        },
        {
          "type": "domain",
          "value": "fp-afd.azurefd.us",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 582 / UDP stream 28, frame 605 / UDP stream 28, frame 960 / UDP stream 28, frame 1006 / UDP stream 28, frame 1007 / UDP stream 28 +1 more"
        },
        {
          "type": "domain",
          "value": "fp-vs-nocache.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 602 / UDP stream 34, frame 625 / UDP stream 34, frame 682 / TCP stream 37"
        },
        {
          "type": "domain",
          "value": "fp.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 633 / UDP stream 37, frame 672 / UDP stream 37, frame 768 / TCP stream 40"
        },
        {
          "type": "domain",
          "value": "fs.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 218 / UDP stream 20, frame 219 / UDP stream 20, frame 223 / TCP stream 8, frame 244 / TCP stream 9, frame 264 / TCP stream 10"
        },
        {
          "type": "domain",
          "value": "gameplayapi.intel.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2328 / UDP stream 49, frame 2329 / UDP stream 49, frame 2370 / UDP stream 49, frame 2457 / TCP stream 76"
        },
        {
          "type": "domain",
          "value": "geo.prod.do.dsp.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4096 / UDP stream 69, frame 4097 / UDP stream 69, frame 4107 / TCP stream 96"
        },
        {
          "type": "domain",
          "value": "k-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 600 / UDP stream 33, frame 618 / UDP stream 33, frame 684 / TCP stream 35"
        },
        {
          "type": "domain",
          "value": "kv601.prod.do.dsp.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4123 / UDP stream 70, frame 4124 / UDP stream 70, frame 4131 / TCP stream 97"
        },
        {
          "type": "domain",
          "value": "login.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 642 / UDP stream 39, frame 707 / UDP stream 39, frame 3072 / UDP stream 64, frame 3073 / UDP stream 64, frame 8397 / UDP stream 90 +5 more"
        },
        {
          "type": "domain",
          "value": "microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1478 / UDP stream 44, frame 1480 / UDP stream 44, frame 1486 / TCP stream 52"
        },
        {
          "type": "domain",
          "value": "moiafdazure.clo.footprintdns.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 579 / UDP stream 26, frame 584 / UDP stream 26, frame 613 / TCP stream 28"
        },
        {
          "type": "domain",
          "value": "myexternalip.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2603 / UDP stream 50, frame 2604 / UDP stream 50, frame 2605 / UDP stream 50, frame 2606 / UDP stream 50, frame 2611 / TCP stream 78"
        },
        {
          "type": "domain",
          "value": "nexus.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2849 / UDP stream 58, frame 2853 / UDP stream 58, frame 2854 / UDP stream 58, frame 8178 / UDP stream 86, frame 8179 / UDP stream 86 +9 more"
        },
        {
          "type": "domain",
          "value": "nexusrules.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2875 / UDP stream 59, frame 2877 / UDP stream 59, frame 2878 / UDP stream 59, frame 1166 / TCP stream 49, frame 2882 / TCP stream 84"
        },
        {
          "type": "domain",
          "value": "office15client.microsoft.com",
          "confidence": 1,
          "description": "dns-query; frame 1143 / UDP stream 41, frame 1144 / UDP stream 41, frame 2833 / UDP stream 56, frame 2844 / UDP stream 56, frame 2845 / UDP stream 56"
        },
        {
          "type": "domain",
          "value": "prod-w.nexus.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 2854 / UDP stream 58, frame 8182 / UDP stream 86, frame 9204 / UDP stream 101"
        },
        {
          "type": "domain",
          "value": "prod.nexusrules.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 2878 / UDP stream 59"
        },
        {
          "type": "domain",
          "value": "q-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 581 / UDP stream 27, frame 586 / UDP stream 27, frame 628 / TCP stream 30"
        },
        {
          "type": "domain",
          "value": "s-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 597 / UDP stream 31, frame 617 / UDP stream 31, frame 657 / TCP stream 34"
        },
        {
          "type": "domain",
          "value": "settings-win.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1086 / UDP stream 40, frame 1087 / UDP stream 40, frame 1088 / UDP stream 40, frame 7445 / UDP stream 76, frame 7446 / UDP stream 76 +13 more"
        },
        {
          "type": "domain",
          "value": "settingsfd-geo.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 1088 / UDP stream 40, frame 7451 / UDP stream 76, frame 8376 / UDP stream 89"
        },
        {
          "type": "domain",
          "value": "simpsonsavingss.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 1180 / UDP stream 43, frame 1181 / UDP stream 43, frame 1182 / UDP stream 43, frame 1189 / TCP stream 50"
        },
        {
          "type": "domain",
          "value": "slscr.update.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3025 / UDP stream 62, frame 3026 / UDP stream 62, frame 3027 / UDP stream 62, frame 3031 / TCP stream 89"
        },
        {
          "type": "domain",
          "value": "spo-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 604 / UDP stream 35, frame 637 / UDP stream 35, frame 700 / TCP stream 38"
        },
        {
          "type": "domain",
          "value": "store-images.s-microsoft.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 2295 / UDP stream 48, frame 2305 / UDP stream 48, frame 2306 / UDP stream 48, frame 2316 / TCP stream 70, frame 2317 / TCP stream 71 +4 more"
        },
        {
          "type": "domain",
          "value": "storeedgefd.dsx.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1932 / UDP stream 45, frame 1933 / UDP stream 45, frame 1936 / UDP stream 45, frame 1945 / UDP stream 45, frame 1946 / UDP stream 45 +8 more"
        },
        {
          "type": "domain",
          "value": "t-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 595 / UDP stream 30, frame 596 / UDP stream 30, frame 627 / TCP stream 32"
        },
        {
          "type": "domain",
          "value": "teams-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 599 / UDP stream 32, frame 619 / UDP stream 32, frame 683 / TCP stream 36"
        },
        {
          "type": "domain",
          "value": "update.googleapis.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8336 / UDP stream 88, frame 8337 / UDP stream 88, frame 8338 / UDP stream 88, frame 8342 / TCP stream 134"
        },
        {
          "type": "domain",
          "value": "v10.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3163 / UDP stream 65, frame 3165 / UDP stream 65, frame 4034 / UDP stream 68, frame 4044 / UDP stream 68, frame 5111 / UDP stream 73 +15 more"
        },
        {
          "type": "domain",
          "value": "wpad.angrypoutine.com",
          "confidence": 1,
          "description": "dns-query; frame 18 / UDP stream 3, frame 19 / UDP stream 3, frame 63 / UDP stream 16, frame 64 / UDP stream 16, frame 133 / UDP stream 17 +15 more"
        },
        {
          "type": "domain",
          "value": "www.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 577 / UDP stream 24, frame 590 / UDP stream 24, frame 624 / TCP stream 31, frame 7746 / TCP stream 115"
        },
        {
          "type": "domain",
          "value": "www.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1145 / UDP stream 42, frame 1146 / UDP stream 42, frame 2846 / UDP stream 57, frame 2847 / UDP stream 57, frame 2848 / UDP stream 57 +1 more"
        },
        {
          "type": "domain",
          "value": "www.msftncsi.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 62 / UDP stream 15, frame 65 / UDP stream 15, frame 75 / TCP stream 0"
        },
        {
          "type": "ipv4",
          "value": "0.0.0.0",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.9.10.102",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 26 / UDP stream 5, frame 30 / UDP stream 5"
        },
        {
          "type": "ipv4",
          "value": "10.9.10.103",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2637 / UDP stream 55, frame 2639 / UDP stream 55"
        },
        {
          "type": "ipv4",
          "value": "10.9.10.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.9.10.9",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 23 / UDP stream 4, frame 40 / UDP stream 10, frame 42 / UDP stream 11, frame 45 / UDP stream 11, frame 2015 / UDP stream 46 +5 more"
        },
        {
          "type": "ipv4",
          "value": "104.125.253.131",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4124 / UDP stream 70, frame 4159 / UDP stream 71"
        },
        {
          "type": "ipv4",
          "value": "104.215.148.63",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1480 / UDP stream 44"
        },
        {
          "type": "ipv4",
          "value": "104.46.162.226",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3165 / UDP stream 65, frame 4044 / UDP stream 68, frame 5113 / UDP stream 73"
        },
        {
          "type": "ipv4",
          "value": "13.107.136.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 637 / UDP stream 35"
        },
        {
          "type": "ipv4",
          "value": "13.107.18.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 618 / UDP stream 33"
        },
        {
          "type": "ipv4",
          "value": "13.107.21.200",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24"
        },
        {
          "type": "ipv4",
          "value": "13.107.246.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 584 / UDP stream 26, frame 596 / UDP stream 30"
        },
        {
          "type": "ipv4",
          "value": "13.107.3.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 617 / UDP stream 31"
        },
        {
          "type": "ipv4",
          "value": "13.107.49.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 586 / UDP stream 27"
        },
        {
          "type": "ipv4",
          "value": "13.107.5.88",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 7990 / UDP stream 81"
        },
        {
          "type": "ipv4",
          "value": "13.69.239.72",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8044 / UDP stream 84"
        },
        {
          "type": "ipv4",
          "value": "13.77.161.179",
          "confidence": 1,
          "description": "dns-answer; frame 1480 / UDP stream 44"
        },
        {
          "type": "ipv4",
          "value": "131.107.255.255",
          "confidence": 1,
          "description": "dns-answer; frame 8040 / UDP stream 83, frame 8042 / UDP stream 83"
        },
        {
          "type": "ipv4",
          "value": "167.172.37.9",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "169.254.181.227",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "169.254.255.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "172.217.168.195",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8338 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "184.85.229.68",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 511 / UDP stream 22"
        },
        {
          "type": "ipv4",
          "value": "194.62.42.206",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1182 / UDP stream 43"
        },
        {
          "type": "ipv4",
          "value": "20.140.48.71",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 712 / UDP stream 38, frame 1007 / UDP stream 28"
        },
        {
          "type": "ipv4",
          "value": "20.189.173.7",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 7586 / UDP stream 77"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.131",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.132",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.133",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.134",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.6",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.68",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.69",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.151.9",
          "confidence": 1,
          "description": "dns-answer; frame 707 / UDP stream 39"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.136",
          "confidence": 1,
          "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.138",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.139",
          "confidence": 1,
          "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.16",
          "confidence": 1,
          "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.17",
          "confidence": 1,
          "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.18",
          "confidence": 1,
          "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.19",
          "confidence": 1,
          "description": "dns-answer; frame 8399 / UDP stream 90"
        },
        {
          "type": "ipv4",
          "value": "20.42.73.25",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8655 / UDP stream 94"
        },
        {
          "type": "ipv4",
          "value": "20.50.73.10",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 7358 / UDP stream 74, frame 7420 / UDP stream 75"
        },
        {
          "type": "ipv4",
          "value": "204.79.197.200",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24"
        }
      ],
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap"
      ],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "observable_count": 248,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "suspicious_findings": [
        {
          "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.",
          "category": "Script, archive, or executable transfer candidate",
          "evidence": "frame 4193 / TCP stream 100, frame 4198 / TCP stream 100, frame 4200 / TCP stream 100, frame 6404 / TCP stream 100",
          "severity": "medium"
        },
        {
          "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v3; confidence 86%.",
          "category": "Script, archive, or executable transfer candidate",
          "evidence": "frame 4195 / TCP stream 101, frame 4199 / TCP stream 101, frame 4201 / TCP stream 101, frame 6356 / TCP stream 101, frame 6371 / TCP stream 101 +1 more",
          "severity": "medium"
        },
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 19 / UDP stream 3, frame 64 / UDP stream 16, frame 134 / UDP stream 17, frame 168 / UDP stream 19, frame 7624 / UDP stream 78 +7 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 389 / TCP stream 15, frame 398 / TCP stream 15, frame 404 / TCP stream 15, frame 417 / TCP stream 15, frame 2059 / TCP stream 67 +20 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 80 / TCP stream 1, frame 83 / TCP stream 1, frame 478 / TCP stream 22, frame 483 / TCP stream 22, frame 486 / TCP stream 22 +45 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 440 / TCP stream 19, frame 442 / TCP stream 19, frame 444 / TCP stream 19, frame 446 / TCP stream 19, frame 448 / TCP stream 19 +52 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 391 / TCP stream 15, frame 401 / TCP stream 15, frame 406 / TCP stream 15, frame 418 / TCP stream 15, frame 2060 / TCP stream 67 +20 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 82 / TCP stream 1, frame 480 / TCP stream 22, frame 485 / TCP stream 22, frame 487 / TCP stream 22, frame 495 / TCP stream 23 +34 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 441 / TCP stream 19, frame 443 / TCP stream 19, frame 445 / TCP stream 19, frame 447 / TCP stream 19, frame 449 / TCP stream 19 +52 more",
          "severity": "low"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Volatile Cedar",
          "similarity": 0.2,
          "shared_count": 1,
          "group_attack_id": "G0123",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Winnti Group",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G0044",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Ajax Security Team",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G0130",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "IndigoZebra",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0136",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Nomadic Octopus",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0133",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Whitefly",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0107",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Metador",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G1013",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Elderwood",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0066",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Rancor",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0075",
          "shared_techniques": [
            "T1105"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Evilnum",
          "similarity": 0.0909,
          "shared_count": 1,
          "group_attack_id": "G0120",
          "shared_techniques": [
            "T1105"
          ]
        }
      ],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ttp-evidence:9923b3d5-8d06-4f6a-b1f1-810507712be3:T1105",
      "type": "ttp-evidence",
      "label": "T1105 Ingress Tool Transfer",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "command-and-control",
      "evidence": "T1105 Ingress Tool Transfer",
      "attack_id": "T1105",
      "confidence": 0.8,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com",
      "type": "ioc",
      "value": "68091d435f184f9c8d6273bdb538ff4b.clo.footprintdns.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 583 / UDP stream 29, frame 601 / UDP stream 29, frame 641 / TCP stream 33",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a-ring.msedge.net",
      "type": "ioc",
      "value": "a-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 632 / UDP stream 36, frame 671 / UDP stream 36, frame 769 / TCP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:am2prdapp01-canary.cloudapp.net",
      "type": "ioc",
      "value": "am2prdapp01-canary.cloudapp.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-cname; frame 587 / UDP stream 25",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:angrypoutine-dc.angrypoutine.com",
      "type": "ioc",
      "value": "angrypoutine-dc.angrypoutine.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 41 / UDP stream 11, frame 42 / UDP stream 11, frame 44 / UDP stream 11, frame 45 / UDP stream 11, frame 8533 / UDP stream 92 +5 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:angrypoutine.com",
      "type": "ioc",
      "value": "angrypoutine.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 26 / UDP stream 5, frame 30 / UDP stream 5",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 555 / UDP stream 23, frame 556 / UDP stream 23, frame 560 / TCP stream 26, frame 970 / TCP stream 43",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:au.download.windowsupdate.com",
      "type": "ioc",
      "value": "au.download.windowsupdate.com",
      "source": "ioc-investigation",
      "verdict": "needs review",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "au.download.windowsupdate.com was classified as domain. Investigation verdict is needs review with score 34/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation"
      ],
      "suspicion_score": 34
    },
    {
      "id": "ioc:bing.com",
      "type": "ioc",
      "value": "bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "tls-sni; frame 594 / TCP stream 27",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cdn.onenote.net",
      "type": "ioc",
      "value": "cdn.onenote.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 510 / UDP stream 22, frame 511 / UDP stream 22, frame 518 / TCP stream 25, frame 519 / TCP stream 24",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "tls-sni; frame 97 / TCP stream 2",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cp601.prod.do.dsp.mp.microsoft.com",
      "type": "ioc",
      "value": "cp601.prod.do.dsp.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 4151 / UDP stream 71, frame 4159 / UDP stream 71, frame 4163 / TCP stream 99",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ctldl.windowsupdate.com",
      "type": "ioc",
      "value": "ctldl.windowsupdate.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, http-host; frame 8441 / UDP stream 91, frame 8442 / UDP stream 91, frame 8446 / TCP stream 137, frame 8449 / TCP stream 137",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-kkitb6q.angrypoutine.com",
      "type": "ioc",
      "value": "desktop-kkitb6q.angrypoutine.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-muyeyv7.angrypoutine.com",
      "type": "ioc",
      "value": "desktop-muyeyv7.angrypoutine.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 2636 / UDP stream 55, frame 2637 / UDP stream 55, frame 2638 / UDP stream 55, frame 2639 / UDP stream 55",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dns.msftncsi.com",
      "type": "ioc",
      "value": "dns.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 8039 / UDP stream 83, frame 8040 / UDP stream 83, frame 8041 / UDP stream 83, frame 8042 / UDP stream 83",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:download.windowsupdate.com",
      "type": "ioc",
      "value": "download.windowsupdate.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, http-host; frame 3232 / UDP stream 66, frame 3233 / UDP stream 66, frame 3241 / TCP stream 93, frame 3254 / TCP stream 93, frame 3263 / TCP stream 93 +15 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:evoke-windowsservices-tas.msedge.net",
      "type": "ioc",
      "value": "evoke-windowsservices-tas.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 7989 / UDP stream 81, frame 7990 / UDP stream 81, frame 7995 / TCP stream 123",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com",
      "type": "ioc",
      "value": "f005cab8a8840abf6ab35152a071b205.clo.footprintdns.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 578 / UDP stream 25, frame 587 / UDP stream 25, frame 714 / TCP stream 29",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.microsoft.com",
      "type": "ioc",
      "value": "fe2cr.update.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 3049 / UDP stream 63, frame 3050 / UDP stream 63, frame 3054 / TCP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.microsoft.com.akadns.net",
      "type": "ioc",
      "value": "fe2cr.update.microsoft.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-cname; frame 3050 / UDP stream 63",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe3cr.delivery.mp.microsoft.com",
      "type": "ioc",
      "value": "fe3cr.delivery.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 4022 / UDP stream 67, frame 4023 / UDP stream 67, frame 4024 / UDP stream 67, frame 4028 / TCP stream 94",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-afd.azureedge.us",
      "type": "ioc",
      "value": "fp-afd.azureedge.us",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 634 / UDP stream 38, frame 706 / UDP stream 38, frame 712 / UDP stream 38, frame 870 / TCP stream 42",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-afd.azurefd.us",
      "type": "ioc",
      "value": "fp-afd.azurefd.us",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 582 / UDP stream 28, frame 605 / UDP stream 28, frame 960 / UDP stream 28, frame 1006 / UDP stream 28, frame 1007 / UDP stream 28 +1 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-vs-nocache.azureedge.net",
      "type": "ioc",
      "value": "fp-vs-nocache.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 602 / UDP stream 34, frame 625 / UDP stream 34, frame 682 / TCP stream 37",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp.msedge.net",
      "type": "ioc",
      "value": "fp.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 633 / UDP stream 37, frame 672 / UDP stream 37, frame 768 / TCP stream 40",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fs.microsoft.com",
      "type": "ioc",
      "value": "fs.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 218 / UDP stream 20, frame 219 / UDP stream 20, frame 223 / TCP stream 8, frame 244 / TCP stream 9, frame 264 / TCP stream 10",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gameplayapi.intel.com",
      "type": "ioc",
      "value": "gameplayapi.intel.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 2328 / UDP stream 49, frame 2329 / UDP stream 49, frame 2370 / UDP stream 49, frame 2457 / TCP stream 76",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:geo.prod.do.dsp.mp.microsoft.com",
      "type": "ioc",
      "value": "geo.prod.do.dsp.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 4096 / UDP stream 69, frame 4097 / UDP stream 69, frame 4107 / TCP stream 96",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:k-ring.msedge.net",
      "type": "ioc",
      "value": "k-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 600 / UDP stream 33, frame 618 / UDP stream 33, frame 684 / TCP stream 35",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:kv601.prod.do.dsp.mp.microsoft.com",
      "type": "ioc",
      "value": "kv601.prod.do.dsp.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 4123 / UDP stream 70, frame 4124 / UDP stream 70, frame 4131 / TCP stream 97",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.live.com",
      "type": "ioc",
      "value": "login.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 642 / UDP stream 39, frame 707 / UDP stream 39, frame 3072 / UDP stream 64, frame 3073 / UDP stream 64, frame 8397 / UDP stream 90 +5 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:microsoft.com",
      "type": "ioc",
      "value": "microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 1478 / UDP stream 44, frame 1480 / UDP stream 44, frame 1486 / TCP stream 52",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:moiafdazure.clo.footprintdns.com",
      "type": "ioc",
      "value": "moiafdazure.clo.footprintdns.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 579 / UDP stream 26, frame 584 / UDP stream 26, frame 613 / TCP stream 28",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:myexternalip.com",
      "type": "ioc",
      "value": "myexternalip.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 2603 / UDP stream 50, frame 2604 / UDP stream 50, frame 2605 / UDP stream 50, frame 2606 / UDP stream 50, frame 2611 / TCP stream 78",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nexus.officeapps.live.com",
      "type": "ioc",
      "value": "nexus.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 2849 / UDP stream 58, frame 2853 / UDP stream 58, frame 2854 / UDP stream 58, frame 8178 / UDP stream 86, frame 8179 / UDP stream 86 +9 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nexusrules.officeapps.live.com",
      "type": "ioc",
      "value": "nexusrules.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 2875 / UDP stream 59, frame 2877 / UDP stream 59, frame 2878 / UDP stream 59, frame 1166 / TCP stream 49, frame 2882 / TCP stream 84",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:office15client.microsoft.com",
      "type": "ioc",
      "value": "office15client.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 1143 / UDP stream 41, frame 1144 / UDP stream 41, frame 2833 / UDP stream 56, frame 2844 / UDP stream 56, frame 2845 / UDP stream 56",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod-w.nexus.live.com.akadns.net",
      "type": "ioc",
      "value": "prod-w.nexus.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-cname; frame 2854 / UDP stream 58, frame 8182 / UDP stream 86, frame 9204 / UDP stream 101",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod.nexusrules.live.com.akadns.net",
      "type": "ioc",
      "value": "prod.nexusrules.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-cname; frame 2878 / UDP stream 59",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:q-ring.msedge.net",
      "type": "ioc",
      "value": "q-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 581 / UDP stream 27, frame 586 / UDP stream 27, frame 628 / TCP stream 30",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:s-ring.msedge.net",
      "type": "ioc",
      "value": "s-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 597 / UDP stream 31, frame 617 / UDP stream 31, frame 657 / TCP stream 34",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:settings-win.data.microsoft.com",
      "type": "ioc",
      "value": "settings-win.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 1086 / UDP stream 40, frame 1087 / UDP stream 40, frame 1088 / UDP stream 40, frame 7445 / UDP stream 76, frame 7446 / UDP stream 76 +13 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:settingsfd-geo.trafficmanager.net",
      "type": "ioc",
      "value": "settingsfd-geo.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-cname; frame 1088 / UDP stream 40, frame 7451 / UDP stream 76, frame 8376 / UDP stream 89",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:simpsonsavingss.com",
      "type": "ioc",
      "value": "simpsonsavingss.com",
      "source": "ioc-investigation",
      "verdict": "needs review",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "simpsonsavingss.com was classified as domain. Investigation verdict is needs review with score 38/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation"
      ],
      "suspicion_score": 38
    },
    {
      "id": "ioc:slscr.update.microsoft.com",
      "type": "ioc",
      "value": "slscr.update.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 3025 / UDP stream 62, frame 3026 / UDP stream 62, frame 3027 / UDP stream 62, frame 3031 / TCP stream 89",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:spo-ring.msedge.net",
      "type": "ioc",
      "value": "spo-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 604 / UDP stream 35, frame 637 / UDP stream 35, frame 700 / TCP stream 38",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:store-images.s-microsoft.com",
      "type": "ioc",
      "value": "store-images.s-microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, http-host; frame 2295 / UDP stream 48, frame 2305 / UDP stream 48, frame 2306 / UDP stream 48, frame 2316 / TCP stream 70, frame 2317 / TCP stream 71 +4 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:storeedgefd.dsx.mp.microsoft.com",
      "type": "ioc",
      "value": "storeedgefd.dsx.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 1932 / UDP stream 45, frame 1933 / UDP stream 45, frame 1936 / UDP stream 45, frame 1945 / UDP stream 45, frame 1946 / UDP stream 45 +8 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:t-ring.msedge.net",
      "type": "ioc",
      "value": "t-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 595 / UDP stream 30, frame 596 / UDP stream 30, frame 627 / TCP stream 32",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:teams-ring.msedge.net",
      "type": "ioc",
      "value": "teams-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 599 / UDP stream 32, frame 619 / UDP stream 32, frame 683 / TCP stream 36",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:update.googleapis.com",
      "type": "ioc",
      "value": "update.googleapis.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 8336 / UDP stream 88, frame 8337 / UDP stream 88, frame 8338 / UDP stream 88, frame 8342 / TCP stream 134",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v10.events.data.microsoft.com",
      "type": "ioc",
      "value": "v10.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 3163 / UDP stream 65, frame 3165 / UDP stream 65, frame 4034 / UDP stream 68, frame 4044 / UDP stream 68, frame 5111 / UDP stream 73 +15 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.angrypoutine.com",
      "type": "ioc",
      "value": "wpad.angrypoutine.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query; frame 18 / UDP stream 3, frame 19 / UDP stream 3, frame 63 / UDP stream 16, frame 64 / UDP stream 16, frame 133 / UDP stream 17 +15 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.bing.com",
      "type": "ioc",
      "value": "www.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 577 / UDP stream 24, frame 590 / UDP stream 24, frame 624 / TCP stream 31, frame 7746 / TCP stream 115",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.microsoft.com",
      "type": "ioc",
      "value": "www.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, tls-sni; frame 1145 / UDP stream 42, frame 1146 / UDP stream 42, frame 2846 / UDP stream 57, frame 2847 / UDP stream 57, frame 2848 / UDP stream 57 +1 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.msftncsi.com",
      "type": "ioc",
      "value": "www.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-query, http-host; frame 62 / UDP stream 15, frame 65 / UDP stream 15, frame 75 / TCP stream 0",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:0.0.0.0",
      "type": "ioc",
      "value": "0.0.0.0",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.9.10.102",
      "type": "ioc",
      "value": "10.9.10.102",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 26 / UDP stream 5, frame 30 / UDP stream 5",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.9.10.103",
      "type": "ioc",
      "value": "10.9.10.103",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 2637 / UDP stream 55, frame 2639 / UDP stream 55",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.9.10.255",
      "type": "ioc",
      "value": "10.9.10.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.9.10.9",
      "type": "ioc",
      "value": "10.9.10.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 23 / UDP stream 4, frame 40 / UDP stream 10, frame 42 / UDP stream 11, frame 45 / UDP stream 11, frame 2015 / UDP stream 46 +5 more",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.125.253.131",
      "type": "ioc",
      "value": "104.125.253.131",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 4124 / UDP stream 70, frame 4159 / UDP stream 71",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.215.148.63",
      "type": "ioc",
      "value": "104.215.148.63",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 1480 / UDP stream 44",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.46.162.226",
      "type": "ioc",
      "value": "104.46.162.226",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 3165 / UDP stream 65, frame 4044 / UDP stream 68, frame 5113 / UDP stream 73",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.136.254",
      "type": "ioc",
      "value": "13.107.136.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 637 / UDP stream 35",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.18.254",
      "type": "ioc",
      "value": "13.107.18.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 618 / UDP stream 33",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.21.200",
      "type": "ioc",
      "value": "13.107.21.200",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.246.254",
      "type": "ioc",
      "value": "13.107.246.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 584 / UDP stream 26, frame 596 / UDP stream 30",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.3.254",
      "type": "ioc",
      "value": "13.107.3.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 617 / UDP stream 31",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.49.254",
      "type": "ioc",
      "value": "13.107.49.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 586 / UDP stream 27",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.5.88",
      "type": "ioc",
      "value": "13.107.5.88",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 7990 / UDP stream 81",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.69.239.72",
      "type": "ioc",
      "value": "13.69.239.72",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 8044 / UDP stream 84",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.77.161.179",
      "type": "ioc",
      "value": "13.77.161.179",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 1480 / UDP stream 44",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:131.107.255.255",
      "type": "ioc",
      "value": "131.107.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 8040 / UDP stream 83, frame 8042 / UDP stream 83",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:167.172.37.9",
      "type": "ioc",
      "value": "167.172.37.9",
      "source": "ioc-investigation",
      "verdict": "suspicious",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "167.172.37.9 was classified as ip. Investigation verdict is suspicious with score 47/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation"
      ],
      "suspicion_score": 47
    },
    {
      "id": "ioc:169.254.181.227",
      "type": "ioc",
      "value": "169.254.181.227",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:169.254.255.255",
      "type": "ioc",
      "value": "169.254.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:172.217.168.195",
      "type": "ioc",
      "value": "172.217.168.195",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 8338 / UDP stream 88",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:184.85.229.68",
      "type": "ioc",
      "value": "184.85.229.68",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 511 / UDP stream 22",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:194.62.42.206",
      "type": "ioc",
      "value": "194.62.42.206",
      "source": "ioc-investigation",
      "verdict": "low signal",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "194.62.42.206 was classified as ip. Investigation verdict is low signal with score 15/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation"
      ],
      "suspicion_score": 15
    },
    {
      "id": "ioc:20.140.48.71",
      "type": "ioc",
      "value": "20.140.48.71",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 712 / UDP stream 38, frame 1007 / UDP stream 28",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.189.173.7",
      "type": "ioc",
      "value": "20.189.173.7",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 7586 / UDP stream 77",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.131",
      "type": "ioc",
      "value": "20.190.151.131",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.132",
      "type": "ioc",
      "value": "20.190.151.132",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.133",
      "type": "ioc",
      "value": "20.190.151.133",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.134",
      "type": "ioc",
      "value": "20.190.151.134",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.6",
      "type": "ioc",
      "value": "20.190.151.6",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.68",
      "type": "ioc",
      "value": "20.190.151.68",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.69",
      "type": "ioc",
      "value": "20.190.151.69",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.151.9",
      "type": "ioc",
      "value": "20.190.151.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 707 / UDP stream 39",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.136",
      "type": "ioc",
      "value": "20.190.154.136",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.138",
      "type": "ioc",
      "value": "20.190.154.138",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.139",
      "type": "ioc",
      "value": "20.190.154.139",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.16",
      "type": "ioc",
      "value": "20.190.154.16",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.17",
      "type": "ioc",
      "value": "20.190.154.17",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.18",
      "type": "ioc",
      "value": "20.190.154.18",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 3073 / UDP stream 64, frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.19",
      "type": "ioc",
      "value": "20.190.154.19",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer; frame 8399 / UDP stream 90",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.42.73.25",
      "type": "ioc",
      "value": "20.42.73.25",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 8655 / UDP stream 94",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.50.73.10",
      "type": "ioc",
      "value": "20.50.73.10",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 7358 / UDP stream 74, frame 7420 / UDP stream 75",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:204.79.197.200",
      "type": "ioc",
      "value": "204.79.197.200",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "description": "dns-answer, network-endpoint; frame 590 / UDP stream 24",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-888e9c1168af2bb2521c2e9a",
      "type": "pcap-finding",
      "label": "Script, archive, or executable transfer candidate",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe",
        "source": "23.1.237.216",
        "destination": "10.9.10.102",
        "content_type": "application/octet-stream",
        "response_count": 2,
        "declared_body_bytes": 1048578
      },
      "rule_id": "script-or-executable-transfer",
      "severity": "medium",
      "confidence": 0.86,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 100,
          "frame_number": 4193,
          "display_filter": "frame.number == 4193",
          "timestamp_epoch": "1631316288.773365000"
        },
        {
          "tcp_stream": 100,
          "frame_number": 4198,
          "display_filter": "frame.number == 4198",
          "timestamp_epoch": "1631316288.847386000"
        },
        {
          "tcp_stream": 100,
          "frame_number": 4200,
          "display_filter": "frame.number == 4200",
          "timestamp_epoch": "1631316288.853317000"
        },
        {
          "tcp_stream": 100,
          "frame_number": 6404,
          "display_filter": "frame.number == 6404",
          "timestamp_epoch": "1631316290.461273000"
        }
      ]
    },
    {
      "id": "finding-4a3305add3580028359ef7dc",
      "type": "pcap-finding",
      "label": "Script, archive, or executable transfer candidate",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "/d/msdownload/update/software/defu/2021/09/am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b.exe",
        "source": "23.1.237.225",
        "destination": "10.9.10.102",
        "content_type": "application/octet-stream",
        "response_count": 3,
        "declared_body_bytes": 1970634
      },
      "rule_id": "script-or-executable-transfer",
      "severity": "medium",
      "confidence": 0.86,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 101,
          "frame_number": 4195,
          "display_filter": "frame.number == 4195",
          "timestamp_epoch": "1631316288.774253000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 4199,
          "display_filter": "frame.number == 4199",
          "timestamp_epoch": "1631316288.850212000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 4201,
          "display_filter": "frame.number == 4201",
          "timestamp_epoch": "1631316288.853479000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 6356,
          "display_filter": "frame.number == 6356",
          "timestamp_epoch": "1631316290.372399000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 6371,
          "display_filter": "frame.number == 6371",
          "timestamp_epoch": "1631316290.377646000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 7346,
          "display_filter": "frame.number == 7346",
          "timestamp_epoch": "1631316291.098090000"
        }
      ]
    },
    {
      "id": "finding-cff8089c8f798d22603605ac",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.angrypoutine.com",
        "source": "10.9.10.102",
        "response_count": 12
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 3,
          "frame_number": 19,
          "display_filter": "frame.number == 19",
          "timestamp_epoch": "1631315709.539026000"
        },
        {
          "udp_stream": 16,
          "frame_number": 64,
          "display_filter": "frame.number == 64",
          "timestamp_epoch": "1631315714.217859000"
        },
        {
          "udp_stream": 17,
          "frame_number": 134,
          "display_filter": "frame.number == 134",
          "timestamp_epoch": "1631315732.217241000"
        },
        {
          "udp_stream": 19,
          "frame_number": 168,
          "display_filter": "frame.number == 168",
          "timestamp_epoch": "1631315792.232631000"
        },
        {
          "udp_stream": 78,
          "frame_number": 7624,
          "display_filter": "frame.number == 7624",
          "timestamp_epoch": "1631316392.221760000"
        },
        {
          "udp_stream": 79,
          "frame_number": 7762,
          "display_filter": "frame.number == 7762",
          "timestamp_epoch": "1631316992.281679000"
        },
        {
          "udp_stream": 80,
          "frame_number": 7922,
          "display_filter": "frame.number == 7922",
          "timestamp_epoch": "1631317592.283915000"
        },
        {
          "udp_stream": 85,
          "frame_number": 8078,
          "display_filter": "frame.number == 8078",
          "timestamp_epoch": "1631318192.330117000"
        },
        {
          "udp_stream": 87,
          "frame_number": 8314,
          "display_filter": "frame.number == 8314",
          "timestamp_epoch": "1631318792.332716000"
        },
        {
          "udp_stream": 87,
          "frame_number": 8316,
          "display_filter": "frame.number == 8316",
          "timestamp_epoch": "1631318792.421801000"
        },
        {
          "udp_stream": 93,
          "frame_number": 8565,
          "display_filter": "frame.number == 8565",
          "timestamp_epoch": "1631319392.407330000"
        },
        {
          "udp_stream": 98,
          "frame_number": 8826,
          "display_filter": "frame.number == 8826",
          "timestamp_epoch": "1631319992.455953000"
        }
      ]
    },
    {
      "id": "finding-f67cfc1410d57105f2d8527d",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.102",
        "protocol": "drsuapi",
        "destination": "10.9.10.9",
        "event_count": 25,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 15,
          "frame_number": 389,
          "display_filter": "frame.number == 389",
          "timestamp_epoch": "1631315816.202252000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 398,
          "display_filter": "frame.number == 398",
          "timestamp_epoch": "1631315816.203725000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 404,
          "display_filter": "frame.number == 404",
          "timestamp_epoch": "1631315816.205311000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 417,
          "display_filter": "frame.number == 417",
          "timestamp_epoch": "1631315816.208329000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2059,
          "display_filter": "frame.number == 2059",
          "timestamp_epoch": "1631315877.056698000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2067,
          "display_filter": "frame.number == 2067",
          "timestamp_epoch": "1631315877.061719000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2069,
          "display_filter": "frame.number == 2069",
          "timestamp_epoch": "1631315877.064549000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2073,
          "display_filter": "frame.number == 2073",
          "timestamp_epoch": "1631315877.070451000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2075,
          "display_filter": "frame.number == 2075",
          "timestamp_epoch": "1631315877.073075000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2077,
          "display_filter": "frame.number == 2077",
          "timestamp_epoch": "1631315877.075923000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2962,
          "display_filter": "frame.number == 2962",
          "timestamp_epoch": "1631316142.057390000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2966,
          "display_filter": "frame.number == 2966",
          "timestamp_epoch": "1631316142.301058000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2968,
          "display_filter": "frame.number == 2968",
          "timestamp_epoch": "1631316142.303973000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2972,
          "display_filter": "frame.number == 2972",
          "timestamp_epoch": "1631316142.310485000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2974,
          "display_filter": "frame.number == 2974",
          "timestamp_epoch": "1631316142.313000000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2976,
          "display_filter": "frame.number == 2976",
          "timestamp_epoch": "1631316142.315848000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8702,
          "display_filter": "frame.number == 8702",
          "timestamp_epoch": "1631319741.451904000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8706,
          "display_filter": "frame.number == 8706",
          "timestamp_epoch": "1631319741.698651000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8708,
          "display_filter": "frame.number == 8708",
          "timestamp_epoch": "1631319741.701621000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8712,
          "display_filter": "frame.number == 8712",
          "timestamp_epoch": "1631319741.708133000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8714,
          "display_filter": "frame.number == 8714",
          "timestamp_epoch": "1631319741.710774000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8717,
          "display_filter": "frame.number == 8717",
          "timestamp_epoch": "1631319741.761245000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8902,
          "display_filter": "frame.number == 8902",
          "timestamp_epoch": "1631320086.166099000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8904,
          "display_filter": "frame.number == 8904",
          "timestamp_epoch": "1631320086.168219000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8906,
          "display_filter": "frame.number == 8906",
          "timestamp_epoch": "1631320086.170454000"
        }
      ]
    },
    {
      "id": "finding-f2b09872431e80778a89f237",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.102",
        "protocol": "ldap",
        "destination": "10.9.10.9",
        "event_count": 50,
        "operation_numbers": [
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 80,
          "display_filter": "frame.number == 80",
          "timestamp_epoch": "1631315714.903567000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 83,
          "display_filter": "frame.number == 83",
          "timestamp_epoch": "1631315714.907528000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 478,
          "display_filter": "frame.number == 478",
          "timestamp_epoch": "1631315816.964061000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 483,
          "display_filter": "frame.number == 483",
          "timestamp_epoch": "1631315816.973775000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 486,
          "display_filter": "frame.number == 486",
          "timestamp_epoch": "1631315817.013900000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 493,
          "display_filter": "frame.number == 493",
          "timestamp_epoch": "1631315817.083271000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 496,
          "display_filter": "frame.number == 496",
          "timestamp_epoch": "1631315817.092275000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 498,
          "display_filter": "frame.number == 498",
          "timestamp_epoch": "1631315817.096649000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 500,
          "display_filter": "frame.number == 500",
          "timestamp_epoch": "1631315817.117237000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 502,
          "display_filter": "frame.number == 502",
          "timestamp_epoch": "1631315817.146873000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 506,
          "display_filter": "frame.number == 506",
          "timestamp_epoch": "1631315817.172122000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2114,
          "display_filter": "frame.number == 2114",
          "timestamp_epoch": "1631315877.084598000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2119,
          "display_filter": "frame.number == 2119",
          "timestamp_epoch": "1631315877.088427000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2122,
          "display_filter": "frame.number == 2122",
          "timestamp_epoch": "1631315877.092174000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2124,
          "display_filter": "frame.number == 2124",
          "timestamp_epoch": "1631315877.095051000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2126,
          "display_filter": "frame.number == 2126",
          "timestamp_epoch": "1631315877.096954000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2133,
          "display_filter": "frame.number == 2133",
          "timestamp_epoch": "1631315877.114050000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2137,
          "display_filter": "frame.number == 2137",
          "timestamp_epoch": "1631315877.116412000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2143,
          "display_filter": "frame.number == 2143",
          "timestamp_epoch": "1631315877.117625000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2145,
          "display_filter": "frame.number == 2145",
          "timestamp_epoch": "1631315877.119480000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2149,
          "display_filter": "frame.number == 2149",
          "timestamp_epoch": "1631315877.119841000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2982,
          "display_filter": "frame.number == 2982",
          "timestamp_epoch": "1631316142.356887000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2987,
          "display_filter": "frame.number == 2987",
          "timestamp_epoch": "1631316142.361415000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2990,
          "display_filter": "frame.number == 2990",
          "timestamp_epoch": "1631316142.365679000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2992,
          "display_filter": "frame.number == 2992",
          "timestamp_epoch": "1631316142.368425000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2995,
          "display_filter": "frame.number == 2995",
          "timestamp_epoch": "1631316142.370645000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3001,
          "display_filter": "frame.number == 3001",
          "timestamp_epoch": "1631316142.407882000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3004,
          "display_filter": "frame.number == 3004",
          "timestamp_epoch": "1631316142.411917000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3009,
          "display_filter": "frame.number == 3009",
          "timestamp_epoch": "1631316142.414145000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3011,
          "display_filter": "frame.number == 3011",
          "timestamp_epoch": "1631316142.416576000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 3014,
          "display_filter": "frame.number == 3014",
          "timestamp_epoch": "1631316142.416733000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8725,
          "display_filter": "frame.number == 8725",
          "timestamp_epoch": "1631319742.090149000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8730,
          "display_filter": "frame.number == 8730",
          "timestamp_epoch": "1631319742.094653000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8733,
          "display_filter": "frame.number == 8733",
          "timestamp_epoch": "1631319742.098736000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8735,
          "display_filter": "frame.number == 8735",
          "timestamp_epoch": "1631319742.101487000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8737,
          "display_filter": "frame.number == 8737",
          "timestamp_epoch": "1631319742.104235000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8744,
          "display_filter": "frame.number == 8744",
          "timestamp_epoch": "1631319742.157383000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8747,
          "display_filter": "frame.number == 8747",
          "timestamp_epoch": "1631319742.160222000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8752,
          "display_filter": "frame.number == 8752",
          "timestamp_epoch": "1631319742.162360000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8754,
          "display_filter": "frame.number == 8754",
          "timestamp_epoch": "1631319742.164839000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8756,
          "display_filter": "frame.number == 8756",
          "timestamp_epoch": "1631319742.164919000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8912,
          "display_filter": "frame.number == 8912",
          "timestamp_epoch": "1631320086.882518000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8917,
          "display_filter": "frame.number == 8917",
          "timestamp_epoch": "1631320086.887609000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8923,
          "display_filter": "frame.number == 8923",
          "timestamp_epoch": "1631320087.008355000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8930,
          "display_filter": "frame.number == 8930",
          "timestamp_epoch": "1631320087.069008000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8933,
          "display_filter": "frame.number == 8933",
          "timestamp_epoch": "1631320087.073105000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8935,
          "display_filter": "frame.number == 8935",
          "timestamp_epoch": "1631320087.075730000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8937,
          "display_filter": "frame.number == 8937",
          "timestamp_epoch": "1631320087.079435000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 9078,
          "display_filter": "frame.number == 9078",
          "timestamp_epoch": "1631320088.311246000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 9082,
          "display_filter": "frame.number == 9082",
          "timestamp_epoch": "1631320088.319916000"
        }
      ]
    },
    {
      "id": "finding-7fc4e438e831d844a0841cfe",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.102",
        "protocol": "samr",
        "destination": "10.9.10.9",
        "event_count": 57,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "18",
          "19",
          "20",
          "25",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 19,
          "frame_number": 440,
          "display_filter": "frame.number == 440",
          "timestamp_epoch": "1631315816.243133000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 442,
          "display_filter": "frame.number == 442",
          "timestamp_epoch": "1631315816.245054000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 444,
          "display_filter": "frame.number == 444",
          "timestamp_epoch": "1631315816.246899000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 446,
          "display_filter": "frame.number == 446",
          "timestamp_epoch": "1631315816.248730000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 448,
          "display_filter": "frame.number == 448",
          "timestamp_epoch": "1631315816.250617000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 450,
          "display_filter": "frame.number == 450",
          "timestamp_epoch": "1631315816.252375000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 452,
          "display_filter": "frame.number == 452",
          "timestamp_epoch": "1631315816.254369000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 454,
          "display_filter": "frame.number == 454",
          "timestamp_epoch": "1631315816.256268000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 456,
          "display_filter": "frame.number == 456",
          "timestamp_epoch": "1631315816.258395000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 458,
          "display_filter": "frame.number == 458",
          "timestamp_epoch": "1631315816.260346000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 460,
          "display_filter": "frame.number == 460",
          "timestamp_epoch": "1631315816.262280000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 462,
          "display_filter": "frame.number == 462",
          "timestamp_epoch": "1631315816.264186000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 464,
          "display_filter": "frame.number == 464",
          "timestamp_epoch": "1631315816.265989000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 466,
          "display_filter": "frame.number == 466",
          "timestamp_epoch": "1631315816.267805000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 468,
          "display_filter": "frame.number == 468",
          "timestamp_epoch": "1631315816.269633000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2705,
          "display_filter": "frame.number == 2705",
          "timestamp_epoch": "1631315966.505945000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2707,
          "display_filter": "frame.number == 2707",
          "timestamp_epoch": "1631315966.508802000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2709,
          "display_filter": "frame.number == 2709",
          "timestamp_epoch": "1631315966.511562000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2711,
          "display_filter": "frame.number == 2711",
          "timestamp_epoch": "1631315966.514181000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2713,
          "display_filter": "frame.number == 2713",
          "timestamp_epoch": "1631315966.516818000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2717,
          "display_filter": "frame.number == 2717",
          "timestamp_epoch": "1631315966.895289000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2719,
          "display_filter": "frame.number == 2719",
          "timestamp_epoch": "1631315966.897682000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2721,
          "display_filter": "frame.number == 2721",
          "timestamp_epoch": "1631315966.900014000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2723,
          "display_filter": "frame.number == 2723",
          "timestamp_epoch": "1631315966.902012000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2725,
          "display_filter": "frame.number == 2725",
          "timestamp_epoch": "1631315966.903988000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2737,
          "display_filter": "frame.number == 2737",
          "timestamp_epoch": "1631315966.916394000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2739,
          "display_filter": "frame.number == 2739",
          "timestamp_epoch": "1631315966.918290000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2741,
          "display_filter": "frame.number == 2741",
          "timestamp_epoch": "1631315966.920310000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2743,
          "display_filter": "frame.number == 2743",
          "timestamp_epoch": "1631315966.922243000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2745,
          "display_filter": "frame.number == 2745",
          "timestamp_epoch": "1631315966.923956000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2747,
          "display_filter": "frame.number == 2747",
          "timestamp_epoch": "1631315966.925841000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2749,
          "display_filter": "frame.number == 2749",
          "timestamp_epoch": "1631315966.927916000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2751,
          "display_filter": "frame.number == 2751",
          "timestamp_epoch": "1631315966.929933000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2753,
          "display_filter": "frame.number == 2753",
          "timestamp_epoch": "1631315966.932162000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2755,
          "display_filter": "frame.number == 2755",
          "timestamp_epoch": "1631315966.934106000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2757,
          "display_filter": "frame.number == 2757",
          "timestamp_epoch": "1631315966.936076000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2770,
          "display_filter": "frame.number == 2770",
          "timestamp_epoch": "1631315967.107975000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2772,
          "display_filter": "frame.number == 2772",
          "timestamp_epoch": "1631315967.109802000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2774,
          "display_filter": "frame.number == 2774",
          "timestamp_epoch": "1631315967.111638000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2776,
          "display_filter": "frame.number == 2776",
          "timestamp_epoch": "1631315967.113444000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2778,
          "display_filter": "frame.number == 2778",
          "timestamp_epoch": "1631315967.115360000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2780,
          "display_filter": "frame.number == 2780",
          "timestamp_epoch": "1631315967.117411000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2782,
          "display_filter": "frame.number == 2782",
          "timestamp_epoch": "1631315967.119332000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2784,
          "display_filter": "frame.number == 2784",
          "timestamp_epoch": "1631315967.121257000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2786,
          "display_filter": "frame.number == 2786",
          "timestamp_epoch": "1631315967.123094000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2788,
          "display_filter": "frame.number == 2788",
          "timestamp_epoch": "1631315967.124946000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2800,
          "display_filter": "frame.number == 2800",
          "timestamp_epoch": "1631315967.137311000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2802,
          "display_filter": "frame.number == 2802",
          "timestamp_epoch": "1631315967.139190000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2804,
          "display_filter": "frame.number == 2804",
          "timestamp_epoch": "1631315967.141123000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2806,
          "display_filter": "frame.number == 2806",
          "timestamp_epoch": "1631315967.142993000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2808,
          "display_filter": "frame.number == 2808",
          "timestamp_epoch": "1631315967.144878000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2810,
          "display_filter": "frame.number == 2810",
          "timestamp_epoch": "1631315967.146886000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2812,
          "display_filter": "frame.number == 2812",
          "timestamp_epoch": "1631315967.148810000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2814,
          "display_filter": "frame.number == 2814",
          "timestamp_epoch": "1631315967.150926000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2816,
          "display_filter": "frame.number == 2816",
          "timestamp_epoch": "1631315967.152894000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2818,
          "display_filter": "frame.number == 2818",
          "timestamp_epoch": "1631315967.154700000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2820,
          "display_filter": "frame.number == 2820",
          "timestamp_epoch": "1631315967.156536000"
        }
      ]
    },
    {
      "id": "finding-66057f32f2a0cf52c87223fb",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.9",
        "protocol": "drsuapi",
        "destination": "10.9.10.102",
        "event_count": 25,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 15,
          "frame_number": 391,
          "display_filter": "frame.number == 391",
          "timestamp_epoch": "1631315816.202503000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 401,
          "display_filter": "frame.number == 401",
          "timestamp_epoch": "1631315816.204127000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 406,
          "display_filter": "frame.number == 406",
          "timestamp_epoch": "1631315816.205807000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 418,
          "display_filter": "frame.number == 418",
          "timestamp_epoch": "1631315816.208461000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2060,
          "display_filter": "frame.number == 2060",
          "timestamp_epoch": "1631315877.057161000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2068,
          "display_filter": "frame.number == 2068",
          "timestamp_epoch": "1631315877.062420000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2070,
          "display_filter": "frame.number == 2070",
          "timestamp_epoch": "1631315877.064849000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2074,
          "display_filter": "frame.number == 2074",
          "timestamp_epoch": "1631315877.070829000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2076,
          "display_filter": "frame.number == 2076",
          "timestamp_epoch": "1631315877.073778000"
        },
        {
          "tcp_stream": 67,
          "frame_number": 2078,
          "display_filter": "frame.number == 2078",
          "timestamp_epoch": "1631315877.076183000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2963,
          "display_filter": "frame.number == 2963",
          "timestamp_epoch": "1631316142.057859000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2967,
          "display_filter": "frame.number == 2967",
          "timestamp_epoch": "1631316142.301796000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2969,
          "display_filter": "frame.number == 2969",
          "timestamp_epoch": "1631316142.304324000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2973,
          "display_filter": "frame.number == 2973",
          "timestamp_epoch": "1631316142.310861000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2975,
          "display_filter": "frame.number == 2975",
          "timestamp_epoch": "1631316142.313717000"
        },
        {
          "tcp_stream": 86,
          "frame_number": 2977,
          "display_filter": "frame.number == 2977",
          "timestamp_epoch": "1631316142.316213000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8703,
          "display_filter": "frame.number == 8703",
          "timestamp_epoch": "1631319741.452370000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8707,
          "display_filter": "frame.number == 8707",
          "timestamp_epoch": "1631319741.699401000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8709,
          "display_filter": "frame.number == 8709",
          "timestamp_epoch": "1631319741.701932000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8713,
          "display_filter": "frame.number == 8713",
          "timestamp_epoch": "1631319741.708518000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8715,
          "display_filter": "frame.number == 8715",
          "timestamp_epoch": "1631319741.711246000"
        },
        {
          "tcp_stream": 146,
          "frame_number": 8718,
          "display_filter": "frame.number == 8718",
          "timestamp_epoch": "1631319741.761575000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8903,
          "display_filter": "frame.number == 8903",
          "timestamp_epoch": "1631320086.166565000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8905,
          "display_filter": "frame.number == 8905",
          "timestamp_epoch": "1631320086.168976000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 8907,
          "display_filter": "frame.number == 8907",
          "timestamp_epoch": "1631320086.170812000"
        }
      ]
    },
    {
      "id": "finding-04c71321ef5dbb606946d222",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.9",
        "protocol": "ldap",
        "destination": "10.9.10.102",
        "event_count": 39,
        "operation_numbers": [
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 82,
          "display_filter": "frame.number == 82",
          "timestamp_epoch": "1631315714.905140000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 480,
          "display_filter": "frame.number == 480",
          "timestamp_epoch": "1631315816.964799000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 485,
          "display_filter": "frame.number == 485",
          "timestamp_epoch": "1631315816.975285000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 487,
          "display_filter": "frame.number == 487",
          "timestamp_epoch": "1631315817.014530000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 495,
          "display_filter": "frame.number == 495",
          "timestamp_epoch": "1631315817.084711000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 497,
          "display_filter": "frame.number == 497",
          "timestamp_epoch": "1631315817.092525000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 499,
          "display_filter": "frame.number == 499",
          "timestamp_epoch": "1631315817.097104000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 501,
          "display_filter": "frame.number == 501",
          "timestamp_epoch": "1631315817.117819000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2116,
          "display_filter": "frame.number == 2116",
          "timestamp_epoch": "1631315877.085324000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2121,
          "display_filter": "frame.number == 2121",
          "timestamp_epoch": "1631315877.089901000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2123,
          "display_filter": "frame.number == 2123",
          "timestamp_epoch": "1631315877.092602000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2125,
          "display_filter": "frame.number == 2125",
          "timestamp_epoch": "1631315877.095417000"
        },
        {
          "tcp_stream": 68,
          "frame_number": 2127,
          "display_filter": "frame.number == 2127",
          "timestamp_epoch": "1631315877.097372000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2135,
          "display_filter": "frame.number == 2135",
          "timestamp_epoch": "1631315877.114813000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2140,
          "display_filter": "frame.number == 2140",
          "timestamp_epoch": "1631315877.117000000"
        },
        {
          "tcp_stream": 69,
          "frame_number": 2144,
          "display_filter": "frame.number == 2144",
          "timestamp_epoch": "1631315877.117965000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2984,
          "display_filter": "frame.number == 2984",
          "timestamp_epoch": "1631316142.357695000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2989,
          "display_filter": "frame.number == 2989",
          "timestamp_epoch": "1631316142.363093000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2991,
          "display_filter": "frame.number == 2991",
          "timestamp_epoch": "1631316142.366144000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2993,
          "display_filter": "frame.number == 2993",
          "timestamp_epoch": "1631316142.368873000"
        },
        {
          "tcp_stream": 87,
          "frame_number": 2996,
          "display_filter": "frame.number == 2996",
          "timestamp_epoch": "1631316142.370955000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3003,
          "display_filter": "frame.number == 3003",
          "timestamp_epoch": "1631316142.409360000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3007,
          "display_filter": "frame.number == 3007",
          "timestamp_epoch": "1631316142.412719000"
        },
        {
          "tcp_stream": 88,
          "frame_number": 3010,
          "display_filter": "frame.number == 3010",
          "timestamp_epoch": "1631316142.414320000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8727,
          "display_filter": "frame.number == 8727",
          "timestamp_epoch": "1631319742.090941000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8732,
          "display_filter": "frame.number == 8732",
          "timestamp_epoch": "1631319742.096110000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8734,
          "display_filter": "frame.number == 8734",
          "timestamp_epoch": "1631319742.099162000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8736,
          "display_filter": "frame.number == 8736",
          "timestamp_epoch": "1631319742.101962000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 8738,
          "display_filter": "frame.number == 8738",
          "timestamp_epoch": "1631319742.104757000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8746,
          "display_filter": "frame.number == 8746",
          "timestamp_epoch": "1631319742.158067000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8750,
          "display_filter": "frame.number == 8750",
          "timestamp_epoch": "1631319742.160990000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 8753,
          "display_filter": "frame.number == 8753",
          "timestamp_epoch": "1631319742.162606000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8914,
          "display_filter": "frame.number == 8914",
          "timestamp_epoch": "1631320086.883277000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8919,
          "display_filter": "frame.number == 8919",
          "timestamp_epoch": "1631320086.889082000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8924,
          "display_filter": "frame.number == 8924",
          "timestamp_epoch": "1631320087.008995000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8932,
          "display_filter": "frame.number == 8932",
          "timestamp_epoch": "1631320087.070473000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8934,
          "display_filter": "frame.number == 8934",
          "timestamp_epoch": "1631320087.073375000"
        },
        {
          "tcp_stream": 156,
          "frame_number": 8936,
          "display_filter": "frame.number == 8936",
          "timestamp_epoch": "1631320087.076111000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 8938,
          "display_filter": "frame.number == 8938",
          "timestamp_epoch": "1631320087.080419000"
        }
      ]
    },
    {
      "id": "finding-94f3fd9fea4406cb12e7ecdf",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.9.10.9",
        "protocol": "samr",
        "destination": "10.9.10.102",
        "event_count": 57,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "18",
          "19",
          "20",
          "25",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 19,
          "frame_number": 441,
          "display_filter": "frame.number == 441",
          "timestamp_epoch": "1631315816.243557000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 443,
          "display_filter": "frame.number == 443",
          "timestamp_epoch": "1631315816.245465000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 445,
          "display_filter": "frame.number == 445",
          "timestamp_epoch": "1631315816.247380000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 447,
          "display_filter": "frame.number == 447",
          "timestamp_epoch": "1631315816.249191000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 449,
          "display_filter": "frame.number == 449",
          "timestamp_epoch": "1631315816.250931000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 451,
          "display_filter": "frame.number == 451",
          "timestamp_epoch": "1631315816.252925000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 453,
          "display_filter": "frame.number == 453",
          "timestamp_epoch": "1631315816.254812000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 455,
          "display_filter": "frame.number == 455",
          "timestamp_epoch": "1631315816.256961000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 457,
          "display_filter": "frame.number == 457",
          "timestamp_epoch": "1631315816.258946000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 459,
          "display_filter": "frame.number == 459",
          "timestamp_epoch": "1631315816.260793000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 461,
          "display_filter": "frame.number == 461",
          "timestamp_epoch": "1631315816.262733000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 463,
          "display_filter": "frame.number == 463",
          "timestamp_epoch": "1631315816.264601000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 465,
          "display_filter": "frame.number == 465",
          "timestamp_epoch": "1631315816.266340000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 467,
          "display_filter": "frame.number == 467",
          "timestamp_epoch": "1631315816.268210000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 469,
          "display_filter": "frame.number == 469",
          "timestamp_epoch": "1631315816.269868000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2706,
          "display_filter": "frame.number == 2706",
          "timestamp_epoch": "1631315966.506606000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2708,
          "display_filter": "frame.number == 2708",
          "timestamp_epoch": "1631315966.509355000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2710,
          "display_filter": "frame.number == 2710",
          "timestamp_epoch": "1631315966.512048000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2712,
          "display_filter": "frame.number == 2712",
          "timestamp_epoch": "1631315966.514600000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2714,
          "display_filter": "frame.number == 2714",
          "timestamp_epoch": "1631315966.517327000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2718,
          "display_filter": "frame.number == 2718",
          "timestamp_epoch": "1631315966.896127000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2720,
          "display_filter": "frame.number == 2720",
          "timestamp_epoch": "1631315966.898450000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2722,
          "display_filter": "frame.number == 2722",
          "timestamp_epoch": "1631315966.900524000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2724,
          "display_filter": "frame.number == 2724",
          "timestamp_epoch": "1631315966.902430000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2726,
          "display_filter": "frame.number == 2726",
          "timestamp_epoch": "1631315966.904500000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2738,
          "display_filter": "frame.number == 2738",
          "timestamp_epoch": "1631315966.916801000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2740,
          "display_filter": "frame.number == 2740",
          "timestamp_epoch": "1631315966.918651000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2742,
          "display_filter": "frame.number == 2742",
          "timestamp_epoch": "1631315966.920672000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2744,
          "display_filter": "frame.number == 2744",
          "timestamp_epoch": "1631315966.922457000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2746,
          "display_filter": "frame.number == 2746",
          "timestamp_epoch": "1631315966.924393000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2748,
          "display_filter": "frame.number == 2748",
          "timestamp_epoch": "1631315966.926357000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2750,
          "display_filter": "frame.number == 2750",
          "timestamp_epoch": "1631315966.928378000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2752,
          "display_filter": "frame.number == 2752",
          "timestamp_epoch": "1631315966.930497000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2754,
          "display_filter": "frame.number == 2754",
          "timestamp_epoch": "1631315966.932520000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2756,
          "display_filter": "frame.number == 2756",
          "timestamp_epoch": "1631315966.934472000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2758,
          "display_filter": "frame.number == 2758",
          "timestamp_epoch": "1631315966.936436000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2771,
          "display_filter": "frame.number == 2771",
          "timestamp_epoch": "1631315967.108357000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2773,
          "display_filter": "frame.number == 2773",
          "timestamp_epoch": "1631315967.110185000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2775,
          "display_filter": "frame.number == 2775",
          "timestamp_epoch": "1631315967.112004000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2777,
          "display_filter": "frame.number == 2777",
          "timestamp_epoch": "1631315967.113908000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2779,
          "display_filter": "frame.number == 2779",
          "timestamp_epoch": "1631315967.115884000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2781,
          "display_filter": "frame.number == 2781",
          "timestamp_epoch": "1631315967.117894000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2783,
          "display_filter": "frame.number == 2783",
          "timestamp_epoch": "1631315967.119790000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2785,
          "display_filter": "frame.number == 2785",
          "timestamp_epoch": "1631315967.121621000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2787,
          "display_filter": "frame.number == 2787",
          "timestamp_epoch": "1631315967.123453000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2789,
          "display_filter": "frame.number == 2789",
          "timestamp_epoch": "1631315967.125283000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2801,
          "display_filter": "frame.number == 2801",
          "timestamp_epoch": "1631315967.137715000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2803,
          "display_filter": "frame.number == 2803",
          "timestamp_epoch": "1631315967.139701000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2805,
          "display_filter": "frame.number == 2805",
          "timestamp_epoch": "1631315967.141536000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2807,
          "display_filter": "frame.number == 2807",
          "timestamp_epoch": "1631315967.143458000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2809,
          "display_filter": "frame.number == 2809",
          "timestamp_epoch": "1631315967.145402000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2811,
          "display_filter": "frame.number == 2811",
          "timestamp_epoch": "1631315967.147382000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2813,
          "display_filter": "frame.number == 2813",
          "timestamp_epoch": "1631315967.149337000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2815,
          "display_filter": "frame.number == 2815",
          "timestamp_epoch": "1631315967.151339000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2817,
          "display_filter": "frame.number == 2817",
          "timestamp_epoch": "1631315967.153273000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2819,
          "display_filter": "frame.number == 2819",
          "timestamp_epoch": "1631315967.155105000"
        },
        {
          "tcp_stream": 80,
          "frame_number": 2821,
          "display_filter": "frame.number == 2821",
          "timestamp_epoch": "1631315967.156946000"
        }
      ]
    },
    {
      "id": "identity-f7b6d432f3eade83def31af2",
      "type": "identity",
      "label": "account: hobart.gunnarsson",
      "value": "hobart.gunnarsson",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.9.10.102"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 300,
          "display_filter": "frame.number == 300",
          "timestamp_epoch": "1631315815.761043000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 311,
          "display_filter": "frame.number == 311",
          "timestamp_epoch": "1631315815.983665000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 315,
          "display_filter": "frame.number == 315",
          "timestamp_epoch": "1631315815.985466000"
        },
        {
          "tcp_stream": 14,
          "frame_number": 332,
          "display_filter": "frame.number == 332",
          "timestamp_epoch": "1631315815.995245000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 341,
          "display_filter": "frame.number == 341",
          "timestamp_epoch": "1631315815.996631000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 350,
          "display_filter": "frame.number == 350",
          "timestamp_epoch": "1631315816.020222000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 352,
          "display_filter": "frame.number == 352",
          "timestamp_epoch": "1631315816.021278000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 367,
          "display_filter": "frame.number == 367",
          "timestamp_epoch": "1631315816.109766000"
        },
        {
          "tcp_stream": 20,
          "frame_number": 393,
          "display_filter": "frame.number == 393",
          "timestamp_epoch": "1631315816.203285000"
        },
        {
          "tcp_stream": 21,
          "frame_number": 408,
          "display_filter": "frame.number == 408",
          "timestamp_epoch": "1631315816.206084000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 455,
          "display_filter": "frame.number == 455",
          "timestamp_epoch": "1631315816.256961000"
        },
        {
          "tcp_stream": 81,
          "frame_number": 2681,
          "display_filter": "frame.number == 2681",
          "timestamp_epoch": "1631315966.487925000"
        }
      ]
    },
    {
      "id": "identity-0b21cf421c3092d50b297bba",
      "type": "identity",
      "label": "full-name: Hobart Gunnarsson",
      "value": "Hobart Gunnarsson",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.9.10.102"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 19,
          "frame_number": 455,
          "display_filter": "frame.number == 455",
          "timestamp_epoch": "1631315816.256961000"
        }
      ]
    },
    {
      "id": "identity-7bbffa5c46aa4e795236652a",
      "type": "identity",
      "label": "hostname: DESKTOP-KKITB6Q",
      "value": "DESKTOP-KKITB6Q",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.9.10.102",
        "169.254.181.227"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 1,
          "display_filter": "frame.number == 1",
          "timestamp_epoch": "1631315707.787295000"
        },
        {
          "udp_stream": 0,
          "frame_number": 3,
          "display_filter": "frame.number == 3",
          "timestamp_epoch": "1631315707.790675000"
        },
        {
          "udp_stream": 2,
          "frame_number": 5,
          "display_filter": "frame.number == 5",
          "timestamp_epoch": "1631315707.932871000"
        },
        {
          "udp_stream": 2,
          "frame_number": 6,
          "display_filter": "frame.number == 6",
          "timestamp_epoch": "1631315707.932872000"
        },
        {
          "udp_stream": 2,
          "frame_number": 9,
          "display_filter": "frame.number == 9",
          "timestamp_epoch": "1631315708.684599000"
        },
        {
          "udp_stream": 2,
          "frame_number": 10,
          "display_filter": "frame.number == 10",
          "timestamp_epoch": "1631315708.684600000"
        },
        {
          "udp_stream": 8,
          "frame_number": 31,
          "display_filter": "frame.number == 31",
          "timestamp_epoch": "1631315709.575825000"
        },
        {
          "udp_stream": 8,
          "frame_number": 36,
          "display_filter": "frame.number == 36",
          "timestamp_epoch": "1631315710.353794000"
        },
        {
          "udp_stream": 8,
          "frame_number": 43,
          "display_filter": "frame.number == 43",
          "timestamp_epoch": "1631315711.117648000"
        },
        {
          "udp_stream": 8,
          "frame_number": 52,
          "display_filter": "frame.number == 52",
          "timestamp_epoch": "1631315711.869204000"
        },
        {
          "udp_stream": 8,
          "frame_number": 54,
          "display_filter": "frame.number == 54",
          "timestamp_epoch": "1631315712.599978000"
        },
        {
          "udp_stream": 14,
          "frame_number": 55,
          "display_filter": "frame.number == 55",
          "timestamp_epoch": "1631315712.687123000"
        },
        {
          "udp_stream": 8,
          "frame_number": 58,
          "display_filter": "frame.number == 58",
          "timestamp_epoch": "1631315713.358829000"
        },
        {
          "udp_stream": 8,
          "frame_number": 61,
          "display_filter": "frame.number == 61",
          "timestamp_epoch": "1631315714.122641000"
        },
        {
          "udp_stream": 8,
          "frame_number": 72,
          "display_filter": "frame.number == 72",
          "timestamp_epoch": "1631315714.885657000"
        },
        {
          "udp_stream": 14,
          "frame_number": 98,
          "display_filter": "frame.number == 98",
          "timestamp_epoch": "1631315715.685778000"
        },
        {
          "udp_stream": 14,
          "frame_number": 121,
          "display_filter": "frame.number == 121",
          "timestamp_epoch": "1631315717.199232000"
        },
        {
          "udp_stream": 14,
          "frame_number": 131,
          "display_filter": "frame.number == 131",
          "timestamp_epoch": "1631315721.834465000"
        },
        {
          "udp_stream": 14,
          "frame_number": 132,
          "display_filter": "frame.number == 132",
          "timestamp_epoch": "1631315721.842967000"
        },
        {
          "tcp_stream": 79,
          "frame_number": 2651,
          "display_filter": "frame.number == 2651",
          "timestamp_epoch": "1631315964.378254000"
        }
      ]
    },
    {
      "id": "identity-6f0a9bd41209a8a862000245",
      "type": "identity",
      "label": "netbios-group: ANGRYPOUTINE",
      "value": "ANGRYPOUTINE",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 2,
          "frame_number": 7,
          "display_filter": "frame.number == 7",
          "timestamp_epoch": "1631315707.932873000"
        },
        {
          "udp_stream": 2,
          "frame_number": 8,
          "display_filter": "frame.number == 8",
          "timestamp_epoch": "1631315708.684598000"
        },
        {
          "udp_stream": 2,
          "frame_number": 11,
          "display_filter": "frame.number == 11",
          "timestamp_epoch": "1631315709.495571000"
        },
        {
          "udp_stream": 8,
          "frame_number": 35,
          "display_filter": "frame.number == 35",
          "timestamp_epoch": "1631315710.258173000"
        },
        {
          "udp_stream": 8,
          "frame_number": 38,
          "display_filter": "frame.number == 38",
          "timestamp_epoch": "1631315711.017650000"
        },
        {
          "udp_stream": 8,
          "frame_number": 50,
          "display_filter": "frame.number == 50",
          "timestamp_epoch": "1631315711.789000000"
        },
        {
          "udp_stream": 8,
          "frame_number": 53,
          "display_filter": "frame.number == 53",
          "timestamp_epoch": "1631315712.599977000"
        },
        {
          "udp_stream": 8,
          "frame_number": 59,
          "display_filter": "frame.number == 59",
          "timestamp_epoch": "1631315713.358831000"
        },
        {
          "udp_stream": 8,
          "frame_number": 60,
          "display_filter": "frame.number == 60",
          "timestamp_epoch": "1631315714.122639000"
        },
        {
          "udp_stream": 8,
          "frame_number": 73,
          "display_filter": "frame.number == 73",
          "timestamp_epoch": "1631315714.885658000"
        },
        {
          "udp_stream": 8,
          "frame_number": 123,
          "display_filter": "frame.number == 123",
          "timestamp_epoch": "1631315718.747751000"
        },
        {
          "udp_stream": 8,
          "frame_number": 127,
          "display_filter": "frame.number == 127",
          "timestamp_epoch": "1631315719.511263000"
        },
        {
          "udp_stream": 8,
          "frame_number": 128,
          "display_filter": "frame.number == 128",
          "timestamp_epoch": "1631315720.278616000"
        },
        {
          "udp_stream": 8,
          "frame_number": 129,
          "display_filter": "frame.number == 129",
          "timestamp_epoch": "1631315721.040842000"
        }
      ]
    },
    {
      "id": "artifact-4ab43a37d5b5d37b561a401c",
      "type": "file-artifact",
      "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe",
      "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "sha256": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1048576,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e972ba353cda6421180154da",
      "type": "file-artifact",
      "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(2).exe",
      "value": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792",
      "sha256": "2ac413d79efa22e42a179f0450d7e8e4bb8202c881bf9e02a5a13a9a3626d792",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1048576,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3139dedfc6a1194feef19f69",
      "type": "file-artifact",
      "label": "date1%3fBNLv65=pAAS",
      "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "sha256": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 284816,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-74472d7bfd877aa3363c2955",
      "type": "file-artifact",
      "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(4).exe",
      "value": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f",
      "sha256": "0fb4d47bcda9b77b0fbd8cb88b34ba180365991f6a376e00add1ac880b67fd8f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 922056,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0fb55f3316dc0c38ed2fe99e",
      "type": "file-artifact",
      "label": "apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c.5c278f58-912b-4af9-88f8-a65fff2da477%3fw=150&h=150",
      "value": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652",
      "sha256": "c1c72144b320890b971bf8cd335438dd6c2e50783398965e7891ccb30b4e3652",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 24101,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-752a975585b653cc07a0b2ff",
      "type": "file-artifact",
      "label": "apps.16525.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.13409c3f-0e0f-40dd-b458-b324f658c185%3fw=150&h=150",
      "value": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43",
      "sha256": "f7018b08490ebc04900ec28586710f3e93542ebe3ce390378e7f4e6665f28c43",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 19230,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-70bb5da136c66653715ee483",
      "type": "file-artifact",
      "label": "apps.31617.13655054093851568.f2bf9430-60d7-4569-a50d-0f21c9ade6b3.c563d383-997d-4da1-9def-d7200e3547f8%3fw=150&h=150",
      "value": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c",
      "sha256": "0c58b13a7b5d78c8a9e35d5995b7352c3b38acee77d6af9886c3cf2d668bfd3c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 17906,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5ab522a329d23e888d2e9c73",
      "type": "file-artifact",
      "label": "apps.16999.13510798885065391.a43a9782-6060-4560-b391-7f6f188559d0.dc15b6ee-644d-41e3-8d76-67c8c9dac9e9%3fw=150&h=225",
      "value": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e",
      "sha256": "4a11107d730c5943885081bfc3e902af14e8e83f59d110979bb2af47e325c38e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 16870,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7953b8baee3e02621457eeef",
      "type": "file-artifact",
      "label": "apps.11608.14255546098955437.c2922c50-eb00-4f80-b393-4e513d9f81c7.4345eb8f-f893-40a2-aec5-20f4758af165%3fw=150&h=150",
      "value": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca",
      "sha256": "0f132c40ca33c057af0aed28534cd23b31ce36da1ad0cda3f2c2f1e03d646bca",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 13972,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-baacb90b3ea2a5bac3bb2228",
      "type": "file-artifact",
      "label": "35098229_d9a668acd9af16621c688b823ada2c10de963ca4.cab",
      "value": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4",
      "sha256": "4b03bfd94c00eecc15b41ef45adb7196c1bcfc942383b2ace3fac4a0423bdef4",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10821,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6ec9d7b2eeadec7d012d8a56",
      "type": "file-artifact",
      "label": "35094827_769ef074432ee9d2982132709c97d7a039b1441d.cab",
      "value": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34",
      "sha256": "4839da5b25468809fbc7708652e77c4aa945e6735bf5c9119b3299653898ce34",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10791,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1bcd879a067ef93d296ed895",
      "type": "file-artifact",
      "label": "35096864_51f3f34383a28a4d5d63528d9978515e66a6806e.cab",
      "value": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7",
      "sha256": "cb82f8b3153b5c172ae382d0cf92ca5373017dd09f98137bc3b06982115006d7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10789,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4cba839fc685581f1de16836",
      "type": "file-artifact",
      "label": "35096188_49a74f42962e10ef9cfa9492f2c1955c24967958.cab",
      "value": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51",
      "sha256": "2972f477a28570de6c949fba237ace8c1bc2ea29b961b63aab3a57469e70cb51",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10781,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4b9ef213a8b480b046f0e55d",
      "type": "file-artifact",
      "label": "35096518_246960552fd8974bcfe0af13e362f8d00f0c6046.cab",
      "value": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c",
      "sha256": "8529705a28a2cc8a6ac692e2f9a8cba5d6a3f44b81041270251389f1a017656c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10767,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-286a093f05b5dda8bf2af676",
      "type": "file-artifact",
      "label": "35095158_9a369166024cd2046a41b3fcf5a7d5743d20b1f8.cab",
      "value": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb",
      "sha256": "1127774b7710ffa8c9bd5d3182517be848d9373e8f4382f28f801ba9e44f80fb",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10765,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ed48e5ec1e756dd30dcc10bc",
      "type": "file-artifact",
      "label": "35097188_47bf5b9e41cf731eeaf7b93672b38948c413df0b.cab",
      "value": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1",
      "sha256": "80a71674cf8a71eaaf73c661d43ca1b69c4f393ccd603b89436812913fffb0f1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10763,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-710cd180d86e73cf5af6f7ca",
      "type": "file-artifact",
      "label": "35095511_08bd8b8ea97b82600094601b9451b7fa9b028927.cab",
      "value": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196",
      "sha256": "07a1470ae3b863578779e025fc6009e6519e0f77325e7a94a426a58b7e408196",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10623,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9e0bee7b41d6b7ca0e69d67d",
      "type": "file-artifact",
      "label": "35097541_59453a64ae1a0f59447d0c4e4bae68350827ad3f.cab",
      "value": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a",
      "sha256": "e9132eaa61c1d06d76b82c27cffa7b6ba171f5e31fcec6fa78b03a7523f0f40a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10621,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c6d21c7f5c356b86c31703bb",
      "type": "file-artifact",
      "label": "35095828_d42aac61fe6047b9b6b654db9d5c9ae957613125.cab",
      "value": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d",
      "sha256": "dd3eb184a16f533fcce480c533d93846a6bb11138dc12468830115263490238d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10593,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-67d57be4db6fe8650288f03b",
      "type": "file-artifact",
      "label": "35097869_11f02196bd92ebd3ff0745749654d98eb8ddd58c.cab",
      "value": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5",
      "sha256": "0076eaec4990322f0ebf53a5a53997c1525f358dc28dd6b7e1cbffd9bd41a9a5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 10589,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-387316dbd8bd994b4abb00f1",
      "type": "file-artifact",
      "label": "35096748_a533dd985a0175649c16855a9c628da8f21d78da.cab",
      "value": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886",
      "sha256": "9db86bb697c7b6a5f3ed228546c9cb8a7037901e61efe0b244ba38e7d9ad3886",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7287,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-180b6d8f674e60363cc922f7",
      "type": "file-artifact",
      "label": "35098113_ea9c1c8bf8003ad3b08ee004e09ae3bbf5fb1456.cab",
      "value": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc",
      "sha256": "01b57c485bc90409c12dfff1fcca905e8ee03a18958ebb8fb7f007d317c2e6fc",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7285,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6d935ccb1dfb597125dd0f98",
      "type": "file-artifact",
      "label": "35096747_f2ef0a3546df9b0fe01091e8cf6244c2b18ad27a.cab",
      "value": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f",
      "sha256": "2cd96ea2a66b8bc4526b21c3744118b75f834d24739b04e2e7ceef21b8ad706f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7285,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2d99be72ce0938e1d5cbe15a",
      "type": "file-artifact",
      "label": "35096072_5331372f4a198d80f7a5602f73259ff77d004730.cab",
      "value": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee",
      "sha256": "6db9e2137a8e7ebe66680ad4b9deeb17f7fc9f3103d9a1d9cde353f898de1bee",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7283,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-69b45771a4e918bc030c1f5c",
      "type": "file-artifact",
      "label": "35098112_e6ce21ecdf7d899a6a8671574b68871ce853efe6.cab",
      "value": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2",
      "sha256": "d98626686f7c56a852f3d658d947d96137ecbcfed278bdc2bc6158239a7434a2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7277,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2ad4d61b8d2e2e6a6577e5fa",
      "type": "file-artifact",
      "label": "35094710_046a1ec2fc584f3c2f6653542576b125ec45b91b.cab",
      "value": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f",
      "sha256": "ea203eb1b56387cac02308b5aca040993e2d1c7fbd06413d41c957a726e4898f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7277,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6c9261c50b1842b029fbf98a",
      "type": "file-artifact",
      "label": "35096071_6f89138c772d9cca2cda43656eecab96a5cd44fc.cab",
      "value": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d",
      "sha256": "153eec5b545f82f598d7728472073b1cdee325fc30cb7bc743c21d753610950d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7275,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-048bc1575e3c1d50f469a660",
      "type": "file-artifact",
      "label": "35097432_b4cbace49a072b37958e15b9d3daadf28c89f361.cab",
      "value": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d",
      "sha256": "729388a4d1b0e06eb28c982bf4a2e9304937ad1a92932dfc76d822b441563b6d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7275,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b01f68708da0f1bb264a8668",
      "type": "file-artifact",
      "label": "35094711_e3993b23840c0d600179f647e9ac08158269c095.cab",
      "value": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21",
      "sha256": "e008608c81024ed297a07321b7c9ba9a00adac7cea71f24491af04b5e88f2f21",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7275,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-910911685decebc2c3ee0cad",
      "type": "file-artifact",
      "label": "35097431_5695ed6029065d034bdbaa6edef143ec73f43570.cab",
      "value": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5",
      "sha256": "8eddb32e5ab1436d9cec5cbf730ad2a82d559730d69e35c534863d64d038d7c5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7273,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-30ac0a77eb10b6bc5a953010",
      "type": "file-artifact",
      "label": "35095402_3a3af9d09b295d5cad27c058b669144408fd1987.cab",
      "value": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864",
      "sha256": "3197375f525ce4d0d339e56b343ecd510ffc72dcfa250b1352f8bd6a02d49864",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7267,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f5f89b4e1678d28348a0e84e",
      "type": "file-artifact",
      "label": "35095401_461f0f3035a629e02f33b5439ab5d58c4e45c62f.cab",
      "value": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7",
      "sha256": "f040d968ae5f0c4324a4e3fce10f7bfbc4370251aecb695f4a5f6c5af7a66aa7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7261,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ae04db8f4788e6435c2d3639",
      "type": "file-artifact",
      "label": "35097072_9c18abaa0dd4f3355c05cb1e0ac0d0a1da10552a.cab",
      "value": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d",
      "sha256": "6c1eac65b98a81cd11abeaffe3fcf7f268e8788f733a0a8598b900201f05fc6d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7189,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-cbf67ce8eb8b5faa88185a15",
      "type": "file-artifact",
      "label": "35097071_01580b64b700158e52507faa6223a4cb41c43f05.cab",
      "value": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7",
      "sha256": "0550952e70d2e4e5ca28a8160e31cab6418ecb152915ec5dbfe88248d39fc2c7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7185,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-86ba355c6f7138cabbded8e8",
      "type": "file-artifact",
      "label": "35096401_980e49644362fb40897606d01fddd1ef79c6702a.cab",
      "value": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4",
      "sha256": "b4effa72b591f85bed1dd07d82d924b9423f5e58a26c62290d11a628768676e4",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7183,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-e0731dc3eff6de98411d3b44",
      "type": "file-artifact",
      "label": "35096402_83d0bc9d8970cab311753b171496293c4e0588b8.cab",
      "value": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219",
      "sha256": "36d3e002691397fefd5287603499d03fd0d929ebc2d4b08ece3d9e8b74cb3219",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7181,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-28cabf370041ec91b1106009",
      "type": "file-artifact",
      "label": "35095042_571a24bf1c59b2fc66012aba76936bc63860b918.cab",
      "value": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe",
      "sha256": "e65eaf9faa6e7f3f0ce49c052a35be7cd5fed3ffc70b3f1ff7c213bee79f83fe",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7181,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3e58d219ed25bd72b8be4a9c",
      "type": "file-artifact",
      "label": "35097759_f51781226900f2c3a24cac0d25d7e32ce4232b12.cab",
      "value": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a",
      "sha256": "809e5e4344a517b4f713aa55e03e2dc0c0d21cfa77ac2963e2e6e937e7d1264a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7175,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6393dcafb21eb3f8fa0af067",
      "type": "file-artifact",
      "label": "35097760_94afc464b79c1922edc5d9f1aa46b8bbdafcac27.cab",
      "value": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334",
      "sha256": "b96661475f79113a3685ff208a52c3dde1340f93a479011f027c7bd3859c5334",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7175,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-382a4df8d7cc37c7274cf358",
      "type": "file-artifact",
      "label": "35095719_bb98167530418ae8aa387c077bca2d54e52a227b.cab",
      "value": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c",
      "sha256": "6a115a372e460c1de12760689955740a891b6d1e3f97bbe7e667c93ee940150c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7171,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-23f6fc7b3b31892241e9e53d",
      "type": "file-artifact",
      "label": "35095718_d6052d2a18efec5d0584f7d9db0c6df36c871e5e.cab",
      "value": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe",
      "sha256": "b80ed4f18c472ca7a6dd8dad53acc51a77e0ee0dc1fbadcc2e5d8e42efaa37fe",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7171,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f8a6b000a365b8e0f3d09f05",
      "type": "file-artifact",
      "label": "35095041_d6fbe7dcab58bad491f97a8fb16f67acdd9c5880.cab",
      "value": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74",
      "sha256": "eddbff1244adffc83452a0a77a9c25fb8eb31625f9d18203acde9fd85eaa7f74",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7171,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1a5706bb5697bc56c5bcddb5",
      "type": "file-artifact",
      "label": "apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012.ada314ec-db8e-49bb-a756-60487526418e%3fw=150&h=150",
      "value": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411",
      "sha256": "84520bc8bb4f129be41a7ab2a1ff1064efcd060d5521c2d5c23afd8710339411",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 2222,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0fc769c752319e9982259def",
      "type": "file-artifact",
      "label": "ncsi.txt",
      "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
      "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 14,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/plain"
    },
    {
      "id": "artifact-cfaef7a0adb110765307d655",
      "type": "file-artifact",
      "label": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(1).exe",
      "value": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d",
      "sha256": "9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 2,
      "source_ref": "2021-09-10-traffic-analysis-exercise.pcap",
      "analysis_id": "9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "source_refs": [
        "2021-09-10-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "type": "ioc-investigation",
      "label": "194.62.42.206",
      "value": "194.62.42.206",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "1 engines marked malicious and 1 suspicious; 53 harmless, 34 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 2 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 7 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "not_found",
          "summary": "Shodan returned 0 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 0 service(s)."
        }
      ],
      "summary": "194.62.42.206 was classified as ip. Investigation verdict is low signal with score 15/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "low signal",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 15,
      "actor_lead_count": 0,
      "graph_edge_count": 20,
      "graph_node_count": 16,
      "source_analysis_ref": "/api/ioc/investigations/8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 20,
      "graph_preview_node_count": 16
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "194.62.42.206",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb",
        "censys"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:collection:lcia:honeynet:2022",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "LCIA:HoneyNet:2022",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:collection:lcia:honeynet:june 2022",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "LCIA:HoneyNet:June 2022",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:194.62.42.206",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "194.62.42.206",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:beilgardenings.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "beilgardenings.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:onlineracehub.ru",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "onlineracehub.ru",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:pq.hosting",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "pq.hosting",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:simpsonsavingss.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "simpsonsavingss.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://194.62.42.206/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://194.62.42.206/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://beilgardenings.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://beilgardenings.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com/bmdff/98508/28068/78672/bcrmmqy/delokzymmv0fvg41eodpr8r/pbiikrfjyeqqbn9bzlxojhpco2dyq/qatc3tafif/42634/mady7?=jcz20ymbcmj&6fyzt=tgzbcaj2nexurt&v4ljjuwj=e9bh0zg8a&search=taxxnhlmloel0l9p5&user=ozpntsa9y9&sid=zvfyov4fxvyoirh8&id=qn5rejnynnvizab9ri8&ve9vdsy32=ikydiix&vorjl=j1m9cmwpp73kubqh",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://beilgardenings.com/bmdff/98508/28068/78672/BcRMMqy/dELOKZymMV0fvg41EodPr8r/PbiikrFjYEqQBN9BzlXOJhpco2DYq/Qatc3tAfiF/42634/mady7?=jCz20ymbCMJ&6FyZT=tGZBcaJ2NEXURT&v4LjjUwj=E9Bh0ZG8a&search=TaxxnHLMlOEl0l9P5&user=OzpnTsA9y9&sid=ZVFYOv4FXvyOiRH8&id=Qn5REjnyNNViZab9ri8&ve9vDsY32=iKyDIix&VOrJl=j1M9CMWpP73kUBQh",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com/bmdff/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/lnkgbuicyecptqnmwhamsg638wk/wdjbt66zbubehyyb0ep2i7ewtttvvisj2gnoqeoka2th/zh2iuvcrnxpdbfnck60wjogkzsby271osl/hcn8zmmkcm7uegrj/ydcxvh4vhhdbjjxq2/y2pfqjaqnakegytxp7xy6f8/pveryfpxah0hecvhbhnn1wk5c1legmnqweefxu3t/ewacszfcesmx0i8spzyybombw1egan3ykyppie0lxvzvyi/date2?=axskd5hanf9uoyixxapgeqjkegy&time=lydjasomugoc0y&8uw7z5ltnx=ogqd0db82byq0&iwkzxfq=o2rsjjjxrkryfw&w8=2k2mq4elnln&ykl2awxu=dutz&ref=ccgsxr1uiipzbhuea0yztxepj&q=bvi0btt6cd9v&user=yj9f6e2&uunxc7=bfzvy",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com/bmdff/LnkGbUicYeCPtQnMwHaMsg638wK/WdJBt66zBuBEhYYb0Ep2I7EwTtTvviSj2GNOqeoka2TH/Zh2iUVCrnXpdBfnck60wJogKzsBY271OSL/hcn8ZMMkcm7uEgRJ/YDCXVh4VHhDBJJxQ2/Y2PFQJaQNAkeGyTxP7XY6f8/pvERyFPxaH0HecVHbhNn1wk5c1LEGmNqWEEfXu3t/eWACSZFCesmx0I8spzYYbombw1eGaN3ykyPpIE0lxVzVyI/date2?=aXsKD5hanf9uOyixXApGeqJKEGY&time=lydjAsOmUGoc0y&8UW7Z5lTNX=OgQd0DB82ByQ0&iwKZXFQ=O2rSjJJxrkrYFW&W8=2K2MQ4elNlN&ykL2aWxu=dutZ&ref=CCgSxr1uIiPZBhUea0YzTxePJ&q=bVI0btT6cd9v&user=yJ9f6E2&uuNxc7=BfZvy",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "type": "ioc-investigation",
      "label": "simpsonsavingss.com",
      "value": "simpsonsavingss.com",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "9 engines marked malicious and 0 suspicious; 46 harmless, 34 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 1 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for simpsonsavingss.com. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "simpsonsavingss.com was classified as domain. Investigation verdict is needs review with score 38/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "needs review",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 38,
      "actor_lead_count": 0,
      "graph_edge_count": 12,
      "graph_node_count": 9,
      "source_analysis_ref": "/api/ioc/investigations/ececde00-c0d7-49bc-be9a-cc6bee393239",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 12,
      "graph_preview_node_count": 9
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "simpsonsavingss.com",
      "sources": [
        "input",
        "virustotal",
        "otx",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 72,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:collection:phishing sites 2023-09-24",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Phishing sites 2023-09-24",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:ns1.bodis.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns1.bodis.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 72,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:ns2.bodis.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns2.bodis.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 72,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:ip:199.59.243.222",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "199.59.243.222",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 72,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:ip:54.38.220.85",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "54.38.220.85",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/bmdff/bhohsctz/mldmpfjax/5ufg3dz7yt/date1?bnlv65=paas",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "type": "ioc-investigation",
      "label": "167.172.37.9",
      "value": "167.172.37.9",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "4 engines marked malicious and 1 suspicious; 51 harmless, 33 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 1 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 1 scan result(s). urlscan activity analysis found 1 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "ok",
          "summary": "Shodan returned 3 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 4 service(s)."
        }
      ],
      "summary": "167.172.37.9 was classified as ip. Investigation verdict is suspicious with score 47/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "suspicious",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 47,
      "actor_lead_count": 0,
      "graph_edge_count": 10,
      "graph_node_count": 9,
      "source_analysis_ref": "/api/ioc/investigations/84edb541-725a-4951-95f7-557c53fc8cf8",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 10,
      "graph_preview_node_count": 9
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "167.172.37.9",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb",
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:collection:ioc records provided by @nextrayai",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:123.goqa.co.za",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "123.goqa.co.za",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:167-172-37-9.cprapid.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "167-172-37-9.cprapid.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:167.172.37.9",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "167.172.37.9",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:api.123.goqa.co.za",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "api.123.goqa.co.za",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:digitalocean.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "digitalocean.com",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:rp-stg.rest",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "rp-stg.rest",
      "sources": [
        "shodan"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:url:https://167.172.37.9/root/tasks/run/handle",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://167.172.37.9/root/tasks/run/handle",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "type": "ioc-investigation",
      "label": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "59 engines marked malicious and 0 suspicious; 0 harmless, 12 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "ok",
          "summary": "MalwareBazaar returned 1 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 2 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8 was classified as hash. Investigation verdict is highly suspicious with score 80/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 17 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 80,
      "actor_lead_count": 0,
      "graph_edge_count": 4,
      "graph_node_count": 4,
      "source_analysis_ref": "/api/ioc/investigations/997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 4,
      "graph_preview_node_count": 4
    },
    {
      "id": "ioc:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "type": "ioc",
      "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "description": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8 was classified as hash. Investigation verdict is highly suspicious with score 80/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 17 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ],
      "suspicion_score": 80
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1018",
      "type": "ttp-evidence",
      "label": "T1018 Remote System Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1018",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1036",
      "type": "ttp-evidence",
      "label": "T1036 Masquerading",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1036",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1055",
      "type": "ttp-evidence",
      "label": "T1055 Process Injection",
      "source": "ioc-investigation",
      "tactic": "stealth, privilege-escalation",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1055",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1059",
      "type": "ttp-evidence",
      "label": "T1059 Command and Scripting Interpreter",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1071",
      "type": "ttp-evidence",
      "label": "T1071 Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1082",
      "type": "ttp-evidence",
      "label": "T1082 System Information Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1082",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1083",
      "type": "ttp-evidence",
      "label": "T1083 File and Directory Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1083",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1129",
      "type": "ttp-evidence",
      "label": "T1129 Shared Modules",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1129",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1218",
      "type": "ttp-evidence",
      "label": "T1218 System Binary Proxy Execution",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1218.010",
      "type": "ttp-evidence",
      "label": "T1218.010 Regsvr32",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218.010",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1218.011",
      "type": "ttp-evidence",
      "label": "T1218.011 Rundll32",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218.011",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1497",
      "type": "ttp-evidence",
      "label": "T1497 Virtualization/Sandbox Evasion",
      "source": "ioc-investigation",
      "tactic": "stealth, discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1497",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1518",
      "type": "ttp-evidence",
      "label": "T1518 Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1518.001",
      "type": "ttp-evidence",
      "label": "T1518.001 Security Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518.001",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1573",
      "type": "ttp-evidence",
      "label": "T1573 Encrypted Channel",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1573",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1574",
      "type": "ttp-evidence",
      "label": "T1574 Hijack Execution Flow",
      "source": "ioc-investigation",
      "tactic": "stealth, execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:997d0aa6-7dd5-4cbb-893d-72ff83b93601:T1574.002",
      "type": "ttp-evidence",
      "label": "T1574.002 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574.002",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "sources": [
        "input",
        "malwarebazaar",
        "otx"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "suspicious": 80,
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:collection:malware bazar 2",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Malware Bazar 2",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:57e32ee603bf5f7fbf4e4befaac52258",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "57e32ee603bf5f7fbf4e4befaac52258",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:da49de88e610e677b2c2ba48b5596933c2288488",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "da49de88e610e677b2c2ba48b5596933c2288488",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "type": "ioc-investigation",
      "label": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "No malicious detections in last analysis; 0 harmless, 69 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "not_found",
          "summary": "MalwareBazaar returned 0 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431 was classified as hash. Investigation verdict is low signal with score 0/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "low signal",
      "source_ref": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 0,
      "actor_lead_count": 0,
      "graph_edge_count": 0,
      "graph_node_count": 1,
      "source_analysis_ref": "/api/ioc/investigations/89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 0,
      "graph_preview_node_count": 1
    },
    {
      "id": "ioc:1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "type": "ioc",
      "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "source": "ioc-investigation",
      "verdict": "low signal",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "description": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431 was classified as hash. Investigation verdict is low signal with score 0/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
        "ioc-investigation"
      ],
      "suspicion_score": 0
    },
    {
      "id": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28:node:hash:1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "sources": [
        "input"
      ],
      "source_ref": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "suspicious": 0,
      "source_refs": [
        "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "type": "ioc-investigation",
      "label": "au.download.windowsupdate.com",
      "value": "au.download.windowsupdate.com",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "No malicious detections in last analysis; 60 harmless, 29 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 2 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for au.download.windowsupdate.com. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "au.download.windowsupdate.com was classified as domain. Investigation verdict is needs review with score 34/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "needs review",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 34,
      "actor_lead_count": 0,
      "graph_edge_count": 36,
      "graph_node_count": 32,
      "source_analysis_ref": "/api/ioc/investigations/144ab9a0-2681-49f4-a410-b126d75d334d",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 36,
      "graph_preview_node_count": 32
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "au.download.windowsupdate.com",
      "sources": [
        "input",
        "virustotal",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:2.au.download.windowsupdate.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2.au.download.windowsupdate.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:4.au.download.windowsupdate.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4.au.download.windowsupdate.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:a767.dspw65.akamai.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "a767.dspw65.akamai.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com.delivery.microsoft.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "au.download.windowsupdate.com.delivery.microsoft.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:bg.microsoft.map.fastly.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "bg.microsoft.map.fastly.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:cl-glcb907925.gcdn.co",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "cl-glcb907925.gcdn.co",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:download.windowsupdate.com.edgesuite.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "download.windowsupdate.com.edgesuite.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:fe2.update.microsoft.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "fe2.update.microsoft.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:wu-b-net.trafficmanager.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "wu-b-net.trafficmanager.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.208",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "132.196.74.208",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.212",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "132.196.74.212",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:134.33.185.100",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "134.33.185.100",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.67",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "172.184.231.67",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.68",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "172.184.231.68",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.69",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "172.184.231.69",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:184.84.165.90",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "184.84.165.90",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.210.172",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "199.232.210.172",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.214.172",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "199.232.214.172",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2600:1407:3c00:12::b819:719a",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2600:1407:3c00:12::b819:719a",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2a03:90c0:9996::6",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2a03:90c0:9996::6",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "92.223.96.6",
      "sources": [
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://15.au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://15.au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://2.au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://2.au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://4.au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://au.download.windowsupdate.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://au.download.windowsupdate.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://fe2.update.microsoft.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://fe2.update.microsoft.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-ca58f50741eb1a816128e19e",
      "type": "pcap-observable",
      "value": "194.62.42.206",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 43,
          "frame_number": 1182,
          "display_filter": "frame.number == 1182",
          "timestamp_epoch": "1631315847.253809000"
        }
      ],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 1,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-fed58a16404c6e5cc73ea7a6",
      "type": "pcap-observable",
      "value": "simpsonsavingss.com",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 43,
          "frame_number": 1180,
          "display_filter": "frame.number == 1180",
          "timestamp_epoch": "1631315847.020323000"
        },
        {
          "udp_stream": 43,
          "frame_number": 1181,
          "display_filter": "frame.number == 1181",
          "timestamp_epoch": "1631315847.100529000"
        },
        {
          "udp_stream": 43,
          "frame_number": 1182,
          "display_filter": "frame.number == 1182",
          "timestamp_epoch": "1631315847.253809000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 1189,
          "display_filter": "frame.number == 1189",
          "timestamp_epoch": "1631315847.822861000"
        }
      ],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 4,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-441114a576e4a8a8f4a5f6b4",
      "type": "pcap-observable",
      "value": "167.172.37.9",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "frame_number": 1479,
          "display_filter": "frame.number == 1479"
        }
      ],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "first-frame-of-exact-address-flow",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 1,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-769d815b3fc7a70c6103ae74",
      "type": "pcap-observable",
      "value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [
        {
          "sha256": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
          "filename": "date1%3fBNLv65=pAAS",
          "size_bytes": 284816,
          "artifact_id": "artifact-3139dedfc6a1194feef19f69",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-d0f371e2065e6ecffdfc02e7",
      "type": "pcap-observable",
      "value": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [
        {
          "sha256": "1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
          "filename": "am_delta_patch_1.349.439.0_dcf977cccce1b58289d270f71f8151b3acc1566b(3).exe",
          "size_bytes": 1048576,
          "artifact_id": "artifact-4ab43a37d5b5d37b561a401c",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-7d2fda5d22bb1e0c9e5f1d73",
      "type": "pcap-observable",
      "value": "au.download.windowsupdate.com",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "artifact_refs": [],
      "source_sha256": "a9576008f7fd634740253a52b2937a205cd214cdde09f6924f0921b8e266dd12",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 72,
          "frame_number": 4182,
          "display_filter": "frame.number == 4182",
          "timestamp_epoch": "1631316288.612396000"
        },
        {
          "udp_stream": 72,
          "frame_number": 4187,
          "display_filter": "frame.number == 4187",
          "timestamp_epoch": "1631316288.685394000"
        },
        {
          "tcp_stream": 100,
          "frame_number": 4193,
          "display_filter": "frame.number == 4193",
          "timestamp_epoch": "1631316288.773365000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 4195,
          "display_filter": "frame.number == 4195",
          "timestamp_epoch": "1631316288.774253000"
        },
        {
          "tcp_stream": 100,
          "frame_number": 4200,
          "display_filter": "frame.number == 4200",
          "timestamp_epoch": "1631316288.853317000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 4201,
          "display_filter": "frame.number == 4201",
          "timestamp_epoch": "1631316288.853479000"
        },
        {
          "tcp_stream": 101,
          "frame_number": 6371,
          "display_filter": "frame.number == 6371",
          "timestamp_epoch": "1631316290.377646000"
        }
      ],
      "semantic_sha256": "ce8b10a4ba7a6615d2c58f5895ecb69dca768d904402026068da26b4ef7db5ed",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_frame_count": 7,
      "evidence_frames_truncated": false
    }
  ],
  "evidence_edges": [
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->collection:lcia:honeynet:2022:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:collection:lcia:honeynet:2022",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "LCIA:HoneyNet:2022",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->collection:lcia:honeynet:june 2022:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:collection:lcia:honeynet:june 2022",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "LCIA:HoneyNet:June 2022",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->domain:194.62.42.206:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:194.62.42.206",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "194.62.42.206",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->ip:194.62.42.206:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "194.62.42.206",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://194.62.42.206/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://194.62.42.206/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://194.62.42.206/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->domain:beilgardenings.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:beilgardenings.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "beilgardenings.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://beilgardenings.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://beilgardenings.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://beilgardenings.com:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://beilgardenings.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://beilgardenings.com/bmdff/98508/28068/78672/bcrmmqy/delokzymmv0fvg41eodpr8r/pbiikrfjyeqqbn9bzlxojhpco2dyq/qatc3tafif/42634/mady7?=jcz20ymbcmj&6fyzt=tgzbcaj2nexurt&v4ljjuwj=e9bh0zg8a&search=taxxnhlmloel0l9p5&user=ozpntsa9y9&sid=zvfyov4fxvyoirh8&id=qn5rejnynnvizab9ri8&ve9vdsy32=ikydiix&vorjl=j1m9cmwpp73kubqh:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com/bmdff/98508/28068/78672/bcrmmqy/delokzymmv0fvg41eodpr8r/pbiikrfjyeqqbn9bzlxojhpco2dyq/qatc3tafif/42634/mady7?=jcz20ymbcmj&6fyzt=tgzbcaj2nexurt&v4ljjuwj=e9bh0zg8a&search=taxxnhlmloel0l9p5&user=ozpntsa9y9&sid=zvfyov4fxvyoirh8&id=qn5rejnynnvizab9ri8&ve9vdsy32=ikydiix&vorjl=j1m9cmwpp73kubqh",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://beilgardenings.com/bmdff/98508/28068/78672/BcRMMqy/dELOKZymMV0fvg41EodPr8r/PbiikrFjYEqQBN9BzlXOJhpco2DYq/Qatc3tAfiF/42634/mady7?=jCz20ymbCMJ&6FyZT=tGZBcaJ2NEXURT&v4LjjUwj=E9Bh0ZG8a&search=TaxxnHLMlOEl0l9P5&user=OzpnTsA9y9&sid=ZVFYOv4FXvyOiRH8&id=Qn5REjnyNNViZab9ri8&ve9vDsY32=iKyDIix&VOrJl=j1M9CMWpP73kUBQh",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->domain:simpsonsavingss.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:simpsonsavingss.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "simpsonsavingss.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com/bmdff/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com/bmdff/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com/bmdff/lnkgbuicyecptqnmwhamsg638wk/wdjbt66zbubehyyb0ep2i7ewtttvvisj2gnoqeoka2th/zh2iuvcrnxpdbfnck60wjogkzsby271osl/hcn8zmmkcm7uegrj/ydcxvh4vhhdbjjxq2/y2pfqjaqnakegytxp7xy6f8/pveryfpxah0hecvhbhnn1wk5c1legmnqweefxu3t/ewacszfcesmx0i8spzyybombw1egan3ykyppie0lxvzvyi/date2?=axskd5hanf9uoyixxapgeqjkegy&time=lydjasomugoc0y&8uw7z5ltnx=ogqd0db82byq0&iwkzxfq=o2rsjjjxrkryfw&w8=2k2mq4elnln&ykl2awxu=dutz&ref=ccgsxr1uiipzbhuea0yztxepj&q=bvi0btt6cd9v&user=yj9f6e2&uunxc7=bfzvy:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/lnkgbuicyecptqnmwhamsg638wk/wdjbt66zbubehyyb0ep2i7ewtttvvisj2gnoqeoka2th/zh2iuvcrnxpdbfnck60wjogkzsby271osl/hcn8zmmkcm7uegrj/ydcxvh4vhhdbjjxq2/y2pfqjaqnakegytxp7xy6f8/pveryfpxah0hecvhbhnn1wk5c1legmnqweefxu3t/ewacszfcesmx0i8spzyybombw1egan3ykyppie0lxvzvyi/date2?=axskd5hanf9uoyixxapgeqjkegy&time=lydjasomugoc0y&8uw7z5ltnx=ogqd0db82byq0&iwkzxfq=o2rsjjjxrkryfw&w8=2k2mq4elnln&ykl2awxu=dutz&ref=ccgsxr1uiipzbhuea0yztxepj&q=bvi0btt6cd9v&user=yj9f6e2&uunxc7=bfzvy",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com/bmdff/LnkGbUicYeCPtQnMwHaMsg638wK/WdJBt66zBuBEhYYb0Ep2I7EwTtTvviSj2GNOqeoka2TH/Zh2iUVCrnXpdBfnck60wJogKzsBY271OSL/hcn8ZMMkcm7uEgRJ/YDCXVh4VHhDBJJxQ2/Y2PFQJaQNAkeGyTxP7XY6f8/pvERyFPxaH0HecVHbhNn1wk5c1LEGmNqWEEfXu3t/eWACSZFCesmx0I8spzYYbombw1eGaN3ykyPpIE0lxVzVyI/date2?=aXsKD5hanf9uOyixXApGeqJKEGY&time=lydjAsOmUGoc0y&8UW7Z5lTNX=OgQd0DB82ByQ0&iwKZXFQ=O2rSjJJxrkrYFW&W8=2K2MQ4elNlN&ykL2aWxu=dutZ&ref=CCgSxr1uIiPZBhUea0YzTxePJ&q=bVI0btT6cd9v&user=yJ9f6E2&uuNxc7=BfZvy",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->domain:pq.hosting:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:pq.hosting",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "pq.hosting",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->domain:onlineracehub.ru:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:domain:onlineracehub.ru",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "onlineracehub.ru",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://194.62.42.206/:urlscan:evidence:5",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://194.62.42.206/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://194.62.42.206/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://beilgardenings.com/bmdff/98508/28068/78672/bcrmmqy/delokzymmv0fvg41eodpr8r/pbiikrfjyeqqbn9bzlxojhpco2dyq/qatc3tafif/42634/mady7?=jcz20ymbcmj&6fyzt=tgzbcaj2nexurt&v4ljjuwj=e9bh0zg8a&search=taxxnhlmloel0l9p5&user=ozpntsa9y9&sid=zvfyov4fxvyoirh8&id=qn5rejnynnvizab9ri8&ve9vdsy32=ikydiix&vorjl=j1m9cmwpp73kubqh:urlscan:evidence:10",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://beilgardenings.com/bmdff/98508/28068/78672/bcrmmqy/delokzymmv0fvg41eodpr8r/pbiikrfjyeqqbn9bzlxojhpco2dyq/qatc3tafif/42634/mady7?=jcz20ymbcmj&6fyzt=tgzbcaj2nexurt&v4ljjuwj=e9bh0zg8a&search=taxxnhlmloel0l9p5&user=ozpntsa9y9&sid=zvfyov4fxvyoirh8&id=qn5rejnynnvizab9ri8&ve9vdsy32=ikydiix&vorjl=j1m9cmwpp73kubqh",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://beilgardenings.com/bmdff/98508/28068/78672/BcRMMqy/dELOKZymMV0fvg41EodPr8r/PbiikrFjYEqQBN9BzlXOJhpco2DYq/Qatc3tAfiF/42634/mady7?=jCz20ymbCMJ&6FyZT=tGZBcaJ2NEXURT&v4LjjUwj=E9Bh0ZG8a&search=TaxxnHLMlOEl0l9P5&user=OzpnTsA9y9&sid=ZVFYOv4FXvyOiRH8&id=Qn5REjnyNNViZab9ri8&ve9vDsY32=iKyDIix&VOrJl=j1M9CMWpP73kUBQh",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com/bmdff/:urlscan:evidence:13",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com/bmdff/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:edge:ip:194.62.42.206->url:http://simpsonsavingss.com/bmdff/lnkgbuicyecptqnmwhamsg638wk/wdjbt66zbubehyyb0ep2i7ewtttvvisj2gnoqeoka2th/zh2iuvcrnxpdbfnck60wjogkzsby271osl/hcn8zmmkcm7uegrj/ydcxvh4vhhdbjjxq2/y2pfqjaqnakegytxp7xy6f8/pveryfpxah0hecvhbhnn1wk5c1legmnqweefxu3t/ewacszfcesmx0i8spzyybombw1egan3ykyppie0lxvzvyi/date2?=axskd5hanf9uoyixxapgeqjkegy&time=lydjasomugoc0y&8uw7z5ltnx=ogqd0db82byq0&iwkzxfq=o2rsjjjxrkryfw&w8=2k2mq4elnln&ykl2awxu=dutz&ref=ccgsxr1uiipzbhuea0yztxepj&q=bvi0btt6cd9v&user=yj9f6e2&uunxc7=bfzvy:urlscan:evidence:15",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:url:http://simpsonsavingss.com/bmdff/lnkgbuicyecptqnmwhamsg638wk/wdjbt66zbubehyyb0ep2i7ewtttvvisj2gnoqeoka2th/zh2iuvcrnxpdbfnck60wjogkzsby271osl/hcn8zmmkcm7uegrj/ydcxvh4vhhdbjjxq2/y2pfqjaqnakegytxp7xy6f8/pveryfpxah0hecvhbhnn1wk5c1legmnqweefxu3t/ewacszfcesmx0i8spzyybombw1egan3ykyppie0lxvzvyi/date2?=axskd5hanf9uoyixxapgeqjkegy&time=lydjasomugoc0y&8uw7z5ltnx=ogqd0db82byq0&iwkzxfq=o2rsjjjxrkryfw&w8=2k2mq4elnln&ykl2awxu=dutz&ref=ccgsxr1uiipzbhuea0yztxepj&q=bvi0btt6cd9v&user=yj9f6e2&uunxc7=bfzvy",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "source_refs": [
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
        "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52:node:ip:194.62.42.206"
      ],
      "source_value": "194.62.42.206",
      "target_value": "http://simpsonsavingss.com/bmdff/LnkGbUicYeCPtQnMwHaMsg638wK/WdJBt66zBuBEhYYb0Ep2I7EwTtTvviSj2GNOqeoka2TH/Zh2iUVCrnXpdBfnck60wJogKzsBY271OSL/hcn8ZMMkcm7uEgRJ/YDCXVh4VHhDBJJxQ2/Y2PFQJaQNAkeGyTxP7XY6f8/pvERyFPxaH0HecVHbhNn1wk5c1LEGmNqWEEfXu3t/eWACSZFCesmx0I8spzYYbombw1eGaN3ykyPpIE0lxVzVyI/date2?=aXsKD5hanf9uOyixXApGeqJKEGY&time=lydjAsOmUGoc0y&8UW7Z5lTNX=OgQd0DB82ByQ0&iwKZXFQ=O2rSjJJxrkrYFW&W8=2K2MQ4elNlN&ykL2aWxu=dutZ&ref=CCgSxr1uIiPZBhUea0YzTxePJ&q=bVI0btT6cd9v&user=yJ9f6E2&uuNxc7=BfZvy",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->domain:ns2.bodis.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:ns2.bodis.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "ns2.bodis.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->ip:199.59.243.222:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:ip:199.59.243.222",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "199.59.243.222",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->domain:ns1.bodis.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:ns1.bodis.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "ns1.bodis.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->collection:phishing sites 2023-09-24:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:collection:phishing sites 2023-09-24",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "Phishing sites 2023-09-24",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->domain:simpsonsavingss.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "simpsonsavingss.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->ip:54.38.220.85:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:ip:54.38.220.85",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "54.38.220.85",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->url:http://simpsonsavingss.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "http://simpsonsavingss.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->url:http://simpsonsavingss.com/:urlscan:evidence:7",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "http://simpsonsavingss.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->url:http://simpsonsavingss.com/bmdff/bhohsctz/mldmpfjax/5ufg3dz7yt/date1?bnlv65=paas:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/bmdff/bhohsctz/mldmpfjax/5ufg3dz7yt/date1?bnlv65=paas",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->url:http://simpsonsavingss.com/bmdff/bhohsctz/mldmpfjax/5ufg3dz7yt/date1?bnlv65=paas:urlscan:evidence:9",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com/bmdff/bhohsctz/mldmpfjax/5ufg3dz7yt/date1?bnlv65=paas",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "http://simpsonsavingss.com/bmdff/BhoHsCtZ/MLdmpfjaX/5uFG3Dz7yt/date1?BNLv65=pAAS",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->url:http://simpsonsavingss.com:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:url:http://simpsonsavingss.com",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "http://simpsonsavingss.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:edge:domain:simpsonsavingss.com->domain:simpsonsavingss.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "source_refs": [
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
        "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239:node:domain:simpsonsavingss.com"
      ],
      "source_value": "simpsonsavingss.com",
      "target_value": "simpsonsavingss.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->collection:ioc records provided by @nextrayai:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:collection:ioc records provided by @nextrayai",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "IOC Records Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:167.172.37.9:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:167.172.37.9",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "167.172.37.9",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->ip:167.172.37.9:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "167.172.37.9",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->url:https://167.172.37.9/root/tasks/run/handle:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:url:https://167.172.37.9/root/tasks/run/handle",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "https://167.172.37.9/root/tasks/run/handle",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->url:https://167.172.37.9/root/tasks/run/handle:urlscan:evidence:4",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:url:https://167.172.37.9/root/tasks/run/handle",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "https://167.172.37.9/root/tasks/run/handle",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:digitalocean.com:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:digitalocean.com",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "digitalocean.com",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:rp-stg.rest:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:rp-stg.rest",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "rp-stg.rest",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:123.goqa.co.za:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:123.goqa.co.za",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "123.goqa.co.za",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:167-172-37-9.cprapid.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:167-172-37-9.cprapid.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "167-172-37-9.cprapid.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:edge:ip:167.172.37.9->domain:api.123.goqa.co.za:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:domain:api.123.goqa.co.za",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "source_refs": [
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
        "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8:node:ip:167.172.37.9"
      ],
      "source_value": "167.172.37.9",
      "target_value": "api.123.goqa.co.za",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:edge:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8->hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "evidence": "malwarebazaar field sha256_hash",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8"
      ],
      "source_value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target_value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:edge:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8->hash:da49de88e610e677b2c2ba48b5596933c2288488:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:da49de88e610e677b2c2ba48b5596933c2288488",
      "evidence": "malwarebazaar field sha1_hash",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8"
      ],
      "source_value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target_value": "da49de88e610e677b2c2ba48b5596933c2288488",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:edge:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8->hash:57e32ee603bf5f7fbf4e4befaac52258:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:57e32ee603bf5f7fbf4e4befaac52258",
      "evidence": "malwarebazaar field md5_hash",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8"
      ],
      "source_value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target_value": "57e32ee603bf5f7fbf4e4befaac52258",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:edge:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8->collection:malware bazar 2:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:collection:malware bazar 2",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "source_refs": [
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
        "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601:node:hash:eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8"
      ],
      "source_value": "eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "target_value": "Malware Bazar 2",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:download.windowsupdate.com.edgesuite.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:download.windowsupdate.com.edgesuite.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "download.windowsupdate.com.edgesuite.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com.delivery.microsoft.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com.delivery.microsoft.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "au.download.windowsupdate.com.delivery.microsoft.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:wu-b-net.trafficmanager.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:wu-b-net.trafficmanager.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "wu-b-net.trafficmanager.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:bg.microsoft.map.fastly.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:bg.microsoft.map.fastly.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "bg.microsoft.map.fastly.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:2a03:90c0:9996::6:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2a03:90c0:9996::6",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "2a03:90c0:9996::6",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:199.232.210.172:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.210.172",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "199.232.210.172",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:199.232.214.172:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:199.232.214.172",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "199.232.214.172",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:cl-glcb907925.gcdn.co:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:cl-glcb907925.gcdn.co",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "cl-glcb907925.gcdn.co",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:a767.dspw65.akamai.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:a767.dspw65.akamai.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "a767.dspw65.akamai.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "au.download.windowsupdate.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:92.223.96.6:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "92.223.96.6",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe:urlscan:evidence:12",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2026/08/updateplatform.amd64fre_99b71e4d3a498fec8b527f4dc0cf4a74169de128.exe",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:2.au.download.windowsupdate.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:2.au.download.windowsupdate.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "2.au.download.windowsupdate.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:184.84.165.90:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:184.84.165.90",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "184.84.165.90",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://2.au.download.windowsupdate.com/d/msdownload/update/software/defu/2026/09/am_delta_patch_1.457.432.0_2215ce772c63285dded5fb81e241ed1f36d543dc.exe",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:4.au.download.windowsupdate.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:4.au.download.windowsupdate.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "4.au.download.windowsupdate.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://4.au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://4.au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://4.au.download.windowsupdate.com/:urlscan:evidence:19",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://4.au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://4.au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:fe2.update.microsoft.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:fe2.update.microsoft.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "fe2.update.microsoft.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:132.196.74.208:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.208",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "132.196.74.208",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://fe2.update.microsoft.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://fe2.update.microsoft.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://fe2.update.microsoft.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://15.au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://15.au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://15.au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.68:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.68",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "172.184.231.68",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:134.33.185.100:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:134.33.185.100",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "134.33.185.100",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:132.196.74.212:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:132.196.74.212",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "132.196.74.212",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:https://2.au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:https://2.au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "https://2.au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.67:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.67",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "172.184.231.67",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:172.184.231.69:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:172.184.231.69",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "172.184.231.69",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->url:http://2.au.download.windowsupdate.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:url:http://2.au.download.windowsupdate.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "http://2.au.download.windowsupdate.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->domain:au.download.windowsupdate.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "au.download.windowsupdate.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:2600:1407:3c00:12::b819:719a:censys",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:2600:1407:3c00:12::b819:719a",
      "evidence": "Censys web property IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "2600:1407:3c00:12::b819:719a",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:edge:domain:au.download.windowsupdate.com->ip:92.223.96.6:censys",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:ip:92.223.96.6",
      "evidence": "Censys web property IP",
      "source_ref": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "source_refs": [
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
        "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d:node:domain:au.download.windowsupdate.com"
      ],
      "source_value": "au.download.windowsupdate.com",
      "target_value": "92.223.96.6",
      "evidence_source": "censys"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-ca58f50741eb1a816128e19e:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-ca58f50741eb1a816128e19e",
      "target": "ioc-investigation:8b7b5cdd-2fd8-4edb-a346-1920bb702d52",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-fed58a16404c6e5cc73ea7a6:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-fed58a16404c6e5cc73ea7a6",
      "target": "ioc-investigation:ececde00-c0d7-49bc-be9a-cc6bee393239",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-441114a576e4a8a8f4a5f6b4:84edb541-725a-4951-95f7-557c53fc8cf8",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-441114a576e4a8a8f4a5f6b4",
      "target": "ioc-investigation:84edb541-725a-4951-95f7-557c53fc8cf8",
      "evidence": "Exact normalized type/value equality; first-frame-of-exact-address-flow. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-769d815b3fc7a70c6103ae74:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-769d815b3fc7a70c6103ae74",
      "target": "ioc-investigation:997d0aa6-7dd5-4cbb-893d-72ff83b93601",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-d0f371e2065e6ecffdfc02e7:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-d0f371e2065e6ecffdfc02e7",
      "target": "ioc-investigation:89e9d15a-c2f9-4310-b3cd-0676c64daa28",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-7d2fda5d22bb1e0c9e5f1d73:144ab9a0-2681-49f4-a410-b126d75d334d",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:9923b3d5-8d06-4f6a-b1f1-810507712be3:observable-7d2fda5d22bb1e0c9e5f1d73",
      "target": "ioc-investigation:144ab9a0-2681-49f4-a410-b126d75d334d",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:9923b3d5-8d06-4f6a-b1f1-810507712be3",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    }
  ],
  "timeline": [
    {
      "at": "2026-09-19T12:49:52.701Z",
      "event": "Added Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T12:57:44.228Z",
      "event": "Added Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2021-09-10-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T13:50:34.610Z",
      "event": "Added IOC investigation for 194.62.42.206",
      "source": "IOC investigation 194.62.42.206",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:57:08.854Z",
      "event": "Added IOC investigation for 194.62.42.206",
      "source": "IOC investigation 194.62.42.206",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:57:12.053Z",
      "event": "Added IOC investigation for simpsonsavingss.com",
      "source": "IOC investigation simpsonsavingss.com",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:57:14.482Z",
      "event": "Added IOC investigation for 167.172.37.9",
      "source": "IOC investigation 167.172.37.9",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:57:16.952Z",
      "event": "Added IOC investigation for eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "source": "IOC investigation eed363fc4af7a9070d69340592dcab7c78db4f90710357de29e3b624aa957cf8",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 17
    },
    {
      "at": "2026-09-19T13:57:19.041Z",
      "event": "Added IOC investigation for 1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "source": "IOC investigation 1d48d9166408d8b8bf39f9557e4f8a57133c353567c55966ec2831a7bc230431",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:57:21.053Z",
      "event": "Added IOC investigation for au.download.windowsupdate.com",
      "source": "IOC investigation au.download.windowsupdate.com",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:29:08.578210+00:00",
      "event": "Linked approved passive lookups to exact typed, capture-backed PCAP observables. Frames retained where available; object hashes retain capture-export provenance. All context remains unreviewed."
    }
  ],
  "created_at": "2026-09-19T12:49:48.393261+00:00",
  "updated_at": "2026-09-19T14:29:08.597351+00:00"
}