| 1.1.3.2.2. Does pcap file indicate it is leveraging email as |
| 1.1.3.2.2.1. If Yes are there any unique identifiers that can |
 | 1.1.3.2.2.1.1. Is it spreading via a unique file name? |
| 1.1.3.2.2.1.2. Is it spreading with a specific file extension that |
| 1.1.3.2.2.1.3. Is it spreading via direct port 25 to internet, |