{"ip":"46.235.216.230","data_as_of":"2026-10-26T20:45:16+00:00","observed":true,"total_events":48,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network service provider","why":["4 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","The first-packet sensors recorded 48 event(s) from this address as well.","Not in any known-scanner range.","Sent 32,927 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,927 bytes sent","bytes_sent":32927,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-09-05T09:34:45","last_seen":"2026-10-22T09:39:09","events_24h":0,"events_7d":0,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":5,"interactive_protocols":[{"protocol":"smb","sessions":5}],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":12389,"org":"Rostelecom"},"source_domain":"mail.northholding.ru","known_scanners":[],"scanner_tag":{"key":"peeringdb:as12389","label":"Rostelecom","category":"isp","url":"https://www.peeringdb.com/asn/12389"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-22T09:38:28","last_seen":"2026-10-22T09:39:09","verdicts":[{"verdict":"exploit-attempt","sessions":4},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smb@Windows Server 2016","sessions":5}],"services":[{"protocol":"smb","port":445,"sessions":5}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","name":"doublepulsar-payload-partial.dll","size":10240,"mime_type":"application/x-dosexec","kind":"sample","times":1,"first_seen":"2026-10-22T09:39:09","last_seen":"2026-10-22T09:39:09","virustotal":{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","status":"known","malicious":34,"total":75,"name":"bl4li.exe"}},{"sha256":"ef4d8d66ec7b6fd6bd2ef9e77b7f86a1e31b66d4b267924be2a0636ea9357580","name":"doublepulsar-payload-partial.bin","size":16384,"mime_type":"application/octet-stream","kind":"sample","times":1,"first_seen":"2026-10-22T09:39:09","last_seen":"2026-10-22T09:39:09","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":4}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":48,"sessions":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-05","count":32,"sessions":0},{"date":"2026-09-26","count":8,"sessions":0},{"date":"2026-10-01","count":8,"sessions":0},{"date":"2026-10-22","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-22T09:39:09","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001\u0000\u000e\u0000\r\u0010\u0000\r\u0005t�\r�$�\r�$���(\u0016ʼ�,Dv��6\u000eXmH~ �+lb0���\r���6\nP�Ev\u0018���.iA�,i�p$�\r���)\n��6��\u001e�M�\u0016�\n? �4Ѭ�\u0011+��\n1XQ�$��\u001dlj�\nP�Ep��E��!����\r��)y�+_ͽ��6v��x���6�d\u0002\u0007v��x���6�,���\u001f��U+�\r\n1�Q�$l���+�\n�\u0016I�(\u0002\u0000uh�\u0005�l.\t��\u0016�\nljέe\u0016ɽ�\u0012\u0005�$�\u0002yl\u0016�\n��=J$���\u0002�\r�\u0017)Ax�͝�$�D~�D~O�D~_�D~ǨS�y�Q6�%E|x�\u0005���)�s��\u0019\u0004���*V\r���\r�$���ll��\u0013��r$�\r�����(�y�ldB�����$�E~'��2|�\b�/�\r�\u001f\u0011+lb\u0006\u001dB\u001e�\nlj.�lj��l\u0016À����\u0000�E~P�5��--��%E|x�\u0005���)�l`y�<�Ev�َȉ)\r�$�\b\u001d2�\r�lb\u0010���\r�ۡ�.Q��=�\u0000��$�1�P��2lb�\u001d��\r�ldQ�%c\u000eq���xc���$�\r�G!�R�\u0016���\u0011E|!���$��5P)E~98��$i6�P�E~�\u0001��$���\u0019d}�P�E��S\f�$�E~�\u0001a\u0002�\u0016E|#��5P�A~硆 lb�\u001dr�\r��)x�lj��l�˽'1��$�����qh$�E~�\u0001y\u0003�\u0016Ev\u0001���$�Ev\u0003����V\r�%�\r�\u0017)E~x�M���)�lby�t��1\u0014�ν��)�$�><a������\u001d*\u0006�\n衆�Nt\r����\nۡ��yt\r�$\u0000\r\n�\u0016E~ࡄ�,���4���<���\u0004�Y�q�[��\u0005-���)�ib���\u0011LvA�\r��\u000bE~����%�\r�ll߁#���mj��\u0017\u0004��\u0006�\u001c��l൒�\u0002a���6�\u0001��e\u0016H�ll��#c\u000e}#��2+_>��*�;��<�$ĺ7���$��\nP�����E\n���6dm��?l�����\u000b\u0004�\u000b��\u0017\u0004����\nP�˲����l\u0016���i6�+m��$���\u0004�\bu\u001f�x�l\u0016�\u001e�i6�+m��$�@p��\u0005���)��-\u0005�����$�\r��\u0002\b��*�4��Q��i6�Q߉?Q��\u0003P�Exg���\u0006�\b��1��\u0017)>'�\u001f\u0002a�b�$�\u0002\u001c\n���\nP���x��2e\u0016H�� x\u001e���5P��\u0003Q�1�P�1�P��'P�\u0002K�\u0001m�$�Ep۝\u0016p��\u0003'��6��E\n����$c\u000e}#��2���5P�E\n����$���$��6Ͱ�\nۡ�\nP���$��2e\u0016H����\nۤ�\u0011P�Dv\u0000�\r���E~x�M���)�lby�t���\u0000�Ev��L�e�L��%E|x�\u0015���)�s��\u0019\u0014j0G��\r�Q���>�\r��ԡn$�LM �\r�\u0017 E~�/\bk��\r�����$�E~9L��$���zr\r�llց!i6�Q�E~����\u0000�Axh�M�\u0017)>'lbƽ��)��T�\nۡn�\u0000�EL�\u0016�\n�\u0016��l���x�n�\u0000�Ev�\u0016~�ld\u0019\u0004l�܇l��?�\f�\nۡ�\rlĺ\u001c���ԡ��\u0000�Axh�M��>E~�\u0000����\u0016򱯵)�l`0V��\r��\">5``\u0010f��\r\u001e'j�\nlbQ�t���\u0000�Ev","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001000e000d10000d0574e90de524e90db524e9f2b02816cabcdb2c4476e0e1360e586d487ec2a0862b6c6230f6e4e90dbda7d5360a50f8457618d2f3812e6941ce2c69e47024e90db4a9ad290ae2ad36fda51ed54dd216f20a3f208e34d1ac88112badc50a315851f524a1861d6c6af50a50a44570e49d45bdaf21f2e08eb50df5a12979ce2b5fcdbdadc53676dceb78f2a4a536fd64020776dcea78f0a4a536fd2ca180b91ff9b7552be90d0a319851f5246ccdfaa02bf00adb1649ce2802007568d205b56c2e09ceda16f20a6c6acead6516c9bda51205f424e902796c16f20aafe43d4a24e9f2e002b50df517294178b8cd9df524e9447e7fc9447e4fc1447e5fd9447ec7a853b479a85136e825457c78cd05bdad9d29e573a18e1904a180e82a560df59aa90df524a186ce6c6cf28113a1807224e20df5cff48e8a28e979ff6c6442e5dbfcfdae24e9457e27a18e327ca108f52fe90dbd1f117f2b6c62061d421ef20a6c6a2ef56c6acefd6c16c3809ca186a900d9457e50cd35bda72d2daae725457c78cd05bdad8529e56c6079d13cbe4576c8d98ec889290df5249c081d32f40df56c6210eabae90dc6dba1882e51f28e3ddb00b9f524e931c850ebf2326c62c61dceca0df56c6451f625630e71e49cea7863e8b7fd24e90dbd4721e552d316f2bdaf11457c21f493f524a188355029457e393890f5246936f550b9457eef01a1d624e98dce19647df450c74596ca530cf524e9457ee9016102db16457c23a18835509a417ee7a186206c62c51d72d80df5a12978be6c6acafd6c8acbbd27318dce249cbabdaff4716824e9457eef017903db164576018590f524e9457603e9caf0e2560df525e90df51729457e78cd4dbdaf8529bd6c6279d174a18e3114b6cebda78d29d524ac3e3c61dacdc6f6dac41d2a06f20ae8a186f84e740df5ccccfb0adba18ed079740df524000d0adb16457ee0a184ad2ca1849d34a184853ca1848d04a859b471a85bbda7052db9af8529956962fcbcaf114c7641e90db9af0b457efda8caf425e90df56c6cdf8123a584f76d6ac9fd17048dce069c1cc6e46ce0b592cb0261e4a1f236af01e6cc651648f56c6cf28123630e7d23a1f2322b5f3ebddb2a863bccd43cf5246ccd8137a8f2b024a1880a50ee87f6acee450ae3a1f236646dfb813f6ce08089a98d0b049d0bb5a417048085a1880a50e0cbb2dbe9e6f66c16c6c6d26936f52b6deef524e98dce049d08751fe078f06c16ce1ed56936f52b6dc6f524e94070c09d05bcadd529bca72d05b4dbefb7f424e90dc6ed0208bddb2af234a4d25181d26936d751df893f51f4880350e7457867e88dcd069c08bdaf31e6fe17293e27a11f0261e462fd24cd021c0aeda1880a50efcbf278a1f232651648f5a120781eaeea893550a6880351e131d550ae31fc50aa882750de024bec016dc524e94570db9d1670e49d037f27a1f236acee450ae3a8f2b024630e7d23a1f232cfe2883550ee450ae7a8f2b024a8f2b024a1f236cdb0f20adba1880a50efcbf224a1f232651648f5cdfdf20adba4881150ec447600cd0db4dbef457e78cd4dbdaf8529bd6c6279d174a1868900b14576e0c94cab65b44ca9e725457c78cd15bdad9d29d573a18e19146a304799e90df551ece5ee3ee90dbda9d4a16e24e94c4d20e80df51720457ef32f086bb8e90df5dbfc89ad24e9457e394cb0f524a184c87a720df56c6cd681216936f551ea457efba180b100a1417868cd4db017293e276c62c6bdadad29d5cc54f00adba16e8100a9454cdb16f20adb16f2ea6cd2fc8678a16eb900a14576dd167ea46c6419046cd2dc876ca1863fcc0cfe0adba1860d6c6ccd811ca580f1d4a180b100a1417868cd4dbdaf3e457eefa184b100c9e592d916f2b1afb529b56c603056bee90db4db223e3560601066bee90d1e276ac50a6c6251d174a1868100b14576","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9af32fed0cd88798","strings":["SMB2","XmH~","+lb0","%E|x","5P)E~98",")E~x","2+_>","E~9L",")>'lb","l`0V"]},"interactive":true},{"timestamp":"2026-10-22T09:38:38","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-22T09:38:38","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-22T09:38:38","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-22T09:38:38","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-22T09:38:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-22T09:38:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\b@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000","payload_hex":"0000005cff534d4275000000001807c00000000000000000000000000000fffe0008400004ff005c00080001003100005c005c003100390032002e003100360038002e00350036002e00320030005c00490050004300240000003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66d478ffe6a01a34","strings":["SMBu","1\\\\192.168.56.20\\IPC$?????"],"iocs":{"ips":["192.168.56.20"]}},"interactive":true},{"timestamp":"2026-10-22T09:38:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000","payload_hex":"00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ee47b9d34e56607b","strings":["SMBs","KWindows 2000 2195Windows 2000 5.0"]},"interactive":true},{"timestamp":"2026-10-22T09:38:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"6b622a0b-b7a2-4269-a1c8-aeec55af98f5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf5baf1504bec0a1","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-22T09:38:36","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"7c034523-6474-44ed-bdda-e5e9325f1739-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":4}]}