{"ip":"109.165.74.18","data_as_of":"2026-10-26T22:47:47+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network service provider","why":["4 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","Not in any known-scanner range.","Sent 19,893 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,893 bytes sent","bytes_sent":19893,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-23T05:19:39","last_seen":"2026-10-23T05:20:20","events_24h":0,"events_7d":0,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"smb","sessions":5}],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":null,"lon":null,"asn":12389,"org":"Rostelecom"},"source_domain":"18.74.165.109.donpac.ru","known_scanners":[],"scanner_tag":{"key":"peeringdb:as12389","label":"Rostelecom","category":"isp","url":"https://www.peeringdb.com/asn/12389"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-23T05:19:39","last_seen":"2026-10-23T05:20:20","verdicts":[{"verdict":"exploit-attempt","sessions":4},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smb@Windows Server 2016","sessions":5}],"services":[{"protocol":"smb","port":445,"sessions":5}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","name":"doublepulsar-payload-partial.dll","size":10240,"mime_type":"application/x-dosexec","kind":"sample","times":1,"first_seen":"2026-10-23T05:20:20","last_seen":"2026-10-23T05:20:20","virustotal":{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","status":"known","malicious":34,"total":75,"name":"bl4li.exe"}},{"sha256":"ef4d8d66ec7b6fd6bd2ef9e77b7f86a1e31b66d4b267924be2a0636ea9357580","name":"doublepulsar-payload-partial.bin","size":16384,"mime_type":"application/octet-stream","kind":"sample","times":1,"first_seen":"2026-10-23T05:20:20","last_seen":"2026-10-23T05:20:20","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":4}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":0,"sessions":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-23","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-23T05:20:20","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001\u0000\u000e\u0000\r\u0010\u0000��E<�p\u0015<� \u0015<]%\u0019�e)�����4��i����u)�]��c�<�(�\u0000��a-��)\u0007\\\u0014\u001f��[\u001d�K�\u0015<�!�x���x�h��z���]�\u000e�!��y'�\u001axj�\u0000��`\u0015t)�]�Z�aq���H�(��]u�`�`���[\u001a�b(�\u0010���>�g�p�hUר��?�e�p�h\u001dt/,.,\u0018�\u001a<��\u0000M�`\u0015�bo��_����[\u0019ׯ�Y\u0007� ]��[��]�]�a8T�f(�Ǫa\u0015<��]�]��1��\u0015<]u3`�`&����\u00182`\u0015<��N\u001c��~\u0014��n\f���}�!H}������I\u0018�(�H�pBt!�5t/}\u001b��`�|�`\u0015t)[]�]\u0014\"t/�\u00157�`�!!\u001f\u0019<�j]��p�)R;\u0015<��\u0016t!�Mt�`\u001e<�(.�о]���s�]�]��`]�ah]�l\u0015�t)<1\f��a\u0018�(���?����I\u0018�(�P�p]��D\rk���\f!]���`\u0015I��\u0003!�`]���<�S�t'�`'!���\u0016`\u0015<�]a>]�]�i��\u001f�`]��c\u0014����IE�R=\u0018h\u0015<�(v�J���](����\u0010!<`\u0015t'�a���\b�?`\u0015��`al����\u000eC\u0015<\"[(��aa\u0012�\u0003���`\u0015<����Η����\u0012t'�aO���t)�]�j�C\r�`���+]�eh]_d(\u0016�\"[\u0015I\u0015(�!��\u0015<����֖����0P?`\u0015<��2<eeӃ�`\u0014<�`&���I\u0018�(�P�(]��DEt!�%ca(�X�@\u0015y��P\u000fbS�\u000fk�\u001b�]��t)m��`�\u0019T��t!EH��`\u0015բ������t+8\u001dt+\b\u0005t+\u0010\rt+\u00185}�!@}�(�Ђ,�P�\u0000X�S)����p<�,�����}ea\u0014<�`]�p\u0014\u0012p+b\\�fh&�\"[7I�SչO �\u001e���t]���IYT��`]�]\u0014\u0012���\u0012t]�\u001a��(��)��\u0001�`\u0015�b\u0014\u0006}]%\u0015t'�a;(c�;���t]�U�T\u0014\u000e�O\u0015�|\"�5H� �«\u0015�t'�a5d'�<Ic]�iS㼙`\u001a�A`\u0015<\"[5H��.5�e]�a�伙`\u001a�i`\u0015<���H�)�\u0000�)���!�:\u0018a\u0015<�S�ק(��]��\u0007�\u0014㼙B`\n&�`!'�a2��V=\"X7I�(��Ik&����ʭ�շR��׳��t'�a:dgIt]�T��`��׋�?&�as'�`4�@a{�ia'�a\u000b�����P\u0015<���H���H��\u0016t]��;���}]%\u0015���\u0012t]��7'�a;���}]%\u0015}]%\u0015t]��e]��t'�a:dg\u0015t]�T��`�(]��q'�a9��1\u0018�!�:��I\u0018�(�P�(]��DEt)\u001c1d���\u001c�>Ta�<����I\u0018�(�H�@Bt!�%��Ҩ<�``9J{\u000f<�(�\u0001\u000e�\u0015<��\u0011=�`&��������<�`�)&8\u0015<��\b�\u001f`\u0015t+]K��`]�y\u0014\u0010��``?���t/$1t��Y\u0018�%&���]�i(�x�@��_��t�\u00141|����]���]]\u0007S\u0013It�,1t�����1]���]\u0007s\u0012]t)���Q��t)�]�b\u0014-p/d�t/$1t��Y\u0018�(�����t+$1\u001cJ\u0007��]$�`� ]��Ï<�!����Q����<��\u0016�j�]��D","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001000e000d1000a290453ca270153ca220153c5d2519c36529eaf9ebe3d134999b69b8e7ebf37529be5db79f63d53ca2289600999f612deae329075c141fbcee5b1dbc4be5153ca2219878869fd378996894cb7ad8e3c35d9f0ef521a1e07927841a786a9f008dfe60157429885dbf5a9f6171eae5d548ea289ef45d75bf60a26090fcd65b1a8a62289c1099e3ed3ed7679570996855d7a8e3ed3fd765957099681d742f2c2e2c18c01a3ca29f004dfe6015b9626f91fe5f9feac3e65b19d7afe05907aa205dfba65bebc35d9f5dbf613854c3662894c7aa61153cadec5dc35d9f9e3192df153c5d753360a26026fceeed89183260153cebeb4e1cebeb7e14ebeb6e0cebebf67dfc21487dfea3d9f0eae94918aa289c4886704274218c35742f7d1b83a260ab7ca2601574295b5db95d1422742fe71537a260fe21211f193cd66a5db1ed70ea29523b153ceaeb167421a74d74a7601e3ca2282ec4d0be5db7a98873cb5d9f5dbf81605dbf61685dc36c15ad74293c310ceaeb61189a2896f8823fd6f0eae94918aa289c5086705db5d6440d6beae3f90c215db8fca2601549a7880321a2605db7bf7f8b3ca253ea7427bb602721a8ead51660153c9e5d613e5da75db76988ff1fa2605db1fe6314b6a1e4d54945ed523d1868153ca22876f44ac7e2c35d289ec4eae910213c60157427a061fceaeb08ed3f6015bc9960616ceaebded40e43153c225b28b1d2616112ea03fb86a360153ceaebd8d4ce97eac3eae9127427a0614feeebd67429b55db76a88430da26090fcd72b5dbf65685d5f642816e4225b154915289e21defd153ceaebded4d696eac3eae330503f60153ceae3323c6565d383a260143ca26026fceaeb4918e2289e5086285db7d644457421a42563612896588640157991a9500f6253c70f6b881bd35d9fd974296d7fa1a260fd19549fea74214548a1a26015d5a29feac3eaebd1742b381d742b0805742b100d742b18357df621407df42896d0822c9e50860058b753299ec4e3e3703ca22c9edeeaebcc7d6561143ca2605db9701412702b625cbf666826d1225b3749b353d5b94f20a31eadf4d5745da39ed4495954c3e7605db95d1412b6a1e812745da71a8a9128eaff29aefd01936015b96214067d5d251574279f613b28639d3bea9fd2745da355b854140eb94f15b87c229e3548a42095c2ab15b474279f61356427ea3c49635dc36953e3bc99601ab84160153c225b3548a7e02e35d7655dc3618be4bc99601ab86960153cefe5f148aa299c00862996f8aa21ea3a1861153ca253dcd7a728eaff5da19507fe14e3bc9942600a26aa602127966132eaed563d22583749a7289ee4496b26fc91b290caadf4d5b752b1fcd7b39fdc74279f613a646749745da754c3e76090f5d78b9f3f26a06173279660349e40617b9e69617f27b2610baddeddd4c250153ceae5ea48b9e5d548acea16745da39d3bea9fd27d5d2515b6a1e812745da7fe3727a0613bea9fd67d5d25157d5d2515745da3fc655d9fea74279f613a646715745da754c3e760fc285d9fea7127846139ebe33118a221ea3aeaeb4918e2289e5086285db7d6444574291c3164eae3d11ce33e5461e33cd6f0eae94918ba289c4886404274218c25bf9fd2a83ca26060394a7b0f3ca22898010efb153ce3d8113da26026f5eaebc2faa7fe893ca260ea292638153ceaeb08991f6015742b5d4ba7a2605db9791410bc9960603feaebca742f243174eeed5918e22526fc91b25db769289c788640fd815f9fea74c114317cead9eac35d9feac35d7f5d0753134974c12c3174eae3ecc3d1315db1b6915d0773125d7429aafdd9519fea7429985db962142d702f64e5742f243174eeed5918e2289eebeaebde742b24311c4a07e8c35d249e6086205db59fc38f3ca221eaf791a051b5bff38f3ca28b16bf6a9f5db7fe44","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"652f586a39624317","strings":["SMB2","t/,.,","<]u3`","pBt!","5t/}","t)[]","t)<1","]a>]","eh]_d(","0P?`"]},"interactive":true},{"timestamp":"2026-10-23T05:19:50","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T05:19:50","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T05:19:50","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T05:19:49","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T05:19:49","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-23T05:19:49","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\b@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000","payload_hex":"0000005cff534d4275000000001807c00000000000000000000000000000fffe0008400004ff005c00080001003100005c005c003100390032002e003100360038002e00350036002e00320030005c00490050004300240000003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66d478ffe6a01a34","strings":["SMBu","1\\\\192.168.56.20\\IPC$?????"],"iocs":{"ips":["192.168.56.20"]}},"interactive":true},{"timestamp":"2026-10-23T05:19:49","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000","payload_hex":"00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ee47b9d34e56607b","strings":["SMBs","KWindows 2000 2195Windows 2000 5.0"]},"interactive":true},{"timestamp":"2026-10-23T05:19:48","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"befa3e5d-c32f-4fd2-8265-f013f9464bd8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf5baf1504bec0a1","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-23T05:19:48","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"46761d47-4b52-4799-8102-e7a24dc0d698-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":4}]}