{
  "id": "40fe3cfe-82bb-402a-98a4-11b7a58a0b41",
  "name": "PCAP verified workflow 2021-12-08 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [
    "T1027",
    "T1036",
    "T1045",
    "T1046",
    "T1053",
    "T1055",
    "T1055.011",
    "T1057",
    "T1059",
    "T1059.001",
    "T1071",
    "T1071.001",
    "T1071.004",
    "T1078",
    "T1080",
    "T1090",
    "T1095",
    "T1102",
    "T1105",
    "T1129",
    "T1137",
    "T1143",
    "T1156",
    "T1189",
    "T1190",
    "T1210",
    "T1218",
    "T1399",
    "T1486",
    "T1490",
    "T1491",
    "T1491.001",
    "T1505.003",
    "T1539",
    "T1566",
    "T1567",
    "T1573",
    "T1583",
    "T1584",
    "T1608"
  ],
  "report_ids": [
    "0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
    "107aeeec-5730-437f-969a-3f434a0cae71",
    "28f3673b-6918-4d37-a37c-1ec91202489a",
    "3c93d6d2-ef39-45ac-9cff-0a0591383b57",
    "417e279b-de9f-426d-90dc-61255e3367de",
    "fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
  ],
  "evidence_nodes": [
    {
      "id": "log-pcap:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "type": "log-pcap-analysis",
      "label": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2021-12-08-ISC-Forensic-Challenge.pcap\nCapture SHA-256: `91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef`\nSemantic result SHA-256: `3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 55390 packets across 756 IP endpoints and 2044 transport flows. Observed 1726 DNS events, 17 HTTP requests, 191 TLS ClientHello events, and 500 exported HTTP object(s). Deterministic rules produced 18 finding(s): 0 high, 12 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 55390\n- Duration: 2036.038412 seconds\n- Captured bytes: 32089556\n- Endpoints: 756\n- Flows: 2044\n\n## Deterministic findings\n\n### MEDIUM — HTTP client claiming a PowerShell User-Agent\n\nThe HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent.\n\nRule: `powershell-http-client@pcap-rules-v3`; confidence: 0.94; evidence: frame 1743 / TCP stream 27.\n\nMetrics: `{\"destination\":\"104.21.29.80\",\"request_count\":1,\"source\":\"10.12.3.66\",\"user_agent\":\"Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1320\"}`\n\n### MEDIUM — HTTP client claiming a PowerShell User-Agent\n\nThe HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent.\n\nRule: `powershell-http-client@pcap-rules-v3`; confidence: 0.94; evidence: frame 1771 / TCP stream 29.\n\nMetrics: `{\"destination\":\"139.59.6.175\",\"request_count\":1,\"source\":\"10.12.3.66\",\"user_agent\":\"Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1320\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 353 / TCP stream 11, frame 355 / TCP stream 11, frame 357 / TCP stream 11, frame 359 / TCP stream 11, frame 3126 / TCP stream 32.\n\nMetrics: `{\"destination\":\"10.12.3.66\",\"event_count\":16,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.12.3.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 46 / TCP stream 0, frame 52 / TCP stream 0, frame 428 / TCP stream 17, frame 433 / TCP stream 17, frame 435 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.12.3.66\",\"event_count\":25,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.12.3.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 291 / TCP stream 8, frame 293 / TCP stream 8, frame 295 / TCP stream 8, frame 297 / TCP stream 8, frame 299 / TCP stream 8.\n\nMetrics: `{\"destination\":\"10.12.3.66\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.12.3.3\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 352 / TCP stream 11, frame 354 / TCP stream 11, frame 356 / TCP stream 11, frame 358 / TCP stream 11, frame 3125 / TCP stream 32.\n\nMetrics: `{\"destination\":\"10.12.3.3\",\"event_count\":16,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.12.3.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 43 / TCP stream 0, frame 50 / TCP stream 0, frame 53 / TCP stream 0, frame 426 / TCP stream 17, frame 431 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.12.3.3\",\"event_count\":32,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.12.3.66\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 290 / TCP stream 8, frame 292 / TCP stream 8, frame 294 / TCP stream 8, frame 296 / TCP stream 8, frame 298 / TCP stream 8.\n\nMetrics: `{\"destination\":\"10.12.3.3\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.12.3.66\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 11092 / TCP stream 92.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":30.685,\"packets\":107,\"source\":\"10.12.3.66\",\"wire_bytes\":73616}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 11301 / TCP stream 113.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":57.532,\"packets\":147,\"source\":\"10.12.3.66\",\"wire_bytes\":105748}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 13057 / TCP stream 241.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":42.498,\"packets\":168,\"source\":\"10.12.3.66\",\"wire_bytes\":125939}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 18188 / TCP stream 443.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":33.66,\"packets\":583,\"source\":\"10.12.3.66\",\"wire_bytes\":454912}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 21451 / TCP stream 597.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":36.785,\"packets\":1049,\"source\":\"10.12.3.66\",\"wire_bytes\":805994}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 23295 / TCP stream 598.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":59.968,\"packets\":108,\"source\":\"10.12.3.66\",\"wire_bytes\":73622}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 28378 / TCP stream 748.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":34.519,\"packets\":3721,\"source\":\"10.12.3.66\",\"wire_bytes\":2960550}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 43910 / TCP stream 895.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":49.751,\"packets\":111,\"source\":\"10.12.3.66\",\"wire_bytes\":74055}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 46108 / TCP stream 1057.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":54.922,\"packets\":353,\"source\":\"10.12.3.66\",\"wire_bytes\":265548}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v3`; confidence: 0.7; evidence: frame 47842 / TCP stream 1128.\n\nMetrics: `{\"destination\":\"91.207.181.106\",\"destination_port\":8080,\"duration_seconds\":40.215,\"packets\":331,\"source\":\"10.12.3.66\",\"wire_bytes\":262342}`\n\n## ATT&CK candidates\n\n- T1059.001 Command and Scripting Interpreter: PowerShell (execution), confidence=0.5, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `darin.figueroa`; client IPs: 10.12.3.66; frames: 224, 232, 234, 246, 274\n- domain: `FARGREENTECH`; client IPs: 10.12.3.66; frames: 274\n- full-name: `Darin Figueroa`; client IPs: 10.12.3.66; frames: 305\n- hostname: `DESKTOP-LUOABV1`; client IPs: 10.12.3.66; frames: 1, 3, 23, 59, 72\n- hostname: `FARGREENTECH`; client IPs: 10.12.3.66; frames: 132, 136, 137, 172\n- netbios-group: `FARGREENTECH`; client IPs: unbound subject; frames: 60, 80, 113, 118, 120\n\n## IOC and artifact candidates\n\n- domain: `a.temp.pl`; roles: dns-query\n- domain: `acerodelcibao.com`; roles: dns-query\n- domain: `actsb.com.my`; roles: dns-cname\n- domain: `adomengineering.com`; roles: dns-cname\n- domain: `amaralcoleta.com.br`; roles: dns-cname\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arketipo.com.mx`; roles: dns-cname\n- domain: `atmail15.worldsoft-mail.net`; roles: dns-query\n- domain: `auth.smtp.1and1.co.uk`; roles: dns-query\n- domain: `auth.smtp.configtools.de`; roles: dns-query\n- domain: `auth.smtp.kundenserver.de`; roles: dns-cname, dns-query\n- domain: `baidyanath.info`; roles: dns-query\n- domain: `bh.frameworks-studios.com`; roles: dns-query\n- domain: `box5718.bluehost.com`; roles: dns-query\n- domain: `broker.zgora.pl`; roles: dns-query\n- domain: `bsmtp.telekom.at`; roles: dns-query\n- domain: `c1.icoremail.net`; roles: dns-query\n- domain: `capchile.cl`; roles: dns-cname\n- domain: `chaudharygroup.com`; roles: dns-query\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ci-aduanas.com`; roles: dns-query\n- domain: `cityangkorhotel.com`; roles: dns-cname\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cmusoft.webhost4life.com`; roles: dns-query\n- domain: `cpmail.contactplus.com.pk`; roles: dns-query\n- domain: `dmfseguros.com.br`; roles: dns-cname\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `dunyakalip.com`; roles: dns-cname\n- domain: `egyptetouring.com`; roles: dns-query\n- domain: `ekopraxis.com.ec`; roles: dns-cname\n- domain: `email-proxy.imaginet.co.za`; roles: dns-cname\n- domain: `email-ssl.com.br`; roles: dns-query\n- domain: `email.aon.at`; roles: dns-query\n- domain: `email.srb.gos.pk`; roles: dns-query\n- domain: `emko.com.pl`; roles: dns-query\n- domain: `enseigneslandreville.com`; roles: dns-cname\n- domain: `eurocertindia.com`; roles: dns-cname\n- domain: `eurodesigngroup.net`; roles: dns-cname\n- domain: `fargreentech-dc.fargreentech.com`; roles: dns-query\n- domain: `fargreentech.com`; roles: dns-query\n- domain: `ff.zydusphils.com`; roles: dns-query\n- domain: `fibre.gondrandvalence.com`; roles: dns-cname\n- domain: `fileserver-int.net`; roles: dns-cname\n- domain: `frameworks-studios.com`; roles: dns-cname\n- domain: `gamaes.shop`; roles: dns-query, http-host\n- domain: `gameplayapi.intel.com`; roles: dns-query, tls-sni\n- domain: `gator4266.hostgator.com`; roles: dns-query\n- domain: `ghs.google.com`; roles: dns-cname\n- domain: `global.sky1technologies.com`; roles: dns-query\n- domain: `globalfreight.pk`; roles: dns-cname\n- domain: `gm-pool.centrum.cz`; roles: dns-cname\n- domain: `gottharthotel.com`; roles: dns-query\n- domain: `gruporadialcristocentrica.com`; roles: dns-cname\n- domain: `gs862.ggsv.jp`; roles: dns-query\n- domain: `hades.dewebworks.net`; roles: dns-cname\n- domain: `hdredirect-lb5-1afb6e2973825a56.elb.us-east-1.amazonaws.com`; roles: dns-cname\n- domain: `hmapumps.com`; roles: dns-cname\n- domain: `hortim.cz`; roles: dns-cname\n- domain: `hosting.netclick.cz`; roles: dns-query\n- domain: `hosting.pronto.hn`; roles: dns-query\n- domain: `hotelandros.com`; roles: dns-cname\n- domain: `hsgroupcal.com`; roles: dns-cname\n- domain: `hueber.pl`; roles: dns-query\n- domain: `hv31svg105.neubox.net`; roles: dns-query\n- domain: `imap.1and1.com`; roles: dns-query\n- domain: `imap.1and1.es`; roles: dns-query\n- domain: `imap.1and1.fr`; roles: dns-query\n- domain: `imap.1und1.de`; roles: dns-query\n- domain: `imap.aol.com`; roles: dns-query\n- domain: `imap.comcast.net`; roles: dns-query\n- domain: `imap.conzulere-nextwealth.in`; roles: dns-query\n- domain: `imap.ge.xfinity.com`; roles: dns-cname\n- domain: `imap.iomartmail.com`; roles: dns-query\n- domain: `imap.ionos.com`; roles: dns-query\n- domain: `imap.mail.com`; roles: dns-query\n- domain: `imap.mail.yahoo.com`; roles: dns-query\n- domain: `imap.mi.com.co`; roles: dns-query\n- domain: `imap.nerim.fr`; roles: dns-query\n- domain: `imap.nerim.net`; roles: dns-cname\n- domain: `imap.otenet.gr`; roles: dns-query\n- domain: `imap.prmail.vn`; roles: dns-query\n- domain: `imap.secureserver.net`; roles: dns-query\n- domain: `imap.strato.de`; roles: dns-query\n- domain: `imap.theblossomvn.com`; roles: dns-query\n- domain: `inbound.att.net`; roles: dns-query\n- domain: `inbound.electric.net`; roles: dns-query\n- domain: `inside.evoc.cn`; roles: dns-query\n- domain: `interline.mx`; roles: dns-cname\n- domain: `internal-aol.imap.mail.g03.yahoodns.net`; roles: dns-cname\n- domain: `jsamerica.net`; roles: dns-cname\n- domain: `jumbosprepackers.co.za`; roles: dns-cname\n- domain: `kdn3.futureweb.at`; roles: dns-query\n- domain: `kitchencuisine.com.pk`; roles: dns-query\n- domain: `kopt-eonet-pop.xspmail.jp`; roles: dns-cname\n- domain: `lagranciudad.mx`; roles: dns-cname\n- domain: `loki.aserv.co.za`; roles: dns-query\n- domain: `macquarieoms-syd.chsecure.zone`; roles: dns-query\n- domain: `mail-out.cytanet.com.cy`; roles: dns-query\n- domain: `mail-out.telenet.be`; roles: dns-query\n- domain: `mail.1and1.mx`; roles: dns-query\n- domain: `mail.1und1.de`; roles: dns-query\n- domain: `mail.abdullahbrothers.com.pk`; roles: dns-query\n- domain: `mail.acmeroof.com`; roles: dns-query\n- domain: `mail.acoop-ks.co.jp`; roles: dns-query\n- domain: `mail.actsb.com.my`; roles: dns-query\n- domain: `mail.adomengineering.com`; roles: dns-query\n- domain: `mail.africaonline.co.zw`; roles: dns-query\n- domain: `mail.aguilarenterprisesfl.com`; roles: dns-query\n- domain: `mail.aisairlines.com`; roles: dns-query\n- domain: `mail.alestraune.net.mx`; roles: dns-query\n- domain: `mail.alfredoparedesyasociados.com`; roles: dns-query\n- domain: `mail.alramooz.net`; roles: dns-cname, dns-query\n- domain: `mail.amarujala.com`; roles: dns-query\n- domain: `mail.apotheke-am-roeterberg.de`; roles: dns-query\n- domain: `mail.arcor.de`; roles: dns-query\n- domain: `mail.arcparc.ro`; roles: dns-query\n- domain: `mail.argo.ge`; roles: dns-query\n- domain: `mail.arketipo.com.mx`; roles: dns-query\n- domain: `mail.arnes.si`; roles: dns-query\n- domain: `mail.arptradingbd.com`; roles: dns-query\n- domain: `mail.aseanbalihotel.com`; roles: dns-query\n- domain: `mail.ava.cl`; roles: dns-query\n- domain: `mail.belzonaquebec.com`; roles: dns-query\n- domain: `mail.bfx.vn`; roles: dns-query\n- domain: `mail.bggreenwood.com`; roles: dns-query\n- domain: `mail.blancolaer.co.za`; roles: dns-query\n- domain: `mail.bnf.hu`; roles: dns-query\n- domain: `mail.bopumu.co.za`; roles: dns-query\n- domain: `mail.borsodweb.hu`; roles: dns-query\n- domain: `mail.bssb.de`; roles: dns-query\n- domain: `mail.cable-connection.com`; roles: dns-query\n- domain: `mail.cable-connection.com.netsolmail.net`; roles: dns-cname\n- domain: `mail.cachetbeachcabo.com`; roles: dns-query\n- domain: `mail.calustro.com`; roles: dns-query\n- domain: `mail.cantv.net`; roles: dns-query\n- domain: `mail.capchile.cl`; roles: dns-query\n- domain: `mail.casaflorencio.com.br`; roles: dns-query\n- domain: `mail.casarramona.com`; roles: dns-query\n- domain: `mail.casi.com.ar`; roles: dns-query\n- domain: `mail.centrum.cz`; roles: dns-query\n- domain: `mail.cesky-hosting.cz`; roles: dns-query\n- domain: `mail.chac.vn`; roles: dns-query\n- domain: `mail.chenabgrw.edu.pk`; roles: dns-query\n- domain: `mail.chot.cz`; roles: dns-query\n- domain: `mail.cine-equipment.com`; roles: dns-query\n- domain: `mail.circlekindonesia.com`; roles: dns-query\n- domain: `mail.cityangkorhotel.com`; roles: dns-query\n- domain: `mail.cn.yusen-logistics.com`; roles: dns-query\n- domain: `mail.comcast.net`; roles: dns-query\n- domain: `mail.copeval.cl`; roles: dns-query\n- domain: `mail.countyofindiana.org`; roles: dns-query\n- domain: `mail.cubimsa.com.mx`; roles: dns-query\n- domain: `mail.degollado.gob.mx`; roles: dns-query\n- domain: `mail.demisport.sk`; roles: dns-query\n- domain: `mail.dmfseguros.com.br`; roles: dns-query\n- domain: `mail.dunyakalip.com`; roles: dns-query\n- domain: `mail.dwidayakarya.com`; roles: dns-query\n- domain: `mail.dywit.it`; roles: dns-query\n- domain: `mail.easy-trade.com.ar`; roles: dns-query\n- domain: `mail.easyname.com`; roles: dns-cname\n- domain: `mail.ecovidatrc.cl`; roles: dns-query\n- domain: `mail.eim.ae`; roles: dns-query\n- domain: `mail.ekopraxis.com.ec`; roles: dns-query\n- domain: `mail.emailsrvr.com`; roles: dns-cname\n- domain: `mail.emepamendoza.com`; roles: dns-query\n- domain: `mail.emirates.net.ae`; roles: dns-query\n- domain: `mail.enseigneslandreville.com`; roles: dns-query\n- domain: `mail.esabrasil.com`; roles: dns-query\n- domain: `mail.essve.ee`; roles: dns-query\n- domain: `mail.estelec.es`; roles: dns-query\n- domain: `mail.ethiopiaetravelling.com`; roles: dns-query\n- domain: `mail.eurocertindia.com`; roles: dns-query\n- domain: `mail.eurodesigngroup.net`; roles: dns-query\n- domain: `mail.eurokel.com`; roles: dns-query\n- domain: `mail.exclusivehosting.net`; roles: dns-query\n- domain: `mail.f2slovakia.sk`; roles: dns-query\n- domain: `mail.fedearroz.com.co`; roles: dns-query\n- domain: `mail.feposa.com`; roles: dns-query\n- domain: `mail.ferreteriacalzada.com`; roles: dns-query\n- domain: `mail.fileserver-int.net`; roles: dns-query\n- domain: `mail.finesseincasso.nl`; roles: dns-query\n- domain: `mail.firma.hortim.cz`; roles: dns-query\n- domain: `mail.flowlinevalves.com`; roles: dns-query\n- domain: `mail.fournarakis.gr`; roles: dns-query\n- domain: `mail.galaxysivtek.com`; roles: dns-query\n- domain: `mail.geoecuatoriana.com`; roles: dns-query\n- domain: `mail.glas-weiss.de`; roles: dns-query\n- domain: `mail.glasofenbau-leipzig.de`; roles: dns-query\n- domain: `mail.globalfreight.pk`; roles: dns-query\n- domain: `mail.globetrotter.net`; roles: dns-query\n- domain: `mail.gmail.com`; roles: dns-query\n- domain: `mail.gmx.net`; roles: dns-query\n- domain: `mail.grimescountyso.org`; roles: dns-query\n- domain: `mail.gruporadialcristocentrica.com`; roles: dns-query\n- domain: `mail.hacioglumetalyapi.com`; roles: dns-query\n- domain: `mail.hielooriental.com`; roles: dns-query\n- domain: `mail.hikam.com.mx`; roles: dns-query\n- domain: `mail.hilliarddental.com`; roles: dns-query\n- domain: `mail.hmapumps.com`; roles: dns-query\n- domain: `mail.hosting.gob.do`; roles: dns-query\n- domain: `mail.hotelandros.com`; roles: dns-query\n- domain: `mail.hoteliers.guru`; roles: dns-query\n- domain: `mail.hotelmoskva.rs`; roles: dns-query\n- domain: `mail.hsgroupcal.com`; roles: dns-query\n- domain: `mail.i-miyazawa.com`; roles: dns-query\n- domain: `mail.icd.co.kr`; roles: dns-query\n- domain: `mail.imaginet.co.za`; roles: dns-query\n- domain: `mail.imexpharm.com`; roles: dns-query\n- domain: `mail.infomaniak.ch`; roles: dns-cname\n- domain: `mail.inkote.co.id`; roles: dns-query\n- domain: `mail.interline.mx`; roles: dns-query\n- domain: `mail.ionos.de`; roles: dns-query\n- domain: `mail.ionos.mx`; roles: dns-query\n- domain: `mail.ita.locamail.com.br`; roles: dns-cname\n- domain: `mail.itep.com.ar`; roles: dns-query\n- domain: `mail.itsolutions-asia.com`; roles: dns-cname\n- domain: `mail.ivermedi.com`; roles: dns-query\n- domain: `mail.jsamerica.net`; roles: dns-query\n- domain: `mail.jumbosprepackers.co.za`; roles: dns-query\n- domain: `mail.jurton.sk`; roles: dns-query\n- domain: `mail.kantoushokuken.co.jp`; roles: dns-query\n- domain: `mail.kvadra.hr`; roles: dns-query\n- domain: `mail.lagranciudad.mx`; roles: dns-query\n- domain: `mail.leiyueh.com`; roles: dns-query\n- domain: `mail.lemex-feinkost.com`; roles: dns-query\n- domain: `mail.lentaba.co.za`; roles: dns-query\n- domain: `mail.lestarijayaraya.com`; roles: dns-query\n- domain: `mail.libero.it`; roles: dns-query\n- domain: `mail.lietkabelis.lt`; roles: dns-query\n- domain: `mail.live.com`; roles: dns-query\n- domain: `mail.lojack.com.ar`; roles: dns-query\n- domain: `mail.mail.com`; roles: dns-query\n- domain: `mail.mail.com.np`; roles: dns-query\n- domain: `mail.mail.yahoo.com`; roles: dns-query\n- domain: `mail.maisondelegance.com.py`; roles: dns-query\n- domain: `mail.mangalamyatra.com`; roles: dns-query\n- domain: `mail.masilagroup.com`; roles: dns-query\n- domain: `mail.mawo-elektro.de`; roles: dns-query\n- domain: `mail.messagingengine.com`; roles: dns-query\n- domain: `mail.mgmltda.cl`; roles: dns-query\n- domain: `mail.mi.com.co`; roles: dns-query\n- domain: `mail.michal-plumbohm.de`; roles: dns-query\n- domain: `mail.mtsbiz.net`; roles: dns-query\n- domain: `mail.myaccess.ca`; roles: dns-query\n- domain: `mail.myoffice.lu`; roles: dns-query\n- domain: `mail.nkol.net`; roles: dns-query\n- domain: `mail.nobleconcierge.pl`; roles: dns-query\n- domain: `mail.nominalia.com`; roles: dns-cname\n- domain: `mail.northernnamthaison.com.vn`; roles: dns-query\n- domain: `mail.notariacarreno.com`; roles: dns-query\n- domain: `mail.notariacuadragazmuri.cl`; roles: dns-query\n- domain: `mail.npo-forum.ch`; roles: dns-query\n- domain: `mail.ocn.ne.jp`; roles: dns-query\n- domain: `mail.omkarcomputers.in`; roles: dns-query\n- domain: `mail.one.com`; roles: dns-query\n- domain: `mail.oneeach.com`; roles: dns-query\n- domain: `mail.orcaseed.com`; roles: dns-query\n- domain: `mail.otenet.gr`; roles: dns-query\n- domain: `mail.outlook.com`; roles: dns-query\n- domain: `mail.oxinsanat.com`; roles: dns-query\n- domain: `mail.parcospa.eu`; roles: dns-query\n- domain: `mail.paul-transporte.de`; roles: dns-query\n- domain: `mail.pec.aruba.it`; roles: dns-query\n- domain: `mail.pecc2.com`; roles: dns-query\n- domain: `mail.pella.mx`; roles: dns-query\n- domain: `mail.phhca.com`; roles: dns-query\n- domain: `mail.phhca.com.netsolmail.net`; roles: dns-cname\n- domain: `mail.pizzahut.com.do`; roles: dns-query\n- domain: `mail.plustarget.com.co`; roles: dns-query\n- domain: `mail.pondokindahmall.co.id`; roles: dns-query\n- domain: `mail.porta.net`; roles: dns-query\n- domain: `mail.powerexpress.com.ph`; roles: dns-query\n- domain: `mail.q.com`; roles: dns-query\n- domain: `mail.q.syn-alias.com`; roles: dns-cname\n- domain: `mail.qlc.co.in`; roles: dns-query\n- domain: `mail.quicknet.ch`; roles: dns-query\n- domain: `mail.rakitsolutions.com`; roles: dns-query\n- domain: `mail.rcilogistics.co.in`; roles: dns-query\n- domain: `mail.readyhosting.com`; roles: dns-query\n- domain: `mail.riungmitra.co.id`; roles: dns-query\n- domain: `mail.ronbermudez.com`; roles: dns-query\n- domain: `mail.santurcexray.com`; roles: dns-query\n- domain: `mail.sasktel.net`; roles: dns-query\n- domain: `mail.sbctransportation.com`; roles: dns-query\n- domain: `mail.scaf.cl`; roles: dns-query\n- domain: `mail.scienceworldpublish.com`; roles: dns-query\n- domain: `mail.secureserver.net`; roles: dns-query\n- domain: `mail.securitycontroldesign.com`; roles: dns-query\n- domain: `mail.seek4.dk`; roles: dns-query\n- domain: `mail.sepauc.cl`; roles: dns-query\n- domain: `mail.server301.com`; roles: dns-query\n- domain: `mail.servitarsa.com.gt`; roles: dns-query\n- domain: `mail.sheratonparco.com`; roles: dns-query\n- domain: `mail.shinseng.co.kr`; roles: dns-query\n- domain: `mail.sigis.com.ve`; roles: dns-query\n- domain: `mail.siol.net`; roles: dns-query\n- domain: `mail.siprocimeca.com`; roles: dns-query\n- domain: `mail.sisacsa.com`; roles: dns-query\n- domain: `mail.skywaygrainsystems.com`; roles: dns-query\n- domain: `mail.smartcloudpt.pt`; roles: dns-query\n- domain: `mail.sng.com.ec`; roles: dns-query\n- domain: `mail.soal.com.mx`; roles: dns-query\n- domain: `mail.stackmail.com`; roles: dns-cname\n- domain: `mail.stoneworx.com`; roles: dns-query\n- domain: `mail.strato.de`; roles: dns-query\n- domain: `mail.stsmail.ro`; roles: dns-query\n- domain: `mail.stylecraftltd.com`; roles: dns-query\n- domain: `mail.t-com.sk`; roles: dns-query\n- domain: `mail.t-email.hu`; roles: dns-query\n- domain: `mail.t-online.hu`; roles: dns-cname, dns-query\n- domain: `mail.tctwest.net`; roles: dns-query\n- domain: `mail.tds.net`; roles: dns-query\n- domain: `mail.techosindustriales.com.mx`; roles: dns-query\n- domain: `mail.tele2.ee`; roles: dns-query\n- domain: `mail.telekom.sk`; roles: dns-query\n- domain: `mail.telstra.com`; roles: dns-query\n- domain: `mail.terraplan.si`; roles: dns-query\n- domain: `mail.texasfirecraft.com`; roles: dns-query\n- domain: `mail.texasfirecraft.com.netsolmail.net`; roles: dns-cname\n- domain: `mail.thiemer.at`; roles: dns-query\n- domain: `mail.tlcmedicalsas.com`; roles: dns-query\n- domain: `mail.topsoiledmonton.com`; roles: dns-query\n- domain: `mail.toyotatownship.com`; roles: dns-query\n- domain: `mail.tremcar.com`; roles: dns-query\n- domain: `mail.triplestarpackaging.com`; roles: dns-query\n- domain: `mail.tudogar.com.mx`; roles: dns-query\n- domain: `mail.twc.com`; roles: dns-query\n- domain: `mail.ucil.com.pk`; roles: dns-query\n- domain: `mail.unidentas.lt`; roles: dns-query\n- domain: `mail.upcbusiness.at`; roles: dns-cname\n- domain: `mail.verizon.net`; roles: dns-query\n- domain: `mail.vietsuncorp.com.vn`; roles: dns-query\n- domain: `mail.vnptmail.vn`; roles: dns-query\n- domain: `mail.washingtonandwells.net`; roles: dns-query\n- domain: `mail.webmail.co.za`; roles: dns-query\n- domain: `mail.wildrepublic.com`; roles: dns-query\n- domain: `mail.xpertcomex.cl`; roles: dns-query\n- domain: `mail.yandex.com`; roles: dns-query\n- domain: `mail.yandex.com.tr`; roles: dns-query\n- domain: `mail.yemen.net.ye`; roles: dns-query\n- domain: `mail.yorkdaledufferinmazda.ca`; roles: dns-query\n- domain: `mail.zahnandmore.ch`; roles: dns-query\n- domain: `mail.zwirgi.ch`; roles: dns-query\n- domain: `mail1.circlekindo.com`; roles: dns-cname\n- domain: `mail1.jramoncorp.com`; roles: dns-query\n- domain: `mail1.qlc.co.in`; roles: dns-cname\n- domain: `mail11.hostmaster.sk`; roles: dns-cname\n- domain: `mail2.medigroup.rs`; roles: dns-query\n- domain: `mail3.armstrong.syn-alias.com`; roles: dns-cname\n- domain: `mail3.bigcommerce.com`; roles: dns-query\n- domain: `mail7.hostmaster.sk`; roles: dns-cname\n- domain: `mailbox.ischl.net`; roles: dns-cname\n- domain: `mailgate.kkp.gr`; roles: dns-query\n- domain: `mailgate.otenet.gr`; roles: dns-query\n- domain: `mailgate.shopkeeper.de`; roles: dns-query\n- domain: `mailhost.hetnet.nl`; roles: dns-query\n- domain: `mailout.hl-c.eu`; roles: dns-query\n- domain: `mailout.sssnet.com`; roles: dns-query\n- domain: `mailserver.naic.edu`; roles: dns-query\n- domain: `mailv.emirates.net.ae`; roles: dns-query\n- domain: `maisondelegance.com.py`; roles: dns-cname\n- domain: `masilagroup.com`; roles: dns-cname\n- domain: `max-schoen.home.pl`; roles: dns-query\n- domain: `mbox.cert.legalmail.it`; roles: dns-query\n- domain: `mgmltda.cl`; roles: dns-cname\n- domain: `mongo.planethoster.net`; roles: dns-query\n- domain: `ms1.isat.co.za`; roles: dns-cname\n- domain: `msa.m.dion.ne.jp`; roles: dns-query\n- domain: `mx.em-it.at`; roles: dns-query\n- domain: `mx.freenet.de`; roles: dns-query\n- domain: `mx.sharpness.info`; roles: dns-query\n- domain: `mx1.domainadmin.eu`; roles: dns-query\n- domain: `mx1.trustlab.cz`; roles: dns-query\n- domain: `newsaarctech.com`; roles: dns-query, http-host\n- domain: `nexus.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: tls-sni\n- domain: `notaria9acapulco.com`; roles: dns-query\n- domain: `notariacuadragazmuri.cl`; roles: dns-cname\n- domain: `notes.damc.or.kr`; roles: dns-query\n- domain: `ns0.ovh.net`; roles: dns-cname\n- domain: `office15client.microsoft.com`; roles: dns-query\n- domain: `omkarcomputers.in`; roles: dns-cname\n- domain: `out.alice.it`; roles: dns-query\n- domain: `out.aliceposta.it`; roles: dns-cname\n- domain: `out.smtp.cz`; roles: dns-query\n- domain: `outmail.is.lt`; roles: dns-query\n- domain: `p04-imap.mail.me.com`; roles: dns-query\n- domain: `p16-smtp.mail.me.com`; roles: dns-query\n- domain: `p22-imap.mail.me.com`; roles: dns-query\n- domain: `p3plcpnl0106.prod.phx3.secureserver.net`; roles: dns-query\n- domain: `p3plcpnl021.prod.phx3.secureserver.net`; roles: dns-query\n- domain: `p47-imap.mail.me.com`; roles: dns-query\n- domain: `paragonknits.com`; roles: dns-query\n- domain: `pasts.ts.gov.lv`; roles: dns-query\n- domain: `peach.mail.plala.or.jp`; roles: dns-query\n- domain: `pl-07.webmail.emailsrvr.com`; roles: dns-cname\n- domain: `plustarget.com.co`; roles: dns-cname\n- domain: `pmaila.emirates.net.ae`; roles: dns-cname\n- domain: `poczta.maxtel.com.pl`; roles: dns-query\n- domain: `poczta.tech-media.pl`; roles: dns-query\n- domain: `poczta.webio.pl`; roles: dns-query\n- domain: `pondokindahmall.co.id`; roles: dns-cname\n- domain: `pop-aliant.owm.bell.net`; roles: dns-cname\n- domain: `pop-ha.skymail.net.br`; roles: dns-cname\n- domain: `pop-verizonmail.egslb.aol.com`; roles: dns-cname\n- domain: `pop.1and1.co.uk`; roles: dns-query\n- domain: `pop.1and1.com`; roles: dns-query\n- domain: `pop.1und1.de`; roles: dns-query\n- domain: `pop.africaonline.com.na`; roles: dns-query\n- domain: `pop.alestra.pangia.biz`; roles: dns-cname\n- domain: `pop.alestraune.net.mx`; roles: dns-query\n- domain: `pop.alpha-prm.jp`; roles: dns-query\n- domain: `pop.alramooz.net`; roles: dns-query\n- domain: `pop.altajuris.com`; roles: dns-query\n- domain: `pop.asia.secureserver.net`; roles: dns-query\n- domain: `pop.att.yahoo.com`; roles: dns-query\n- domain: `pop.bellaliant.net`; roles: dns-query\n- domain: `pop.bellnet.ca`; roles: dns-cname, dns-query\n- domain: `pop.biz.rr.com`; roles: dns-query\n- domain: `pop.broserimmo.com`; roles: dns-query\n- domain: `pop.crcollision.com`; roles: dns-query\n- domain: `pop.earthlink.net`; roles: dns-query\n- domain: `pop.earthlinkbusiness.com`; roles: dns-cname\n- domain: `pop.eastav.com`; roles: dns-query\n- domain: `pop.easyname.com`; roles: dns-query\n- domain: `pop.emailsrvr.com`; roles: dns-query\n- domain: `pop.eonet.ne.jp`; roles: dns-query\n- domain: `pop.exchangeadministrado.com`; roles: dns-query\n- domain: `pop.fecamsc.org.br`; roles: dns-query\n- domain: `pop.fibertel.com.ar`; roles: dns-cname\n- domain: `pop.gmail.com`; roles: dns-query\n- domain: `pop.infinitummail.com`; roles: dns-query\n- domain: `pop.infinitummail.mail2world.com`; roles: dns-cname\n- domain: `pop.infovia.com.ar`; roles: dns-query\n- domain: `pop.itsolutions-asia.com`; roles: dns-query\n- domain: `pop.mail.g.yahoo.co.jp`; roles: dns-cname\n- domain: `pop.mail.yahoo.co.jp`; roles: dns-query\n- domain: `pop.nbflogistica.com.br`; roles: dns-query\n- domain: `pop.net4india.com`; roles: dns-query\n- domain: `pop.one.com`; roles: dns-query\n- domain: `pop.oxfordal.us`; roles: dns-query\n- domain: `pop.poncacityhousingauthority.com`; roles: dns-query\n- domain: `pop.prodigy.net.mx`; roles: dns-query\n- domain: `pop.prosites.com`; roles: dns-query\n- domain: `pop.rediffmailpro.com`; roles: dns-query\n- domain: `pop.sbcglobal.yahoo.com`; roles: dns-query\n- domain: `pop.securemail.pro`; roles: dns-query\n- domain: `pop.secureserver.net`; roles: dns-query\n- domain: `pop.serviciodecorreo.es`; roles: dns-query\n- domain: `pop.sofimex.com.mx`; roles: dns-query\n- domain: `pop.sonic.net`; roles: dns-query\n- domain: `pop.speedy.com.ar`; roles: dns-query\n- domain: `pop.sunbeltcustommineral.com`; roles: dns-query\n- domain: `pop.super.net.pk`; roles: dns-query\n- domain: `pop.yandex.com.tr`; roles: dns-query\n- domain: `pop.zoho.com`; roles: dns-query\n- domain: `pop3.anticorrosiva.com.ar`; roles: dns-query\n- domain: `pop3.arnet.com.ar`; roles: dns-query\n- domain: `pop3.ciudad.com.ar`; roles: dns-query\n- domain: `pop3.dimarasalud.com`; roles: dns-query\n- domain: `pop3.enet.cu`; roles: dns-query\n- domain: `pop3.fibertel.com.ar`; roles: dns-query\n- domain: `pop3.forpsi.com`; roles: dns-query\n- domain: `pop3.frontier.com`; roles: dns-query\n- domain: `pop3.guidoguidi.com.ar`; roles: dns-query\n- domain: `pop3.iq.pl`; roles: dns-query\n- domain: `pop3.isat.co.za`; roles: dns-query\n- domain: `pop3.iso3.it`; roles: dns-query\n- domain: `pop3.mailprotect.be`; roles: dns-query\n- domain: `pop3.massalud.com.ar`; roles: dns-query\n- domain: `pop3.mweb.co.za`; roles: dns-query\n- domain: `pop3.netcologne.de`; roles: dns-query\n- domain: `pop3.pldauto.fr`; roles: dns-query\n- domain: `pop3.siasaweb.com.ar`; roles: dns-query\n- domain: `pop3.smartcloudpt.pt`; roles: dns-query\n- domain: `pop3.telkomsa.net`; roles: dns-query\n- domain: `pop3.tintasultramix.com.br`; roles: dns-query\n- domain: `pop3.utande.co.zw`; roles: dns-cname\n- domain: `pop3.webmail.mw`; roles: dns-query\n- domain: `pop3.world4you.com`; roles: dns-query\n- domain: `pop3.yoafrica.com`; roles: dns-query\n- domain: `pop3.zoominternet.net`; roles: dns-query\n- domain: `pop51.on.aibn.com`; roles: dns-query\n- domain: `poplar.ocn.ne.jp`; roles: dns-query\n- domain: `poppro.zoho.com`; roles: dns-query\n- domain: `post.strato.de`; roles: dns-query\n- domain: `prod-w.nexus.live.com.akadns.net`; roles: dns-cname\n- domain: `q1.epropiadns.com`; roles: dns-query\n- domain: `radiadoreslider.com`; roles: dns-cname\n- domain: `rakitsolutions.com`; roles: dns-cname\n- domain: `relais.videotron.ca`; roles: dns-query\n- domain: `relay.edpnet.be`; roles: dns-query\n- domain: `relay.glb.proximus.be`; roles: dns-cname\n- domain: `riungmitra.co.id`; roles: dns-cname\n- domain: `rkrisltx.bpiwd.com`; roles: dns-query\n- domain: `roaming.iskon.hr`; roles: dns-query\n- domain: `schindler-kg.at`; roles: dns-query\n- domain: `secure.bst-system.com`; roles: dns-cname\n- domain: `secure.emailsrvr.com`; roles: dns-query\n- domain: `securepop.t-online.de`; roles: dns-query\n- exported object `sSTToaEwCG5VASw`; SHA-256 `0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a`; size 4334 bytes\n- exported object `object52357`; SHA-256 `2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38`; size 1523 bytes\n- exported object `object15143`; SHA-256 `43a258e943f8cd5728ccf1018a03865b61c37dfed7f48995afe4ffd47b6cb8b7`; size 1523 bytes\n- exported object `object30893`; SHA-256 `0b2e930d209670f78f6aaa3f2d19fd749c38c7bc223d2f6325df6b9f7614b5ff`; size 1442 bytes\n- exported object `object53515`; SHA-256 `0cf2273cfb4ed1bc7051f653b37843c2fb2209d2bc95d5a38e4c8b76a97e3dac`; size 1442 bytes\n- exported object `object46438`; SHA-256 `245afb556ba5bd1d4eff3e45c51f83f18ebdedefe744a7cd668a720ac0be841e`; size 1442 bytes\n- exported object `object15275`; SHA-256 `250d82db6d12fbc6a4f93c9be1cfc6d819cb4f6d6e0d66648b2c66286d1e0c5f`; size 1442 bytes\n- exported object `object32536`; SHA-256 `26ec6c18d689cdab1e882b3e5c40454fdde105b4dad784fc0b70ec34f33a685d`; size 1442 bytes\n- exported object `object22887`; SHA-256 `2b5cd53248ff8bc195e931ea07c8ec7a6a6d4c9c3b3e326b3af21ca6d2e396a3`; size 1442 bytes\n- exported object `object31033`; SHA-256 `32f3a788a007aded055b0c3f1596e75876843afc5f7e2562ffb2a981954bc5b9`; size 1442 bytes\n- exported object `object53575`; SHA-256 `33bf9ccf421e4074ef459928e02242cc1e678da63061f3c4fdbd77aaa5a5c899`; size 1442 bytes\n- exported object `object52709`; SHA-256 `34efa567764f17e790931c8a0bd8c00126acab0e76f53a9847f674c0c4eaad95`; size 1442 bytes\n- exported object `object49925`; SHA-256 `367912ca5e87e14e40985a68eab3831fcc2cf94405a80442f4d2440ade4e434d`; size 1442 bytes\n- exported object `object54034`; SHA-256 `38cbe5f6f1edafbf65fcb5fbe27f69c8d2de10fa41e05f8162bc0091bdd0082c`; size 1442 bytes\n- exported object `object54392`; SHA-256 `398d8ab91648e39ce8559875ceffc4a8724e4259089bbe99a8ab871bd8cd510a`; size 1442 bytes\n- exported object `object29937`; SHA-256 `465a2843237e39fd98af179ad65eb4f108513067d1c969bbeaa1c2cfccb26e5c`; size 1442 bytes\n- exported object `object52814`; SHA-256 `4724352878e31617bd51e7499dd320a9f3d0c759ae4768ae31acd2612ece99b2`; size 1442 bytes\n- exported object `object51834`; SHA-256 `473e9d4a177530efe3f1ed28ec3fdfe042a999f93ee3ea6cfb5f0fbf1509eb3d`; size 1442 bytes\n- exported object `object53351`; SHA-256 `4db16bca2fd7324cdc66d241e0b3e950e153bb9534e60c1160d1ba0e9c18d083`; size 1442 bytes\n- exported object `object32196`; SHA-256 `4ed21b81e706b20773e4f3c10dbe7fb015dbce15aa429db06f93d804a4e0ff62`; size 1442 bytes\n- exported object `object31009`; SHA-256 `4f56fad91f1644a4257195137fcf8f6e821e3ea3ea96e165daf57e529fe521ff`; size 1442 bytes\n- exported object `object52046`; SHA-256 `4fa3add17dca31bdfb61917c627b2ec9fff3716ed0eee78d31ca10bce3b5ad7b`; size 1442 bytes\n- exported object `object54214`; SHA-256 `51ada0d3e87516cded91d77b86d32a08bfedd96cf5b5e3fddd084fe61d5d7a21`; size 1442 bytes\n- exported object `object32123`; SHA-256 `526ba4dd3baed534f591d3b8f53cc2268d8e11d3ac3961fdeec21e8bb6078063`; size 1442 bytes\n- exported object `object52334`; SHA-256 `53bbc8b15e8f03691544144a2b45d417d5c5d840b1f779624afcc479d8fa8813`; size 1442 bytes\n- exported object `object32989`; SHA-256 `56d9a87699b652053de95016b18a677a850b948d1f0061aeef3951f9cbecd2ac`; size 1442 bytes\n- exported object `object30399`; SHA-256 `57865023300c0ed7bcc2e312f58b481635f5efa0ee8750a39da4838b25dbed10`; size 1442 bytes\n- exported object `object22862`; SHA-256 `5b43f9a38fc4125cd084c915a715fd8080bd829e34406729e73ac02b6d80b288`; size 1442 bytes\n- exported object `object33448`; SHA-256 `5f3061cb3b17856f18adaefd99f3960482f2474c1f0191de970a7cac0444260d`; size 1442 bytes\n- exported object `object30376`; SHA-256 `61fb009bf5c563ebd3f2334446057d1013f68f052fb08f48a297bb2edb57f71b`; size 1442 bytes\n- exported object `object52180`; SHA-256 `63137c9e2fdc28ddaec8c99e9df36eab9d63a2129438ae0921f9827defc3806d`; size 1442 bytes\n- exported object `object18811`; SHA-256 `6956751df0c5ab706d011b2746a3709835f56e2d620a8775133f79362c4e1bda`; size 1442 bytes\n- exported object `object30761`; SHA-256 `6b659e04d03b4c6abeb9fc4d31d4d4442801e0a6c5e06d56f62fe49d915e8a0e`; size 1442 bytes\n- exported object `object18745`; SHA-256 `7038bd0d004e61fbdd451623d51c217ffda4fb2723975dbc02a1b10fa121ff26`; size 1442 bytes\n- exported object `object31121`; SHA-256 `7e08110ab733043f314cb23d05ca5fc0bd4beb2de9c33e6ab35836a6eb0a00a5`; size 1442 bytes\n- exported object `object18619`; SHA-256 `82391338f3ede30f52a646fc558a4c20beba5db70ef26d1e7f1c63b11970ab67`; size 1442 bytes\n- exported object `object29113`; SHA-256 `88f42f2c65bfe60c6395328f200ed242f0cf3dded1c22a3cd07204d56525bf28`; size 1442 bytes\n- exported object `object54190`; SHA-256 `8ff8d44a63e43c9aea1d597f0a101445df8d6679df657c92c0d6faeb07245422`; size 1442 bytes\n- exported object `object33388`; SHA-256 `93e83129d829e059611c03fb9536529c7581e94017a8a247d0764df0c0889791`; size 1442 bytes\n- exported object `object53376`; SHA-256 `93e914a6facbc2481df7473c52459dbb24ca163e4510445893fd03ebc444480b`; size 1442 bytes\n- exported object `object32566`; SHA-256 `971fa77239886aaf06e6f65eca0a607cc8ada189aaca1f69eb9f894c0deb4a96`; size 1442 bytes\n- exported object `object53160`; SHA-256 `9f6d91ccc16d4a26cf0fe623bc1ef1a597d983f166826ba47e6434910d1c3336`; size 1442 bytes\n- exported object `object53916`; SHA-256 `9ff868e0d2918a01a1f6c8a72cbed18403b8f66d25ccf0d19acad8ca7bb6986d`; size 1442 bytes\n- exported object `object53672`; SHA-256 `a6f76feb3a4d155ed886c5dbc9980941ec147872aa7a8b89abea415216fb972f`; size 1442 bytes\n- exported object `object31505`; SHA-256 `a7ea74281391750b02cfcb614469e8f355443ee33290f512b27b6a6c50f84622`; size 1442 bytes\n- exported object `object23504`; SHA-256 `b947d88ec74e3504f3b45342741c224d51d504af8368c7fae4841310def2bfe1`; size 1442 bytes\n- exported object `object51765`; SHA-256 `b982edb41289eb8e2a0be5c14616d9522142daa952415f0d0c96deef2eefeda5`; size 1442 bytes\n- exported object `object31261`; SHA-256 `bb8d070ab43578233d89a2400c7c434f3ee15dc8c76ce5456e265cd68613a7f9`; size 1442 bytes\n- exported object `object52500`; SHA-256 `cc2d680db9b64012df081755faba4281f0a482b1efe5c0d45cccbf44e1146cf2`; size 1442 bytes\n- exported object `object23724`; SHA-256 `ce7336e46e69697b00c496073012548a733921e8b584e241053b38a086040f6a`; size 1442 bytes\n- exported object `object44224`; SHA-256 `cf9b3de8917fbd7b627d4f0a32f4ab067c0d4a047ca87bf2dd7c1c0fa5977c53`; size 1442 bytes\n- exported object `object33492`; SHA-256 `d1e9ccf86eb1e1e97645ea5bd8b2fe203903501273bdafe211aaaf43a050e42f`; size 1442 bytes\n- exported object `object22839`; SHA-256 `d4109a6ae38b5f386c33b725308bc7b9ba01c0f7fb177b3edbbee1d5d5c203b9`; size 1442 bytes\n- exported object `object53810`; SHA-256 `d4d48dea91cd0ebb930092dfd4d693f5eac915fdab0c53040ed9277d30aff980`; size 1442 bytes\n- exported object `object51812`; SHA-256 `ea356b9fe5e4cd10ff16783e8f0d9a36054b1e8650e02253d7fd5d05b71a5146`; size 1442 bytes\n- exported object `object30029`; SHA-256 `ef772f43958315122fc750cb52a6c8f60362283e68c2a1ac449ec41cf1b0f561`; size 1442 bytes\n- exported object `object52203`; SHA-256 `effad7b3021800a4d426f10291186b533f0a6434fc1bfc91be07361faa78b663`; size 1442 bytes\n- exported object `object52909`; SHA-256 `f3f4bd16d2dccbdcb3c378e8cbcf5fc3fdbe1750da5c411c408d6c695f3c2374`; size 1442 bytes\n- exported object `object29136`; SHA-256 `f938fc5c9098e2f06b104998f23d8c691e23465d50b7bd7549112751e9c75e6f`; size 1442 bytes\n- exported object `object53486`; SHA-256 `fe07c43edc7a3842e06bfd354f506e86a7dcb13689a4be3b94843d6fe655fa28`; size 1442 bytes\n- exported object `object33144`; SHA-256 `fe6e39f569582b37f300c2d258a4440dd6473e89e44e2f1c05219020e56d7c6f`; size 1442 bytes\n- exported object `object54319`; SHA-256 `fe796664efee221a3b7427e112e3e816629ddfc20433bb3fc032f31a7652bec7`; size 1442 bytes\n- exported object `object30496`; SHA-256 `0012aa801678ae49c2d6e962920c3f912672e7deabd1338b08f786e71f91e911`; size 1361 bytes\n- exported object `object49973`; SHA-256 `00572b8a56fba936d13eb443442624bbd01a0f8c9c676a8428f5c14c78b3dee9`; size 1361 bytes\n- exported object `object15513`; SHA-256 `006623b67391b15bdc7f15ea38951f72b3f0bc2aef1279f5e2ef4c49fdceb61f`; size 1361 bytes\n- exported object `object32910`; SHA-256 `0072d405aa5414a5aa300a5dbc908c12b181988c74010c4fb5f12c19b55b075e`; size 1361 bytes\n- exported object `object34020`; SHA-256 `00a17cac5a3fd69a5b23dc5387136fe283d71d9c9088288ab31370542c493c5c`; size 1361 bytes\n- exported object `object31492`; SHA-256 `00dc31d414c0738b0d71cdbfca06346612a337a8bb93f48191e7743acfadfc23`; size 1361 bytes\n- exported object `object15587`; SHA-256 `00dd56a10881d0d22c2c6d6666f7227317cbd5c53342ef99cb4ccbde46d1513f`; size 1361 bytes\n- exported object `object51603`; SHA-256 `00f88c0a50b5db8457f302b996f10e6e213aa415bd35764e878af92d1d98dbeb`; size 1361 bytes\n- exported object `object33178`; SHA-256 `0104013328f4d3f2b6f57f798cb6a327940aaef2f390131951ad1159de6bc6bd`; size 1361 bytes\n- exported object `object49985`; SHA-256 `012ef80f044aeac2bb3b458fd60b94c7cf05aa792a99b3ed90874652418d3c2b`; size 1361 bytes\n- exported object `object46287`; SHA-256 `013362d5b3634cb0e8991a6b1516aeb4da26196fb07776f2de19aed375f506f0`; size 1361 bytes\n- exported object `object30974`; SHA-256 `0157f5d604041e48cd6e91b973c8b610189a7b5c180845a55413c8663235af64`; size 1361 bytes\n- exported object `object16659`; SHA-256 `01883ea44373de2ba27f0b322e6ee9e150f51a1a1f9ebb1c8990c55fb5ffb500`; size 1361 bytes\n- exported object `object53163`; SHA-256 `01a99e3f02848b519b3c3a036af0d26363b9c38ef8bb162144100367c3ef68ea`; size 1361 bytes\n- exported object `object13108`; SHA-256 `01ab3d222b25628cb40111921527735ae76c39fa4cec77784dc7a21da51f7fde`; size 1361 bytes\n- exported object `object30260`; SHA-256 `01c6989be26c5296352274615da5427b35ebeb8fab60e3677716ba8ddde9f580`; size 1361 bytes\n- exported object `object15539`; SHA-256 `025a33285a9207330b494981bdf5276647b94d41e022225c8ae671f1ae60567e`; size 1361 bytes\n- exported object `object51887`; SHA-256 `029046b4eb0c08411ed9b3201220c86a89b6fc2e776711595914c4b8414c6694`; size 1361 bytes\n- exported object `object32028`; SHA-256 `02b9310a633169e1e199f3129745cedef8be1886bbd63ef55a95f2419b4e810e`; size 1361 bytes\n- exported object `object33440`; SHA-256 `0332d0cbae4950c24bc6619fbbe1465c57e6c8e12040586494a35619b28fd122`; size 1361 bytes\n- exported object `object29431`; SHA-256 `03a354f9de7d86876f7d23695b1a1d7f3466b0982462e542e80bd53a41e6850c`; size 1361 bytes\n- exported object `object52325`; SHA-256 `03b590abb054b607f92d48b851f88ccf57fd51bf17becbf5fcdec2926388df8d`; size 1361 bytes\n- exported object `object49964`; SHA-256 `03b6d46d7cceeed3b05bd04e02f2794a603fafccad5eeb88e2dc7bcaf8ff91a8`; size 1361 bytes\n- exported object `object15112`; SHA-256 `03c8e8681de20f44fca121de3691c487d7d6fef3fadfc37e5cfb9f11907beb0f`; size 1361 bytes\n- exported object `object54199`; SHA-256 `03d054646bce2a15c17a2b9f1e6abcff498d5b4dbd8555396e5a11584358431c`; size 1361 bytes\n- exported object `object48073`; SHA-256 `03d8eade1fbf830407059b3531802fd500b60ae267cd77612ef2ef1bf5370c75`; size 1361 bytes\n- exported object `object23580`; SHA-256 `03da014864a4f3e63c1840a57a7a41d260779e9e4783b7439a2ffe91d0564f6d`; size 1361 bytes\n- exported object `object23495`; SHA-256 `0405bac83ab8c5f11913dbb716075cae23e482c66d88a28c099dcdbd145b6dcb`; size 1361 bytes\n- exported object `object32055`; SHA-256 `041467a3bee037373a1c5a5c745e243c91b3e23b85e96ea6c92c14402cd6003f`; size 1361 bytes\n- exported object `object54018`; SHA-256 `04156590b6fd4be0762d5f6b5b3ad92b3bcd2981945ee402948dc837e7e5e979`; size 1361 bytes\n- exported object `object33152`; SHA-256 `041952257a132d2b4338692650357096c8f6bf6d1300a37429d7d532da0941b1`; size 1361 bytes\n- exported object `object33684`; SHA-256 `045281fc55e6d6578fac3b7cd59d914d0c004dee44a5747807687b02f2c6bf95`; size 1361 bytes\n- exported object `object13177`; SHA-256 `0483ba73e19d23352009800bc48ad89b9366572500a60a67019383755995017a`; size 1361 bytes\n- exported object `object53140`; SHA-256 `04c196337ac9e4ea59491ebe0161ba1fea2df8cf008da680d61f91b44381735d`; size 1361 bytes\n- exported object `object32627`; SHA-256 `04f84c9cb8a90f08af403970bc08bc44833a198ede19dae2337fbcccfd173796`; size 1361 bytes\n- exported object `object52923`; SHA-256 `04ff3f7973ed0862d3a40581b6f2f57ecf11b2443ff09ddc4d8d472d1b6ece4b`; size 1361 bytes\n- exported object `object30319`; SHA-256 `053e49637cadeb1904e14922390d3973ee989c9e6b4e923d0fda878343c3bf3e`; size 1361 bytes\n- exported object `object28909`; SHA-256 `054a254feaca85b72805a88f8a8aa75ce34a8f3ad73c8319bc636a2cf4341761`; size 1361 bytes\n- exported object `object32769`; SHA-256 `05611c6f6bfec60af30c517f092b00a88c284a90a26948d1ee7d620b2ddce5f1`; size 1361 bytes\n- exported object `object30947`; SHA-256 `05a65a61ec1885e2778d455dcda107c65247dabfa4ec60bbc75191d8b2e0b4c3`; size 1361 bytes\n- exported object `object52062`; SHA-256 `05be44dc237edf7e9d54e1865748bd2cc593134f43aecb64d5eb28bfed0fa01a`; size 1361 bytes\n- exported object `object29597`; SHA-256 `05c3667639fd25b51fff051b8d6ede5c730d927a542feb13135a04e4b3a8f265`; size 1361 bytes\n- exported object `object52912`; SHA-256 `05fc4007dd365609c4dd7b73cd625397355e410662f0622ba7e60301585739a2`; size 1361 bytes\n- exported object `object43929`; SHA-256 `0608f7fa7485e032a5a0fe8848bd690875aedda49ce9d6c1188aad65dc642680`; size 1361 bytes\n- exported object `object29573`; SHA-256 `0629069e5ebb927dd394772027e3e9cbd1532733afff3ea7273985ce231de7c5`; size 1361 bytes\n- exported object `object50037`; SHA-256 `0662465237674f31f5d26e21fe3123bedd4d01c4f1caa2591fb30d595a4b8b2a`; size 1361 bytes\n- exported object `object33317`; SHA-256 `067c37a96ba039a4de134e74e71d06b952812e176303689238ac013788cbc1ae`; size 1361 bytes\n- exported object `object34457`; SHA-256 `067fb5afeff836328b32d1f4210a6fa495554fd83df4b9501698cfef030fffae`; size 1361 bytes\n- exported object `object33502`; SHA-256 `06a3a1aab53a94e085ada9bcd92958b43b1c8e8572ee1480ee37df584f81dca7`; size 1361 bytes\n- exported object `object44077`; SHA-256 `0711a06d485902ad60e6a04a1893529e2b9865d44e91fde009e4457ca61825b5`; size 1361 bytes\n- exported object `object48012`; SHA-256 `071a5da339b1d1596cb8481499412c20de3114d5600398be06f5a2b1cd43d778`; size 1361 bytes\n- exported object `object23516`; SHA-256 `071d2002e64f4e65d93a52b1697093392b76ab11cf2a753867370d454da56a29`; size 1361 bytes\n- exported object `object31703`; SHA-256 `0747ae71c073eb86e0e5afc4b6f7b3785624b4139c0f1e08402142c4c1e458c3`; size 1361 bytes\n- exported object `object29413`; SHA-256 `0776e5afb1e90077bf644e994228c9cf06699d7e3cf71e68d67f08a79bd4b27c`; size 1361 bytes\n- exported object `object13209`; SHA-256 `0796454cd492f8133c920ae565d235b5cd34b21a4e05dca423a21e104d6f812e`; size 1361 bytes\n- exported object `object52387`; SHA-256 `07dd2f025b05a1339e661fa39a58aa6e2237ae30462e2a67e3dbf579979be568`; size 1361 bytes\n- exported object `object22661`; SHA-256 `07f256bae45201651cdd122f4d3f656e63069206e59f22d609f3a5e60ae9c232`; size 1361 bytes\n- exported object `object22815`; SHA-256 `083d2a4e9eca6ceddf634735ff1702e41018e1e0e177715ab03b00885999aede`; size 1361 bytes\n- exported object `object29955`; SHA-256 `08abe123c978232970cc565c513c9f8215d99d322cd2085a7e149a22f34c2d23`; size 1361 bytes\n- exported object `object29631`; SHA-256 `0903b6b8edc761ef3ba9d7ccc93e479e7c84fd5942bc46ab77a135c175aad715`; size 1361 bytes\n- exported object `object33393`; SHA-256 `092105ddf74cbb404dc763472e8e336980a75b3266fc71ab6cd5872590933024`; size 1361 bytes\n- exported object `object46400`; SHA-256 `094bba08127b66e3097bcbcf2e119a0b31624c578a51b392649ab146419274e8`; size 1361 bytes\n- exported object `object15603`; SHA-256 `097b0737527b8d5a604fd600b050827353ca1fd75de5aad95c0108da1ade342d`; size 1361 bytes\n- exported object `object15086`; SHA-256 `09e40529169ae90908609819469ea3ac9c086a9434a10c65ef753cdf99e29b74`; size 1361 bytes\n- exported object `object54462`; SHA-256 `0a0886e7aa6ff36d13816a445a02e5b3882f91105a7efd72fc1058b03e63d800`; size 1361 bytes\n- exported object `object29728`; SHA-256 `0a6d89fa6a8ed133ab9f9aec883513e25118c9715c1dadb77b5ed2dd39987988`; size 1361 bytes\n- exported object `object21825`; SHA-256 `0acc8bad510081dc93c8ac019cc283594256dafd20553eea64d0fff666ee630a`; size 1361 bytes\n- exported object `object30860`; SHA-256 `0ade63619d6d528e5ab89494f642cbf1c0148623e3dfeaf77e9a0fbb440299b2`; size 1361 bytes\n- exported object `object21909`; SHA-256 `0ae794ee1d89e5b3cce28e650cfc3c3e24acdd8e4d95e2f9da1607b8de4e97f7`; size 1361 bytes\n- exported object `object47902`; SHA-256 `0b0e34b03f2958d9714ae2b515f2b3bae39c102e255e2c793ffe5037388409bc`; size 1361 bytes\n- exported object `object11543`; SHA-256 `0b2631d837c93672d27c18cba5275de75364c435ff4916da5dd46946db61a1dc`; size 1361 bytes\n- exported object `object47906`; SHA-256 `0b30ef8d01ba40ab5b8586ef39476b1c4db51d8a95f4d2b56dbdd6b5d6d74475`; size 1361 bytes\n- exported object `object52344`; SHA-256 `0b43402fb6e8725c7f8dcd581cd653543fb04c4e87a69c533c7cf39adec6f9a2`; size 1361 bytes\n- exported object `object31012`; SHA-256 `0b4e47d118b34afd6fb3b14b0af17ed2c7abf41835d2ed2715df684ea8d6ffd8`; size 1361 bytes\n- exported object `object31520`; SHA-256 `0b8db45a74f8225b297dba01ffbfe9223cfe5ff96717b33cdee3c7d7952d0c0b`; size 1361 bytes\n- exported object `object15133`; SHA-256 `0bb0f8bb74e2ed6b391ac01b767211179370df14e7a3cd9b6a3c734e10abaa7d`; size 1361 bytes\n- exported object `object33736`; SHA-256 `0be2658fdf946e5f974ca5bd4d3aadbf0417c4a67f31634f9e438291f157307f`; size 1361 bytes\n- exported object `object52341`; SHA-256 `0be3de6cbe02649cac51b45bd94ff6d19a983412ba64b0e8d09bf001d670f936`; size 1361 bytes\n- exported object `object52540`; SHA-256 `0c1699035ad33d5a5bbb3a1757c1403a6dd6e6701c0b44c440475272da405c92`; size 1361 bytes\n- exported object `object53277`; SHA-256 `0c371ce96d766cf8f8b5a3e9f5fb6455f6357e8ae9f1df6f9cc5e9d570c47786`; size 1361 bytes\n- exported object `object22855`; SHA-256 `0c7235740ffbcef98e3563dec0a7f00e0c540477142df44f30c786a5b802c7dd`; size 1361 bytes\n- exported object `object18748`; SHA-256 `0c92140f9b3f7aeeaec909bf9c931e8470956ac8ff4b3fc00989a30742126d7f`; size 1361 bytes\n- exported object `object33806`; SHA-256 `0ca5ce010722d08937143314f81e2a841c0ed3d6dcd196b1beb8b5f838e989bb`; size 1361 bytes\n- exported object `object54410`; SHA-256 `0cac5dce45567504fec6f2175c02e8a9a2a1a291c65f341adb699ca5698da188`; size 1361 bytes\n- exported object `object32737`; SHA-256 `0ce846a948032ea005cf44971ba98a1274be595acec2e801988f2e6d7b4d2144`; size 1361 bytes\n- exported object `object33682`; SHA-256 `0cf01d966db97935bd75cf1e21aac60ea9971b148a6582fc76c8735ef4d2e9e9`; size 1361 bytes\n- exported object `object15272`; SHA-256 `0d28d6f7d557164abfeded843a250023793d3a0354d6a7d8146edabef20b7dd9`; size 1361 bytes\n- exported object `object48159`; SHA-256 `0d44094ee78b64cb11f220bfbd6a351569cc9cbe56192cf869815338779417d6`; size 1361 bytes\n- exported object `object31373`; SHA-256 `0d5268d8703a78be118b790b6f318c29468e10d93d904e3f8a2d89e748dcc04c`; size 1361 bytes\n- exported object `object31010`; SHA-256 `0d65f283876d720094daa97b3279e684c74128cecbb7cceb3181286e2fbbbc20`; size 1361 bytes\n- exported object `object22523`; SHA-256 `0d794efd08478c1b15832783b865b8f123a8f225bf2c806b0f9ab5e1e3bb1b52`; size 1361 bytes\n- exported object `object53034`; SHA-256 `0d9fddc732c93bb2d938e458c82784703edde666fe2efebda3ce00cb0349899d`; size 1361 bytes\n- exported object `object32731`; SHA-256 `0daaa88b20226ae1f4c42c17c4c6cbbfa11dedfd9703cb779ebfd44b76ad82b1`; size 1361 bytes\n- exported object `object23591`; SHA-256 `0de0c8f286db181c37bdc2195928e89de5197597e75ad4cad75ff5d4288937f5`; size 1361 bytes\n- exported object `object33780`; SHA-256 `0de95a6dd74bfe274dbbd7c0ceb5f141adcdf595ce11730e42de61877c464fc4`; size 1361 bytes\n- exported object `object48036`; SHA-256 `0e1caceac5a7205259b6f6bcf942a11ff76fe5545d648927d016773497c719d3`; size 1361 bytes\n- exported object `object51997`; SHA-256 `0e25b544fbab68265ea690a46f017495adea916e109b1182928e9465ecaa94f2`; size 1361 bytes\n- exported object `object31683`; SHA-256 `0e5b4a758abe3ab92146ccf55b4d2c3bf8cbc21668bd0bb56ea5d3640d513d85`; size 1361 bytes\n- exported object `object44004`; SHA-256 `0e6fa606a24e4e6078c8bf8ac0cbb36c2bed47e9be2f287272c8ba792c14c014`; size 1361 bytes\n- exported object `object32921`; SHA-256 `0e82c907c8cd9aa157c7c761e99cac8f45006fc84bdbbb05ec75fcded4238253`; size 1361 bytes\n- exported object `object22857`; SHA-256 `0e9ea89f80df75091a4cc812e5dbd17cc224ec6bd8ea00f4ff4ea63445ffb325`; size 1361 bytes\n- exported object `object53715`; SHA-256 `0eac0fa0f97d8bab85621c5fbfb4fa060ecc5ba7352ff2be940e58c9d7c12760`; size 1361 bytes\n- exported object `object53125`; SHA-256 `0ee52f2355c117842f2f19d3f0c879d314ffbc5baa5e519c64f215be721476ee`; size 1361 bytes\n- exported object `object49929`; SHA-256 `0f260101f477681eecd0d3f1a9d7ac49b4e0455a82cc9fbdcf5f0e7cde9fc361`; size 1361 bytes\n- exported object `object33055`; SHA-256 `0f4364784a913740609a3600f0cfff9aaf587e0211b7f02c929f8bd0b36a816b`; size 1361 bytes\n- exported object `object18560`; SHA-256 `0f47ad71c32b5bd256982e0e91759df7f55ca94082303c0663d94acaa93ca02c`; size 1361 bytes\n- exported object `object44430`; SHA-256 `0fab4f6ca7bd6b8bb0e7bc56221b5171100fe3bc932100aa8ea788881c83e103`; size 1361 bytes\n- exported object `object22373`; SHA-256 `0fb3e36e6534b2319c9aa3ef11bdc5e63f4936f0dd7602f1dd4d635e5896a5a4`; size 1361 bytes\n- exported object `object23499`; SHA-256 `0fb4e4a743f5c30d4b05958d27a67e73f8bbc36ac2f65d04762a8c4d68023255`; size 1361 bytes\n- exported object `object46266`; SHA-256 `0fbaacfe6e94b7f83a1c39b7c780ca0d2f0678560015cc2c771e778a3f473001`; size 1361 bytes\n- exported object `object23298`; SHA-256 `0ff9fac2113e3888b5d144463c5c6945c11564c980a6089b7f7dfe1b9d614a80`; size 1361 bytes\n- exported object `object13298`; SHA-256 `100ddabc33cdc6fe76fa4b540256bd06d6b5accb0002b2f7d4369d38a4351cc7`; size 1361 bytes\n- exported object `object32582`; SHA-256 `103bf4c5c14533e16574153b81b6f1734b23fe110be50fb68ff18fac125477bf`; size 1361 bytes\n- exported object `object30325`; SHA-256 `105cc58ea985855602cd233b66281c8e2de8832dc2ca6003253b78e875fb4b16`; size 1361 bytes\n- exported object `object31586`; SHA-256 `10732599c70bbacdef1b5bfc15f5edba67539976fd97e48a51b1667cd29a5083`; size 1361 bytes\n- exported object `object22158`; SHA-256 `10960552d889333d5bf995aa02e95d0261a39679a06beeac34c37f654bbda708`; size 1361 bytes\n- exported object `object33404`; SHA-256 `109baac39f865d43b65478d15e0b6f7f3929f58dd9c2ec72cc6ed8c46cb66261`; size 1361 bytes\n- exported object `object52754`; SHA-256 `10b860c3f90e1d7185a94151c42cc1404908d4d4af02fcdfa3e2f2e9c85f0513`; size 1361 bytes\n- exported object `object51868`; SHA-256 `1111281d22bf620459aca772ceb3f5dc821c3f978939b3ac5cca81b709b4e2ba`; size 1361 bytes\n- exported object `object44376`; SHA-256 `1115a41f4fd7b629b5f8b70dceaef84f4fc8b6cb82f05962a22cc97379583757`; size 1361 bytes\n- exported object `object30132`; SHA-256 `111f968c11e5c908654bc87bbb11a8cd66d1859c003021dcf76371b61562e48d`; size 1361 bytes\n- exported object `object53581`; SHA-256 `1181373ff5e53f848c7ef0692b70725ca8dbd7e1cf1b2354bfb0d40233621624`; size 1361 bytes\n- exported object `object44444`; SHA-256 `1187b0e0bc25bb9cad44ea2f15eaa0553feaca599b6319004fc33177bddb512d`; size 1361 bytes\n- exported object `object18307`; SHA-256 `11d95a0597638c7ebfd636d7fa665d7b96ba1d6a938a0a7f7eeceada33c477aa`; size 1361 bytes\n- exported object `object49965`; SHA-256 `11e9f276cfe626be7ee28f5768bb67c94bd5036f1d1b27baeb3259655814306a`; size 1361 bytes\n- exported object `object33015`; SHA-256 `1223006aefd1f01c7303af2a2b63b5d6140b2add24f00a843ca8f3e0beca7ce0`; size 1361 bytes\n- exported object `object33442`; SHA-256 `124564c8d2a52347de7eb3af2b2c43b99f35dbb3b41f35eede3db7d027541f00`; size 1361 bytes\n- exported object `object52320`; SHA-256 `124ab8ab6d95f1864ccb201bb3af9518629a54cb206ab971736846650e252c76`; size 1361 bytes\n- exported object `object53098`; SHA-256 `12574189186de0aba6103d97667532aba80d8e2f39b5d5c6c0ac834ce07e2fd9`; size 1361 bytes\n- exported object `object22453`; SHA-256 `126e38fa9c87810aaf9e9828daaf5b29ff4d2a1564f7edda27105a9bc7ea4763`; size 1361 bytes\n- exported object `object30483`; SHA-256 `12eb91f6db9ec98c6507086c04ce36593b26a442e7fc346ff6c653dd3356eca7`; size 1361 bytes\n- exported object `object32640`; SHA-256 `12f98788142404142f0ebcfc2e1b26fb68fbff42256f02178f681a5e01082075`; size 1361 bytes\n- exported object `object22682`; SHA-256 `12fda192ab97a921a90112e345bc008e67f44337a36e29e4eaafa76c9bd109d3`; size 1361 bytes\n- exported object `object53104`; SHA-256 `1313f26f132af560385da3614ebb327c0d7ee4c40771a23da6b87c505c22e6c3`; size 1361 bytes\n- exported object `object29295`; SHA-256 `13444fc6df6157e6bb1510f5a024f22986ae6fac7e212edfe092f9c854141f3f`; size 1361 bytes\n- exported object `object31545`; SHA-256 `13549461fdd383ce263d5645d080a25de84be85daacf70d9ff015e60ca315832`; size 1361 bytes\n- exported object `object22956`; SHA-256 `13728223b67c5f320b624d7f199d8308e036e4a5fa0c585255acfc11b500f660`; size 1361 bytes\n- exported object `object30393`; SHA-256 `137b6f81c662562efddf079930b84f11f4b57a8bbcc21e454c6b0a61878a6540`; size 1361 bytes\n\n## Actor similarity leads\n\n- Thrip (G0076): 25% TTP overlap. This is an investigation lead, not attribution.\n- TA459 (G0062): 20% TTP overlap. This is an investigation lead, not attribution.\n- Gallmaker (G0084): 17% TTP overlap. This is an investigation lead, not attribution.\n- DarkHydrus (G0079): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Poseidon Group (G0033): 12% TTP overlap. This is an investigation lead, not attribution.\n- CopyKittens (G0052): 12% TTP overlap. This is an investigation lead, not attribution.\n- MoustachedBouncer (G1019): 12% TTP overlap. This is an investigation lead, not attribution.\n- GOLD SOUTHFIELD (G0115): 11% TTP overlap. This is an investigation lead, not attribution.\n- DarkVishnya (G0105): 10% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `37c4030f9b25335ca7a7a8cd23b5f050fab86309243d1fc8d5d3462e90e2a5a9`; recorded 2026-09-19T12:09:53.287759+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":3662,\"observable_limit\":5000,\"observables_checked\":3662,\"observables_total\":3662,\"prior_case_limit_reached\":false,\"prior_cases_checked\":13,\"truncated\":false}`\n\n- Catalog T1059.001: https://attack.mitre.org/techniques/T1059/001; detection strategies: [{\"attack_id\":\"DET0455\",\"name\":\"Abuse of PowerShell for Arbitrary Execution\",\"stix_id\":\"x-mitre-detection-strategy--72b209e2-8c65-4217-8532-fabd0cb54ae5\"}]\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 41 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 14 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":1555,\"complete\":true,\"detailed_objects\":500,\"exported_objects\":2055,\"hashed_bytes\":2729292,\"hashed_objects\":2055,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2055,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2055}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 18/18, identities 6/6, observables 500/3662, artifacts 200/500. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 55390 packets across 756 IP endpoints and 2044 transport flows. Observed 1726 DNS events, 17 HTTP requests, 191 TLS ClientHello events, and 500 exported HTTP object(s). Deterministic rules produced 18 finding(s): 0 high, 12 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "observables": [
        {
          "type": "domain",
          "value": "a.temp.pl",
          "confidence": 1,
          "description": "dns-query; frame 34482 / UDP stream 390, frame 34499 / UDP stream 390, frame 34517 / UDP stream 390"
        },
        {
          "type": "domain",
          "value": "acerodelcibao.com",
          "confidence": 1,
          "description": "dns-query; frame 45766 / UDP stream 487, frame 45784 / UDP stream 487"
        },
        {
          "type": "domain",
          "value": "actsb.com.my",
          "confidence": 1,
          "description": "dns-cname; frame 55172 / UDP stream 612"
        },
        {
          "type": "domain",
          "value": "adomengineering.com",
          "confidence": 1,
          "description": "dns-cname; frame 20860 / UDP stream 302"
        },
        {
          "type": "domain",
          "value": "amaralcoleta.com.br",
          "confidence": 1,
          "description": "dns-cname; frame 25666 / UDP stream 370"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 461 / UDP stream 38, frame 462 / UDP stream 38, frame 466 / TCP stream 19"
        },
        {
          "type": "domain",
          "value": "arketipo.com.mx",
          "confidence": 1,
          "description": "dns-cname; frame 55160 / UDP stream 613"
        },
        {
          "type": "domain",
          "value": "atmail15.worldsoft-mail.net",
          "confidence": 1,
          "description": "dns-query; frame 23627 / UDP stream 317, frame 23634 / UDP stream 317, frame 23655 / UDP stream 317"
        },
        {
          "type": "domain",
          "value": "auth.smtp.1and1.co.uk",
          "confidence": 1,
          "description": "dns-query; frame 52430 / UDP stream 564, frame 52442 / UDP stream 564"
        },
        {
          "type": "domain",
          "value": "auth.smtp.configtools.de",
          "confidence": 1,
          "description": "dns-query; frame 16688 / UDP stream 203, frame 16726 / UDP stream 203, frame 16733 / UDP stream 203"
        },
        {
          "type": "domain",
          "value": "auth.smtp.kundenserver.de",
          "confidence": 1,
          "description": "dns-cname, dns-query; frame 13316 / UDP stream 143, frame 13341 / UDP stream 143, frame 13370 / UDP stream 143, frame 16733 / UDP stream 203"
        },
        {
          "type": "domain",
          "value": "baidyanath.info",
          "confidence": 1,
          "description": "dns-query; frame 12357 / UDP stream 131, frame 12360 / UDP stream 131, frame 12378 / UDP stream 131, frame 12543 / UDP stream 131"
        },
        {
          "type": "domain",
          "value": "bh.frameworks-studios.com",
          "confidence": 1,
          "description": "dns-query; frame 14225 / UDP stream 164, frame 14239 / UDP stream 164, frame 14245 / UDP stream 164"
        },
        {
          "type": "domain",
          "value": "box5718.bluehost.com",
          "confidence": 1,
          "description": "dns-query; frame 48937 / UDP stream 533, frame 48940 / UDP stream 533"
        },
        {
          "type": "domain",
          "value": "broker.zgora.pl",
          "confidence": 1,
          "description": "dns-query; frame 23756 / UDP stream 326, frame 23787 / UDP stream 326, frame 23813 / UDP stream 326"
        },
        {
          "type": "domain",
          "value": "bsmtp.telekom.at",
          "confidence": 1,
          "description": "dns-query; frame 19402 / UDP stream 267, frame 19423 / UDP stream 267"
        },
        {
          "type": "domain",
          "value": "c1.icoremail.net",
          "confidence": 1,
          "description": "dns-query; frame 45191 / UDP stream 460, frame 45205 / UDP stream 460, frame 45206 / UDP stream 460, frame 45207 / UDP stream 460, frame 45208 / UDP stream 460"
        },
        {
          "type": "domain",
          "value": "capchile.cl",
          "confidence": 1,
          "description": "dns-cname; frame 36582 / UDP stream 431"
        },
        {
          "type": "domain",
          "value": "chaudharygroup.com",
          "confidence": 1,
          "description": "dns-query; frame 17830 / UDP stream 224, frame 17836 / UDP stream 224, frame 17854 / UDP stream 224"
        },
        {
          "type": "domain",
          "value": "checkappexec.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1635 / UDP stream 40, frame 1636 / UDP stream 40, frame 1640 / TCP stream 24"
        },
        {
          "type": "domain",
          "value": "ci-aduanas.com",
          "confidence": 1,
          "description": "dns-query; frame 14475 / UDP stream 172, frame 14481 / UDP stream 172"
        },
        {
          "type": "domain",
          "value": "cityangkorhotel.com",
          "confidence": 1,
          "description": "dns-cname; frame 55295 / UDP stream 621"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 82 / UDP stream 20, frame 86 / UDP stream 20, frame 90 / TCP stream 1"
        },
        {
          "type": "domain",
          "value": "cmusoft.webhost4life.com",
          "confidence": 1,
          "description": "dns-query; frame 24390 / UDP stream 340, frame 24404 / UDP stream 340, frame 24405 / UDP stream 340"
        },
        {
          "type": "domain",
          "value": "cpmail.contactplus.com.pk",
          "confidence": 1,
          "description": "dns-query; frame 35184 / UDP stream 413, frame 35203 / UDP stream 413, frame 35230 / UDP stream 413"
        },
        {
          "type": "domain",
          "value": "dmfseguros.com.br",
          "confidence": 1,
          "description": "dns-cname; frame 48760 / UDP stream 525"
        },
        {
          "type": "domain",
          "value": "dns.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 65 / UDP stream 16, frame 71 / UDP stream 16"
        },
        {
          "type": "domain",
          "value": "dunyakalip.com",
          "confidence": 1,
          "description": "dns-cname; frame 44555 / UDP stream 447"
        },
        {
          "type": "domain",
          "value": "egyptetouring.com",
          "confidence": 1,
          "description": "dns-query; frame 35182 / UDP stream 412, frame 35189 / UDP stream 412"
        },
        {
          "type": "domain",
          "value": "ekopraxis.com.ec",
          "confidence": 1,
          "description": "dns-cname; frame 35964 / UDP stream 421"
        },
        {
          "type": "domain",
          "value": "email-proxy.imaginet.co.za",
          "confidence": 1,
          "description": "dns-cname; frame 45674 / UDP stream 483"
        },
        {
          "type": "domain",
          "value": "email-ssl.com.br",
          "confidence": 1,
          "description": "dns-query; frame 18018 / UDP stream 235, frame 18033 / UDP stream 235, frame 18036 / UDP stream 235"
        },
        {
          "type": "domain",
          "value": "email.aon.at",
          "confidence": 1,
          "description": "dns-query; frame 13778 / UDP stream 154, frame 13788 / UDP stream 154"
        },
        {
          "type": "domain",
          "value": "email.srb.gos.pk",
          "confidence": 1,
          "description": "dns-query; frame 19547 / UDP stream 274, frame 19563 / UDP stream 274, frame 19613 / UDP stream 274"
        },
        {
          "type": "domain",
          "value": "emko.com.pl",
          "confidence": 1,
          "description": "dns-query; frame 23755 / UDP stream 325, frame 23786 / UDP stream 325, frame 23825 / UDP stream 325"
        },
        {
          "type": "domain",
          "value": "enseigneslandreville.com",
          "confidence": 1,
          "description": "dns-cname; frame 48698 / UDP stream 522"
        },
        {
          "type": "domain",
          "value": "eurocertindia.com",
          "confidence": 1,
          "description": "dns-cname; frame 26563 / UDP stream 375"
        },
        {
          "type": "domain",
          "value": "eurodesigngroup.net",
          "confidence": 1,
          "description": "dns-cname; frame 20432 / UDP stream 285"
        },
        {
          "type": "domain",
          "value": "fargreentech-dc.fargreentech.com",
          "confidence": 1,
          "description": "dns-query; frame 27 / UDP stream 8, frame 28 / UDP stream 8"
        },
        {
          "type": "domain",
          "value": "fargreentech.com",
          "confidence": 1,
          "description": "dns-query; frame 251 / UDP stream 36, frame 252 / UDP stream 36"
        },
        {
          "type": "domain",
          "value": "ff.zydusphils.com",
          "confidence": 1,
          "description": "dns-query; frame 25827 / UDP stream 372, frame 25875 / UDP stream 372, frame 25883 / UDP stream 372"
        },
        {
          "type": "domain",
          "value": "fibre.gondrandvalence.com",
          "confidence": 1,
          "description": "dns-cname; frame 21017 / UDP stream 308"
        },
        {
          "type": "domain",
          "value": "fileserver-int.net",
          "confidence": 1,
          "description": "dns-cname; frame 12454 / UDP stream 132"
        },
        {
          "type": "domain",
          "value": "frameworks-studios.com",
          "confidence": 1,
          "description": "dns-cname; frame 14245 / UDP stream 164"
        },
        {
          "type": "domain",
          "value": "gamaes.shop",
          "confidence": 1,
          "description": "dns-query, http-host; frame 1737 / UDP stream 43, frame 1738 / UDP stream 43, frame 1739 / UDP stream 43, frame 1743 / TCP stream 27"
        },
        {
          "type": "domain",
          "value": "gameplayapi.intel.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3102 / UDP stream 47, frame 3107 / UDP stream 47, frame 3180 / TCP stream 30"
        },
        {
          "type": "domain",
          "value": "gator4266.hostgator.com",
          "confidence": 1,
          "description": "dns-query; frame 19205 / UDP stream 258, frame 19207 / UDP stream 258"
        },
        {
          "type": "domain",
          "value": "ghs.google.com",
          "confidence": 1,
          "description": "dns-cname; frame 18143 / UDP stream 240"
        },
        {
          "type": "domain",
          "value": "global.sky1technologies.com",
          "confidence": 1,
          "description": "dns-query; frame 46904 / UDP stream 71, frame 46907 / UDP stream 71"
        },
        {
          "type": "domain",
          "value": "globalfreight.pk",
          "confidence": 1,
          "description": "dns-cname; frame 19607 / UDP stream 275"
        },
        {
          "type": "domain",
          "value": "gm-pool.centrum.cz",
          "confidence": 1,
          "description": "dns-cname; frame 36179 / UDP stream 426"
        },
        {
          "type": "domain",
          "value": "gottharthotel.com",
          "confidence": 1,
          "description": "dns-query; frame 34059 / UDP stream 378, frame 34093 / UDP stream 378"
        },
        {
          "type": "domain",
          "value": "gruporadialcristocentrica.com",
          "confidence": 1,
          "description": "dns-cname; frame 54972 / UDP stream 604"
        },
        {
          "type": "domain",
          "value": "gs862.ggsv.jp",
          "confidence": 1,
          "description": "dns-query; frame 16451 / UDP stream 194, frame 16459 / UDP stream 194, frame 16461 / UDP stream 194"
        },
        {
          "type": "domain",
          "value": "hades.dewebworks.net",
          "confidence": 1,
          "description": "dns-cname; frame 24435 / UDP stream 341"
        },
        {
          "type": "domain",
          "value": "hdredirect-lb5-1afb6e2973825a56.elb.us-east-1.amazonaws.com",
          "confidence": 1,
          "description": "dns-cname; frame 35147 / UDP stream 408"
        },
        {
          "type": "domain",
          "value": "hmapumps.com",
          "confidence": 1,
          "description": "dns-cname; frame 54948 / UDP stream 603"
        },
        {
          "type": "domain",
          "value": "hortim.cz",
          "confidence": 1,
          "description": "dns-cname; frame 11701 / UDP stream 89"
        },
        {
          "type": "domain",
          "value": "hosting.netclick.cz",
          "confidence": 1,
          "description": "dns-query; frame 17951 / UDP stream 230, frame 17965 / UDP stream 230, frame 17972 / UDP stream 230"
        },
        {
          "type": "domain",
          "value": "hosting.pronto.hn",
          "confidence": 1,
          "description": "dns-query; frame 34791 / UDP stream 399, frame 34806 / UDP stream 399, frame 34823 / UDP stream 399"
        },
        {
          "type": "domain",
          "value": "hotelandros.com",
          "confidence": 1,
          "description": "dns-cname; frame 55149 / UDP stream 614"
        },
        {
          "type": "domain",
          "value": "hsgroupcal.com",
          "confidence": 1,
          "description": "dns-cname; frame 46843 / UDP stream 493"
        },
        {
          "type": "domain",
          "value": "hueber.pl",
          "confidence": 1,
          "description": "dns-query; frame 11624 / UDP stream 85, frame 11644 / UDP stream 85, frame 11662 / UDP stream 85"
        },
        {
          "type": "domain",
          "value": "hv31svg105.neubox.net",
          "confidence": 1,
          "description": "dns-query; frame 12312 / UDP stream 127, frame 12327 / UDP stream 127, frame 12333 / UDP stream 127"
        },
        {
          "type": "domain",
          "value": "imap.1and1.com",
          "confidence": 1,
          "description": "dns-query; frame 34292 / UDP stream 382, frame 34298 / UDP stream 382, frame 34306 / UDP stream 382"
        },
        {
          "type": "domain",
          "value": "imap.1and1.es",
          "confidence": 1,
          "description": "dns-query; frame 11777 / UDP stream 102, frame 11783 / UDP stream 102, frame 11792 / UDP stream 102"
        },
        {
          "type": "domain",
          "value": "imap.1and1.fr",
          "confidence": 1,
          "description": "dns-query; frame 45232 / UDP stream 461, frame 45259 / UDP stream 461"
        },
        {
          "type": "domain",
          "value": "imap.1und1.de",
          "confidence": 1,
          "description": "dns-query; frame 11807 / UDP stream 104, frame 11810 / UDP stream 104"
        },
        {
          "type": "domain",
          "value": "imap.aol.com",
          "confidence": 1,
          "description": "dns-query; frame 34346 / UDP stream 386, frame 34357 / UDP stream 386, frame 34362 / UDP stream 386"
        },
        {
          "type": "domain",
          "value": "imap.comcast.net",
          "confidence": 1,
          "description": "dns-query; frame 35098 / UDP stream 407, frame 35110 / UDP stream 407, frame 35113 / UDP stream 407, frame 53737 / UDP stream 573, frame 53764 / UDP stream 573"
        },
        {
          "type": "domain",
          "value": "imap.conzulere-nextwealth.in",
          "confidence": 1,
          "description": "dns-query; frame 45340 / UDP stream 469, frame 45365 / UDP stream 469"
        },
        {
          "type": "domain",
          "value": "imap.ge.xfinity.com",
          "confidence": 1,
          "description": "dns-cname; frame 20511 / UDP stream 286, frame 35113 / UDP stream 407, frame 53764 / UDP stream 573"
        },
        {
          "type": "domain",
          "value": "imap.iomartmail.com",
          "confidence": 1,
          "description": "dns-query; frame 45272 / UDP stream 463, frame 45300 / UDP stream 463"
        },
        {
          "type": "domain",
          "value": "imap.ionos.com",
          "confidence": 1,
          "description": "dns-query; frame 20688 / UDP stream 295, frame 20704 / UDP stream 295, frame 20708 / UDP stream 295"
        },
        {
          "type": "domain",
          "value": "imap.mail.com",
          "confidence": 1,
          "description": "dns-query; frame 12313 / UDP stream 128, frame 12328 / UDP stream 128, frame 12330 / UDP stream 128"
        },
        {
          "type": "domain",
          "value": "imap.mail.yahoo.com",
          "confidence": 1,
          "description": "dns-query; frame 18029 / UDP stream 236, frame 18034 / UDP stream 236"
        },
        {
          "type": "domain",
          "value": "imap.mi.com.co",
          "confidence": 1,
          "description": "dns-query; frame 16584 / UDP stream 200, frame 16590 / UDP stream 200"
        },
        {
          "type": "domain",
          "value": "imap.nerim.fr",
          "confidence": 1,
          "description": "dns-query; frame 25036 / UDP stream 358, frame 25093 / UDP stream 358, frame 25207 / UDP stream 358"
        },
        {
          "type": "domain",
          "value": "imap.nerim.net",
          "confidence": 1,
          "description": "dns-cname; frame 25207 / UDP stream 358"
        },
        {
          "type": "domain",
          "value": "imap.otenet.gr",
          "confidence": 1,
          "description": "dns-query; frame 46822 / UDP stream 496, frame 46845 / UDP stream 496"
        },
        {
          "type": "domain",
          "value": "imap.prmail.vn",
          "confidence": 1,
          "description": "dns-query; frame 36026 / UDP stream 430, frame 36175 / UDP stream 430, frame 36417 / UDP stream 430"
        },
        {
          "type": "domain",
          "value": "imap.secureserver.net",
          "confidence": 1,
          "description": "dns-query; frame 11981 / UDP stream 110, frame 11985 / UDP stream 110, frame 11986 / UDP stream 110, frame 16493 / UDP stream 196, frame 16498 / UDP stream 196 +4 more"
        },
        {
          "type": "domain",
          "value": "imap.strato.de",
          "confidence": 1,
          "description": "dns-query; frame 34961 / UDP stream 400, frame 34968 / UDP stream 400, frame 34972 / UDP stream 400"
        },
        {
          "type": "domain",
          "value": "imap.theblossomvn.com",
          "confidence": 1,
          "description": "dns-query; frame 17981 / UDP stream 233, frame 17995 / UDP stream 233, frame 18051 / UDP stream 233"
        },
        {
          "type": "domain",
          "value": "inbound.att.net",
          "confidence": 1,
          "description": "dns-query; frame 45151 / UDP stream 455, frame 45165 / UDP stream 455, frame 45171 / UDP stream 455"
        },
        {
          "type": "domain",
          "value": "inbound.electric.net",
          "confidence": 1,
          "description": "dns-query; frame 11734 / UDP stream 98, frame 11750 / UDP stream 98, frame 11756 / UDP stream 98"
        },
        {
          "type": "domain",
          "value": "inside.evoc.cn",
          "confidence": 1,
          "description": "dns-query; frame 20802 / UDP stream 301, frame 20815 / UDP stream 301, frame 20873 / UDP stream 301"
        },
        {
          "type": "domain",
          "value": "interline.mx",
          "confidence": 1,
          "description": "dns-cname; frame 35191 / UDP stream 190"
        },
        {
          "type": "domain",
          "value": "internal-aol.imap.mail.g03.yahoodns.net",
          "confidence": 1,
          "description": "dns-cname; frame 34362 / UDP stream 386"
        },
        {
          "type": "domain",
          "value": "jsamerica.net",
          "confidence": 1,
          "description": "dns-cname; frame 16430 / UDP stream 191"
        },
        {
          "type": "domain",
          "value": "jumbosprepackers.co.za",
          "confidence": 1,
          "description": "dns-cname; frame 19756 / UDP stream 283"
        },
        {
          "type": "domain",
          "value": "kdn3.futureweb.at",
          "confidence": 1,
          "description": "dns-query; frame 19405 / UDP stream 270, frame 19433 / UDP stream 270, frame 19449 / UDP stream 270"
        },
        {
          "type": "domain",
          "value": "kitchencuisine.com.pk",
          "confidence": 1,
          "description": "dns-query; frame 45179 / UDP stream 458, frame 45181 / UDP stream 458, frame 45188 / UDP stream 458"
        },
        {
          "type": "domain",
          "value": "kopt-eonet-pop.xspmail.jp",
          "confidence": 1,
          "description": "dns-cname; frame 19352 / UDP stream 263"
        },
        {
          "type": "domain",
          "value": "lagranciudad.mx",
          "confidence": 1,
          "description": "dns-cname; frame 55202 / UDP stream 615"
        },
        {
          "type": "domain",
          "value": "loki.aserv.co.za",
          "confidence": 1,
          "description": "dns-query; frame 20740 / UDP stream 298, frame 20752 / UDP stream 298, frame 20780 / UDP stream 298"
        },
        {
          "type": "domain",
          "value": "macquarieoms-syd.chsecure.zone",
          "confidence": 1,
          "description": "dns-query; frame 24621 / UDP stream 351, frame 24657 / UDP stream 351, frame 24767 / UDP stream 351"
        },
        {
          "type": "domain",
          "value": "mail-out.cytanet.com.cy",
          "confidence": 1,
          "description": "dns-query; frame 46461 / UDP stream 183, frame 46499 / UDP stream 183, frame 46533 / UDP stream 183"
        },
        {
          "type": "domain",
          "value": "mail-out.telenet.be",
          "confidence": 1,
          "description": "dns-query; frame 13311 / UDP stream 139, frame 13340 / UDP stream 139, frame 13358 / UDP stream 139"
        },
        {
          "type": "domain",
          "value": "mail.1and1.mx",
          "confidence": 1,
          "description": "dns-query; frame 47102 / UDP stream 506, frame 47110 / UDP stream 506"
        }
      ],
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap"
      ],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "observable_count": 3662,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "suspicious_findings": [
        {
          "reason": "The HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent. Rule powershell-http-client@pcap-rules-v3; confidence 94%.",
          "category": "HTTP client claiming a PowerShell User-Agent",
          "evidence": "frame 1743 / TCP stream 27",
          "severity": "medium"
        },
        {
          "reason": "The HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent. Rule powershell-http-client@pcap-rules-v3; confidence 94%.",
          "category": "HTTP client claiming a PowerShell User-Agent",
          "evidence": "frame 1771 / TCP stream 29",
          "severity": "medium"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 353 / TCP stream 11, frame 355 / TCP stream 11, frame 357 / TCP stream 11, frame 359 / TCP stream 11, frame 3126 / TCP stream 32 +11 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 46 / TCP stream 0, frame 52 / TCP stream 0, frame 428 / TCP stream 17, frame 433 / TCP stream 17, frame 435 / TCP stream 17 +20 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 291 / TCP stream 8, frame 293 / TCP stream 8, frame 295 / TCP stream 8, frame 297 / TCP stream 8, frame 299 / TCP stream 8 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 352 / TCP stream 11, frame 354 / TCP stream 11, frame 356 / TCP stream 11, frame 358 / TCP stream 11, frame 3125 / TCP stream 32 +11 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 43 / TCP stream 0, frame 50 / TCP stream 0, frame 53 / TCP stream 0, frame 426 / TCP stream 17, frame 431 / TCP stream 17 +27 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 290 / TCP stream 8, frame 292 / TCP stream 8, frame 294 / TCP stream 8, frame 296 / TCP stream 8, frame 298 / TCP stream 8 +10 more",
          "severity": "low"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 11092 / TCP stream 92",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 11301 / TCP stream 113",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 13057 / TCP stream 241",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 18188 / TCP stream 443",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 21451 / TCP stream 597",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 23295 / TCP stream 598",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 28378 / TCP stream 748",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 43910 / TCP stream 895",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 46108 / TCP stream 1057",
          "severity": "medium"
        },
        {
          "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v3; confidence 70%.",
          "category": "Sustained external TCP conversation outside decoded application coverage",
          "evidence": "frame 47842 / TCP stream 1128",
          "severity": "medium"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Thrip",
          "similarity": 0.25,
          "shared_count": 1,
          "group_attack_id": "G0076",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "TA459",
          "similarity": 0.2,
          "shared_count": 1,
          "group_attack_id": "G0062",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Gallmaker",
          "similarity": 0.1667,
          "shared_count": 1,
          "group_attack_id": "G0084",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "DarkHydrus",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0079",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Nomadic Octopus",
          "similarity": 0.1429,
          "shared_count": 1,
          "group_attack_id": "G0133",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Poseidon Group",
          "similarity": 0.125,
          "shared_count": 1,
          "group_attack_id": "G0033",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "CopyKittens",
          "similarity": 0.125,
          "shared_count": 1,
          "group_attack_id": "G0052",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "MoustachedBouncer",
          "similarity": 0.125,
          "shared_count": 1,
          "group_attack_id": "G1019",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "GOLD SOUTHFIELD",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0115",
          "shared_techniques": [
            "T1059.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "DarkVishnya",
          "similarity": 0.1,
          "shared_count": 1,
          "group_attack_id": "G0105",
          "shared_techniques": [
            "T1059.001"
          ]
        }
      ],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ttp-evidence:96e0e828-93ae-49d5-8104-9f14cb584c3e:T1059.001",
      "type": "ttp-evidence",
      "label": "T1059.001 Command and Scripting Interpreter: PowerShell",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "execution",
      "evidence": "T1059.001 Command and Scripting Interpreter: PowerShell",
      "attack_id": "T1059.001",
      "confidence": 0.5,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a.temp.pl",
      "type": "ioc",
      "value": "a.temp.pl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34482 / UDP stream 390, frame 34499 / UDP stream 390, frame 34517 / UDP stream 390",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:acerodelcibao.com",
      "type": "ioc",
      "value": "acerodelcibao.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45766 / UDP stream 487, frame 45784 / UDP stream 487",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:actsb.com.my",
      "type": "ioc",
      "value": "actsb.com.my",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 55172 / UDP stream 612",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:adomengineering.com",
      "type": "ioc",
      "value": "adomengineering.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 20860 / UDP stream 302",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:amaralcoleta.com.br",
      "type": "ioc",
      "value": "amaralcoleta.com.br",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 25666 / UDP stream 370",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query, tls-sni; frame 461 / UDP stream 38, frame 462 / UDP stream 38, frame 466 / TCP stream 19",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:arketipo.com.mx",
      "type": "ioc",
      "value": "arketipo.com.mx",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 55160 / UDP stream 613",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:atmail15.worldsoft-mail.net",
      "type": "ioc",
      "value": "atmail15.worldsoft-mail.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 23627 / UDP stream 317, frame 23634 / UDP stream 317, frame 23655 / UDP stream 317",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:auth.smtp.1and1.co.uk",
      "type": "ioc",
      "value": "auth.smtp.1and1.co.uk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 52430 / UDP stream 564, frame 52442 / UDP stream 564",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:auth.smtp.configtools.de",
      "type": "ioc",
      "value": "auth.smtp.configtools.de",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 16688 / UDP stream 203, frame 16726 / UDP stream 203, frame 16733 / UDP stream 203",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:auth.smtp.kundenserver.de",
      "type": "ioc",
      "value": "auth.smtp.kundenserver.de",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname, dns-query; frame 13316 / UDP stream 143, frame 13341 / UDP stream 143, frame 13370 / UDP stream 143, frame 16733 / UDP stream 203",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:baidyanath.info",
      "type": "ioc",
      "value": "baidyanath.info",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 12357 / UDP stream 131, frame 12360 / UDP stream 131, frame 12378 / UDP stream 131, frame 12543 / UDP stream 131",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:bh.frameworks-studios.com",
      "type": "ioc",
      "value": "bh.frameworks-studios.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 14225 / UDP stream 164, frame 14239 / UDP stream 164, frame 14245 / UDP stream 164",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:box5718.bluehost.com",
      "type": "ioc",
      "value": "box5718.bluehost.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 48937 / UDP stream 533, frame 48940 / UDP stream 533",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:broker.zgora.pl",
      "type": "ioc",
      "value": "broker.zgora.pl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 23756 / UDP stream 326, frame 23787 / UDP stream 326, frame 23813 / UDP stream 326",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:bsmtp.telekom.at",
      "type": "ioc",
      "value": "bsmtp.telekom.at",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 19402 / UDP stream 267, frame 19423 / UDP stream 267",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c1.icoremail.net",
      "type": "ioc",
      "value": "c1.icoremail.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45191 / UDP stream 460, frame 45205 / UDP stream 460, frame 45206 / UDP stream 460, frame 45207 / UDP stream 460, frame 45208 / UDP stream 460",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:capchile.cl",
      "type": "ioc",
      "value": "capchile.cl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 36582 / UDP stream 431",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:chaudharygroup.com",
      "type": "ioc",
      "value": "chaudharygroup.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 17830 / UDP stream 224, frame 17836 / UDP stream 224, frame 17854 / UDP stream 224",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:checkappexec.microsoft.com",
      "type": "ioc",
      "value": "checkappexec.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query, tls-sni; frame 1635 / UDP stream 40, frame 1636 / UDP stream 40, frame 1640 / TCP stream 24",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ci-aduanas.com",
      "type": "ioc",
      "value": "ci-aduanas.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 14475 / UDP stream 172, frame 14481 / UDP stream 172",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cityangkorhotel.com",
      "type": "ioc",
      "value": "cityangkorhotel.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 55295 / UDP stream 621",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query, tls-sni; frame 82 / UDP stream 20, frame 86 / UDP stream 20, frame 90 / TCP stream 1",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cmusoft.webhost4life.com",
      "type": "ioc",
      "value": "cmusoft.webhost4life.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 24390 / UDP stream 340, frame 24404 / UDP stream 340, frame 24405 / UDP stream 340",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cpmail.contactplus.com.pk",
      "type": "ioc",
      "value": "cpmail.contactplus.com.pk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 35184 / UDP stream 413, frame 35203 / UDP stream 413, frame 35230 / UDP stream 413",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dmfseguros.com.br",
      "type": "ioc",
      "value": "dmfseguros.com.br",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 48760 / UDP stream 525",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dns.msftncsi.com",
      "type": "ioc",
      "value": "dns.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 65 / UDP stream 16, frame 71 / UDP stream 16",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dunyakalip.com",
      "type": "ioc",
      "value": "dunyakalip.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 44555 / UDP stream 447",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:egyptetouring.com",
      "type": "ioc",
      "value": "egyptetouring.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 35182 / UDP stream 412, frame 35189 / UDP stream 412",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ekopraxis.com.ec",
      "type": "ioc",
      "value": "ekopraxis.com.ec",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 35964 / UDP stream 421",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:email-proxy.imaginet.co.za",
      "type": "ioc",
      "value": "email-proxy.imaginet.co.za",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 45674 / UDP stream 483",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:email-ssl.com.br",
      "type": "ioc",
      "value": "email-ssl.com.br",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 18018 / UDP stream 235, frame 18033 / UDP stream 235, frame 18036 / UDP stream 235",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:email.aon.at",
      "type": "ioc",
      "value": "email.aon.at",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 13778 / UDP stream 154, frame 13788 / UDP stream 154",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:email.srb.gos.pk",
      "type": "ioc",
      "value": "email.srb.gos.pk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 19547 / UDP stream 274, frame 19563 / UDP stream 274, frame 19613 / UDP stream 274",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:emko.com.pl",
      "type": "ioc",
      "value": "emko.com.pl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 23755 / UDP stream 325, frame 23786 / UDP stream 325, frame 23825 / UDP stream 325",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:enseigneslandreville.com",
      "type": "ioc",
      "value": "enseigneslandreville.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 48698 / UDP stream 522",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:eurocertindia.com",
      "type": "ioc",
      "value": "eurocertindia.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 26563 / UDP stream 375",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:eurodesigngroup.net",
      "type": "ioc",
      "value": "eurodesigngroup.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 20432 / UDP stream 285",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fargreentech-dc.fargreentech.com",
      "type": "ioc",
      "value": "fargreentech-dc.fargreentech.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 27 / UDP stream 8, frame 28 / UDP stream 8",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fargreentech.com",
      "type": "ioc",
      "value": "fargreentech.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 251 / UDP stream 36, frame 252 / UDP stream 36",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ff.zydusphils.com",
      "type": "ioc",
      "value": "ff.zydusphils.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 25827 / UDP stream 372, frame 25875 / UDP stream 372, frame 25883 / UDP stream 372",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fibre.gondrandvalence.com",
      "type": "ioc",
      "value": "fibre.gondrandvalence.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 21017 / UDP stream 308",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fileserver-int.net",
      "type": "ioc",
      "value": "fileserver-int.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 12454 / UDP stream 132",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:frameworks-studios.com",
      "type": "ioc",
      "value": "frameworks-studios.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 14245 / UDP stream 164",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gameplayapi.intel.com",
      "type": "ioc",
      "value": "gameplayapi.intel.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query, tls-sni; frame 3102 / UDP stream 47, frame 3107 / UDP stream 47, frame 3180 / TCP stream 30",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gator4266.hostgator.com",
      "type": "ioc",
      "value": "gator4266.hostgator.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 19205 / UDP stream 258, frame 19207 / UDP stream 258",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ghs.google.com",
      "type": "ioc",
      "value": "ghs.google.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 18143 / UDP stream 240",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:global.sky1technologies.com",
      "type": "ioc",
      "value": "global.sky1technologies.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 46904 / UDP stream 71, frame 46907 / UDP stream 71",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:globalfreight.pk",
      "type": "ioc",
      "value": "globalfreight.pk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 19607 / UDP stream 275",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gm-pool.centrum.cz",
      "type": "ioc",
      "value": "gm-pool.centrum.cz",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 36179 / UDP stream 426",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gottharthotel.com",
      "type": "ioc",
      "value": "gottharthotel.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34059 / UDP stream 378, frame 34093 / UDP stream 378",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gruporadialcristocentrica.com",
      "type": "ioc",
      "value": "gruporadialcristocentrica.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 54972 / UDP stream 604",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:gs862.ggsv.jp",
      "type": "ioc",
      "value": "gs862.ggsv.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 16451 / UDP stream 194, frame 16459 / UDP stream 194, frame 16461 / UDP stream 194",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hades.dewebworks.net",
      "type": "ioc",
      "value": "hades.dewebworks.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 24435 / UDP stream 341",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hdredirect-lb5-1afb6e2973825a56.elb.us-east-1.amazonaws.com",
      "type": "ioc",
      "value": "hdredirect-lb5-1afb6e2973825a56.elb.us-east-1.amazonaws.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 35147 / UDP stream 408",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hmapumps.com",
      "type": "ioc",
      "value": "hmapumps.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 54948 / UDP stream 603",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hortim.cz",
      "type": "ioc",
      "value": "hortim.cz",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 11701 / UDP stream 89",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hosting.netclick.cz",
      "type": "ioc",
      "value": "hosting.netclick.cz",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 17951 / UDP stream 230, frame 17965 / UDP stream 230, frame 17972 / UDP stream 230",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hosting.pronto.hn",
      "type": "ioc",
      "value": "hosting.pronto.hn",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34791 / UDP stream 399, frame 34806 / UDP stream 399, frame 34823 / UDP stream 399",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hotelandros.com",
      "type": "ioc",
      "value": "hotelandros.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 55149 / UDP stream 614",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hsgroupcal.com",
      "type": "ioc",
      "value": "hsgroupcal.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 46843 / UDP stream 493",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hueber.pl",
      "type": "ioc",
      "value": "hueber.pl",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 11624 / UDP stream 85, frame 11644 / UDP stream 85, frame 11662 / UDP stream 85",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:hv31svg105.neubox.net",
      "type": "ioc",
      "value": "hv31svg105.neubox.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 12312 / UDP stream 127, frame 12327 / UDP stream 127, frame 12333 / UDP stream 127",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.1and1.com",
      "type": "ioc",
      "value": "imap.1and1.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34292 / UDP stream 382, frame 34298 / UDP stream 382, frame 34306 / UDP stream 382",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.1and1.es",
      "type": "ioc",
      "value": "imap.1and1.es",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 11777 / UDP stream 102, frame 11783 / UDP stream 102, frame 11792 / UDP stream 102",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.1and1.fr",
      "type": "ioc",
      "value": "imap.1and1.fr",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45232 / UDP stream 461, frame 45259 / UDP stream 461",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.1und1.de",
      "type": "ioc",
      "value": "imap.1und1.de",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 11807 / UDP stream 104, frame 11810 / UDP stream 104",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.aol.com",
      "type": "ioc",
      "value": "imap.aol.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34346 / UDP stream 386, frame 34357 / UDP stream 386, frame 34362 / UDP stream 386",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.comcast.net",
      "type": "ioc",
      "value": "imap.comcast.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 35098 / UDP stream 407, frame 35110 / UDP stream 407, frame 35113 / UDP stream 407, frame 53737 / UDP stream 573, frame 53764 / UDP stream 573",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.conzulere-nextwealth.in",
      "type": "ioc",
      "value": "imap.conzulere-nextwealth.in",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45340 / UDP stream 469, frame 45365 / UDP stream 469",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.ge.xfinity.com",
      "type": "ioc",
      "value": "imap.ge.xfinity.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 20511 / UDP stream 286, frame 35113 / UDP stream 407, frame 53764 / UDP stream 573",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.iomartmail.com",
      "type": "ioc",
      "value": "imap.iomartmail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45272 / UDP stream 463, frame 45300 / UDP stream 463",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.ionos.com",
      "type": "ioc",
      "value": "imap.ionos.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 20688 / UDP stream 295, frame 20704 / UDP stream 295, frame 20708 / UDP stream 295",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.mail.com",
      "type": "ioc",
      "value": "imap.mail.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 12313 / UDP stream 128, frame 12328 / UDP stream 128, frame 12330 / UDP stream 128",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.mail.yahoo.com",
      "type": "ioc",
      "value": "imap.mail.yahoo.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 18029 / UDP stream 236, frame 18034 / UDP stream 236",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.mi.com.co",
      "type": "ioc",
      "value": "imap.mi.com.co",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 16584 / UDP stream 200, frame 16590 / UDP stream 200",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.nerim.fr",
      "type": "ioc",
      "value": "imap.nerim.fr",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 25036 / UDP stream 358, frame 25093 / UDP stream 358, frame 25207 / UDP stream 358",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.nerim.net",
      "type": "ioc",
      "value": "imap.nerim.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 25207 / UDP stream 358",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.otenet.gr",
      "type": "ioc",
      "value": "imap.otenet.gr",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 46822 / UDP stream 496, frame 46845 / UDP stream 496",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.prmail.vn",
      "type": "ioc",
      "value": "imap.prmail.vn",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 36026 / UDP stream 430, frame 36175 / UDP stream 430, frame 36417 / UDP stream 430",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.secureserver.net",
      "type": "ioc",
      "value": "imap.secureserver.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 11981 / UDP stream 110, frame 11985 / UDP stream 110, frame 11986 / UDP stream 110, frame 16493 / UDP stream 196, frame 16498 / UDP stream 196 +4 more",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.strato.de",
      "type": "ioc",
      "value": "imap.strato.de",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 34961 / UDP stream 400, frame 34968 / UDP stream 400, frame 34972 / UDP stream 400",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:imap.theblossomvn.com",
      "type": "ioc",
      "value": "imap.theblossomvn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 17981 / UDP stream 233, frame 17995 / UDP stream 233, frame 18051 / UDP stream 233",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:inbound.att.net",
      "type": "ioc",
      "value": "inbound.att.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45151 / UDP stream 455, frame 45165 / UDP stream 455, frame 45171 / UDP stream 455",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:inbound.electric.net",
      "type": "ioc",
      "value": "inbound.electric.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 11734 / UDP stream 98, frame 11750 / UDP stream 98, frame 11756 / UDP stream 98",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:inside.evoc.cn",
      "type": "ioc",
      "value": "inside.evoc.cn",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 20802 / UDP stream 301, frame 20815 / UDP stream 301, frame 20873 / UDP stream 301",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:interline.mx",
      "type": "ioc",
      "value": "interline.mx",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 35191 / UDP stream 190",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:internal-aol.imap.mail.g03.yahoodns.net",
      "type": "ioc",
      "value": "internal-aol.imap.mail.g03.yahoodns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 34362 / UDP stream 386",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:jsamerica.net",
      "type": "ioc",
      "value": "jsamerica.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 16430 / UDP stream 191",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:jumbosprepackers.co.za",
      "type": "ioc",
      "value": "jumbosprepackers.co.za",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 19756 / UDP stream 283",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:kdn3.futureweb.at",
      "type": "ioc",
      "value": "kdn3.futureweb.at",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 19405 / UDP stream 270, frame 19433 / UDP stream 270, frame 19449 / UDP stream 270",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:kitchencuisine.com.pk",
      "type": "ioc",
      "value": "kitchencuisine.com.pk",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 45179 / UDP stream 458, frame 45181 / UDP stream 458, frame 45188 / UDP stream 458",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:kopt-eonet-pop.xspmail.jp",
      "type": "ioc",
      "value": "kopt-eonet-pop.xspmail.jp",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 19352 / UDP stream 263",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:lagranciudad.mx",
      "type": "ioc",
      "value": "lagranciudad.mx",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-cname; frame 55202 / UDP stream 615",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:loki.aserv.co.za",
      "type": "ioc",
      "value": "loki.aserv.co.za",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 20740 / UDP stream 298, frame 20752 / UDP stream 298, frame 20780 / UDP stream 298",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:macquarieoms-syd.chsecure.zone",
      "type": "ioc",
      "value": "macquarieoms-syd.chsecure.zone",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 24621 / UDP stream 351, frame 24657 / UDP stream 351, frame 24767 / UDP stream 351",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail-out.cytanet.com.cy",
      "type": "ioc",
      "value": "mail-out.cytanet.com.cy",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 46461 / UDP stream 183, frame 46499 / UDP stream 183, frame 46533 / UDP stream 183",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail-out.telenet.be",
      "type": "ioc",
      "value": "mail-out.telenet.be",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 13311 / UDP stream 139, frame 13340 / UDP stream 139, frame 13358 / UDP stream 139",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mail.1and1.mx",
      "type": "ioc",
      "value": "mail.1and1.mx",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "description": "dns-query; frame 47102 / UDP stream 506, frame 47110 / UDP stream 506",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-1b733080d6e0b7ad9ffea148",
      "type": "pcap-finding",
      "label": "HTTP client claiming a PowerShell User-Agent",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1320",
        "destination": "104.21.29.80",
        "request_count": 1
      },
      "rule_id": "powershell-http-client",
      "severity": "medium",
      "confidence": 0.94,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 27,
          "frame_number": 1743,
          "display_filter": "frame.number == 1743",
          "timestamp_epoch": "1638560567.664570000"
        }
      ]
    },
    {
      "id": "finding-7e9703de3fe34db91e3e2205",
      "type": "pcap-finding",
      "label": "HTTP client claiming a PowerShell User-Agent",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1320",
        "destination": "139.59.6.175",
        "request_count": 1
      },
      "rule_id": "powershell-http-client",
      "severity": "medium",
      "confidence": 0.94,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The HTTP User-Agent claims Windows PowerShell. User-Agent strings can be spoofed; this alone does not prove interpreter execution or malicious intent.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 29,
          "frame_number": 1771,
          "display_filter": "frame.number == 1771",
          "timestamp_epoch": "1638560568.410086000"
        }
      ]
    },
    {
      "id": "finding-5e33bfcd783468d77d711572",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.3",
        "protocol": "drsuapi",
        "destination": "10.12.3.66",
        "event_count": 16,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 353,
          "display_filter": "frame.number == 353",
          "timestamp_epoch": "1638560529.117762000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 355,
          "display_filter": "frame.number == 355",
          "timestamp_epoch": "1638560529.118266000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 357,
          "display_filter": "frame.number == 357",
          "timestamp_epoch": "1638560529.118716000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 359,
          "display_filter": "frame.number == 359",
          "timestamp_epoch": "1638560529.118920000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3126,
          "display_filter": "frame.number == 3126",
          "timestamp_epoch": "1638560589.875741000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3128,
          "display_filter": "frame.number == 3128",
          "timestamp_epoch": "1638560589.876349000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3130,
          "display_filter": "frame.number == 3130",
          "timestamp_epoch": "1638560589.876600000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3134,
          "display_filter": "frame.number == 3134",
          "timestamp_epoch": "1638560589.878049000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3136,
          "display_filter": "frame.number == 3136",
          "timestamp_epoch": "1638560589.878487000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3138,
          "display_filter": "frame.number == 3138",
          "timestamp_epoch": "1638560589.878723000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4906,
          "display_filter": "frame.number == 4906",
          "timestamp_epoch": "1638560847.505267000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4908,
          "display_filter": "frame.number == 4908",
          "timestamp_epoch": "1638560847.506871000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4910,
          "display_filter": "frame.number == 4910",
          "timestamp_epoch": "1638560847.507779000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4914,
          "display_filter": "frame.number == 4914",
          "timestamp_epoch": "1638560847.511229000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4916,
          "display_filter": "frame.number == 4916",
          "timestamp_epoch": "1638560847.512502000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4918,
          "display_filter": "frame.number == 4918",
          "timestamp_epoch": "1638560847.513350000"
        }
      ]
    },
    {
      "id": "finding-22587c82a07dc096e86fdda8",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.3",
        "protocol": "ldap",
        "destination": "10.12.3.66",
        "event_count": 25,
        "operation_numbers": [
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 0,
          "frame_number": 46,
          "display_filter": "frame.number == 46",
          "timestamp_epoch": "1638560510.676125000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 52,
          "display_filter": "frame.number == 52",
          "timestamp_epoch": "1638560510.678769000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 428,
          "display_filter": "frame.number == 428",
          "timestamp_epoch": "1638560529.447451000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 433,
          "display_filter": "frame.number == 433",
          "timestamp_epoch": "1638560529.450780000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 435,
          "display_filter": "frame.number == 435",
          "timestamp_epoch": "1638560529.461613000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 442,
          "display_filter": "frame.number == 442",
          "timestamp_epoch": "1638560529.468801000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 444,
          "display_filter": "frame.number == 444",
          "timestamp_epoch": "1638560529.469619000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 446,
          "display_filter": "frame.number == 446",
          "timestamp_epoch": "1638560529.470884000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 448,
          "display_filter": "frame.number == 448",
          "timestamp_epoch": "1638560529.474385000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3144,
          "display_filter": "frame.number == 3144",
          "timestamp_epoch": "1638560589.881350000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3149,
          "display_filter": "frame.number == 3149",
          "timestamp_epoch": "1638560589.883040000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3151,
          "display_filter": "frame.number == 3151",
          "timestamp_epoch": "1638560589.883479000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3153,
          "display_filter": "frame.number == 3153",
          "timestamp_epoch": "1638560589.884459000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3155,
          "display_filter": "frame.number == 3155",
          "timestamp_epoch": "1638560589.884763000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3162,
          "display_filter": "frame.number == 3162",
          "timestamp_epoch": "1638560589.888351000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3166,
          "display_filter": "frame.number == 3166",
          "timestamp_epoch": "1638560589.889264000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3169,
          "display_filter": "frame.number == 3169",
          "timestamp_epoch": "1638560589.889634000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4924,
          "display_filter": "frame.number == 4924",
          "timestamp_epoch": "1638560847.518029000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4929,
          "display_filter": "frame.number == 4929",
          "timestamp_epoch": "1638560847.521078000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4931,
          "display_filter": "frame.number == 4931",
          "timestamp_epoch": "1638560847.522301000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4933,
          "display_filter": "frame.number == 4933",
          "timestamp_epoch": "1638560847.523278000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4935,
          "display_filter": "frame.number == 4935",
          "timestamp_epoch": "1638560847.524222000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4942,
          "display_filter": "frame.number == 4942",
          "timestamp_epoch": "1638560847.530072000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4946,
          "display_filter": "frame.number == 4946",
          "timestamp_epoch": "1638560847.531828000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4949,
          "display_filter": "frame.number == 4949",
          "timestamp_epoch": "1638560847.532494000"
        }
      ]
    },
    {
      "id": "finding-65b2e2ee103b1f48c74af8d1",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.3",
        "protocol": "samr",
        "destination": "10.12.3.66",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 291,
          "display_filter": "frame.number == 291",
          "timestamp_epoch": "1638560529.027946000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 293,
          "display_filter": "frame.number == 293",
          "timestamp_epoch": "1638560529.028328000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 295,
          "display_filter": "frame.number == 295",
          "timestamp_epoch": "1638560529.028671000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 297,
          "display_filter": "frame.number == 297",
          "timestamp_epoch": "1638560529.029075000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 299,
          "display_filter": "frame.number == 299",
          "timestamp_epoch": "1638560529.029476000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 301,
          "display_filter": "frame.number == 301",
          "timestamp_epoch": "1638560529.029971000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 303,
          "display_filter": "frame.number == 303",
          "timestamp_epoch": "1638560529.030419000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 305,
          "display_filter": "frame.number == 305",
          "timestamp_epoch": "1638560529.031061000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 307,
          "display_filter": "frame.number == 307",
          "timestamp_epoch": "1638560529.031533000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 309,
          "display_filter": "frame.number == 309",
          "timestamp_epoch": "1638560529.031926000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 311,
          "display_filter": "frame.number == 311",
          "timestamp_epoch": "1638560529.032267000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 313,
          "display_filter": "frame.number == 313",
          "timestamp_epoch": "1638560529.032661000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 315,
          "display_filter": "frame.number == 315",
          "timestamp_epoch": "1638560529.033005000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 317,
          "display_filter": "frame.number == 317",
          "timestamp_epoch": "1638560529.033339000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 319,
          "display_filter": "frame.number == 319",
          "timestamp_epoch": "1638560529.033608000"
        }
      ]
    },
    {
      "id": "finding-2ee4a42a8ed733004519c64d",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "protocol": "drsuapi",
        "destination": "10.12.3.3",
        "event_count": 16,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 352,
          "display_filter": "frame.number == 352",
          "timestamp_epoch": "1638560529.117621000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 354,
          "display_filter": "frame.number == 354",
          "timestamp_epoch": "1638560529.117977000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 356,
          "display_filter": "frame.number == 356",
          "timestamp_epoch": "1638560529.118458000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 358,
          "display_filter": "frame.number == 358",
          "timestamp_epoch": "1638560529.118859000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3125,
          "display_filter": "frame.number == 3125",
          "timestamp_epoch": "1638560589.875334000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3127,
          "display_filter": "frame.number == 3127",
          "timestamp_epoch": "1638560589.876060000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3129,
          "display_filter": "frame.number == 3129",
          "timestamp_epoch": "1638560589.876527000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3133,
          "display_filter": "frame.number == 3133",
          "timestamp_epoch": "1638560589.877888000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3135,
          "display_filter": "frame.number == 3135",
          "timestamp_epoch": "1638560589.878252000"
        },
        {
          "tcp_stream": 32,
          "frame_number": 3137,
          "display_filter": "frame.number == 3137",
          "timestamp_epoch": "1638560589.878658000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4905,
          "display_filter": "frame.number == 4905",
          "timestamp_epoch": "1638560847.504770000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4907,
          "display_filter": "frame.number == 4907",
          "timestamp_epoch": "1638560847.506180000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4909,
          "display_filter": "frame.number == 4909",
          "timestamp_epoch": "1638560847.507431000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4913,
          "display_filter": "frame.number == 4913",
          "timestamp_epoch": "1638560847.510849000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4915,
          "display_filter": "frame.number == 4915",
          "timestamp_epoch": "1638560847.511795000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 4917,
          "display_filter": "frame.number == 4917",
          "timestamp_epoch": "1638560847.513015000"
        }
      ]
    },
    {
      "id": "finding-b0d10923d02098005d04b5a3",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "protocol": "ldap",
        "destination": "10.12.3.3",
        "event_count": 32,
        "operation_numbers": [
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 0,
          "frame_number": 43,
          "display_filter": "frame.number == 43",
          "timestamp_epoch": "1638560510.675316000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 50,
          "display_filter": "frame.number == 50",
          "timestamp_epoch": "1638560510.677316000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 53,
          "display_filter": "frame.number == 53",
          "timestamp_epoch": "1638560510.679119000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 426,
          "display_filter": "frame.number == 426",
          "timestamp_epoch": "1638560529.446667000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 431,
          "display_filter": "frame.number == 431",
          "timestamp_epoch": "1638560529.449309000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 434,
          "display_filter": "frame.number == 434",
          "timestamp_epoch": "1638560529.460978000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 440,
          "display_filter": "frame.number == 440",
          "timestamp_epoch": "1638560529.467360000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 443,
          "display_filter": "frame.number == 443",
          "timestamp_epoch": "1638560529.469370000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 445,
          "display_filter": "frame.number == 445",
          "timestamp_epoch": "1638560529.470430000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 447,
          "display_filter": "frame.number == 447",
          "timestamp_epoch": "1638560529.473943000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 453,
          "display_filter": "frame.number == 453",
          "timestamp_epoch": "1638560529.780285000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 457,
          "display_filter": "frame.number == 457",
          "timestamp_epoch": "1638560529.783242000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3142,
          "display_filter": "frame.number == 3142",
          "timestamp_epoch": "1638560589.880769000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3147,
          "display_filter": "frame.number == 3147",
          "timestamp_epoch": "1638560589.882273000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3150,
          "display_filter": "frame.number == 3150",
          "timestamp_epoch": "1638560589.883293000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3152,
          "display_filter": "frame.number == 3152",
          "timestamp_epoch": "1638560589.883924000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3154,
          "display_filter": "frame.number == 3154",
          "timestamp_epoch": "1638560589.884555000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3160,
          "display_filter": "frame.number == 3160",
          "timestamp_epoch": "1638560589.887625000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3163,
          "display_filter": "frame.number == 3163",
          "timestamp_epoch": "1638560589.888639000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3168,
          "display_filter": "frame.number == 3168",
          "timestamp_epoch": "1638560589.889364000"
        },
        {
          "tcp_stream": 34,
          "frame_number": 3170,
          "display_filter": "frame.number == 3170",
          "timestamp_epoch": "1638560589.889748000"
        },
        {
          "tcp_stream": 33,
          "frame_number": 3172,
          "display_filter": "frame.number == 3172",
          "timestamp_epoch": "1638560589.889945000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4922,
          "display_filter": "frame.number == 4922",
          "timestamp_epoch": "1638560847.517281000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4927,
          "display_filter": "frame.number == 4927",
          "timestamp_epoch": "1638560847.519610000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4930,
          "display_filter": "frame.number == 4930",
          "timestamp_epoch": "1638560847.521880000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4932,
          "display_filter": "frame.number == 4932",
          "timestamp_epoch": "1638560847.522873000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4934,
          "display_filter": "frame.number == 4934",
          "timestamp_epoch": "1638560847.523802000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4940,
          "display_filter": "frame.number == 4940",
          "timestamp_epoch": "1638560847.528689000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4943,
          "display_filter": "frame.number == 4943",
          "timestamp_epoch": "1638560847.530912000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4948,
          "display_filter": "frame.number == 4948",
          "timestamp_epoch": "1638560847.532062000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4950,
          "display_filter": "frame.number == 4950",
          "timestamp_epoch": "1638560847.533007000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4954,
          "display_filter": "frame.number == 4954",
          "timestamp_epoch": "1638560847.533259000"
        }
      ]
    },
    {
      "id": "finding-8475ce7ff8009e2fa65343ef",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "protocol": "samr",
        "destination": "10.12.3.3",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 290,
          "display_filter": "frame.number == 290",
          "timestamp_epoch": "1638560529.027599000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 292,
          "display_filter": "frame.number == 292",
          "timestamp_epoch": "1638560529.028068000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 294,
          "display_filter": "frame.number == 294",
          "timestamp_epoch": "1638560529.028482000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 296,
          "display_filter": "frame.number == 296",
          "timestamp_epoch": "1638560529.028840000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 298,
          "display_filter": "frame.number == 298",
          "timestamp_epoch": "1638560529.029245000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 300,
          "display_filter": "frame.number == 300",
          "timestamp_epoch": "1638560529.029657000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 302,
          "display_filter": "frame.number == 302",
          "timestamp_epoch": "1638560529.030084000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 304,
          "display_filter": "frame.number == 304",
          "timestamp_epoch": "1638560529.030610000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 306,
          "display_filter": "frame.number == 306",
          "timestamp_epoch": "1638560529.031177000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 308,
          "display_filter": "frame.number == 308",
          "timestamp_epoch": "1638560529.031665000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 310,
          "display_filter": "frame.number == 310",
          "timestamp_epoch": "1638560529.032079000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 312,
          "display_filter": "frame.number == 312",
          "timestamp_epoch": "1638560529.032433000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 314,
          "display_filter": "frame.number == 314",
          "timestamp_epoch": "1638560529.032771000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 316,
          "display_filter": "frame.number == 316",
          "timestamp_epoch": "1638560529.033113000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 318,
          "display_filter": "frame.number == 318",
          "timestamp_epoch": "1638560529.033415000"
        }
      ]
    },
    {
      "id": "finding-851742a6415fa1bccbc91e14",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 107,
        "wire_bytes": 73616,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 30.685
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 92,
          "frame_number": 11092,
          "display_filter": "tcp.stream == 92",
          "timestamp_epoch": "1638562189.711447"
        }
      ]
    },
    {
      "id": "finding-abd2a9fc86c560ac81454b7f",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 147,
        "wire_bytes": 105748,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 57.532
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 113,
          "frame_number": 11301,
          "display_filter": "tcp.stream == 113",
          "timestamp_epoch": "1638562192.632698"
        }
      ]
    },
    {
      "id": "finding-4cad591a164925ce5eac4972",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 168,
        "wire_bytes": 125939,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 42.498
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 241,
          "frame_number": 13057,
          "display_filter": "tcp.stream == 241",
          "timestamp_epoch": "1638562220.118295"
        }
      ]
    },
    {
      "id": "finding-0202ab09088cfed167c269d5",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 583,
        "wire_bytes": 454912,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 33.66
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 443,
          "frame_number": 18188,
          "display_filter": "tcp.stream == 443",
          "timestamp_epoch": "1638562283.142675"
        }
      ]
    },
    {
      "id": "finding-f1de26de42c781e9f106bcac",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 1049,
        "wire_bytes": 805994,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 36.785
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 597,
          "frame_number": 21451,
          "display_filter": "tcp.stream == 597",
          "timestamp_epoch": "1638562316.538087"
        }
      ]
    },
    {
      "id": "finding-e04d6c63378f3367d28a467d",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 108,
        "wire_bytes": 73622,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 59.968
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 598,
          "frame_number": 23295,
          "display_filter": "tcp.stream == 598",
          "timestamp_epoch": "1638562322.890489"
        }
      ]
    },
    {
      "id": "finding-b6bb739b90d87a903a18a586",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 3721,
        "wire_bytes": 2960550,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 34.519
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 748,
          "frame_number": 28378,
          "display_filter": "tcp.stream == 748",
          "timestamp_epoch": "1638562353.057066"
        }
      ]
    },
    {
      "id": "finding-16881a82d5680ecb0bbaef2c",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 111,
        "wire_bytes": 74055,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 49.751
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 895,
          "frame_number": 43910,
          "display_filter": "tcp.stream == 895",
          "timestamp_epoch": "1638562407.885993"
        }
      ]
    },
    {
      "id": "finding-cdfbbc3a86f8ec3d8377d9ff",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 353,
        "wire_bytes": 265548,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 54.922
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1057,
          "frame_number": 46108,
          "display_filter": "tcp.stream == 1057",
          "timestamp_epoch": "1638562433.2206"
        }
      ]
    },
    {
      "id": "finding-64158930a5ca1d9cf666e583",
      "type": "pcap-finding",
      "label": "Sustained external TCP conversation outside decoded application coverage",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.12.3.66",
        "packets": 331,
        "wire_bytes": 262342,
        "destination": "91.207.181.106",
        "destination_port": 8080,
        "duration_seconds": 40.215
      },
      "rule_id": "unclassified-external-tcp",
      "severity": "medium",
      "confidence": 0.7,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1128,
          "frame_number": 47842,
          "display_filter": "tcp.stream == 1128",
          "timestamp_epoch": "1638562457.36879"
        }
      ]
    },
    {
      "id": "identity-5d6b36554a373f811b350b29",
      "type": "identity",
      "label": "account: darin.figueroa",
      "value": "darin.figueroa",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.12.3.66"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 5,
          "frame_number": 224,
          "display_filter": "frame.number == 224",
          "timestamp_epoch": "1638560528.909687000"
        },
        {
          "tcp_stream": 6,
          "frame_number": 232,
          "display_filter": "frame.number == 232",
          "timestamp_epoch": "1638560528.918139000"
        },
        {
          "tcp_stream": 6,
          "frame_number": 234,
          "display_filter": "frame.number == 234",
          "timestamp_epoch": "1638560528.919743000"
        },
        {
          "tcp_stream": 7,
          "frame_number": 246,
          "display_filter": "frame.number == 246",
          "timestamp_epoch": "1638560528.923123000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 274,
          "display_filter": "frame.number == 274",
          "timestamp_epoch": "1638560529.024350000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 305,
          "display_filter": "frame.number == 305",
          "timestamp_epoch": "1638560529.031061000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 341,
          "display_filter": "frame.number == 341",
          "timestamp_epoch": "1638560529.115939000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 395,
          "display_filter": "frame.number == 395",
          "timestamp_epoch": "1638560529.181757000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 407,
          "display_filter": "frame.number == 407",
          "timestamp_epoch": "1638560529.183276000"
        }
      ]
    },
    {
      "id": "identity-d526743902c575c2206f5ebe",
      "type": "identity",
      "label": "domain: FARGREENTECH",
      "value": "FARGREENTECH",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.12.3.66"
      ],
      "identity_type": "domain",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 274,
          "display_filter": "frame.number == 274",
          "timestamp_epoch": "1638560529.024350000"
        }
      ]
    },
    {
      "id": "identity-74f6fa8437d87403154140ae",
      "type": "identity",
      "label": "full-name: Darin Figueroa",
      "value": "Darin Figueroa",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.12.3.66"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 8,
          "frame_number": 305,
          "display_filter": "frame.number == 305",
          "timestamp_epoch": "1638560529.031061000"
        }
      ]
    },
    {
      "id": "identity-3c0db3f5d23c66bc197bee17",
      "type": "identity",
      "label": "hostname: DESKTOP-LUOABV1",
      "value": "DESKTOP-LUOABV1",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.12.3.66"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 1,
          "display_filter": "frame.number == 1",
          "timestamp_epoch": "1638560510.282150000"
        },
        {
          "udp_stream": 0,
          "frame_number": 3,
          "display_filter": "frame.number == 3",
          "timestamp_epoch": "1638560510.288034000"
        },
        {
          "udp_stream": 6,
          "frame_number": 23,
          "display_filter": "frame.number == 23",
          "timestamp_epoch": "1638560510.361363000"
        },
        {
          "udp_stream": 6,
          "frame_number": 59,
          "display_filter": "frame.number == 59",
          "timestamp_epoch": "1638560510.736480000"
        },
        {
          "udp_stream": 6,
          "frame_number": 72,
          "display_filter": "frame.number == 72",
          "timestamp_epoch": "1638560511.124943000"
        },
        {
          "udp_stream": 6,
          "frame_number": 81,
          "display_filter": "frame.number == 81",
          "timestamp_epoch": "1638560511.489834000"
        },
        {
          "udp_stream": 6,
          "frame_number": 85,
          "display_filter": "frame.number == 85",
          "timestamp_epoch": "1638560511.878075000"
        },
        {
          "udp_stream": 6,
          "frame_number": 112,
          "display_filter": "frame.number == 112",
          "timestamp_epoch": "1638560512.254409000"
        },
        {
          "udp_stream": 6,
          "frame_number": 116,
          "display_filter": "frame.number == 116",
          "timestamp_epoch": "1638560512.647942000"
        },
        {
          "udp_stream": 6,
          "frame_number": 119,
          "display_filter": "frame.number == 119",
          "timestamp_epoch": "1638560513.025401000"
        },
        {
          "tcp_stream": 2,
          "frame_number": 157,
          "display_filter": "frame.number == 157",
          "timestamp_epoch": "1638560516.663175000"
        },
        {
          "udp_stream": 22,
          "frame_number": 197,
          "display_filter": "frame.number == 197",
          "timestamp_epoch": "1638560519.733332000"
        },
        {
          "udp_stream": 22,
          "frame_number": 198,
          "display_filter": "frame.number == 198",
          "timestamp_epoch": "1638560519.739766000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 274,
          "display_filter": "frame.number == 274",
          "timestamp_epoch": "1638560529.024350000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6372,
          "display_filter": "frame.number == 6372",
          "timestamp_epoch": "1638561241.960396000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6543,
          "display_filter": "frame.number == 6543",
          "timestamp_epoch": "1638561962.497879000"
        }
      ]
    },
    {
      "id": "identity-8b311739b78ca92b8e6d3e09",
      "type": "identity",
      "label": "hostname: FARGREENTECH",
      "value": "FARGREENTECH",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.12.3.66"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 6,
          "frame_number": 132,
          "display_filter": "frame.number == 132",
          "timestamp_epoch": "1638560516.545745000"
        },
        {
          "udp_stream": 22,
          "frame_number": 136,
          "display_filter": "frame.number == 136",
          "timestamp_epoch": "1638560516.547184000"
        },
        {
          "udp_stream": 23,
          "frame_number": 137,
          "display_filter": "frame.number == 137",
          "timestamp_epoch": "1638560516.547368000"
        },
        {
          "udp_stream": 6,
          "frame_number": 172,
          "display_filter": "frame.number == 172",
          "timestamp_epoch": "1638560516.667931000"
        }
      ]
    },
    {
      "id": "identity-09f0246d7c6ac3af99f5e2ec",
      "type": "identity",
      "label": "netbios-group: FARGREENTECH",
      "value": "FARGREENTECH",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 6,
          "frame_number": 60,
          "display_filter": "frame.number == 60",
          "timestamp_epoch": "1638560510.736543000"
        },
        {
          "udp_stream": 6,
          "frame_number": 80,
          "display_filter": "frame.number == 80",
          "timestamp_epoch": "1638560511.489833000"
        },
        {
          "udp_stream": 6,
          "frame_number": 113,
          "display_filter": "frame.number == 113",
          "timestamp_epoch": "1638560512.254410000"
        },
        {
          "udp_stream": 6,
          "frame_number": 118,
          "display_filter": "frame.number == 118",
          "timestamp_epoch": "1638560513.025399000"
        },
        {
          "udp_stream": 6,
          "frame_number": 120,
          "display_filter": "frame.number == 120",
          "timestamp_epoch": "1638560513.456004000"
        },
        {
          "udp_stream": 6,
          "frame_number": 125,
          "display_filter": "frame.number == 125",
          "timestamp_epoch": "1638560514.209333000"
        },
        {
          "udp_stream": 6,
          "frame_number": 126,
          "display_filter": "frame.number == 126",
          "timestamp_epoch": "1638560514.960655000"
        },
        {
          "udp_stream": 6,
          "frame_number": 130,
          "display_filter": "frame.number == 130",
          "timestamp_epoch": "1638560515.751429000"
        },
        {
          "udp_stream": 6,
          "frame_number": 179,
          "display_filter": "frame.number == 179",
          "timestamp_epoch": "1638560516.669682000"
        },
        {
          "udp_stream": 6,
          "frame_number": 193,
          "display_filter": "frame.number == 193",
          "timestamp_epoch": "1638560517.415887000"
        },
        {
          "udp_stream": 6,
          "frame_number": 194,
          "display_filter": "frame.number == 194",
          "timestamp_epoch": "1638560518.170350000"
        },
        {
          "udp_stream": 6,
          "frame_number": 195,
          "display_filter": "frame.number == 195",
          "timestamp_epoch": "1638560518.941158000"
        }
      ]
    },
    {
      "id": "artifact-11a8fbae98a3126ee8453ab2",
      "type": "file-artifact",
      "label": "sSTToaEwCG5VASw",
      "value": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "sha256": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 4334,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-eadf61db2925b9c390795fae",
      "type": "file-artifact",
      "label": "object52357",
      "value": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "sha256": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1523,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a52d8aaac28726dcfbe6c851",
      "type": "file-artifact",
      "label": "object15143",
      "value": "43a258e943f8cd5728ccf1018a03865b61c37dfed7f48995afe4ffd47b6cb8b7",
      "sha256": "43a258e943f8cd5728ccf1018a03865b61c37dfed7f48995afe4ffd47b6cb8b7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1523,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-408372fdd5641fabad7d6ec5",
      "type": "file-artifact",
      "label": "object30893",
      "value": "0b2e930d209670f78f6aaa3f2d19fd749c38c7bc223d2f6325df6b9f7614b5ff",
      "sha256": "0b2e930d209670f78f6aaa3f2d19fd749c38c7bc223d2f6325df6b9f7614b5ff",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-fc8e45126ab8c3f30798e2ab",
      "type": "file-artifact",
      "label": "object53515",
      "value": "0cf2273cfb4ed1bc7051f653b37843c2fb2209d2bc95d5a38e4c8b76a97e3dac",
      "sha256": "0cf2273cfb4ed1bc7051f653b37843c2fb2209d2bc95d5a38e4c8b76a97e3dac",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a2685223232d33671eea526f",
      "type": "file-artifact",
      "label": "object46438",
      "value": "245afb556ba5bd1d4eff3e45c51f83f18ebdedefe744a7cd668a720ac0be841e",
      "sha256": "245afb556ba5bd1d4eff3e45c51f83f18ebdedefe744a7cd668a720ac0be841e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-226773165fc7dd3e640f1d11",
      "type": "file-artifact",
      "label": "object15275",
      "value": "250d82db6d12fbc6a4f93c9be1cfc6d819cb4f6d6e0d66648b2c66286d1e0c5f",
      "sha256": "250d82db6d12fbc6a4f93c9be1cfc6d819cb4f6d6e0d66648b2c66286d1e0c5f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-fb7fc6d4d109e57e7156d380",
      "type": "file-artifact",
      "label": "object32536",
      "value": "26ec6c18d689cdab1e882b3e5c40454fdde105b4dad784fc0b70ec34f33a685d",
      "sha256": "26ec6c18d689cdab1e882b3e5c40454fdde105b4dad784fc0b70ec34f33a685d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-afd24c6554a79339818cbfdc",
      "type": "file-artifact",
      "label": "object22887",
      "value": "2b5cd53248ff8bc195e931ea07c8ec7a6a6d4c9c3b3e326b3af21ca6d2e396a3",
      "sha256": "2b5cd53248ff8bc195e931ea07c8ec7a6a6d4c9c3b3e326b3af21ca6d2e396a3",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8a66555d071ad3a283e3cf51",
      "type": "file-artifact",
      "label": "object31033",
      "value": "32f3a788a007aded055b0c3f1596e75876843afc5f7e2562ffb2a981954bc5b9",
      "sha256": "32f3a788a007aded055b0c3f1596e75876843afc5f7e2562ffb2a981954bc5b9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-174402f43f93bac66f026d4b",
      "type": "file-artifact",
      "label": "object53575",
      "value": "33bf9ccf421e4074ef459928e02242cc1e678da63061f3c4fdbd77aaa5a5c899",
      "sha256": "33bf9ccf421e4074ef459928e02242cc1e678da63061f3c4fdbd77aaa5a5c899",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c448dc0bba6513ad5fef3cd1",
      "type": "file-artifact",
      "label": "object52709",
      "value": "34efa567764f17e790931c8a0bd8c00126acab0e76f53a9847f674c0c4eaad95",
      "sha256": "34efa567764f17e790931c8a0bd8c00126acab0e76f53a9847f674c0c4eaad95",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a01d7aad568bc3f842a3b543",
      "type": "file-artifact",
      "label": "object49925",
      "value": "367912ca5e87e14e40985a68eab3831fcc2cf94405a80442f4d2440ade4e434d",
      "sha256": "367912ca5e87e14e40985a68eab3831fcc2cf94405a80442f4d2440ade4e434d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bfec08c30844f321f3d5d186",
      "type": "file-artifact",
      "label": "object54034",
      "value": "38cbe5f6f1edafbf65fcb5fbe27f69c8d2de10fa41e05f8162bc0091bdd0082c",
      "sha256": "38cbe5f6f1edafbf65fcb5fbe27f69c8d2de10fa41e05f8162bc0091bdd0082c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2b26356e41bdf9d9d83c3c4a",
      "type": "file-artifact",
      "label": "object54392",
      "value": "398d8ab91648e39ce8559875ceffc4a8724e4259089bbe99a8ab871bd8cd510a",
      "sha256": "398d8ab91648e39ce8559875ceffc4a8724e4259089bbe99a8ab871bd8cd510a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-227a43283e073376c9e7fe66",
      "type": "file-artifact",
      "label": "object29937",
      "value": "465a2843237e39fd98af179ad65eb4f108513067d1c969bbeaa1c2cfccb26e5c",
      "sha256": "465a2843237e39fd98af179ad65eb4f108513067d1c969bbeaa1c2cfccb26e5c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c2c07c449160dc62e8c8e9fd",
      "type": "file-artifact",
      "label": "object52814",
      "value": "4724352878e31617bd51e7499dd320a9f3d0c759ae4768ae31acd2612ece99b2",
      "sha256": "4724352878e31617bd51e7499dd320a9f3d0c759ae4768ae31acd2612ece99b2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c2de92ddb1f9af556a84c8e9",
      "type": "file-artifact",
      "label": "object51834",
      "value": "473e9d4a177530efe3f1ed28ec3fdfe042a999f93ee3ea6cfb5f0fbf1509eb3d",
      "sha256": "473e9d4a177530efe3f1ed28ec3fdfe042a999f93ee3ea6cfb5f0fbf1509eb3d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6463483b21cc5abe24e0754d",
      "type": "file-artifact",
      "label": "object53351",
      "value": "4db16bca2fd7324cdc66d241e0b3e950e153bb9534e60c1160d1ba0e9c18d083",
      "sha256": "4db16bca2fd7324cdc66d241e0b3e950e153bb9534e60c1160d1ba0e9c18d083",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-72d16cdca0d3e67a6032b099",
      "type": "file-artifact",
      "label": "object32196",
      "value": "4ed21b81e706b20773e4f3c10dbe7fb015dbce15aa429db06f93d804a4e0ff62",
      "sha256": "4ed21b81e706b20773e4f3c10dbe7fb015dbce15aa429db06f93d804a4e0ff62",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bc7b18bbf92deee85350dac4",
      "type": "file-artifact",
      "label": "object31009",
      "value": "4f56fad91f1644a4257195137fcf8f6e821e3ea3ea96e165daf57e529fe521ff",
      "sha256": "4f56fad91f1644a4257195137fcf8f6e821e3ea3ea96e165daf57e529fe521ff",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-94cdd9ed228fed094bd61cfd",
      "type": "file-artifact",
      "label": "object52046",
      "value": "4fa3add17dca31bdfb61917c627b2ec9fff3716ed0eee78d31ca10bce3b5ad7b",
      "sha256": "4fa3add17dca31bdfb61917c627b2ec9fff3716ed0eee78d31ca10bce3b5ad7b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f85dc8c80bbab5bf4dbb3999",
      "type": "file-artifact",
      "label": "object54214",
      "value": "51ada0d3e87516cded91d77b86d32a08bfedd96cf5b5e3fddd084fe61d5d7a21",
      "sha256": "51ada0d3e87516cded91d77b86d32a08bfedd96cf5b5e3fddd084fe61d5d7a21",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-937e30fed906de13ebb6ec6f",
      "type": "file-artifact",
      "label": "object32123",
      "value": "526ba4dd3baed534f591d3b8f53cc2268d8e11d3ac3961fdeec21e8bb6078063",
      "sha256": "526ba4dd3baed534f591d3b8f53cc2268d8e11d3ac3961fdeec21e8bb6078063",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-668b453cee4a0cce4b91c303",
      "type": "file-artifact",
      "label": "object52334",
      "value": "53bbc8b15e8f03691544144a2b45d417d5c5d840b1f779624afcc479d8fa8813",
      "sha256": "53bbc8b15e8f03691544144a2b45d417d5c5d840b1f779624afcc479d8fa8813",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a76c09910c2ee2602f4d69bf",
      "type": "file-artifact",
      "label": "object32989",
      "value": "56d9a87699b652053de95016b18a677a850b948d1f0061aeef3951f9cbecd2ac",
      "sha256": "56d9a87699b652053de95016b18a677a850b948d1f0061aeef3951f9cbecd2ac",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b53b64e34b0e874e1667634b",
      "type": "file-artifact",
      "label": "object30399",
      "value": "57865023300c0ed7bcc2e312f58b481635f5efa0ee8750a39da4838b25dbed10",
      "sha256": "57865023300c0ed7bcc2e312f58b481635f5efa0ee8750a39da4838b25dbed10",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-81cf0227288ccfbcef18c4be",
      "type": "file-artifact",
      "label": "object22862",
      "value": "5b43f9a38fc4125cd084c915a715fd8080bd829e34406729e73ac02b6d80b288",
      "sha256": "5b43f9a38fc4125cd084c915a715fd8080bd829e34406729e73ac02b6d80b288",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-af131e454c7235be4b56e1dd",
      "type": "file-artifact",
      "label": "object33448",
      "value": "5f3061cb3b17856f18adaefd99f3960482f2474c1f0191de970a7cac0444260d",
      "sha256": "5f3061cb3b17856f18adaefd99f3960482f2474c1f0191de970a7cac0444260d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-489529b5cd6638a85465732b",
      "type": "file-artifact",
      "label": "object30376",
      "value": "61fb009bf5c563ebd3f2334446057d1013f68f052fb08f48a297bb2edb57f71b",
      "sha256": "61fb009bf5c563ebd3f2334446057d1013f68f052fb08f48a297bb2edb57f71b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bcd4f61dceec201f131ab83b",
      "type": "file-artifact",
      "label": "object52180",
      "value": "63137c9e2fdc28ddaec8c99e9df36eab9d63a2129438ae0921f9827defc3806d",
      "sha256": "63137c9e2fdc28ddaec8c99e9df36eab9d63a2129438ae0921f9827defc3806d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7912daee7258f3a252b8afa1",
      "type": "file-artifact",
      "label": "object18811",
      "value": "6956751df0c5ab706d011b2746a3709835f56e2d620a8775133f79362c4e1bda",
      "sha256": "6956751df0c5ab706d011b2746a3709835f56e2d620a8775133f79362c4e1bda",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b8ad53967293c799152c0817",
      "type": "file-artifact",
      "label": "object30761",
      "value": "6b659e04d03b4c6abeb9fc4d31d4d4442801e0a6c5e06d56f62fe49d915e8a0e",
      "sha256": "6b659e04d03b4c6abeb9fc4d31d4d4442801e0a6c5e06d56f62fe49d915e8a0e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-73cc4b8745aac47854482dcc",
      "type": "file-artifact",
      "label": "object18745",
      "value": "7038bd0d004e61fbdd451623d51c217ffda4fb2723975dbc02a1b10fa121ff26",
      "sha256": "7038bd0d004e61fbdd451623d51c217ffda4fb2723975dbc02a1b10fa121ff26",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5b69d99fb3ca0796fb73e4b9",
      "type": "file-artifact",
      "label": "object31121",
      "value": "7e08110ab733043f314cb23d05ca5fc0bd4beb2de9c33e6ab35836a6eb0a00a5",
      "sha256": "7e08110ab733043f314cb23d05ca5fc0bd4beb2de9c33e6ab35836a6eb0a00a5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3d6a38479d2f4048e942bee4",
      "type": "file-artifact",
      "label": "object18619",
      "value": "82391338f3ede30f52a646fc558a4c20beba5db70ef26d1e7f1c63b11970ab67",
      "sha256": "82391338f3ede30f52a646fc558a4c20beba5db70ef26d1e7f1c63b11970ab67",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a00e757d284a41cf6d524474",
      "type": "file-artifact",
      "label": "object29113",
      "value": "88f42f2c65bfe60c6395328f200ed242f0cf3dded1c22a3cd07204d56525bf28",
      "sha256": "88f42f2c65bfe60c6395328f200ed242f0cf3dded1c22a3cd07204d56525bf28",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b0d1bbc7e6169bea80d58dbf",
      "type": "file-artifact",
      "label": "object54190",
      "value": "8ff8d44a63e43c9aea1d597f0a101445df8d6679df657c92c0d6faeb07245422",
      "sha256": "8ff8d44a63e43c9aea1d597f0a101445df8d6679df657c92c0d6faeb07245422",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-64d7e8ba1ae4f7dd8f8787a5",
      "type": "file-artifact",
      "label": "object33388",
      "value": "93e83129d829e059611c03fb9536529c7581e94017a8a247d0764df0c0889791",
      "sha256": "93e83129d829e059611c03fb9536529c7581e94017a8a247d0764df0c0889791",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2ce800d0056734956db6daee",
      "type": "file-artifact",
      "label": "object53376",
      "value": "93e914a6facbc2481df7473c52459dbb24ca163e4510445893fd03ebc444480b",
      "sha256": "93e914a6facbc2481df7473c52459dbb24ca163e4510445893fd03ebc444480b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-019aa729d00a3efd73731144",
      "type": "file-artifact",
      "label": "object32566",
      "value": "971fa77239886aaf06e6f65eca0a607cc8ada189aaca1f69eb9f894c0deb4a96",
      "sha256": "971fa77239886aaf06e6f65eca0a607cc8ada189aaca1f69eb9f894c0deb4a96",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9aa56a425f2cc7dee0de4f72",
      "type": "file-artifact",
      "label": "object53160",
      "value": "9f6d91ccc16d4a26cf0fe623bc1ef1a597d983f166826ba47e6434910d1c3336",
      "sha256": "9f6d91ccc16d4a26cf0fe623bc1ef1a597d983f166826ba47e6434910d1c3336",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ee11cac3dd7300fa87c38edf",
      "type": "file-artifact",
      "label": "object53916",
      "value": "9ff868e0d2918a01a1f6c8a72cbed18403b8f66d25ccf0d19acad8ca7bb6986d",
      "sha256": "9ff868e0d2918a01a1f6c8a72cbed18403b8f66d25ccf0d19acad8ca7bb6986d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8f807967436652e05906108b",
      "type": "file-artifact",
      "label": "object53672",
      "value": "a6f76feb3a4d155ed886c5dbc9980941ec147872aa7a8b89abea415216fb972f",
      "sha256": "a6f76feb3a4d155ed886c5dbc9980941ec147872aa7a8b89abea415216fb972f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-05cd5579e02d53dc239574c2",
      "type": "file-artifact",
      "label": "object31505",
      "value": "a7ea74281391750b02cfcb614469e8f355443ee33290f512b27b6a6c50f84622",
      "sha256": "a7ea74281391750b02cfcb614469e8f355443ee33290f512b27b6a6c50f84622",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2b9a9a4d44efa3a9c6e7435b",
      "type": "file-artifact",
      "label": "object23504",
      "value": "b947d88ec74e3504f3b45342741c224d51d504af8368c7fae4841310def2bfe1",
      "sha256": "b947d88ec74e3504f3b45342741c224d51d504af8368c7fae4841310def2bfe1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1bb646485bb4b68c968ece6d",
      "type": "file-artifact",
      "label": "object51765",
      "value": "b982edb41289eb8e2a0be5c14616d9522142daa952415f0d0c96deef2eefeda5",
      "sha256": "b982edb41289eb8e2a0be5c14616d9522142daa952415f0d0c96deef2eefeda5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-033da09db6dce5a3da77af92",
      "type": "file-artifact",
      "label": "object31261",
      "value": "bb8d070ab43578233d89a2400c7c434f3ee15dc8c76ce5456e265cd68613a7f9",
      "sha256": "bb8d070ab43578233d89a2400c7c434f3ee15dc8c76ce5456e265cd68613a7f9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-df484f64fd26c4252db6426c",
      "type": "file-artifact",
      "label": "object52500",
      "value": "cc2d680db9b64012df081755faba4281f0a482b1efe5c0d45cccbf44e1146cf2",
      "sha256": "cc2d680db9b64012df081755faba4281f0a482b1efe5c0d45cccbf44e1146cf2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3564669f7dd198e4f4745be6",
      "type": "file-artifact",
      "label": "object23724",
      "value": "ce7336e46e69697b00c496073012548a733921e8b584e241053b38a086040f6a",
      "sha256": "ce7336e46e69697b00c496073012548a733921e8b584e241053b38a086040f6a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-041c2a273b14b9bbd7a46733",
      "type": "file-artifact",
      "label": "object44224",
      "value": "cf9b3de8917fbd7b627d4f0a32f4ab067c0d4a047ca87bf2dd7c1c0fa5977c53",
      "sha256": "cf9b3de8917fbd7b627d4f0a32f4ab067c0d4a047ca87bf2dd7c1c0fa5977c53",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5443ad6a0f8a884f727317b6",
      "type": "file-artifact",
      "label": "object33492",
      "value": "d1e9ccf86eb1e1e97645ea5bd8b2fe203903501273bdafe211aaaf43a050e42f",
      "sha256": "d1e9ccf86eb1e1e97645ea5bd8b2fe203903501273bdafe211aaaf43a050e42f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6e55f75f6ed91e6ed27cb66f",
      "type": "file-artifact",
      "label": "object22839",
      "value": "d4109a6ae38b5f386c33b725308bc7b9ba01c0f7fb177b3edbbee1d5d5c203b9",
      "sha256": "d4109a6ae38b5f386c33b725308bc7b9ba01c0f7fb177b3edbbee1d5d5c203b9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c77a7c20f6d0987390396ee4",
      "type": "file-artifact",
      "label": "object53810",
      "value": "d4d48dea91cd0ebb930092dfd4d693f5eac915fdab0c53040ed9277d30aff980",
      "sha256": "d4d48dea91cd0ebb930092dfd4d693f5eac915fdab0c53040ed9277d30aff980",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ae3017ebffe869d6d7b72e0b",
      "type": "file-artifact",
      "label": "object51812",
      "value": "ea356b9fe5e4cd10ff16783e8f0d9a36054b1e8650e02253d7fd5d05b71a5146",
      "sha256": "ea356b9fe5e4cd10ff16783e8f0d9a36054b1e8650e02253d7fd5d05b71a5146",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0a63e46d1687f4973d4e560e",
      "type": "file-artifact",
      "label": "object30029",
      "value": "ef772f43958315122fc750cb52a6c8f60362283e68c2a1ac449ec41cf1b0f561",
      "sha256": "ef772f43958315122fc750cb52a6c8f60362283e68c2a1ac449ec41cf1b0f561",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-19122317ade473926c80424b",
      "type": "file-artifact",
      "label": "object52203",
      "value": "effad7b3021800a4d426f10291186b533f0a6434fc1bfc91be07361faa78b663",
      "sha256": "effad7b3021800a4d426f10291186b533f0a6434fc1bfc91be07361faa78b663",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-09d1d30624f30cff5f505778",
      "type": "file-artifact",
      "label": "object52909",
      "value": "f3f4bd16d2dccbdcb3c378e8cbcf5fc3fdbe1750da5c411c408d6c695f3c2374",
      "sha256": "f3f4bd16d2dccbdcb3c378e8cbcf5fc3fdbe1750da5c411c408d6c695f3c2374",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ee3aaa8da8ef03c207fedd77",
      "type": "file-artifact",
      "label": "object29136",
      "value": "f938fc5c9098e2f06b104998f23d8c691e23465d50b7bd7549112751e9c75e6f",
      "sha256": "f938fc5c9098e2f06b104998f23d8c691e23465d50b7bd7549112751e9c75e6f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a8a9a8e1053db4754e4643e4",
      "type": "file-artifact",
      "label": "object53486",
      "value": "fe07c43edc7a3842e06bfd354f506e86a7dcb13689a4be3b94843d6fe655fa28",
      "sha256": "fe07c43edc7a3842e06bfd354f506e86a7dcb13689a4be3b94843d6fe655fa28",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bfc428d1011f7f395f5ef0fc",
      "type": "file-artifact",
      "label": "object33144",
      "value": "fe6e39f569582b37f300c2d258a4440dd6473e89e44e2f1c05219020e56d7c6f",
      "sha256": "fe6e39f569582b37f300c2d258a4440dd6473e89e44e2f1c05219020e56d7c6f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3323cbaf9a7464ffebe7baf0",
      "type": "file-artifact",
      "label": "object54319",
      "value": "fe796664efee221a3b7427e112e3e816629ddfc20433bb3fc032f31a7652bec7",
      "sha256": "fe796664efee221a3b7427e112e3e816629ddfc20433bb3fc032f31a7652bec7",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1442,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-441dcca94340190ba3a35dff",
      "type": "file-artifact",
      "label": "object30496",
      "value": "0012aa801678ae49c2d6e962920c3f912672e7deabd1338b08f786e71f91e911",
      "sha256": "0012aa801678ae49c2d6e962920c3f912672e7deabd1338b08f786e71f91e911",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-949bcc75735d7a9bef6997c0",
      "type": "file-artifact",
      "label": "object49973",
      "value": "00572b8a56fba936d13eb443442624bbd01a0f8c9c676a8428f5c14c78b3dee9",
      "sha256": "00572b8a56fba936d13eb443442624bbd01a0f8c9c676a8428f5c14c78b3dee9",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-27b25c3881790052ee1dbd4c",
      "type": "file-artifact",
      "label": "object15513",
      "value": "006623b67391b15bdc7f15ea38951f72b3f0bc2aef1279f5e2ef4c49fdceb61f",
      "sha256": "006623b67391b15bdc7f15ea38951f72b3f0bc2aef1279f5e2ef4c49fdceb61f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-25cb4beef7d4337aae6b1633",
      "type": "file-artifact",
      "label": "object32910",
      "value": "0072d405aa5414a5aa300a5dbc908c12b181988c74010c4fb5f12c19b55b075e",
      "sha256": "0072d405aa5414a5aa300a5dbc908c12b181988c74010c4fb5f12c19b55b075e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a1048e5ea7d853682af93b29",
      "type": "file-artifact",
      "label": "object34020",
      "value": "00a17cac5a3fd69a5b23dc5387136fe283d71d9c9088288ab31370542c493c5c",
      "sha256": "00a17cac5a3fd69a5b23dc5387136fe283d71d9c9088288ab31370542c493c5c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a2a62b6fd58839ba93627519",
      "type": "file-artifact",
      "label": "object31492",
      "value": "00dc31d414c0738b0d71cdbfca06346612a337a8bb93f48191e7743acfadfc23",
      "sha256": "00dc31d414c0738b0d71cdbfca06346612a337a8bb93f48191e7743acfadfc23",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1834151f6b42db7a7c04a04b",
      "type": "file-artifact",
      "label": "object15587",
      "value": "00dd56a10881d0d22c2c6d6666f7227317cbd5c53342ef99cb4ccbde46d1513f",
      "sha256": "00dd56a10881d0d22c2c6d6666f7227317cbd5c53342ef99cb4ccbde46d1513f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-65584a7974cc0724cf2a1026",
      "type": "file-artifact",
      "label": "object51603",
      "value": "00f88c0a50b5db8457f302b996f10e6e213aa415bd35764e878af92d1d98dbeb",
      "sha256": "00f88c0a50b5db8457f302b996f10e6e213aa415bd35764e878af92d1d98dbeb",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-35596f7d868eedf724c7a364",
      "type": "file-artifact",
      "label": "object33178",
      "value": "0104013328f4d3f2b6f57f798cb6a327940aaef2f390131951ad1159de6bc6bd",
      "sha256": "0104013328f4d3f2b6f57f798cb6a327940aaef2f390131951ad1159de6bc6bd",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6cb59c049cd8755dfcf13733",
      "type": "file-artifact",
      "label": "object49985",
      "value": "012ef80f044aeac2bb3b458fd60b94c7cf05aa792a99b3ed90874652418d3c2b",
      "sha256": "012ef80f044aeac2bb3b458fd60b94c7cf05aa792a99b3ed90874652418d3c2b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-d5b0f1365bff9f9b32199ccd",
      "type": "file-artifact",
      "label": "object46287",
      "value": "013362d5b3634cb0e8991a6b1516aeb4da26196fb07776f2de19aed375f506f0",
      "sha256": "013362d5b3634cb0e8991a6b1516aeb4da26196fb07776f2de19aed375f506f0",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-778a33592ec8ef424f52e072",
      "type": "file-artifact",
      "label": "object30974",
      "value": "0157f5d604041e48cd6e91b973c8b610189a7b5c180845a55413c8663235af64",
      "sha256": "0157f5d604041e48cd6e91b973c8b610189a7b5c180845a55413c8663235af64",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-cdde0642bbc3736df76d0b93",
      "type": "file-artifact",
      "label": "object16659",
      "value": "01883ea44373de2ba27f0b322e6ee9e150f51a1a1f9ebb1c8990c55fb5ffb500",
      "sha256": "01883ea44373de2ba27f0b322e6ee9e150f51a1a1f9ebb1c8990c55fb5ffb500",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-647c8c70a7d104a003ace5f0",
      "type": "file-artifact",
      "label": "object53163",
      "value": "01a99e3f02848b519b3c3a036af0d26363b9c38ef8bb162144100367c3ef68ea",
      "sha256": "01a99e3f02848b519b3c3a036af0d26363b9c38ef8bb162144100367c3ef68ea",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-159f477708e7524e0e00f577",
      "type": "file-artifact",
      "label": "object13108",
      "value": "01ab3d222b25628cb40111921527735ae76c39fa4cec77784dc7a21da51f7fde",
      "sha256": "01ab3d222b25628cb40111921527735ae76c39fa4cec77784dc7a21da51f7fde",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-62e973431072d7e03fe5122c",
      "type": "file-artifact",
      "label": "object30260",
      "value": "01c6989be26c5296352274615da5427b35ebeb8fab60e3677716ba8ddde9f580",
      "sha256": "01c6989be26c5296352274615da5427b35ebeb8fab60e3677716ba8ddde9f580",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-980cb231d8b44644fa22d165",
      "type": "file-artifact",
      "label": "object15539",
      "value": "025a33285a9207330b494981bdf5276647b94d41e022225c8ae671f1ae60567e",
      "sha256": "025a33285a9207330b494981bdf5276647b94d41e022225c8ae671f1ae60567e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c16c3e51bb3edcdf92188cfe",
      "type": "file-artifact",
      "label": "object51887",
      "value": "029046b4eb0c08411ed9b3201220c86a89b6fc2e776711595914c4b8414c6694",
      "sha256": "029046b4eb0c08411ed9b3201220c86a89b6fc2e776711595914c4b8414c6694",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-c3ce7bbb1d0a71ff7e72c17e",
      "type": "file-artifact",
      "label": "object32028",
      "value": "02b9310a633169e1e199f3129745cedef8be1886bbd63ef55a95f2419b4e810e",
      "sha256": "02b9310a633169e1e199f3129745cedef8be1886bbd63ef55a95f2419b4e810e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-27e8848b305e50174621c070",
      "type": "file-artifact",
      "label": "object33440",
      "value": "0332d0cbae4950c24bc6619fbbe1465c57e6c8e12040586494a35619b28fd122",
      "sha256": "0332d0cbae4950c24bc6619fbbe1465c57e6c8e12040586494a35619b28fd122",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-78836560342823dc3b2b3341",
      "type": "file-artifact",
      "label": "object29431",
      "value": "03a354f9de7d86876f7d23695b1a1d7f3466b0982462e542e80bd53a41e6850c",
      "sha256": "03a354f9de7d86876f7d23695b1a1d7f3466b0982462e542e80bd53a41e6850c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5140e63bbb564a2d7aec4dfb",
      "type": "file-artifact",
      "label": "object52325",
      "value": "03b590abb054b607f92d48b851f88ccf57fd51bf17becbf5fcdec2926388df8d",
      "sha256": "03b590abb054b607f92d48b851f88ccf57fd51bf17becbf5fcdec2926388df8d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b7be1affcbb47df189b2fbf4",
      "type": "file-artifact",
      "label": "object49964",
      "value": "03b6d46d7cceeed3b05bd04e02f2794a603fafccad5eeb88e2dc7bcaf8ff91a8",
      "sha256": "03b6d46d7cceeed3b05bd04e02f2794a603fafccad5eeb88e2dc7bcaf8ff91a8",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ba0612379cf2996766ea1e2e",
      "type": "file-artifact",
      "label": "object15112",
      "value": "03c8e8681de20f44fca121de3691c487d7d6fef3fadfc37e5cfb9f11907beb0f",
      "sha256": "03c8e8681de20f44fca121de3691c487d7d6fef3fadfc37e5cfb9f11907beb0f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-2e2f830a539d87262bc54e4b",
      "type": "file-artifact",
      "label": "object54199",
      "value": "03d054646bce2a15c17a2b9f1e6abcff498d5b4dbd8555396e5a11584358431c",
      "sha256": "03d054646bce2a15c17a2b9f1e6abcff498d5b4dbd8555396e5a11584358431c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-94e78e98b42bb331003bc1ba",
      "type": "file-artifact",
      "label": "object48073",
      "value": "03d8eade1fbf830407059b3531802fd500b60ae267cd77612ef2ef1bf5370c75",
      "sha256": "03d8eade1fbf830407059b3531802fd500b60ae267cd77612ef2ef1bf5370c75",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3e2ac3175398e36a3a5b656d",
      "type": "file-artifact",
      "label": "object23580",
      "value": "03da014864a4f3e63c1840a57a7a41d260779e9e4783b7439a2ffe91d0564f6d",
      "sha256": "03da014864a4f3e63c1840a57a7a41d260779e9e4783b7439a2ffe91d0564f6d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-01be30b1090421f34cb6f0c5",
      "type": "file-artifact",
      "label": "object23495",
      "value": "0405bac83ab8c5f11913dbb716075cae23e482c66d88a28c099dcdbd145b6dcb",
      "sha256": "0405bac83ab8c5f11913dbb716075cae23e482c66d88a28c099dcdbd145b6dcb",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b3401d2cc626f8a414e9b33c",
      "type": "file-artifact",
      "label": "object32055",
      "value": "041467a3bee037373a1c5a5c745e243c91b3e23b85e96ea6c92c14402cd6003f",
      "sha256": "041467a3bee037373a1c5a5c745e243c91b3e23b85e96ea6c92c14402cd6003f",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4429ac28a23190f4e89c017e",
      "type": "file-artifact",
      "label": "object54018",
      "value": "04156590b6fd4be0762d5f6b5b3ad92b3bcd2981945ee402948dc837e7e5e979",
      "sha256": "04156590b6fd4be0762d5f6b5b3ad92b3bcd2981945ee402948dc837e7e5e979",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-9dcf879ad55d0969cca893ef",
      "type": "file-artifact",
      "label": "object33152",
      "value": "041952257a132d2b4338692650357096c8f6bf6d1300a37429d7d532da0941b1",
      "sha256": "041952257a132d2b4338692650357096c8f6bf6d1300a37429d7d532da0941b1",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-82b0f938c72b2266967901b2",
      "type": "file-artifact",
      "label": "object33684",
      "value": "045281fc55e6d6578fac3b7cd59d914d0c004dee44a5747807687b02f2c6bf95",
      "sha256": "045281fc55e6d6578fac3b7cd59d914d0c004dee44a5747807687b02f2c6bf95",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-0ef4837d3454f03ad76ccf2a",
      "type": "file-artifact",
      "label": "object13177",
      "value": "0483ba73e19d23352009800bc48ad89b9366572500a60a67019383755995017a",
      "sha256": "0483ba73e19d23352009800bc48ad89b9366572500a60a67019383755995017a",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f618e5fd05ea483324f8009f",
      "type": "file-artifact",
      "label": "object53140",
      "value": "04c196337ac9e4ea59491ebe0161ba1fea2df8cf008da680d61f91b44381735d",
      "sha256": "04c196337ac9e4ea59491ebe0161ba1fea2df8cf008da680d61f91b44381735d",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-b3695f4794bbd5eb0cc5e0e9",
      "type": "file-artifact",
      "label": "object32627",
      "value": "04f84c9cb8a90f08af403970bc08bc44833a198ede19dae2337fbcccfd173796",
      "sha256": "04f84c9cb8a90f08af403970bc08bc44833a198ede19dae2337fbcccfd173796",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8e3c94caffc395f9cfc0b591",
      "type": "file-artifact",
      "label": "object52923",
      "value": "04ff3f7973ed0862d3a40581b6f2f57ecf11b2443ff09ddc4d8d472d1b6ece4b",
      "sha256": "04ff3f7973ed0862d3a40581b6f2f57ecf11b2443ff09ddc4d8d472d1b6ece4b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4c6c177a9be5b07670b67c7b",
      "type": "file-artifact",
      "label": "object30319",
      "value": "053e49637cadeb1904e14922390d3973ee989c9e6b4e923d0fda878343c3bf3e",
      "sha256": "053e49637cadeb1904e14922390d3973ee989c9e6b4e923d0fda878343c3bf3e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4aea194f6c397b3959d7c00d",
      "type": "file-artifact",
      "label": "object28909",
      "value": "054a254feaca85b72805a88f8a8aa75ce34a8f3ad73c8319bc636a2cf4341761",
      "sha256": "054a254feaca85b72805a88f8a8aa75ce34a8f3ad73c8319bc636a2cf4341761",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1361,
      "source_ref": "2021-12-08-ISC-Forensic-Challenge.pcap",
      "analysis_id": "96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "source_refs": [
        "2021-12-08-ISC-Forensic-Challenge.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "type": "ioc-investigation",
      "label": "newsaarctech.com",
      "value": "newsaarctech.com",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "2 engines marked malicious and 3 suspicious; 52 harmless, 32 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 3 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 2 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for newsaarctech.com. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "newsaarctech.com was classified as domain. Investigation verdict is highly suspicious with score 83/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 15 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 83,
      "actor_lead_count": 0,
      "graph_edge_count": 29,
      "graph_node_count": 23,
      "source_analysis_ref": "/api/ioc/investigations/107aeeec-5730-437f-969a-3f434a0cae71",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 29,
      "graph_preview_node_count": 23
    },
    {
      "id": "ioc:newsaarctech.com",
      "type": "ioc",
      "value": "newsaarctech.com",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "description": "newsaarctech.com was classified as domain. Investigation verdict is highly suspicious with score 83/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 15 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ],
      "suspicion_score": 83
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1583",
      "type": "ttp-evidence",
      "label": "T1583 Acquire Infrastructure",
      "source": "ioc-investigation",
      "tactic": "resource-development",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1583",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1584",
      "type": "ttp-evidence",
      "label": "T1584 Compromise Infrastructure",
      "source": "ioc-investigation",
      "tactic": "resource-development",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1584",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1608",
      "type": "ttp-evidence",
      "label": "T1608 Stage Capabilities",
      "source": "ioc-investigation",
      "tactic": "resource-development",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1608",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1190",
      "type": "ttp-evidence",
      "label": "T1190 Exploit Public-Facing Application",
      "source": "ioc-investigation",
      "tactic": "initial-access",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1190",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1078",
      "type": "ttp-evidence",
      "label": "T1078 Valid Accounts",
      "source": "ioc-investigation",
      "tactic": "stealth, persistence, privilege-escalation, initial-access",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1078",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1090",
      "type": "ttp-evidence",
      "label": "T1090 Proxy",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1090",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1505.003",
      "type": "ttp-evidence",
      "label": "T1505.003 Web Shell",
      "source": "ioc-investigation",
      "tactic": "persistence",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1505.003",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1573",
      "type": "ttp-evidence",
      "label": "T1573 Encrypted Channel",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1573",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1539",
      "type": "ttp-evidence",
      "label": "T1539 Steal Web Session Cookie",
      "source": "ioc-investigation",
      "tactic": "credential-access",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1539",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1071.001",
      "type": "ttp-evidence",
      "label": "T1071.001 Web Protocols",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071.001",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1567",
      "type": "ttp-evidence",
      "label": "T1567 Exfiltration Over Web Service",
      "source": "ioc-investigation",
      "tactic": "exfiltration",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1567",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1059",
      "type": "ttp-evidence",
      "label": "T1059 Command and Scripting Interpreter",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1137",
      "type": "ttp-evidence",
      "label": "T1137 Office Application Startup",
      "source": "ioc-investigation",
      "tactic": "persistence",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1137",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1218",
      "type": "ttp-evidence",
      "label": "T1218 System Binary Proxy Execution",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:107aeeec-5730-437f-969a-3f434a0cae71:T1027",
      "type": "ttp-evidence",
      "label": "T1027 Obfuscated Files or Information",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1027",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "newsaarctech.com",
      "sources": [
        "input",
        "virustotal",
        "otx",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 83,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:collection:diving into the emotet maldoc boutade - k7 labs",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Diving into the Emotet Maldoc Boutade - K7 Labs",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:collection:investigating indonesias gambling ecosystem: indicators of national-level cyber operations",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Investigating Indonesias Gambling Ecosystem: Indicators of National-Level Cyber Operations",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:ns75.domaincontrol.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns75.domaincontrol.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:ns76.domaincontrol.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns76.domaincontrol.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:www.dot-services.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "www.dot-services.org",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:www.holytacopdx.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "www.holytacopdx.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:13.248.213.45",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "13.248.213.45",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:15.197.225.128",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "15.197.225.128",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:23.36.162.222",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "23.36.162.222",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:3.33.251.168",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "3.33.251.168",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:45.194.53.26",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "45.194.53.26",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:45.194.53.52",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "45.194.53.52",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:76.223.67.189",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "76.223.67.189",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://newsaarctech.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/sx9tvv5/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://newsaarctech.com/wp-content/Sx9tvV5/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://newsaarctech.com/wp-content/cnLb7g7OiB83Zp/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/jtkcwsgomz",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://newsaarctech.com/wp-content/jtkcwsgomz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://newsaarctech.com/wp-content/cnlb7g7oib83zp/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://newsaarctech.com/wp-content/cnLb7g7OiB83Zp/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://newsaarctech.com/wp-content/jtkcwsgomz",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://newsaarctech.com/wp-content/jtkcWsGOmZ",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://www.dot-services.org/articles/software-as-a-service-selection-criteria.html?psystem=pw&domain=newsaarctech.com",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://www.dot-services.org/articles/software-as-a-service-selection-criteria.html?psystem=PW&domain=newsaarctech.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://www.holytacopdx.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://www.holytacopdx.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "type": "ioc-investigation",
      "label": "172.104.227.98",
      "value": "172.104.227.98",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "5 engines marked malicious and 0 suspicious; 51 harmless, 33 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 50 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 6 scan result(s). urlscan activity analysis found 1 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "not_found",
          "summary": "Shodan returned 0 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 0 service(s)."
        }
      ],
      "summary": "172.104.227.98 was classified as ip. Investigation verdict is suspicious with score 49/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "suspicious",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 49,
      "actor_lead_count": 0,
      "graph_edge_count": 14,
      "graph_node_count": 11,
      "source_analysis_ref": "/api/ioc/investigations/3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 14,
      "graph_preview_node_count": 11
    },
    {
      "id": "ioc:172.104.227.98",
      "type": "ioc",
      "value": "172.104.227.98",
      "source": "ioc-investigation",
      "verdict": "suspicious",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "description": "172.104.227.98 was classified as ip. Investigation verdict is suspicious with score 49/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation"
      ],
      "suspicion_score": 49
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "172.104.227.98",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:collection:test",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "test",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:collection:test created 1 year ago by testivk1 clone",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "test CREATED 1 YEAR AGO by testivk1 clone",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:domain:172.104.227.98",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "172.104.227.98",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:domain:linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "linode.com",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:http://172.104.227.98",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://172.104.227.98",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:http://172.104.227.98/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://172.104.227.98/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://172.104.227.98/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/kzymkrkzugjxxyuoueoifprjfac",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://172.104.227.98/kzymKrkzugjXXyuoueoIfPRjFAC",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/wj",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://172.104.227.98/wJ",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98:443",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://172.104.227.98:443",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "type": "ioc-investigation",
      "label": "163.172.50.82",
      "value": "163.172.50.82",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "11 engines marked malicious and 0 suspicious; 46 harmless, 32 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 50 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 9 scan result(s). urlscan activity analysis found 1 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "ok",
          "summary": "Shodan returned 98 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 48 service(s)."
        }
      ],
      "summary": "163.172.50.82 was classified as ip. Investigation verdict is highly suspicious with score 75/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 21 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 75,
      "actor_lead_count": 0,
      "graph_edge_count": 17,
      "graph_node_count": 13,
      "source_analysis_ref": "/api/ioc/investigations/28f3673b-6918-4d37-a37c-1ec91202489a",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 17,
      "graph_preview_node_count": 13
    },
    {
      "id": "ioc:163.172.50.82",
      "type": "ioc",
      "value": "163.172.50.82",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "description": "163.172.50.82 was classified as ip. Investigation verdict is highly suspicious with score 75/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 21 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ],
      "suspicion_score": 75
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1045",
      "type": "ttp-evidence",
      "label": "T1045 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1045",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1055",
      "type": "ttp-evidence",
      "label": "T1055 Process Injection",
      "source": "ioc-investigation",
      "tactic": "stealth, privilege-escalation",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1055",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1129",
      "type": "ttp-evidence",
      "label": "T1129 Shared Modules",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1129",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1143",
      "type": "ttp-evidence",
      "label": "T1143 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1143",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1057",
      "type": "ttp-evidence",
      "label": "T1057 Process Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1057",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1105",
      "type": "ttp-evidence",
      "label": "T1105 Ingress Tool Transfer",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1105",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1071",
      "type": "ttp-evidence",
      "label": "T1071 Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1071.001",
      "type": "ttp-evidence",
      "label": "T1071.001 Web Protocols",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071.001",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1071.004",
      "type": "ttp-evidence",
      "label": "T1071.004 DNS",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071.004",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1491",
      "type": "ttp-evidence",
      "label": "T1491 Defacement",
      "source": "ioc-investigation",
      "tactic": "impact",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1491",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1491.001",
      "type": "ttp-evidence",
      "label": "T1491.001 Internal Defacement",
      "source": "ioc-investigation",
      "tactic": "impact",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1491.001",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1156",
      "type": "ttp-evidence",
      "label": "T1156 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1156",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1399",
      "type": "ttp-evidence",
      "label": "T1399 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1399",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1027",
      "type": "ttp-evidence",
      "label": "T1027 Obfuscated Files or Information",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1027",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1053",
      "type": "ttp-evidence",
      "label": "T1053 Scheduled Task/Job",
      "source": "ioc-investigation",
      "tactic": "execution, persistence, privilege-escalation",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1053",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1080",
      "type": "ttp-evidence",
      "label": "T1080 Taint Shared Content",
      "source": "ioc-investigation",
      "tactic": "lateral-movement",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1080",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1102",
      "type": "ttp-evidence",
      "label": "T1102 Web Service",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1102",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1210",
      "type": "ttp-evidence",
      "label": "T1210 Exploitation of Remote Services",
      "source": "ioc-investigation",
      "tactic": "lateral-movement",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1210",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1486",
      "type": "ttp-evidence",
      "label": "T1486 Data Encrypted for Impact",
      "source": "ioc-investigation",
      "tactic": "impact",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1486",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1490",
      "type": "ttp-evidence",
      "label": "T1490 Inhibit System Recovery",
      "source": "ioc-investigation",
      "tactic": "impact",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1490",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:28f3673b-6918-4d37-a37c-1ec91202489a:T1566",
      "type": "ttp-evidence",
      "label": "T1566 Phishing",
      "source": "ioc-investigation",
      "tactic": "initial-access",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1566",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "163.172.50.82",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb",
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 75,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:ioc records provided by @nextrayai",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:test",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "test",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:test created 1 year ago by testivk1 clone",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "test CREATED 1 YEAR AGO by testivk1 clone",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163-172-50-82.rev.poneytelecom.eu",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "163-172-50-82.rev.poneytelecom.eu",
      "sources": [
        "abuseipdb",
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163.172.50.82",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "163.172.50.82",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:avatar.dynns.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "avatar.dynns.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:scaleway.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "scaleway.com",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:sd-101918.dedibox.fr",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "sd-101918.dedibox.fr",
      "sources": [
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://163.172.50.82",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://163.172.50.82",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://163.172.50.82/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://163.172.50.82/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://avatar.dynns.com",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://avatar.dynns.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://avatar.dynns.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://avatar.dynns.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "type": "ioc-investigation",
      "label": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "value": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "No malicious detections in last analysis; 0 harmless, 61 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "not_found",
          "summary": "MalwareBazaar returned 0 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a was classified as hash. Investigation verdict is needs review with score 20/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 8 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "needs review",
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 20,
      "actor_lead_count": 0,
      "graph_edge_count": 0,
      "graph_node_count": 1,
      "source_analysis_ref": "/api/ioc/investigations/417e279b-de9f-426d-90dc-61255e3367de",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 0,
      "graph_preview_node_count": 1
    },
    {
      "id": "ioc:0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "type": "ioc",
      "value": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "source": "ioc-investigation",
      "verdict": "needs review",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "description": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a was classified as hash. Investigation verdict is needs review with score 20/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 8 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ],
      "suspicion_score": 20
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1036",
      "type": "ttp-evidence",
      "label": "T1036 Masquerading",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1036",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1046",
      "type": "ttp-evidence",
      "label": "T1046 Network Service Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1046",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1055",
      "type": "ttp-evidence",
      "label": "T1055 Process Injection",
      "source": "ioc-investigation",
      "tactic": "privilege-escalation, stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1055",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1055.011",
      "type": "ttp-evidence",
      "label": "T1055.011 Extra Window Memory Injection",
      "source": "ioc-investigation",
      "tactic": "privilege-escalation, stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1055.011",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1071",
      "type": "ttp-evidence",
      "label": "T1071 Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1095",
      "type": "ttp-evidence",
      "label": "T1095 Non-Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1095",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1189",
      "type": "ttp-evidence",
      "label": "T1189 Drive-by Compromise",
      "source": "ioc-investigation",
      "tactic": "initial-access",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1189",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:417e279b-de9f-426d-90dc-61255e3367de:T1573",
      "type": "ttp-evidence",
      "label": "T1573 Encrypted Channel",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1573",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de:node:hash:0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "sources": [
        "input"
      ],
      "source_ref": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "suspicious": 20,
      "source_refs": [
        "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "type": "ioc-investigation",
      "label": "gamaes.shop",
      "value": "gamaes.shop",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "4 engines marked malicious and 1 suspicious; 49 harmless, 35 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 2 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 4 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for gamaes.shop. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "gamaes.shop was classified as domain. Investigation verdict is highly suspicious with score 95/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 4 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 95,
      "actor_lead_count": 0,
      "graph_edge_count": 26,
      "graph_node_count": 21,
      "source_analysis_ref": "/api/ioc/investigations/fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 26,
      "graph_preview_node_count": 21
    },
    {
      "id": "ioc:gamaes.shop",
      "type": "ioc",
      "value": "gamaes.shop",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "description": "gamaes.shop was classified as domain. Investigation verdict is highly suspicious with score 95/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 4 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ],
      "suspicion_score": 95
    },
    {
      "id": "ttp-evidence:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:T1059",
      "type": "ttp-evidence",
      "label": "T1059 Command and Scripting Interpreter",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:T1137",
      "type": "ttp-evidence",
      "label": "T1137 Office Application Startup",
      "source": "ioc-investigation",
      "tactic": "persistence",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1137",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:T1218",
      "type": "ttp-evidence",
      "label": "T1218 System Binary Proxy Execution",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:T1027",
      "type": "ttp-evidence",
      "label": "T1027 Obfuscated Files or Information",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1027",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "gamaes.shop",
      "sources": [
        "input",
        "virustotal",
        "otx",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 95,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:collection:Diving into the Emotet Maldoc Boutade - K7 Labs",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Diving into the Emotet Maldoc Boutade - K7 Labs",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns1.linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns1.linode.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns2.linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns2.linode.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns3.linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns3.linode.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns4.linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns4.linode.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns5.linode.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "ns5.linode.com",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:www1.gamaes.shop",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "www1.gamaes.shop",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:13.248.148.254",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "13.248.148.254",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2606:4700:3037::6815:1d50",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2606:4700:3037::6815:1d50",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2606:4700:3037::ac43:ab6c",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2606:4700:3037::ac43:ab6c",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2a06:98c1:3120::c",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2a06:98c1:3120::c",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:64.225.91.73",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "64.225.91.73",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:76.223.26.96",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "76.223.26.96",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://gamaes.shop/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://www1.gamaes.shop/?tm=1&subid4=1683742057.0380260000",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://www1.gamaes.shop/?tm=1&subid4=1683742057.0380260000",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://www1.gamaes.shop/?tm=1&subid4=1686791310.0182270000",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://www1.gamaes.shop/?tm=1&subid4=1686791310.0182270000",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "type": "ioc-investigation",
      "label": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "value": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "not_found",
          "summary": "virustotal has no record for this lookup."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "not_found",
          "summary": "MalwareBazaar returned 0 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38 was classified as hash. Investigation verdict is low signal with score 0/100. Sources checked successfully: local-db, otx, urlscan. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "low signal",
      "source_ref": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 0,
      "actor_lead_count": 0,
      "graph_edge_count": 0,
      "graph_node_count": 1,
      "source_analysis_ref": "/api/ioc/investigations/0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 0,
      "graph_preview_node_count": 1
    },
    {
      "id": "ioc:2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "type": "ioc",
      "value": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "source": "ioc-investigation",
      "verdict": "low signal",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "description": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38 was classified as hash. Investigation verdict is low signal with score 0/100. Sources checked successfully: local-db, otx, urlscan. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
        "ioc-investigation"
      ],
      "suspicion_score": 0
    },
    {
      "id": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9:node:hash:2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "sources": [
        "input"
      ],
      "source_ref": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "suspicious": 0,
      "source_refs": [
        "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c3d286699a2177a89cf4a3e6",
      "type": "pcap-observable",
      "value": "gamaes.shop",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 43,
          "frame_number": 1737,
          "display_filter": "frame.number == 1737",
          "timestamp_epoch": "1638560567.231231000"
        },
        {
          "udp_stream": 43,
          "frame_number": 1738,
          "display_filter": "frame.number == 1738",
          "timestamp_epoch": "1638560567.384060000"
        },
        {
          "udp_stream": 43,
          "frame_number": 1739,
          "display_filter": "frame.number == 1739",
          "timestamp_epoch": "1638560567.546111000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 1743,
          "display_filter": "frame.number == 1743",
          "timestamp_epoch": "1638560567.664570000"
        }
      ],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 4,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-71424fede7fc391a0c9d38e6",
      "type": "pcap-observable",
      "value": "newsaarctech.com",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 44,
          "frame_number": 1754,
          "display_filter": "frame.number == 1754",
          "timestamp_epoch": "1638560568.001987000"
        },
        {
          "udp_stream": 44,
          "frame_number": 1755,
          "display_filter": "frame.number == 1755",
          "timestamp_epoch": "1638560568.147291000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 1771,
          "display_filter": "frame.number == 1771",
          "timestamp_epoch": "1638560568.410086000"
        }
      ],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 3,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-24a2d485ab5dd8071194b4d8",
      "type": "pcap-observable",
      "value": "172.104.227.98",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "frame_number": 3209,
          "display_filter": "frame.number == 3209"
        },
        {
          "frame_number": 3311,
          "display_filter": "frame.number == 3311"
        },
        {
          "frame_number": 3366,
          "display_filter": "frame.number == 3366"
        },
        {
          "frame_number": 3389,
          "display_filter": "frame.number == 3389"
        },
        {
          "frame_number": 4046,
          "display_filter": "frame.number == 4046"
        },
        {
          "frame_number": 4093,
          "display_filter": "frame.number == 4093"
        },
        {
          "frame_number": 4112,
          "display_filter": "frame.number == 4112"
        },
        {
          "frame_number": 4811,
          "display_filter": "frame.number == 4811"
        },
        {
          "frame_number": 4870,
          "display_filter": "frame.number == 4870"
        },
        {
          "frame_number": 4964,
          "display_filter": "frame.number == 4964"
        },
        {
          "frame_number": 5378,
          "display_filter": "frame.number == 5378"
        },
        {
          "frame_number": 5433,
          "display_filter": "frame.number == 5433"
        },
        {
          "frame_number": 5451,
          "display_filter": "frame.number == 5451"
        },
        {
          "frame_number": 5898,
          "display_filter": "frame.number == 5898"
        },
        {
          "frame_number": 6002,
          "display_filter": "frame.number == 6002"
        },
        {
          "frame_number": 6031,
          "display_filter": "frame.number == 6031"
        },
        {
          "frame_number": 6153,
          "display_filter": "frame.number == 6153"
        },
        {
          "frame_number": 6177,
          "display_filter": "frame.number == 6177"
        },
        {
          "frame_number": 6319,
          "display_filter": "frame.number == 6319"
        },
        {
          "frame_number": 6352,
          "display_filter": "frame.number == 6352"
        }
      ],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "first-frame-of-exact-address-flow",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 26,
      "evidence_frames_truncated": true
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c4e7be9e905aad7da0f62a33",
      "type": "pcap-observable",
      "value": "163.172.50.82",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "frame_number": 3312,
          "display_filter": "frame.number == 3312"
        },
        {
          "frame_number": 4047,
          "display_filter": "frame.number == 4047"
        },
        {
          "frame_number": 4812,
          "display_filter": "frame.number == 4812"
        },
        {
          "frame_number": 5389,
          "display_filter": "frame.number == 5389"
        },
        {
          "frame_number": 5904,
          "display_filter": "frame.number == 5904"
        },
        {
          "frame_number": 11053,
          "display_filter": "frame.number == 11053"
        }
      ],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "first-frame-of-exact-address-flow",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 6,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-611f81fa9c47cc7197d69dd6",
      "type": "pcap-observable",
      "value": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [
        {
          "sha256": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
          "filename": "sSTToaEwCG5VASw",
          "size_bytes": 4334,
          "artifact_id": "artifact-11a8fbae98a3126ee8453ab2",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-563965986f13e34394955d1b",
      "type": "pcap-observable",
      "value": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "artifact_refs": [
        {
          "sha256": "2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
          "filename": "object52357",
          "size_bytes": 1523,
          "artifact_id": "artifact-eadf61db2925b9c390795fae",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "91e547acc39e8ef27d7ec549404157fe527e090bd5caf6fe189c2bae6d4a57ef",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "3343d2811e62c53a10dfd853861eeb3e3316a3080f654a63017c370f005b6af8",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    }
  ],
  "evidence_edges": [
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:ns75.domaincontrol.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:ns75.domaincontrol.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "ns75.domaincontrol.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:13.248.213.45:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:13.248.213.45",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "13.248.213.45",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:76.223.67.189:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:76.223.67.189",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "76.223.67.189",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:ns76.domaincontrol.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:ns76.domaincontrol.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "ns76.domaincontrol.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->collection:investigating indonesias gambling ecosystem: indicators of national-level cyber operations:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:collection:investigating indonesias gambling ecosystem: indicators of national-level cyber operations",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "Investigating Indonesias Gambling Ecosystem: Indicators of National-Level Cyber Operations",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->collection:diving into the emotet maldoc boutade - k7 labs:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:collection:diving into the emotet maldoc boutade - k7 labs",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "Diving into the Emotet Maldoc Boutade - K7 Labs",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:www.dot-services.org:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:www.dot-services.org",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "www.dot-services.org",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:23.36.162.222:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:23.36.162.222",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "23.36.162.222",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:https://www.dot-services.org/articles/software-as-a-service-selection-criteria.html?psystem=pw&domain=newsaarctech.com:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://www.dot-services.org/articles/software-as-a-service-selection-criteria.html?psystem=pw&domain=newsaarctech.com",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "https://www.dot-services.org/articles/software-as-a-service-selection-criteria.html?psystem=PW&domain=newsaarctech.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/cnLb7g7OiB83Zp/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:newsaarctech.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "newsaarctech.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:15.197.225.128:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:15.197.225.128",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "15.197.225.128",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp/:urlscan:evidence:12",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/cnLb7g7OiB83Zp/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:3.33.251.168:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:3.33.251.168",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "3.33.251.168",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:https://newsaarctech.com/wp-content/cnlb7g7oib83zp/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://newsaarctech.com/wp-content/cnlb7g7oib83zp/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "https://newsaarctech.com/wp-content/cnLb7g7OiB83Zp/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:www.holytacopdx.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:www.holytacopdx.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "www.holytacopdx.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:45.194.53.26:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:45.194.53.26",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "45.194.53.26",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:https://www.holytacopdx.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://www.holytacopdx.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "https://www.holytacopdx.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/jtkcwsgomz:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/jtkcwsgomz:urlscan:evidence:20",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp:urlscan:evidence:22",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/cnlb7g7oib83zp",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/sx9tvv5/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/sx9tvv5/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/Sx9tvV5/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:http://newsaarctech.com/wp-content/sx9tvv5/:urlscan:evidence:24",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:http://newsaarctech.com/wp-content/sx9tvv5/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "http://newsaarctech.com/wp-content/Sx9tvV5/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->ip:45.194.53.52:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:ip:45.194.53.52",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "45.194.53.52",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:https://newsaarctech.com/wp-content/jtkcwsgomz:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "https://newsaarctech.com/wp-content/jtkcWsGOmZ",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->url:https://newsaarctech.com/wp-content/jtkcwsgomz:urlscan:evidence:27",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:url:https://newsaarctech.com/wp-content/jtkcwsgomz",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "https://newsaarctech.com/wp-content/jtkcWsGOmZ",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:edge:domain:newsaarctech.com->domain:newsaarctech.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "source_refs": [
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
        "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71:node:domain:newsaarctech.com"
      ],
      "source_value": "newsaarctech.com",
      "target_value": "newsaarctech.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->collection:test created 1 year ago by testivk1 clone:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:collection:test created 1 year ago by testivk1 clone",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "test CREATED 1 YEAR AGO by testivk1 clone",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->collection:test:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:collection:test",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "test",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->domain:172.104.227.98:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:domain:172.104.227.98",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "172.104.227.98",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->ip:172.104.227.98:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "172.104.227.98",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:http://172.104.227.98/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:http://172.104.227.98/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "http://172.104.227.98/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:http://172.104.227.98:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:http://172.104.227.98",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "http://172.104.227.98",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/wj:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/wj",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/wJ",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/wj:urlscan:evidence:7",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/wj",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/wJ",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/kzymkrkzugjxxyuoueoifprjfac:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/kzymkrkzugjxxyuoueoifprjfac",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/kzymKrkzugjXXyuoueoIfPRjFAC",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/kzymkrkzugjxxyuoueoifprjfac:urlscan:evidence:9",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/kzymkrkzugjxxyuoueoifprjfac",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/kzymKrkzugjXXyuoueoIfPRjFAC",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98/:urlscan:evidence:11",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->url:https://172.104.227.98:443:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:url:https://172.104.227.98:443",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "https://172.104.227.98:443",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:edge:ip:172.104.227.98->domain:linode.com:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:domain:linode.com",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "source_refs": [
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
        "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57:node:ip:172.104.227.98"
      ],
      "source_value": "172.104.227.98",
      "target_value": "linode.com",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->collection:ioc records provided by @nextrayai:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:ioc records provided by @nextrayai",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "IOC Records Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->collection:test created 1 year ago by testivk1 clone:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:test created 1 year ago by testivk1 clone",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "test CREATED 1 YEAR AGO by testivk1 clone",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->collection:test:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:collection:test",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "test",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:163.172.50.82:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163.172.50.82",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "163.172.50.82",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->ip:163.172.50.82:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "163.172.50.82",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->url:http://163.172.50.82/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://163.172.50.82/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "http://163.172.50.82/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->url:http://163.172.50.82/:urlscan:evidence:6",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://163.172.50.82/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "http://163.172.50.82/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->url:http://163.172.50.82:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://163.172.50.82",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "http://163.172.50.82",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:avatar.dynns.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:avatar.dynns.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "avatar.dynns.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->url:http://avatar.dynns.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://avatar.dynns.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "http://avatar.dynns.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->url:http://avatar.dynns.com:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:url:http://avatar.dynns.com",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "http://avatar.dynns.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:scaleway.com:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:scaleway.com",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "scaleway.com",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:163-172-50-82.rev.poneytelecom.eu:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163-172-50-82.rev.poneytelecom.eu",
      "evidence": "AbuseIPDB hostname",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "163-172-50-82.rev.poneytelecom.eu",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:163-172-50-82.rev.poneytelecom.eu:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163-172-50-82.rev.poneytelecom.eu",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "163-172-50-82.rev.poneytelecom.eu",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:sd-101918.dedibox.fr:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:sd-101918.dedibox.fr",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "sd-101918.dedibox.fr",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:sd-101918.dedibox.fr:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:sd-101918.dedibox.fr",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "sd-101918.dedibox.fr",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:edge:ip:163.172.50.82->domain:163-172-50-82.rev.poneytelecom.eu:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:domain:163-172-50-82.rev.poneytelecom.eu",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "source_refs": [
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
        "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a:node:ip:163.172.50.82"
      ],
      "source_value": "163.172.50.82",
      "target_value": "163-172-50-82.rev.poneytelecom.eu",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:ns5.linode.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns5.linode.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "ns5.linode.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:64.225.91.73:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:64.225.91.73",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "64.225.91.73",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:ns4.linode.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns4.linode.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "ns4.linode.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:ns2.linode.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns2.linode.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "ns2.linode.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:ns1.linode.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns1.linode.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "ns1.linode.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:ns3.linode.com:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:ns3.linode.com",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "ns3.linode.com",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->collection:Diving into the Emotet Maldoc Boutade - K7 Labs:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:collection:Diving into the Emotet Maldoc Boutade - K7 Labs",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "Diving into the Emotet Maldoc Boutade - K7 Labs",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:gamaes.shop:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "gamaes.shop",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/:urlscan:evidence:9",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/ssttoaewcg5vasw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/:urlscan:evidence:11",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "https://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:www1.gamaes.shop:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:www1.gamaes.shop",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "www1.gamaes.shop",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:13.248.148.254:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:13.248.148.254",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "13.248.148.254",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://www1.gamaes.shop/?tm=1&subid4=1686791310.0182270000:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://www1.gamaes.shop/?tm=1&subid4=1686791310.0182270000",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://www1.gamaes.shop/?tm=1&subid4=1686791310.0182270000",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:76.223.26.96:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:76.223.26.96",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "76.223.26.96",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://www1.gamaes.shop/?tm=1&subid4=1683742057.0380260000:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://www1.gamaes.shop/?tm=1&subid4=1683742057.0380260000",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://www1.gamaes.shop/?tm=1&subid4=1683742057.0380260000",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:2a06:98c1:3120::c:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2a06:98c1:3120::c",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "2a06:98c1:3120::c",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:2606:4700:3037::ac43:ab6c:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2606:4700:3037::ac43:ab6c",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "2606:4700:3037::ac43:ab6c",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html:urlscan:evidence:22",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/index.html",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/:urlscan:evidence:23",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:url:http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "http://gamaes.shop/wp-content/plugins/sSTToaEwCG5VASw/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->ip:2606:4700:3037::6815:1d50:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:ip:2606:4700:3037::6815:1d50",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "2606:4700:3037::6815:1d50",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:edge:domain:gamaes.shop->domain:gamaes.shop:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "source_refs": [
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
        "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2:node:domain:gamaes.shop"
      ],
      "source_value": "gamaes.shop",
      "target_value": "gamaes.shop",
      "evidence_source": "censys"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c3d286699a2177a89cf4a3e6:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c3d286699a2177a89cf4a3e6",
      "target": "ioc-investigation:fcf25435-dfc9-4f8d-bbe0-b6263c17dbf2",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-71424fede7fc391a0c9d38e6:107aeeec-5730-437f-969a-3f434a0cae71",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-71424fede7fc391a0c9d38e6",
      "target": "ioc-investigation:107aeeec-5730-437f-969a-3f434a0cae71",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-24a2d485ab5dd8071194b4d8:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-24a2d485ab5dd8071194b4d8",
      "target": "ioc-investigation:3c93d6d2-ef39-45ac-9cff-0a0591383b57",
      "evidence": "Exact normalized type/value equality; first-frame-of-exact-address-flow. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c4e7be9e905aad7da0f62a33:28f3673b-6918-4d37-a37c-1ec91202489a",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-c4e7be9e905aad7da0f62a33",
      "target": "ioc-investigation:28f3673b-6918-4d37-a37c-1ec91202489a",
      "evidence": "Exact normalized type/value equality; first-frame-of-exact-address-flow. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-611f81fa9c47cc7197d69dd6:417e279b-de9f-426d-90dc-61255e3367de",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-611f81fa9c47cc7197d69dd6",
      "target": "ioc-investigation:417e279b-de9f-426d-90dc-61255e3367de",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-563965986f13e34394955d1b:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:96e0e828-93ae-49d5-8104-9f14cb584c3e:observable-563965986f13e34394955d1b",
      "target": "ioc-investigation:0ac59bd3-1ec5-4019-b24e-02ea5aa390d9",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:96e0e828-93ae-49d5-8104-9f14cb584c3e",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    }
  ],
  "timeline": [
    {
      "at": "2026-09-19T12:50:04.478Z",
      "event": "Added Log/PCAP analysis 2021-12-08-ISC-Forensic-Challenge.pcap",
      "source": "Log/PCAP analysis 2021-12-08-ISC-Forensic-Challenge.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T12:57:53.859Z",
      "event": "Added Log/PCAP analysis 2021-12-08-ISC-Forensic-Challenge.pcap",
      "source": "Log/PCAP analysis 2021-12-08-ISC-Forensic-Challenge.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T13:57:53.768Z",
      "event": "Added IOC investigation for gamaes.shop",
      "source": "IOC investigation gamaes.shop",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 4
    },
    {
      "at": "2026-09-19T13:57:56.388Z",
      "event": "Added IOC investigation for newsaarctech.com",
      "source": "IOC investigation newsaarctech.com",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 15
    },
    {
      "at": "2026-09-19T13:57:58.792Z",
      "event": "Added IOC investigation for 172.104.227.98",
      "source": "IOC investigation 172.104.227.98",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T13:58:20.622Z",
      "event": "Added IOC investigation for 163.172.50.82",
      "source": "IOC investigation 163.172.50.82",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 21
    },
    {
      "at": "2026-09-19T13:58:31.819Z",
      "event": "Added IOC investigation for 0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "source": "IOC investigation 0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 8
    },
    {
      "at": "2026-09-19T13:58:53.050Z",
      "event": "Added IOC investigation for 2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "source": "IOC investigation 2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:02:46.092783+00:00",
      "event": "Superseded test-generated enrichment handoffs before corrected retry; original provider sessions and before-images retained."
    },
    {
      "at": "2026-09-19T14:06:03.968Z",
      "event": "Added IOC investigation for gamaes.shop",
      "source": "IOC investigation gamaes.shop",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 4
    },
    {
      "at": "2026-09-19T14:06:15.221Z",
      "event": "Added IOC investigation for 2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "source": "IOC investigation 2c80de6ffeb0759cb01dd7ad50437ea8dfcb7e4b8582a0129e7e7f700b593e38",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:29:10.056457+00:00",
      "event": "Linked approved passive lookups to exact typed, capture-backed PCAP observables. Frames retained where available; object hashes retain capture-export provenance. All context remains unreviewed."
    }
  ],
  "created_at": "2026-09-19T12:49:59.119090+00:00",
  "updated_at": "2026-09-19T14:29:10.078873+00:00"
}